Satine Sentinel: October 30, 2026

Five incidents this week, and four of them sit one step outside the victim’s direct control. At ENGIE, attackers reached French customer records through a partner-run marketing tool and never touched the company’s own network. A contractor, BAE Systems, runs the federal Bankruptcy Noticing Center, which stayed dark until October 29. Hackers published records on more than 41,000 Department of Homeland Security employees and say they got them through the department’s single sign-on service, a claim the vendor, Okta, disputes. At U.S. military commissaries, freezers that heated their own contents in late August are now a Pentagon investigation. The exception is the University of New Mexico, where the state’s only Level 1 trauma center diverted ambulances for two hours while a brand-new extortion group made claims the university says are wrong.

This week: The shared theme is custody. In most of these cases the system that failed was run by a partner, a contractor, an identity provider, or a controller nobody had inventoried, and the organization held responsible found out what happened at the same speed as the public. The defender’s decisions had to be made without the full picture.

UNM Health Diverts Ambulances as a New Extortion Group Claims the Attack

What happened: On October 26, 2026, the University of New Mexico Health Sciences Center detected a cyberattack that cut access to critical systems across UNM Health, which runs the state’s only Level 1 trauma center. Ambulances were diverted from 12:30 to 2:30 p.m. local time, all appointments and outpatient surgeries were canceled that day, and health sciences students were sent off campus. Phased restoration began at 2:30 p.m. UNM said critical systems were back online in the early hours of October 27, and clinics resumed that day. A group calling itself Byod claimed the attack. Law enforcement is investigating.

Technical details that matter:

Initial access is undisclosed. UNM has called it a cybersecurity event and has not named a vector or confirmed ransomware. The ransomware label comes from Byod’s own leak-site post, picked up by BleepingComputer and HIPAA Journal.
Byod is a new group. Its leak site listed 10 victims at the time of HIPAA Journal’s report. It claimed 36,000 compromised systems across the main campus and hospital environments, including both Active Directory forests, Group Policy infrastructure, the Microsoft Entra tenant, and two Oracle databases. It also listed payroll data, internal email, and Cerner EHR rosters. All of this is attacker claim, not confirmed.
UNM’s account is narrower: some end-user devices were affected, but the threat actor did not reach core systems or servers. Containment began around 11 a.m. on October 26.
Inference, not reporting: a claim that names Active Directory and Group Policy describes the usual route to pushing ransomware to tens of thousands of endpoints. If UNM’s account is right, the 36,000 figure counts devices touched, not core compromise. Both accounts cannot be fully correct, and forensics will settle it.
On October 27, Byod posted an apology, offered free decryption keys for the hospital sector, said it would keep the data, and offered patients up to $2,500 each. That is extortion messaging, not evidence of restraint. UNM has not confirmed data theft.
Persistence, command and control, and exfiltration methods are not public.

Why critical institutions should care: The measure that mattered here was time. Detection, containment, a two-hour diversion, and restored clinics inside about a day is a good outcome for a hospital system, and it depended on neighboring systems in Albuquerque and Santa Fe absorbing patients. Not every region has that. The open question is the data: UNM has not said what was taken, and the notification clock, the patient trust question, and the extortion leverage all sit behind that answer.

Key sources:

DHS Employee Directory Published Online, With a Disputed Okta Claim

What happened: On October 28, 2026, Distributed Denial of Secrets published a searchable database it calls Icepick, covering more than 40,000 current and former Department of Homeland Security employees and contractors. Outlets report counts from about 40,000 to more than 41,000. A hacktivist group calling itself the Department of Peace supplied the data and said the release was retaliation for the DHS secretary’s immigration enforcement pledge. DHS said it is aware of a potential breach and is working to address it.

Technical details that matter:

The records include names, phone numbers, email addresses, job titles, and internal group memberships, according to Nextgov/FCW. Some entries belong to former employees. Nextgov also found about 75 records tied to the DHS Office of Intelligence and Analysis and reached two listed officials by phone.
The group says it obtained the data through the Okta single sign-on service DHS uses. Nextgov has not confirmed that. An Okta spokesperson said the company has no evidence its systems or data were compromised. SecurityWeek reports the data was allegedly taken earlier this year, which is also unconfirmed.
Inference, not reporting: Okta’s denial of a vendor-side compromise does not clear the path. An identity provider tenant can be exposed through a stolen administrative credential, an API token, or an integration, all of which sit on the customer’s side. The investigation needs to separate those.
A directory export is a complete organization chart with reachable phone numbers and email addresses. Defenders should treat it as a targeting list for phishing, voice impersonation, and physical approach.
Nextgov notes a similar September exposure of FBI employee information claimed by ShinyHunters, and an earlier DHS network intrusion that was twice dismissed as a false positive before it was confirmed.
Persistence and dwell time are unknown.

