Good morning!

The FBI suspects a ransom negotiator helped run ShinyHunters' extortion portal as California's attorney general secures a $6 million settlement from 23andMe's successor. One is a settlement; the other is suspicion without a charge.

Here are the 7 things you don't want to miss:

1. ⚖️ The FBI suspects a ransom negotiator of running ShinyHunters' extortion site

In a follow-up to October's arrest of a ransomware-negotiation firm executive, U.S. investigators suspect executives at two negotiation firms of close ShinyHunters ties and one executive at an American consulting firm of helping run Shinywire, an extortion portal listing nearly 100 organizations between May 3 and October 16. KrebsOnSecurity names neither the firm nor the executive: neither has been charged. (KrebsOnSecurity)

2. 🤝 Practice the Thing You Just Read About

Every item above is something you will eventually have to do, not just read about. Threat Road's Cyber Security Labs give you an isolated VM, a guided exercise, and a target that only exists for you to break — Linux fundamentals through hands-on exploitation, in your browser, on your own schedule. No shared infrastructure, no waiting for a lab window, no permission slip. (Threat Road)

3. 🧬 23andMe's successor settles a $6M case over the 2023 breach

California's attorney general announced a $6 million settlement Monday with Chrome Holding Co., 23andMe's successor, over allegations that weak security led to the 2023 breach of nearly 7 million customers, more than 855,000 of them Californians. The deal was filed in bankruptcy court and is pending approval. Customers retain the right to request deletion of their data and destruction of their samples. (California DOJ)

4. 🛒 Ahold Delhaize's precaution is now an attack, a week on

A week after its precautionary shutdown, Ahold Delhaize said Monday the incident was caused by "malicious actions" and that it filed a police report in the Netherlands. The company says it has no evidence sensitive data was stolen, but its investigation continues. Restoration is phased: Albert Heijn deliveries not expected back until Friday, Food Lion and Stop & Shop online shopping still down. (The Record)

5. 🎭 Why attackers picked Siemens' signed Software Center

Siemens said Monday that attackers exploited CVE-2026-110936 in its Software Center, pairing a genuine, validly signed copy of the program with malicious DLL files, and tied the attacks to the Romulus ClickFix campaign. The flaw, disclosed October 15 and rated 8.4, was fixed in version 4.0.9.8. Siemens says no system, product or update channel of its own was breached, to its knowledge. The signature was valid; that was the point. (SecurityWeek)

6. 🎬 Four Plex flaws, one day from proof-of-concept to miners

Attackers are chaining four Plex Media Server flaws into unauthenticated remote code execution to install crypto miners and a reverse-proxy backdoor, researchers reported. The technical details went public October 16 and exploitation began October 17 — more than two months after Plex shipped fixes in version 1.43.3.10861 on August 3. (The Hacker News)

7. 📱 Belgrade's rector was infected with Pegasus, Citizen Lab says

Citizen Lab and the SHARE Foundation report with high confidence that University of Belgrade rector Vladan Đokić was infected with NSO Group's Pegasus through a zero-click exploit this year. Prosecutor Rade Bajić received an Apple threat notification in August, a sign of likely targeting, the researchers say. Serbian civil society now counts at least 16 spyware targets, days before the October 25 election. (Citizen Lab)

Bonus. Threat Road Tip Of The Day

Find your Plex Media Server version in its settings; anything below 1.43.3.10861 was patched in August. Update today, then check your server's recent connections for anything you don't recognise. The exploit chain is public and the miners are not picky.

Disclosure: Topic #2 in this newsletter is a promotion for Threat Road's Cyber Security Labs. Nothing else in this issue is sponsored.