Daily Brief, October 8, 2026

Top Story

Florida's attorney general sued TP-Link, which sells most of the routers US homes and small offices buy at retail, saying it marketed them as secure while hackers broke into some and it stopped patching others

The complaint, filed October 6th in Polk County, Florida, says the TP-Link TL-WR940N router was exploited by the Quad7 botnet, which Microsoft attributes to Chinese threat actors, and by Russia's military intelligence agency, the GRU.

Source: Florida Attorney General

Iran War Spillover

Hiring one supertanker to carry US crude to Asia now costs $77 million, up over 700% on the 2025 average, as attacks on tankers disrupt Strait of Hormuz shipping

The Baltic Exchange, the London shipping-price benchmark, published the figure on October 7th.

Source: Bloomberg (via Semafor)

Iraq cut the official value of its dinar about 14.5%, to 1,520 per dollar

[AR · Asharq Al-Awsat]

Asharq Al-Awsat, a Saudi-owned pan-Arab daily, reported that Iraq's cabinet set a new official rate, effective October 7th, about 14.5% weaker than the 2023 official rate.

Source: Asharq Al-Awsat

The White House has asked the Pentagon for options to strike Iran before the November 3rd midterm elections, The Atlantic reports; the targets for that strike are still undecided

Two administration officials told The Atlantic that the scope and targets of a pre-election strike remain under discussion.

Source: The Atlantic (via Caspian Post)

Saudi Arabia says attacks on its airports in Riyadh and Abha, a southwestern city near Yemen, killed 3 people and injured 36

Asharq Al-Awsat, a Saudi-owned pan-Arab daily, reported the toll on October 7th, citing the Saudi civil aviation authority, which said the airports were hit on Tuesday and Wednesday.

Source: Asharq Al-Awsat

United States

Enforcement & Liability

The US Copyright Office opened a public inquiry into music streaming fraud, asking how bot farms and AI-generated songs are draining royalty payouts, with comments due December 21st

Royalties, ad impressions, affiliate clicks, metered software seats: any business that pays out on an automated count now has a federal docket describing how bots inflate that count.

Source: Federal Register (US Copyright Office)

Supply Chain Risk

The Justice Department charged MonsterCloud's owner, Zohar Pinhasi, saying his Florida ransomware-recovery firm paid hackers more than $8 million in ransoms while charging victims $19 million for decryption

Federal prosecutors in Brooklyn say Pinhasi told clients he could unlock their files without paying the criminals, then quietly bought the decryption keys from the attackers; in one 2023 case he paid about $8,200 and billed the client about $150,000.

Source: US Department of Justice

Regulatory Horizon

The Government Accountability Office found that none of the 24 largest US federal agencies has finished the three basic steps for moving off encryption that quantum computers will break

The audit measured three things: whether an agency has inventoried the systems running vulnerable encryption, and whether the replacement work is funded.

Source: GAO

Around the World

Enforcement & Liability

EU ambassadors agreed to add more than 1,500 names (743 individuals, 826 entities) to the Russia sanctions list, which Meduza calls the largest expansion yet, citing Euronews

[RU · Meduza]

Meduza, an independent Russian-language news outlet, reported on October 7th, citing the Sistema investigative project, that the new listings target defense-industry organizations and their managers and staff.

Source: Meduza

Seoul says fuel loaded at its ports onto tankers that sailed to Russia broke no Korean law, though three of the tankers are under UK and EU sanctions

South Korea's export controls on Russia cover mainly industrial machinery, electronics and vehicles, not refined fuel, so its foreign and trade ministries and customs service say loading the fuel at Korean ports was legal.

Source: The Guardian

The speaker of Russia's parliament, Vyacheslav Volodin, proposed treating money moved out of Russia as a factor that raises sentences in economic-crime cases

[RU · Kommersant]

Volodin said outbound transfers are often tied to fraud, theft or laundering.

Source: Kommersant

Germany's financial regulator BaFin fined financial services firm abcfinance 90,000 euros for reporting suspected money laundering late

[DE · BaFin]

German law requires companies to report suspected money laundering without undue delay to a government unit that reviews the reports and, where needed, passes them to law enforcement; BaFin says that in April 2025 abcfinance filed several such reports late.

Source: BaFin

Supply Chain Risk

Mexico's gas pipeline operator says US maintenance cut about a fifth of the gas entering its pipelines for 10 days

[ES · Expansión, El Financiero]

Expansión, a Mexican business publication, reported on October 7th that Cenagas, the gas-pipeline operator, blamed scheduled maintenance at the Ramones injection point in Texas and an unplanned compressor-station event at El Paso.

Source: Expansión (México)

If the EU blocks its $500 million sale to Chinese miner MMG, mining group Anglo American says it would idle its Brazilian nickel business as a path to closure

[PT · Folha de S.Paulo]

If the European Commission blocks the sale, Anglo American says it would have few options besides idling its Brazilian nickel business, a step it calls a path to closure.

Source: Folha de S.Paulo

Geopolitical Shocks

France will release 10 million barrels of diesel from its strategic reserves to lower prices at the pump

[FR · L'Usine Nouvelle]

France's release is its national share of the reserve draw the G7 agreed on October 3rd, and it names pump prices rather than supply security as the reason.

Source: L'Usine Nouvelle

Infrastructure & Capacity

Yandex says an incident at its data center in Russia's Ryazan region knocked out part of its infrastructure, after Telegram monitoring channels reported a Ukrainian drone strike started a fire there

[RU · Meduza]

Yandex, the Russian search and cloud company, says the situation is under control with no casualties and that services are being restored.

Source: Meduza

Also Today

The Democratic Republic of Congo's regulator says 14 miners, including Glencore, paid at least $20 billion from 2020 to 2025 to subcontractors it deems ineligible

Source: Semafor Africa

Dutch researchers found 8,547 internet-facing systems at European solar parks and wind farms, mostly admin login pages, and believe full control was possible at about 181 sites

Source: Metacurity (Reuters report)

China refused the EU's request to cap its hybrid car exports at about 15% of the EU market, a week before an EU leaders' summit on October 15th

Source: Sinocism (Financial Times report)

Denmark's domestic intelligence service says Russia has begun sabotage operations against Danish defense companies; Russia denies it

Source: Le Figaro

Corrections

Yesterday's email got these wrong. The site now has the right version.

• FBI contractor. We said the FBI removed an Accenture contractor. The FBI confirmed it removed a contractor and blamed a missed Oracle patch, but did not name Accenture. A person familiar with the matter said the contractor worked through Accenture. We also said the breach exposed agents' data. The data may have been exposed, and the ShinyHunters extortion crew claimed the hack.
• Australia's legacy-systems order. We said it covers every federal agency. It covers non-corporate federal agencies only.
• Fortinet firewall campaign. Attackers create their own administrator accounts. We said they lock the real administrators out. They do that in some cases, by deleting the real accounts or changing their passwords.

Get the full risk analysis every Sunday. Manage your subscription.