Hackers remotely manipulated connected refrigeration systems at hundreds of French supermarkets, reportedly pushing some fridges and freezers to 50C (122F), spoiling food and even sparking fires. According to Reuters, French Prime Minister Sebastien Lecornu ordered a cybersecurity investigation into the hacks, with similar incidents reported in Spain, Portugal, Poland, Germany, and Belgium. In France, Carrefour reported 80 affected stores, Monoprix said 5% of its locations were hit, and Les Mousquetaires said refrigerators at roughly 150 Intermarche stores were heated to 50C for six hours. From the report: Supermarket cold aisles are typically run by control panels that manage an entire store's fridges and freezers and can be accessed over the internet, which lets maintenance companies adjust them from anywhere. The source close to Lecornu said ANSSI had identified a vulnerability in software supplied by Danish company Danfoss. Danfoss said it was "aware of incidents in France affecting a limited number of refrigeration management systems." The affected units "were running outdated firmware," Danfoss said, adding that it had "long advised customers to keep supported systems updated with the latest firmware and to migrate legacy systems to current-generation solutions." On August 9, cybersecurity firm Claroty's Team82 published research detailing vulnerabilities in the Danfoss AK-SM 800A controller. According to the report, software updates issued by Danfoss addressed issues that could have allowed attackers to bypass authentication controls and execute code on compromised devices.

Read more of this story at Slashdot.

CNN reports: The FBI arrested a Canadian cybersecurity executive and ransomware expert as part of the investigation of a damaging hack that exposed the sensitive data of current and former FBI employees, according to court documents and people familiar the investigation. Edward Dubrovsky was arrested in the Philadelphia area in recent days... Dubrovsky is facing charges related to extortion and making threats. He has been transferred to Texas's Eastern District for a scheduled detention hearing, according to court records and a law enforcement official. FBI Director Kash Patel announced the arrest on Friday but did not disclose where it occurred or what role the man is suspected of playing in the hack. Patel also didn't name Dubrovsky, but CNN confirmed the defendant is believed to be tied to the FBI hack through multiple people familiar with the investigation... A LinkedIn profile under Dubrovsky's name lists years of experience in the Canadian cybersecurity industry and describes Dubrovsky as a 'globally recognized cybersecurity expert.' An Ed Dubrovsky is also the author of a book on handling ransomware negotiations with cybercriminals... There has also been an inquest at the FBI over how such a critical security lapse happened. The FBI determined that a contractor managing the bureau's jobs portal failed to update software "explicitly issued to secure the platform," [senior FBI cyber official, Brett Leatherman said last week]. The FBI has "removed the contractor," he said. The software in question is a human-resources platform made by Oracle, ShinyHunters has said. The hackers previously used a flaw in the software to attack targets in the education sector in May and June, according to Google's Threat Intelligence Group. But months later, the FBI contractor apparently still had not applied a security patch that was available for the software. "The inmate locator at the U.S. Bureau of Prisons website reports that a 54-year-old Edward Dubrovsky is currently being held at a federal facility in Philadelphia," reports security researcher Brian Krebs. Thanks to long-time Slashdot reader schwit1 for sharing the news.

Read more of this story at Slashdot.

ASOS says hackers gained unauthorized access to third-party platforms it uses and sent an "ASOS HACKED" push notification directly to customers, apparently as part of an extortion attempt. The clothing and beauty store says some basic personal information may have been accessed but does not believe payment-card data or passwords were affected. The BBC reports: In an email to customers on Tuesday night, the company apologized and urged customers not to engage with the notification. And it said the website and app are "operating as usual" promising customers they can "shop with confidence" while it investigates the incident. The company has not as of yet informed the UK's data watchdog, the Information Commission's Office (ICO), about any breach. Exactly how many Asos customers received the notification on Tuesday remains unclear, but Google's Play store says the ASOS app has been downloaded to android devices more than 10 million times. The British retailer has a substantial global footprint -- serving around 17 million customers each year across more than 150 markets. Some Asos app users in Australia, France, Sweden and the Republic of Ireland had also received the notification, according to local reports on Tuesday. [...] Users of the Asos app appeared to have received the alarming notification at around 10:00 BST on Tuesday. Headlined "ASOS HACKED" and addressed to the company's data protection officer and IT teams, it said: "We have fully compromised the Snowflake instance." "Engage with us, or we will leak it," it added, before linking to a Telegram channel. The message left many ASOS customers confused. [...] Meanwhile Snowflake -- whose tools are used by dozens of firms to collect, analyze and store data -- told the BBC its investigation was ongoing, but it had so far found "no compromise" of its platform.

Read more of this story at Slashdot.

IBM and Red Hat say their AI-powered Lightwell initiative has identified and helped remediate more than 400 previously unknown vulnerabilities across widely used Java libraries. Phoronix reports: They announced this feat today as part of their promoting Lightwell Clearinghouse to GA, which is an enterprise service for their customers to submit open-source software dependencies for priority review and remediation. From today's announcement: "The milestone addresses a growing business risk. As autonomous AI agents become capable of combining several lower-risk software weaknesses into a more serious attack, companies need to do more than identify vulnerabilities. They need a practical way to develop, test and deploy fixes in the software that supports critical applications."

Read more of this story at Slashdot.

An anonymous reader quotes a report from Reuters: OpenAI has informed more than 100 organizations about incidents involving unauthorized activity tied to its AI agents, according to a blog post by the ChatGPT maker, as AI labs face mounting scrutiny over rogue AI agent activity. Here are some other details: - The Sam Altman-led company has been conducting a broad review of the activities of its AI models after the accidental hacking of Hugging Face. - OpenAI is searching through roughly 50 petabytes of data as it works to understand the full scope of its rogue agent activity. - A string of high-profile breaches globally by rogue AI agents in recent months has sparked widespread worries within the AI industry over its ability to control the more powerful AI models now under development. - "In some cases, models used internet access in unintended ways or, in retrospect, did not have the ideal restrictions applied. Over the last several months, we have been applying new technical and operational measures to avoid similar problems, or catch them very early, and will continue this work," OpenAI said. - OpenAI previously said the review would take months to complete given the scale of the work. - The Hugging Face incident remains the most severe rogue agent activity OpenAI has identified from its AI models so far.

Read more of this story at Slashdot.

New research explores behavioral trends behind that ‘nothing to hide’ phrase. Plus: 6 ways to improve your phone privacy.

New research explores behavioral trends behind that ‘nothing to hide’ phrase. Plus: 6 ways to improve your phone privacy.

Researchers say LG TV’s behavior ‘parallels malware’ – with user data logged even when TVs are on standby.

Researchers say LG TV’s behavior ‘parallels malware’ – with user data logged even when TVs are on standby.