> InfoSec News Nuggets – 10/13/2026

Retail giant Ahold Delhaize takes systems offline after cyberattack Ahold Delhaize, the parent company of Food Lion, Stop & Shop, Giant Food, Hannaford, Albert Heijn and Delhaize, confirmed it was forced to take some systems offline after a cybersecurity incident in its network. While stores remained open, customers in the Netherlands and Belgium lost access to websites, apps and customer service platforms, Stop & Shop employees reported being unable to view schedules and pay stubs, and Food Lion staff were warned their stores might be unable to process online orders. The company has not said whether data was stolen or devices were encrypted, and this marks the second major incident for the retailer after INC Ransom stole data on more than 2.2 million people in a November 2024 attack.   Midnight Mimosa Malware Found Preinstalled on Low-Cost Android Phones Bitdefender researchers have uncovered a campaign dubbed Midnight Mimosa in which malware is baked into the firmware of low-cost MediaTek-based Android phones, meaning devices are compromised before buyers ever switch them on. Hiding as system packages that users cannot remove, the malware can silently install and remove apps, grant permissions, temporarily disable the Google Play Store to dodge Play Protect checks, and download additional code, which operators use mainly for ad fraud and residential proxyware. Thousands of infected devices were observed across more than 150 countries, including counterfeit phones posing as flagship models and budget Doogee and Cubot handsets, and the same ad fraud code turned up in 13 Google Play apps.   FBI Arrests Executive at Ransomware Negotiation Firm FBI agents arrested an executive at a Canadian ransomware negotiation firm in Pennsylvania as part of the investigation into the ShinyHunters hacking group, which recently stole sensitive data on thousands of FBI agents. Court records show an Edward Dobrovsky was charged with conspiracy to threaten to impair the confidentiality of information with the intent to extort money and interference with commerce by threats, and the case has been moved to the Eastern District of Texas, now the center of the ShinyHunters probe. Sources say investigators are combing through devices seized during an earlier Dutch arrest and that charges against principals at other ransomware negotiation companies may follow.   Co-creator of Empire Market dark web marketplace given 40-year sentence Raheim Hamilton, co-creator of the Empire Market dark web marketplace, has been sentenced to 40 years in federal prison and fined $5 million after pleading guilty to a drug conspiracy charge. Between 2018 and 2020 the platform hosted more than 4 million transactions worth roughly $430 million, the vast majority from drug sales, alongside stolen credentials, counterfeit currency and hacking tools, with mixers used to launder proceeds. Hamilton agreed to forfeit more than $100 million in bitcoin and several Virginia properties, while his partner Thomas Pavey is due to be sentenced later this month.   Karaoke giant warns 8.7 million customers exposed in supplier data breach Japanese karaoke giant Daiichi Kosho has warned that personal information belonging to about 8.7 million customers may have been exposed after malware infected an employee computer at its supplier, Nippon Columbia Group, where data tied to outsourced work had been temporarily stored. Potentially exposed details include names, genders, dates of birth, email addresses and phone numbers, with Big Echo accounting for about 5.6 million of the affected customers and DK Dining for roughly 3.5 million. Passwords have been reset at the supplier, a helpline has been opened, and customers are being urged to watch for convincing phishing messages that could leverage the leaked details. The post InfoSec News Nuggets – 10/13/2026 appeared first on AboutDFIR - The Definitive Compendium Project.