(In)Secure Digest: Halloween Data Horrors, AI Hackers and Rogue Tech

October's cybersecurity headlines read like a horror marathon: a breach exposing Denmark's population records, AI-powered payment-card theft, sabotaged supermarket freezers and an unexpectedly talkative coffee maker. Here's our roundup of the month's most striking incidents – and the security lessons behind them.

A Nightmare on Data Street

Film still from A Nightmare on Elm Street (dir. Wes Craven, 1984)

What happened: Hackers accessed personal records linked to nearly nine million people in Denmark.

How it happened: Attackers compromised systems operated by Pays ApS, a private company with authorized access to Denmark’s Central Person Register (CPR). According to media reports, at least three Pays ApS accounts, including an administrator account, were protected by the password "123456".

After gaining access to an account, the attackers used an automated tool to extract records. Between September 10 and 20, they sent roughly 14 million requests to the registry, obtaining names, addresses and personal identification numbers associated with 8.8 million people. Monitoring systems failed to flag the suspicious activity. The breach was discovered on October 2, when an administrative employee noticed an unusually large bill for Pays ApS registry requests. The company’s access was blocked, and police launched an investigation.

The scale is especially alarming. The registry holds approximately 11 million records, including those of people who have died or emigrated, and the attackers accessed about 80% of them. Denmark’s current population is roughly six million, meaning the incident could have affected virtually everyone living in the country.

Stranger Things, Zero Evidence

TV still from Stranger Things (created by Matt and Ross Duffer, 2016–2025)

What happened: A Dubai-based company accused a former employee of disclosing trade secrets but could not provide sufficient evidence.

How it happened: The company sued its former employee, alleging that he had insulted colleagues and customers, revealed confidential business information and poached clients. Management said the alleged conduct had caused financial and reputational damage and sought around US$1.4 million in compensation.

The court ruled that the company had failed to substantiate its allegations. It had not produced sufficient supporting material, such as recordings of conversations or screenshots of messages. The claim was dismissed.

Protecting trade secrets takes more than a confidentiality clause. Organizations need clear handling rules, documented access controls and records that can support an investigation. Our practical guide explains how to protect digital trade secrets with classification labels.

American Data Horror Story

TV still from American Horror Story (created by Ryan Murphy and Brad Falchuk, 2011–present)

What happened: Hackers exposed personal information relating to more than three million people in US Defense Department personnel records.

How it happened: The Defense Manpower Data Center, a US Department of Defense agency, maintains more than 60 million records relating to service members, civilian employees, family members, retirees and veterans. Attackers broke into the center’s file servers in October 2025, but the intrusion went undetected for around six months.

During that time, the attackers gained access to personal information about 2.76 million living people and 294,000 deceased individuals. The exposed information included names, dates of birth, contact details and Social Security numbers.

The perpetrators have not been identified. Pentagon representatives said they had found no evidence that the stolen information had been misused.

IT: They Say They Work Here

Film still from It (dir. Andy Muschietti, 2017)

What happened: Attackers impersonating employees of healthcare company Astrana Health stole confidential corporate information.

How it happened: The attackers spoofed Astrana Health’s official telephone number and called employees while pretending to be their colleagues. The social-engineering scheme helped them gain access to corporate servers and obtain internal information.

Astrana Health engaged external cybersecurity specialists to investigate. The full extent of the exposure is still being assessed. Following the incident, the company reset accounts, restricted the use of remote-access tools and strengthened security monitoring.

The Horribly Slow Data Leak

Film still from The Horribly Slow Murderer with the Extremely Inefficient Weapon (dir. Richard Gale, 2008)

What happened: A public-sector employee accidentally published personal information relating to nearly 400,000 people.

How it happened: In 2023, an employee of the District of Columbia’s Department of Health Care Finance posted patient statistics reports on a public website. Three years later, an internal audit revealed that the files had contained hidden fields with the personal information of 399,086 individuals all along.

The employee had failed to notice the hidden data. Anyone who accessed the files could potentially view patient addresses, health insurance numbers, dates of birth and the names of treating physicians.

The agency removed the information, notified federal authorities and conducted an internal review. Officials said they had found no evidence that anyone had accessed or used the information for fraudulent purposes.