Why critical institutions should care: The data is not secret in the way a customer database is. It is a list of who does what and how to reach them. For any institution, the identity provider and the directory behind it hold that same list, and most organizations cannot quickly say who can export it. Exposure of this kind does not need to be catastrophic to be useful to an adversary, and it does not expire.

Key sources:

Update: Pentagon Treats Commissary Freezer Failures as a Suspected Cyberattack

Timing note: The freezer failures happened in late August 2026. The investigation became public on October 29, inside this window. The French refrigeration attack it may relate to was covered in the October 9 to October 16 edition.

What happened: The Pentagon is investigating freezer malfunctions that spoiled food at military base commissaries in August as a suspected cyberattack, according to Reuters and an official who spoke to Nextgov/FCW. About six commissaries were affected per the official. At Fort Huachuca in Arizona, a freezer entered defrost mode and heated its contents. U.S. Cyber Command and the Army Criminal Investigation Division’s Cyber Field Office are involved, and investigators are coordinating with French authorities. It has not been established that a cyberattack caused the failures.

Technical details that matter:

The mechanism is unconfirmed. Reporting relayed from Reuters says that in at least one case investigators found temperatures raised overnight rather than a unit simply failing. Newsweek describes the controls as appearing to have been altered. Some units reportedly caught fire from the heat.
Military Times, as relayed by Fox, names seven bases: Fort Irwin, Holloman, Naval Station Newport, Little Rock, F.E. Warren, Robins, and Fort Huachuca. The official told Nextgov about six.
The French case involved attackers overriding temperature controls on commercial refrigeration equipment at more than 350 establishments, per Nextgov’s account. Whether the same actor or technique is behind the U.S. incidents is unresolved.
The Food and Agriculture ISAC has warned that attackers target internet-accessible industrial controls with weak defenses. That is context for the French case, not a finding about the commissaries.
No attribution, no named controller vendor, and no access method has been confirmed. A claim that the commissary controllers were made by a specific vendor appeared in one aggregator and is not used here.

Why critical institutions should care: The first public signal was a base Facebook post and an independent blog in August, and the official investigation surfaced two months later. Any institution that stores food, specimens, vaccines, or pharmaceuticals depends on controllers that sit on networks facilities teams manage and security teams rarely see. The consequence of a setpoint change is spoiled inventory and, in some cases, fire, not a ransom note.

Key sources:

ENGIE Customer Data Taken Through a Partner Marketing Tool

What happened: On October 27, 2026, ENGIE told BleepingComputer it had identified unusual data access activity in a tool its partners use for customer prospecting and for marketing energy offers in France. Attackers took customer data. ENGIE says its internal IT systems were not affected and no banking data was involved. Notification letters list first and last names, mailing addresses, email addresses, and phone numbers, and ENGIE says certain energy contract details were also exposed. ENGIE has cut partner access to the tool, notified authorities, and warned customers about fraud and phishing.

Technical details that matter:

Initial access is undisclosed. ENGIE has not named the tool, the partner, the intrusion date, or the number of customers affected.
No ransomware or extortion group had claimed the breach at the time of BleepingComputer’s report.
The exposure is contact data plus contract context. Together they tell a caller who your energy supplier is and that you hold a contract, which makes an impersonation call or message more convincing.
Techbytes and another secondary outlet note an earlier, separate claim involving an ENGIE-related Salesforce instance. ENGIE has not tied it to this incident, and nothing here links them.
Inference, not reporting: a partner-operated sales tool holds a working copy of customer data behind partner-grade authentication. An attacker who wants the data does not need to defeat the company with the strongest controls, only the custodian with the weakest.

