CRUNCHY TECH
YESTERDAY, STILL WORTH KNOWING
A vendor-side credential breach and a supermarket cyberattack dominate the day, while Nvidia and Amazon jostle over AI hardware and Call of Duty finds unexpected goodwill.
ConnectWise has suspended its Cloud Backup, SaaS Security and Cloud Management services after unauthorised use of an application credential held in its own tenant. Huntress reports that the stolen credential was used to sign in to 162 Microsoft 365 tenants between 15 and 16 October, with sign-in activity from the attacker's IP in nearly 1,000 Entra tenants by the 17th and over 300 successful logins. In one tenant, the Cloud Management app for Teams granted itself Global Administrator rights. ConnectWise says customer archives remain encrypted and untouched, but has given no restoration timeline.
The awkward part is who must clean up. Because the credential lived in the vendor's tenant, nothing a customer did could have prevented it, and many businesses do not even know their managed service provider uses ConnectWise. Huntress warns that disabling the abused apps will not remove credentials attackers may already have planted, so firms must audit the credentials on all their Microsoft 365 applications. The 2021 Kaseya attack showed how one vendor compromise cascades downstream; this looks like another entry in that genre.
Ahold Delhaize has confirmed that malicious activity forced it offline across most of its US and European brands, from Stop & Shop to Albert Heijn, after suspicious activity was detected on 12 October. Stores stayed open but online shopping stalled on both continents, and recovery is uneven: Albert Heijn's app is back but deliveries wait until Friday, while US e-commerce should return in the coming days. There is no evidence yet of data theft, though the company is staying quiet on the attack's nature. It is the group's second breach in two years, after a 2024 incident compromised details of over 2.2 million people. The Register notes it declined to say whether this links to attacks on French supermarket refrigeration controllers that reportedly pushed temperatures to 50°C.
Nvidia launched its open-weight Nemotron 3.5 models, from a 120-billion-parameter enterprise agent model down to Bolt variants that run locally on AI PCs, a push TechCrunch reads as a hedge against AI labs drifting to rival chips. Amazon answered with TorchNeuron, which it says runs PyTorch apps on its Trainium chip after a one-line configuration change, and it plans upstream PyTorch changes to loosen the framework's Nvidia ties. Meanwhile Microsoft exited Nscale's Essex datacentre, once billed as the UK's largest AI facility, because the grid cannot supply enough power until the early to mid-2030s, leaving the Nvidia-backed firm without its only announced customer and complicating a hoped-for $35bn float.
In Brussels, an ECIPE study of 8,725 procurement contracts warns the EU's Cloud and AI Development Act could entrench national favouritism, since nearly all contracts already went to domestic providers and every sovereignty-flavoured one did too. The trade body CISPE counters that real sovereignty means control of the underlying technology, not a provider's passport. Elsewhere in policy, DHS banned DeepSeek from all federal civilian agencies, citing data transfer risks, and Apple tightened App Store rules to explicitly ban nudify apps that hide harmful features until after review.
Call of Duty: Modern Warfare 4's early-access campaign sits at around 90 to 92% positive on Steam, the series' best since 2015, though pre-order buyers are doing the scoring and multiplayer arrives on 23 October. Indie developers are less cheerful: Alliance Arts and Digital Sun have both restricted demos and playtests for fear AI clones will beat their games to market, a fear given weight by the rapid copies of Freya Holmér's prototype in March. Nvidia insists the RTX 5090 is not discontinued even as it vanishes from its own store and resellers charge up to three times MSRP. And hobbyists are using AI coding agents to strip ads and tracking from smart TVs, with a few thousand replicating one hack in two days, though at least one person bricked their set.