Cyberattack Hits Major Spanish Fishing Port

A ransomware attack recently disrupted operations at the Port of Vigo in Spain, forcing authorities to shut down affected IT systems and switch to manual processes. Critical platforms used for managing cargo and logistics were taken offline, creating delays and operational inefficiencies. Although ships continued to move and port activity did not fully stop, the reliance on paper-based workflows slowed coordination and highlighted how dependent modern ports are on digital infrastructure.

This incident reinforces the growing cybersecurity risks facing critical infrastructure. Ports, like many logistics hubs, rely heavily on interconnected systems to manage supply chains, making them attractive targets for cybercriminals. Even when physical operations remain functional, the disruption of digital systems can spread across industries, affecting trade flows, scheduling, and economic stability. Ongoing investigations aim to determine how the attackers gained access and whether sensitive data was compromised.

The importance of strong cybersecurity becomes even clearer when viewed alongside past disruptions such as the Suez Canal blockage, where a single incident caused massive delays and cost the global economy billions, including significant impacts on Europe. While that event was not cyber-related, it demonstrated how fragile and interconnected global trade systems are. A similar level of disruption caused by cyberattacks could have equally severe—or even more widespread—economic consequences, underscoring the urgent need for robust cyber resilience in critical infrastructure.

https://bit.ly/4mhw1CF

Keynotes:

"A ransomware attack has disrupted digital systems at Spain’s Port of Vigo, forcing authorities to disconnect parts of its network and temporarily manage cargo operations manually..."

"...Officials told local media the incident locked some equipment and involved a ransom demand."

"...Some operators have been instructed to rely on manual procedures and paper documentation to continue working."

"Ports and maritime organizations have increasingly become targets for ransomware gangs in recent years because of their critical role in global trade."

"In 2023, Japan’s Port of Nagoya temporarily suspended operations following a ransomware attack attributed to the LockBit cybercrime group. Ports across Belgium, the Netherlands, Germany, Portugal, Japan, Australia and in U.S. cities like Houston have all faced attack."

Askul Ransomware and Data Breach

Let’s start with the cliché that too often proves true: "Put essential cybersecurity measures in place before the moment arrives when prevention is no longer possible."

Askul, a major Japanese e-commerce and logistics company, has finally restarted part of its online services after a ransomware attack shut them down for 45 days. During this time, the company could not process normal orders or ship products to customers. Can you imagine your company not earning revenue for more than six weeks because of one cyber incident?

The attack did more than disrupt operations — it also led to a data breach. Customer names and contact information were exposed, and some of the leaked data even appeared online. Askul had to fall back to a temporary, very limited ordering system using fax, offering only 37 basic items. What would your organization do if it suddenly had to return to pen-and-paper processes just to keep business moving?

As of early December (2025), Askul restored its Warehouse Management System with stronger security controls and reopened online ordering for corporate clients. However, deliveries are still slower than before, and its consumer-facing services are not yet operational. The company also delayed its financial reporting as it tries to understand the full impact of the disruption. Would your business survive a similar delay in sales, logistics, and reporting?

This incident shows how a single ransomware attack can have long-lasting effects, not only on technology but on revenue, trust, and daily operations. It’s a reminder that cybersecurity is not just an IT problem — it is a business survival problem. If this happened to you tomorrow, would your company be ready?

https://bit.ly/4oJ4edM

Headlines:

"On October 19 (2025), the company found itself infected by ransomware and the next day advised it couldn’t accept orders or ship products. On October 22 (2025) the company said its Warehouse Management System was the problem, which meant it had to suspend its logistics services.

On October 30th (2025), the company revealed the attack led to a major data breach, with customers’ names and contact details leaked..."

"The incident is broadly comparable to the ransomware attack on British retailer Marks & Spencer, which cost it £136 million ($177.2 million) to clean up and saw profits slump.

Askul will have a similar bill to pay, and it may well be larger because the company’s initial outage ran for a few days more than Marks & Spencer’s, and full recovery also looks like it will take longer."

JLR Cyberattack Slowed Down UK's GDP Growth

We usually think of cyber attacks as issues that disrupt individual companies. But have you ever considered that a single cyber incident could slow down the GDP growth of a developed country?

It may seem unlikely, yet it has already happened. In September 2025, Jaguar Land Rover (JLR) suffered a major cyber attack that forced the company to halt production for an entire month.

This event didn’t only affect JLR’s operations, it also contributed to slower economic growth in the United Kingdom. It’s a strong reminder that cyber threats can have real and measurable impact on a nation’s economy.

https://bit.ly/4r7E2Mr

Headlines:

"The Bank of England (BoE) has cited the cyberattack on Jaguar Land Rover (JLR) as one of the reasons for the country's slower-than-expected GDP growth in its latest rates decision."

"Weaker exports to the US, plus JLR's cyberattack, which was so damaging that the government had to step in and offer financial support, were the two reasons given by the BoE for this slower growth.

This is thought to be the first case in which a cyberattack has caused material economic and fiscal harm to the UK.

According to the most recent report from the Office for Budget Responsibility (OBR), dated 2021, while cyberattacks are a growing threat to Britain, none had caused sufficient disruption to adversely impact the entire economy."

"Economists previously estimated the harm to JLR alone could be north of £2 billion in lost revenues"

"JLR's cyber-instigated shutdown in September (2025) followed a rough few months for UK businesses, which were battered by major cyberattacks over the summer."