Why critical institutions should care: This is not an operational technology incident, and it is not large by the numbers disclosed. It matters because it is the common shape of supply chain exposure at utilities: customer records copied into tools run by sales, marketing, and billing partners, with security decided by the partner. ENGIE’s response, cutting partner access and notifying customers quickly, is the part worth copying. The part to examine is how many such tools an institution has and who can name them.

Key sources:

Update: BAE Systems Restores the Bankruptcy Noticing Center and Says No Data Was Taken

Timing note: The outage was covered in the October 9 to October 16 edition. The new development, restoration of service and BAE’s statement on data, landed October 29, inside this window.

What happened: On October 29, 2026, BAE Systems and the Administrative Office of the U.S. Courts said the Bankruptcy Noticing Center, which produces and sends notices for all federal bankruptcy courts, is back online. BAE told The Record that no other systems were affected, no data was extracted, and no personal information was breached. No group has claimed the attack. Courts declared a Bankruptcy Rules emergency that lasts 90 days, through January 2027, unless ended sooner, and said it is likely to stay necessary during restoration.

Technical details that matter:

The cause and vector have never been disclosed. There is no ransomware family, no attribution, and no actor claim.
All BNC systems and websites BAE operates for the judiciary were offline, including bnc.uscourts.gov, bankruptcynotices.uscourts.gov, notices.uscourts.gov, and the National Creditor Registration Service.
Recovery is a reconciliation job. The courts said the BNC will work through a backlog dating to October 7 plus new submissions, and that paper notices will be released in prioritized waves. Paper notices created from October 13 through October 26 carry a warning that they were sent late because of the attack.
The “no data extracted” statement is the company’s own, given without a stated cause. Inference, not reporting: a finding of no exfiltration is only as strong as the logging that existed to see it, and BAE has not said what the evidence was.

Why critical institutions should care: The damage here was procedural, not a data loss. A legal process that runs on deadlines and notices depended on one contractor-operated system, and courts had to bend their own rules to keep working around it. Any institution that outsources a function it cannot perform by hand has the same dependency, and the recovery time is set by someone else’s incident response.

Key sources:

The Pattern this Week

Look at who ran the failing piece. ENGIE’s data sat in a partner’s tool. BAE ran the courts’ noticing system. DHS’s directory was reportedly reached through a sign-on service the vendor says it did not lose. The commissary freezers answered to controllers that facilities staff manage and security staff do not usually see. Only UNM was a straightforward case of an institution’s own systems under attack, and even there the most important facts, what was reached and what was taken, are disputed between the attacker and the victim.

Every one of these organizations had a statement ready within days, and every statement drew a boundary: internal systems not affected, no data extracted, endpoints only, no evidence of compromise. Some of those boundaries may hold. None of them could be checked by the people relying on them when the statements were made.

That is the defender’s problem. The assets that fail are increasingly the ones you depend on but do not hold, and the evidence for whether they were compromised sits with someone whose incentives are not yours.

What Your Business Can Do This Week

Rehearse the downtime plan (UNM Health). Ask your operations leaders to walk through what happens if core systems are unavailable for a day: who decides, which work continues on paper, and which neighboring organization takes the overflow. UNM’s day-long recovery depended on all three.
Find out who can export your employee directory (DHS). Ask IT who administers your single sign-on service, who can pull a full list of staff with phone numbers and titles, and whether those pulls are logged and reviewed. Treat that list as sensitive.
Ask whether building and refrigeration controls are reachable from the internet (Pentagon freezers). Have facilities and operations produce a list of connected equipment that controls temperature, power, or access, and who maintains it. Security usually does not have that list.
List every partner that holds a copy of your customer data (ENGIE). For each one, ask what they hold, how they secure it, and how fast you can cut their access. ENGIE could cut access quickly because it knew the tool existed.
Name the vendors you cannot work without (BAE). For each, ask for their restoration time and their notification commitment in writing, and decide what your people would do by hand while the vendor recovers.

See you next week!

UNM Health Diverts Ambulances as a New Extortion Group Claims the Attack

DHS Employee Directory Published Online, With a Disputed Okta Claim

Update: Pentagon Treats Commissary Freezer Failures as a Suspected Cyberattack

ENGIE Customer Data Taken Through a Partner Marketing Tool

Update: BAE Systems Restores the Bankruptcy Noticing Center and Says No Data Was Taken

The Pattern this Week

What Your Business Can Do This Week

Like this:

Ready to Strengthen Your Defenses?