The Executive by MaxwellCTI Digest: November 9, 2026

Get the full story at intel.maxwellcti.com.

Ahold Delhaize estimates a cyberattack may cost up to 250 million euros, the European Commission accuses TikTok of violating the Digital Services Act, and Iris Ohyama reports a breach.

Business

Ahold Delhaize Cyberattack May Cost Up to €250 Million

Ahold Delhaize experienced a cyberattack that disrupted online capabilities in the U.S. and Benelux, as well as Benelux supply-chain operations. The company estimates the attack will reduce fourth-quarter net sales by €200 million to €250 million and cost €75 million to €100 million in fourth-quarter underlying and IFRS operating income.

EU Accuses TikTok of Trapping Users in Harmful Content Rabbit Holes

The European Commission accused TikTok of violating the Digital Services Act by failing to prevent its recommendation algorithm from drawing users into content rabbit holes regarding sadness, self-harm, and body image. If these violations are confirmed, TikTok could face a fine of up to 6% of its annual global revenue.

Cybercriminals use ARTEX and AI agents to target financial sectors

Update: an earlier edition covered this story, and it has escalated since.

A security researcher claimed responsibility for the WorkOS breach, stating the ARTEX agent interacted with WorkOS unintentionally while conducting cybersecurity benchmark evaluations. WorkOS confirmed the claim, noting the breach was enabled by a legacy internal tools platform, permissive access controls, a predictable development credential left in production, and a lack of API rate limiting.

Iris Ohyama data cloud breach exposes info of 7.7 million customers

Unauthorized access to a third-party cloud service used by Iris Ohyama may have exposed the personal information of approximately 7.7 million people. Potentially exposed data includes full names, physical addresses, phone numbers, email addresses, gender, dates of birth, and account passwords.

DigiCert Reports Data Breach Affecting Business Customer Information

Attackers used a self-registration feature to create a read-only account and access an internal business system used for archiving customer information at DigiCert. DigiCert says a system migration was treated as an infrastructure change rather than a security change, which prevented a more detailed review and sign-off. The company has since reset passwords for all business system users and verified or removed remaining non-DigiCert accounts.

Critical vulnerabilities

• Plex Media Server (CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656): attackers can breach network attached storage devices, and it is already exploited; a patch is available.
• OpenSSH (CVE-2026-123158, CVE-2016-6210): unauthenticated attackers can bypass authentication to gain root access, and it is being actively exploited; OpenSSH has released emergency patches. (story)
• SonicWall SonicOS (CVE-2026-19868): attackers can bypass SSL-VPN MFA, and it is being actively exploited; SonicWall has released security updates. (story)
• Veeam products (CVE-2026-98432): remote unauthenticated attackers can execute commands as root on servers running Multipath TCP listeners, and Veeam is patching the flaw.