19th October – Threat Intelligence Report
Reported exploitedMicrosoft WindowsARMORY CASTLEIvanti Connect SecureOur summary
Check Point's latest weekly intelligence bulletin covers several major breaches and patch releases. CenterPoint Energy disclosed unauthorized access exposing data on over 1 million Texas customers, while Burger King Japan reported that roughly 11.18 million app members had personal details compromised. A separate incident saw attackers abuse stolen credentials for ConnectWise's Microsoft 365 backup service to reach at least 173 managed service provider environments, and French supermarkets suffered costly disruptions after hackers tampered with networked refrigeration systems.
On the vulnerability front, Microsoft's October Patch Tuesday fixed a record 1,413 flaws, including the actively exploited Windows Shell bug CVE-2026-96951. CISA also added an Ivanti Connect Secure authentication bypass, CVE-2026-104935, to its exploited-vulnerabilities list, while GitLab patched a maximum-severity CI/CD flaw (CVE-2026-97229, CVSS 10.0) and BeyondTrust fixed a Remote Support authentication bypass (CVE-2026-102764) reportedly exploited by the China-linked group ARMORY CASTLE before disclosure. Additional research detailed AI-agent risks, large-scale calendar-invite phishing against Microsoft accounts, election-related scams, and espionage activity by the Kazakhstan-linked group Silent Lynx exploiting a WinRAR flaw (CVE-2025-8088).
Below is the opening; the full story is at Check Point Research.
From Check Point Research
For the latest discoveries in cyber research for the week of 19th October, please download our Threat Intelligence Bulletin.
TOP ATTACKS AND BREACHES
- CenterPoint Energy, a US utility company serving Texas and several other states, has disclosed a data breach affecting more than 1 million Texas residents. Unauthorized access to an external system exposed names, addresses, Social Security information, and driver’s license numbers, according to regulatory notifications filed by the company.
- Burger King Japan, operator of the international fast-food chain in Japan, has disclosed a breach affecting approximately 11.18 million application members. Unauthorized access between October 2 and 7 exposed contact information, birth dates, gender, and regional details. The company found no evidence of compromised passwords or payment cards.
- ConnectWise Cloud Backup, a Microsoft 365 backup service used by managed service providers, has suffered a credential compromise enabling unauthorized access to customer environments. Attackers used compromised application credentials to sign in to at least 173 organizations, potentially accessing email, files, and Teams information before access was suspended.
- Several French supermarkets, including E. Leclerc stores, have experienced cyberattacks targeting connected refrigeration controllers. Attackers reportedly manipulated temperature settings, causing refrigeration system failures, food losses, and operational disruption. Losses from the attacks exceeded $100,000 for one retailer.…
Worried this affects your company?
Discuss a security assessment of your internet-facing systems. Scope agreed before testing.