The State of the Threat logo

The State of the Threat

Archives
Log in
Subscribe
October 10, 2026

Daily Brief, October 10, 2026

Daily Brief, October 10, 2026

Top Story

The US Treasury blacklisted the International Criminal Court, then issued four licenses the same day letting companies keep serving it

Treasury's Office of Foreign Assets Control blocked all US property and interests of the court, the war-crimes tribunal in The Hague, under the presidential order on sanctioning international courts, and issued four licenses the same day so existing vendors could keep working.

Source: OFAC Recent Actions (primary)

Insurance Shifting Risk Back

A German court made a treasury manager personally liable for 50 million euros of fraud transfers, because his employer had bought him liability insurance

[DE · Heise]

The Cologne labor court held that enrolling the manager in a management liability policy removed the limited-liability protection German case law normally gives an employee for a work-related loss, and whether that policy will actually pay has not been decided.

Source: Heise Security

Ozon, Russia's biggest online marketplace, drops its sellers'-goods insurance on October 13th after its insurer's reinsurance terms worsened

[RU · Vedomosti]

Ingosstrakh, the insurer behind the seller-goods program at Ozon, says it is stopping the coverage because the terms on which it buys its own backup protection from other insurers, called reinsurance, changed on October 1st and the available capacity shrank.

Source: Vedomosti

The federal employment regulator is suing a Texas trucking firm that turned down drivers over 60, blaming an insurer's 65-year age limit

The Equal Employment Opportunity Commission alleges Trancasa USA of Pharr, Texas refused to hire drivers over 60 and gave an insurer-imposed ceiling of 65 as its reason, a cut-off five years below the limit it blamed, which turns an underwriting rule into the employer's own discrimination exposure.

Source: FreightWaves

A $604 million verdict for a fatal truck crash reached the freight broker that arranged the load, not just the carrier that drove it

Munich Re, one of the world's largest reinsurers, cites the 2026 Marathon Strategies Report's count of nearly 200 US corporate lawsuits that produced verdicts of at least $10 million in 2025, a 40% rise on 2024, and says liability can extend beyond the parties directly involved.

Source: Reinsurance News

United States

Enforcement & Liability

A California freight forwarder paid $175,015 to Treasury, partly for taking six months to answer a sanctions subpoena

Four of the ten apparent violations by Pegasus Worldwide Logistics were of the narcotics-trafficking sanctions rules; the other six were for failing to fully answer an administrative subpoena from Treasury's Office of Foreign Assets Control for half a year.

Source: OFAC enforcement release (primary)

Supply Chain Risk

The US government's purchasing agency pulled 244 products from its catalog after finding they were Chinese-made, some sold to agencies for 10 to 15 years

The General Services Administration called this a first wave with more to come, and published neither the list nor one brand name.

Source: Nextgov/FCW

Around the World

Enforcement & Liability

French prosecutors have counted 77 violent attacks on cryptocurrency holders this year, more than all of 2025

Organized syndicates in France recruit young operatives online, often for a single job apiece, to carry out home invasions, torture and kidnapping until a victim hands over the keys to a cryptocurrency wallet.

Source: OCCRP

A former Ukrainian officer goes on trial in Hamburg for the Nord Stream pipeline bombing, the first prosecution over it to reach a court

[DE · Welt]

German prosecutors laid the case out in 136 pages, and the open legal question it raises is whether blowing up the pipelines counts as a war crime.

Source: Welt (DE)

Mexican bank customers filed 11.2 billion pesos, about $620 million, in fraud claims in the first half of 2026, equal to 7.5% of the banks' profits

[ES · Expansión]

Mexico's financial sector has a standing public alert out telling customers not to download unverified applications or share personal data, and the outlet's own headline calls the trend unstoppable.

Source: Expansión (México)

Cyber Threats

European analysts are floating an offensive cyberattack to shut down services in a Russian city as a warning over sabotage in Europe, the New York Times reports

[RU · Vedomosti]

No EU institution has confirmed it, and Russian readers got the account secondhand, through the business daily Vedomosti rather than from the Times.

Source: Vedomosti

Supply Chain Risk

Eleven merchant ships have been attacked near the Strait of Hormuz since October 1st, by Iran and by the US Navy, and Gulf crude exports are back near pre-war levels anyway

[RU · Interfax]

Lloyd's List Intelligence, a maritime shipping-data firm, attributes the export recovery to a shuttle pattern.

Source: Interfax

The EU says China agreed to halve its hybrid-car exports to Europe over four years; Beijing confirmed the deal without the numbers or the mechanism

[ES/DE/ZH · El País, FAZ, MOFCOM]

EU trade commissioner Maros Sefcovic gave the percentage and the four-year timeframe in public and called it a crucial first step.

Source: El País

Geopolitical Shocks

Trump says Russia will immediately ship more than 300,000 tons of diesel into global markets, with no confirmed US-bound volume

Politico reports that Washington lifted its sanctions on Russian diesel to permit the trade and that the US may buy some of it directly.

Source: gCaptain

Ethiopia expelled ten Eritrean diplomats and says Eritrean troops are 20 to 40 miles inside Tigray, days after Egypt, Eritrea, Sudan and Somalia signed a Red Sea pact it was left out of

[FR · France 24]

Egypt, Eritrea, Sudan and Somalia signed what they call the El Alamein Declaration on October 4th, framed around Red Sea security, Sudan's territorial integrity and Somalia's sovereignty; its text never names Ethiopia, the largest state on that coast's approaches, which is not a party to it.

Source: France 24 — Afrique

Regulatory Horizon

Britain's privacy regulator won data-protection changes from ten AI developers and is taking evidence on AI agents until November 20th

The Information Commissioner's Office secured commitments from Amazon, Anthropic, Apple, Cohere, DeepSeek, Google, Meta, Microsoft, OpenAI and Stability AI covering how they disclose their use of personal data and how individuals exercise their data rights, and each firm also agreed to assess its own safeguards more rigorously.

Source: UK ICO (primary)

India's central bank cut how much foreign-currency cover a company can buy without showing a matching trade, from $100 million to $5 million

Companies hedging the rupee could previously take up to $100 million of currency positions without having to show the underlying import, export or loan behind them.

Source: Reserve Bank of India (primary)

Also Today

China opened its first dedicated air force facility outside China, a joint training base at Ban Keun airport near Vientiane, the capital of Laos

Source: Fulcrum (ISEAS)

Hurricane Isaias halted 71% of US Gulf oil production, with trucking contract rates already at a 52-week high of $2.72 a mile

Source: OilPrice / FreightWaves


Get the full risk analysis every Sunday. Manage your subscription.

Don't miss what's next. Subscribe to The State of the Threat:
← Newer Daily Brief, October 11, 2026 Older → Daily Brief, October 9, 2026
stateofthethreat.com
LinkedIn
Powered by Buttondown, the easiest way to start and grow your newsletter.