Maximum Overdrive, Powered by AI

Film still from Maximum Overdrive (dir. Stephen King, 1986)

What happened: An unknown attacker used AI to steal data from more than 600,000 payment cards and compromise over 100 websites.

How it happened: The attacker automated the operation using AI agents. After receiving high-level goals, the agents searched for vulnerabilities and exploited targeted systems. The campaign resulted in the theft of information associated with more than 600,000 active payment cards and the installation of web skimmers on at least 119 websites.

The victims reportedly included a major US airline and a Fortune 500 hotel chain, although the organizations were not named. A number of affected businesses experienced data losses and operational disruption.

The Ring: A Call No Customer Wants

Film still from The Ring (dir. Gore Verbinski, 2002)

What happened: Attackers stole more than 11 million customer records from Burger King Japan.

How it happened: The attackers compromised a system responsible for managing user information in Burger King Japan’s mobile application. Over six days, they downloaded data on approximately 11.18 million customers, including names, dates of birth, gender, email addresses, telephone numbers and order histories.

The company detected the breach, blocked the compromised IP addresses and launched an investigation. It said it had not identified cases of fraud or other direct consequences of the incident. Customers were nevertheless warned that criminals might use the stolen information to send phishing messages or make calls impersonating the company.

A Cold-Blooded Attack on French Supermarkets

Film still from Dracula (dir. Luc Besson, 2025)

What happened: Attackers compromised refrigeration software in at least 330 French supermarkets.

How it happened: The intruders targeted Danfoss refrigeration-control software used by stores belonging to major French supermarket chains, including Intermarché, Netto, Carrefour and U. Outdated, unpatched systems were reportedly the main point of entry.

The web interfaces of the refrigeration controllers were exposed to the internet so technicians could service the equipment remotely. Attackers located the interfaces, gained control of the management panels and raised temperatures to as high as 50°C (122°F), ruining fresh and frozen stock.

To conceal the sabotage, they reportedly altered security monitoring settings and fed false readings to engineers while the goods spoiled. Paris prosecutors and a specialized cybercrime unit launched an investigation. Preliminary losses were estimated at tens of millions of euros, and the affected retailers were reportedly preparing legal action against Danfoss.

Twilight: The ShinyHunters Saga

Film still from The Twilight Saga: Eclipse (dir. David Slade, 2010)

What happened: The ShinyHunters hacking group allegedly stole 3 TB of data linked to FBI personnel.

How it happened: ShinyHunters is an international cybercrime group known for stealing and selling data. It has been linked to attacks involving Microsoft, AT&T, Salesforce, LVMH and other large organizations. Since the group emerged in 2019, the FBI has tracked its activities and disrupted websites associated with it.

In May 2026, the FBI released a statement about ShinyHunters, accusing the group of exaggerating the impact of its attacks and pressuring victims. Four months later, attackers reportedly breached FBI-related infrastructure and obtained personal information on 5,000 current and former agents.

According to the bureau, the attackers exploited a vulnerability in a system managed by a third-party contractor. ShinyHunters described the attack as a "marketing campaign against disinformation" and demanded that the FBI correct or remove its May statement. The group also told journalists it did not intend to publish the stolen records.

After the attack, the ShinyHunters dark-web site went offline. Law enforcement agencies in the United States, Jordan and the Netherlands arrested key members of the group.

The Coffee Maker That Knew Too Much

What happened: A smart coffee machine generated about 1 TB of network traffic in just 10 days.

How it happened: A software developer noticed that his Keurig K-Supreme Smart coffee maker had generated 1,008 GB of network traffic over ten days. He posted a complaint to the manufacturer on social media, questioning why a coffee machine could be sending so much information in the first place.

After investigating, the developer concluded that the unusually high volume was likely caused by a fault in the device’s network stack or firmware. Under normal conditions, the machine sends only limited telemetry, such as settings, power status, brewing information and pod types. It was not designed to transmit personal data.

The fault overloaded the network access point, but most of the traffic appeared to be looping within the local network rather than being uploaded externally. The developer restarted the machine and moved it to an isolated virtual network segment. The anomalous traffic stopped.