Flight Delays Across Europe Due To Cyber Attacks

 

Most of us don’t think much about cybersecurity—until it affects us directly. But the reality is: threats exist whether we’re aware of them or not.

Recently, cyberattacks caused flight delays in airport terminals across Europe. Imagine arriving at the airport, ready for your holiday, only to learn your flight is delayed or even cancelled for hours. Frustrating, right?

https://bit.ly/4pH2hjL

Headlines:

"Several of the largest airports in Europe, including London Heathrow, have been trying to restore normal operations over the past few days after an attack on Friday disrupted automatic check-in and boarding software.

The problem stemmed from Collins Aerospace, a software provider that works with several airlines across the world."

"Airports in Brussels, Dublin and Berlin have also experienced delays. While kiosks and bag-drop machines have been offline, airline staff have instead relied on manual processing."

"A spokesperson for Brussels airport said Collins Aerospace had not yet confirmed the system was secure again. On Monday, 40 of its 277 departing flights and 23 of its 277 arriving services were cancelled."

Legacy Medical Devices Remain Easy Targets for Cyber Threats

 

Do you think that your health data secure?

Most of the people don't really think about this question. But imagine, what would you do if your health data ended up on the internet one day? Once it's exposed, you can't undo it. That's scary and disturbing, isn't it?

Anyone who worked with medical systems knows that it is quite difficult to patch the vulnerabilities on these systems. Main reasons are: 1) Many of the systems run on outdated software that no longer supports new patches. 2) Updates are too risky because they can interrupt care or cause devices to fail during use. So, many of these devices stay unpatched and highly vulnerable to cyber attacks.

Researchers from Claroty's Team82 analyzed over 2.25 million Internet of Medical Things (IoMT) devices and more than 647,000 operational technology (OT) devices across 351 healthcare organizations. They found that 99% of these organizations had vulnerabilities with publicly available exploits, as listed in CISA's Known Exploited Vulnerabilities (KEV) catalog. (Yes, 99%. We can say (almost) "all of them")

You can find the report in the following link:

https://bit.ly/4j1es7d

https://bit.ly/3FOYOgp

Headlines:

"...the firm was able to analyze the security state of more than 2.25 million IoMT devices and more than 647,000 OT devices across 351 healthcare organizations – and found that 99% of the organizations are vulnerable to publicly available exploits..."

Chinese AI DeepSeek Database Is Exposed

A Chinese company DeepSeek AI Database is exposed recently and over 1 million log lines and secret keys are leaked.

Choose your AI wisely. Choose your software wisely. Cheap software might end up costing you far more in the long run. While no choice is entirely risk-free, it's best to use software from countries that uphold strong democratic values, justice, and human rights. Your data is being collected and sold to third parties. This is almost unavoidable. If it must happen, it's (relatively) safer in the hands of democratic countries. (Consider it the lesser of two evils.)

https://bit.ly/4hmIqBQ

[Headlines]

"Buzzy Chinese artificial intelligence (AI) startup DeepSeek, which has had a meteoric rise in popularity in recent days, left one of its databases exposed on the internet, which could have allowed malicious actors to gain access to sensitive data.

The ClickHouse database 'allows full control over database operations, including the ability to access internal data,' Wiz security researcher Gal Nagli said.

The exposure also includes more than a million lines of log streams containing chat history, secret keys, backend details, and other highly sensitive information, such as API Secrets and operational metadata. DeepSeek has since plugged the security hole following attempts by the cloud security firm to contact them.

The database, hosted at oauth2callback.deepseek[.]com:9000 and dev.deepseek[.]com:9000, is said to have enabled unauthorized access to a wide range of information. The exposure, Wiz noted, allowed for complete database control and potential privilege escalation within the DeepSeek environment without requiring any authentication."

"Furthermore, DeepSeek's apps became unavailable in Italy shortly after the country's data protection regulator, the Garante, requested information about its data handling practices and where it obtained its training data..."

"Bloomberg, Financial Times, and The Wall Street Journal have also reported that both OpenAI and Microsoft are probing whether DeepSeek used OpenAI's application programming interface (API) without permission to train its own models on the output of OpenAI's systems, an approach referred to as distillation."

UN Aviation Agency ICAO Confirms Recruitment Database Security Breach

Hackers target a broad spectrum of organizations for their attacks, from telecom companies to hospitals. Their victim was United Nations this time.

Approximately, 42,000 records were stolen from the database of the United Nations' International Civil Aviation Organization (ICAO).

https://bit.ly/3PBiOVx

"The United Nations' International Civil Aviation Organization (ICAO) has confirmed that a threat actor has stolen approximately 42,000 records after hacking into its recruitment database."

"According to Natohub's claims, the allegedly stolen documents contain names, dates of birth, addresses, phone numbers, email addresses, and education and employment information.

Another threat actor said the leaked archive contains 2GB of files with information on 57,240 unique emails."

"'The compromised data includes recruitment-related information that applicants entered into our system, such as names, email addresses, dates of birth, and employment history. The affected data does not include financial information, passwords, passport details, or any documents uploaded by applicants,' ICAO said."

"Threat actors also hacked UN networks in Vienna and Geneva in July 2019 using a Sharepoint exploit, gaining access to staff records, health insurance, and commercial contract data."