Screenshot 2026-10-19 at 12.51.34

Weekly Cyber Radar

12th October - 18th October 2026

Each week, Cyber Radar brings together the latest cyber security, resilience and regulatory developments, with clear insight into what they mean for organisations.

Old data, unmanaged tools and trusted suppliers drove last week's cyber risk, with real operational impact.

Subscribe to receive the weekly highlights and scroll down to explore this week's stories.

Subscribe to Cyber Radar

Legal Aid Agency Breach Reaches Back Decades

Screenshot 2026-10-19 at 12.36.59
What happened

About 250,000 stolen records predate 2007, the earliest from 1978, far older than first reported.

Insider Intel

The attack was found in April 2025, yet its full reach is only now being set out.

What to do now

Review how long you keep personal records, and whether old archives still need to be reachable.

Read More

Met Police Reprimanded Over Unapproved Platform

Screenshot 2026-10-19 at 12.42.43
What happened

The ICO found staff put 179 people's details on a retail platform with no data protection checks.

Insider Intel

500 accounts were opened and 375 used, yet the force could not track access.

What to do now

Ask staff which unapproved tools they use, and offer approved routes before simply blocking them.

Read More

Fashion Group Systems Offline After Attack

Screenshot 2026-10-19 at 12.41.45
What happened

Hobbs, Phase Eight and Whistles orders are delayed while the cause and recovery time stay undisclosed.

Insider Intel

How attackers got in, and whether ransomware was involved, has not been shared.

What to do now

Check your continuity plan covers online orders and website functions if systems are down for days.

Read More

Backup Supplier Attack Reaches Microsoft 365 Tenants

Screenshot 2026-10-19 at 12.43.22
What happened

Attackers used a backup app's approved permissions to reach at least 162 Microsoft 365 tenants.

Insider Intel

Sign-ins came from a script acting as the app, so multi-factor checks never applied.

What to do now

List the supplier apps with permissions in your Microsoft 365 tenant and remove any you cannot justify.

Read More

Supplier Account Opens Danish Population Register

Screenshot 2026-10-19 at 12.44.21
What happened

Denmark says 8.8 million people's records were accessed through an IT supplier's authorised account.

Insider Intel

About 14 million automated searches went unflagged until an odd invoice stood out.

What to do now

Ask suppliers with access to your data how they secure and monitor their accounts, and check usage yourself.

Read More

Three priorities for leaders

Review which suppliers and apps hold access

List the suppliers, apps and accounts with standing access to your data, and remove permissions that are no longer needed or well understood.

Know what data you keep and why

Set clear retention periods for personal records, and give staff approved tools so data does not drift into services nobody has checked.

Plan trading without key systems

Agree how you would take orders, serve customers and restore data if a core system or supplier were unavailable for several days.

The Cyber Security Compliance Experts

RightCue has delivered cyber security compliance and assurance since 2009. We are an NCSC Assured Service Provider, CREST accredited, and a Government Commercial Agency supplier.  We work across Defence, Healthcare, Financial Services and Technology, helping organisations meet today’s regulatory requirements and prepare for what comes next.

Stay informed beyond the Cyber Radar briefing

rightcue-dcc-deadline

MOD spotlights RightCue as a Defence Cyber Certification certifying body

RightCue was delighted to speak to the Ministry of Defence about hardening cyber security Defence's supply chain. This follows the company being accredited by IASME as a Certifying Body across all four levels of the Defence Cyber Certification (DCC) - Levels 0 to 3 - under MOD governance. You can read the whole piece here.

 

Read Press Release
Concordia series part 1 - Identity is the new perimeter landscape

Identity is the new perimeter landscape

Concordia Series - Part 1 - Most incidents no longer start with someone breaking in. They start with someone logging in. In the first part of our Concordia series, we look at why identity has become the new perimeter, from help desk password resets and deepfake calls to the service accounts and API keys nobody owns. We also set out where we would start, including the identity changes in the April 2026 Cyber Essentials update.

Read More
Subscribe to Cyber Radar