NEC Subcontractor Suffers Cyber Attack Leading to Customer System Disruptions and Personal Data Leak
NEC has confirmed that a subcontractor responsible for system development and maintenance operations was targeted in a cyber attack, resulting in disruptions across multiple customer systems and the leakage of personal information.
According to the company, the breach occurred in late September 2026 when the subcontractor’s legitimate account credentials were stolen and subsequently misused by the attackers. Using these credentials, the threat actors gained access to customer system environments directly from the subcontractor’s terminals.
In the compromised customer environments, files stored on servers were encrypted, leaving the systems in an unusable state. Additionally, files were exfiltrated from a cloud storage service employed for information sharing among NEC, the subcontractor, and affected customers. These files included customer-held personal data as well as system-related information.
NEC has already contacted all impacted customers individually and is coordinating response measures. Further details regarding the specific personal information involved will be reported to customers once they are confirmed.
Related articles
OVHcloud CLI Compromised: Infostealer Distributed Through Hijacked GitHub Releases for 25 Minutes
On October 19, the official OVHcloud CLI tool was compromised when an attacker used a hijacked developer account to replace binaries in five existing releases from v0.11.0 to v0.15.0. The attack lasted from 15:47 to 16:12 Moscow time, with the infostealer targeting API keys, SSH keys, and other secrets stored on developer and CI machines. The malicious binaries were uploaded directly via the GitHub Releases API, and the checksums.txt file was also replaced to match the tampered archives. Only users who had hardcoded the original SHA-256 hash in their CI pipelines, such as one customer who opened issue #300, detected the tampering when builds failed. The compromised account HassenBF had been infected with GlassWorm malware since March 2025, allowing persistent access until the October attack. OVH responded by deleting the malicious files at 17:21 and releasing v0.16.0 with immutable releases and attestation enabled.
Supply Chain Attacks Target Ledger Hardware Wallets with Evolving Backdoors
Ledger disclosed that sophisticated hardware backdoors discovered in multiple Nano X, Flex, and Stax devices enabled thieves to steal approximately 102 million dollars in cryptocurrency from roughly 315 accounts. The implants, initially found by hardware hacker Joe Grand in devices sold by unauthorized Southeast Asian sellers, have since appeared in units purchased from authorized resellers CryptoBilis and MediaMarkt. Later versions analyzed by Mark Karpeles feature custom flexible PCBs, LTE modules, and antennas engineered to intercept seed phrases and exfiltrate them over cellular networks. Evidence now points to deliberate compromise of the authorized supply chain rather than isolated tampering of returned units. Ledger has urged resellers to purchase only through verified channels and has suspended sales through CryptoBilis pending investigation, while users continue to report additional compromised devices across Europe.
Audit of 25 Package Managers Shows Only Two Verify Every Package's Integrity Against Compromised Repositories
A comprehensive test by Trail of Bits examined 25 popular package managers to determine whether they detect malicious code substituted by a compromised repository. The study found that fewer than half verify package integrity by default using lockfiles, and only two managers check the cryptographic hash of every downloaded package. Most managers either require manual configuration, use hashes insecurely, or lack any integrity checks even when lockfiles are present. Signature verification is even rarer, with only Go performing checks by default. The research used a Docker and mitmproxy testbed to simulate attacks while preserving realistic conditions. Results highlight significant gaps in supply-chain protections across ecosystems including JavaScript, Python, Ruby, Rust, and others. The findings also discuss limitations of current lockfile designs and emerging improvements in several communities.
Compromised ConnectWise Credential Used to Access 173 Microsoft 365 Environments in Supply Chain Attack
A compromised credential from ConnectWise Cloud Backup, formerly known as SkyKick Backup, was abused to access at least 173 partner and customer Microsoft 365 environments. Microsoft Threat Intelligence classified the incident as an active supply chain attack. The attacker bypassed password and multi-factor authentication by using a client assertion issued from the vendor environment, impersonating an already-approved application identity to obtain Microsoft Graph tokens. Access occurred on October 15 between 06:13 and 08:34 UTC, with the intruder enumerating environment identifiers sequentially at short intervals, indicating automated scripting against a prepared target list. The backup application's permissions covered Exchange, OneDrive, SharePoint, Teams, and directory information. In one environment, another vendor application was granted global administrator rights and planted secrets in two trusted applications valid until 2028. ConnectWise later disabled seven application identities, revoked affected certificates, and suspended Cloud Backup services.