October 2026 in cyber: the big stories, explained simply

Why this roundup?

October is Cybersecurity Awareness Month, and the first two weeks of October 2026 were unusually busy. Some stories were technical, but each one has a lesson for ordinary people and small businesses. We picked four, explain them in everyday words and end each with what to do.

Where a number comes from the criminals or from early reports and has not been confirmed, we say so. Facts in security news often change in the first days after an incident.

1. A record Windows update, with one flaw already in use

On 13 October Microsoft released its monthly security update, often called Patch Tuesday. It fixed more than 1,400 flaws, the largest number Microsoft has ever shipped in one month. Microsoft said it now uses AI tools to find bugs faster, which partly explains the record.

One flaw stands out. It lets a booby-trapped file get round Mark of the Web, the label Windows adds to files you download so it can warn you before they open. Microsoft said attackers were already using it, and the US cybersecurity agency CISA told government bodies to patch it within days.

The same update was the last one for Windows 11 version 24H2 Home and Pro. Computers still on that version no longer get security fixes. We explain how to check and move on in our blog post on Windows 11 24H2 reaching end of support.

What to do: open Settings, then Windows Update, press Check for updates and restart when asked. If you see an offer to move to a newer version such as 25H2, accept it.

2. ASOS: a fake alert sent through the shop's own app

On 6 October many customers of the online fashion shop ASOS received a strange alert on their phones saying the company had been hacked. It really was sent through the official app. Two days later ASOS explained that criminals had gained access to an employee's account by pretending to be someone the employee trusted. They then used that login to reach some outside services ASOS uses to send messages to customers.

ASOS said names, contact details and some account information were accessed, but not payment cards or passwords, and that its website and app were still safe to use. It did not say how many customers were affected. A group claiming responsibility made bigger claims online, which ASOS had not confirmed.

The lesson: the weak point was not the app's code but one person being fooled. It is the same trick behind most office breaches, and it is why staff training and two-step sign-in matter so much.

What to do if you shop there: you do not need to change anything, but expect scam emails and calls that mention ASOS. The company says it will never ask for your password, a security code or card details in a message or call you did not expect.

3. Supermarket fridges turned into ovens

From early October, refrigerated and frozen display cases in French supermarkets started failing. France's finance minister told parliament that around 700 of the country's roughly 10,000 supermarkets were affected, across chains including Intermarché, Netto, Système U, Carrefour and Monoprix. Reports said attackers forced fridges into a constant defrost cycle and pushed some temperatures up to about 50°C, so food had to be thrown away.

The target was the small control boxes that run shop refrigeration, from makers including Danfoss and Copeland. France's national cybersecurity agency said it knew of many compromised remote-control modules. The makers said most affected devices were older models that no longer received security updates, and security researchers had warned in the summer that thousands of these controllers could be reached directly from the internet. The Paris prosecutor's cybercrime unit opened an investigation. The government said France's food supply was not at risk.

The lesson for any business: anything with a network connection, from a fridge controller to a CCTV recorder, is a computer. If its control page can be reached from the internet and it no longer gets updates, it is an open door. We cover the practical checks in what hacked supermarket fridges teach every business.

4. Japan: a wave of breaches and a warning about ID photos

Over a few weeks, a long list of well-known Japanese companies announced breaches, among them the travel site Skyticket, the restaurant chain Yakiniku King, karaoke chain Big Echo, car-sharing service Times Car, the railway company JR East, the second-hand store Bookoff and the convenience store chain Lawson. Together, seven of the announcements covered more than 55 million records. Most figures are maximums, and one person can appear in several. In one case, images of about 1.6 million identity documents were exposed.

A senior ruling-party politician described the situation as close to an emergency in cyberspace, although the government did not formally declare one. Japan's financial regulator told banks to re-check their online identity checks for faked or reused ID images, and to act now rather than wait for new rules in April 2027 that move checks from ID photos to the chip inside the card.

What to do: if a company you use says your data was involved, read its notice carefully and expect scams that quote your real details. Where a service allows it, prefer stronger identity checks, such as reading your card's chip, over uploading a photo of your ID.

The habits that cover most of this

1. Update and restart. Phones, computers, browsers and the devices in your shop or office.
2. Turn on two-step sign-in for email and work accounts, so a stolen password alone is not enough. See strong passwords and MFA.
3. Be suspicious after any breach. Criminals use the news to make scams sound real. Our October scam alerts show what they are trying now.
4. Know what you have connected. Old devices that no longer get updates should not be reachable from the internet.