Wednesday, 14 October 2026

Houthi missiles reach Saudi Aramco facility as coalition strikes Yemen fuel depot

Update on yesterday's Houthi and Saudi exchange of strikes: the fighting has now reached Saudi energy infrastructure. Euronews reports that an attack hit a Saudi Aramco facility, while the BBC says missiles were intercepted near Riyadh after the Saudi-led coalition struck a fuel depot in Yemen. DW describes a fresh wave of Houthi missiles across Saudi Arabia, and a football match in Riyadh was delayed by a missile alert. Trump called the Houthis 'not nice'. The pattern is tit-for-tat targeting of fuel and energy sites, which raises risk for oil flows, insurance conditions and staff based in the Kingdom. Separately, NOS reports gas prices at their highest level in years, though the headlines draw no link between the two. Organisations with personnel, contractors or travellers in Saudi Arabia should confirm shelter and alert procedures, review travel approvals for Riyadh, and test how quickly they can account for every employee. Procurement teams should check their energy cost exposure in current contracts.

Our protection teams support travelling executives and staff with route planning and live monitoring where missile alerts are active.

Russian strikes leave 600,000 Ukrainians without power as Starlink limits hit the front line

New Russian strikes have left more than 600,000 Ukrainians without electricity, according to Zelensky as reported by NOS. The BBC adds that restrictions on Starlink are affecting the front line, so civilian infrastructure and military communications are under pressure at the same time. For companies the effects are indirect but real: staff, suppliers and logistics partners in Ukraine face outages, weaker mobile coverage and unreliable data links, and every lost day of heating and power weighs more as the weather turns colder. Firms with Ukrainian operations or Ukrainian dependencies should confirm that backup generation and fuel stocks are in place, that critical communications do not rely on a single satellite or mobile provider, and that duty-of-care contact details are current. Teams moving people or cargo into the country should plan for sudden route changes and hold regular check-ins over more than one channel.

Employee charged with planting listening device in OpenAI executive conference room

A Saudi national, described by the BBC as an employee, has been charged with planting a recording device in an OpenAI office. The Record says it was an executive conference room, and DW reports that OpenAI says the employee was caught. The case is a clear example of insider-enabled technical surveillance: a device placed in a room where strategy, funding and security matters are discussed, by someone with legitimate access. Perimeter controls and cyber defences do not detect that. The headlines give no detail on motive or on what was recorded, so any attribution to a state is unproven. Organisations that host board, M&A or product discussions should schedule technical counter-surveillance sweeps of those rooms, tighten who can enter and when, log visitor and contractor access, and agree in advance who reports a suspect object and how. Sweeps work best at irregular intervals and after any maintenance or refurbishment work.

Mission Support's TSCM specialists sweep boardrooms and executive spaces for hidden recording devices.

MI5 chief warns of threats to UK from Russia, Iran and AI

The head of MI5 has warned of threats to the UK from Russia, Iran and artificial intelligence, the BBC reports. The headline gives no specifics, but the combination matters for European organisations because the same state actors and the same tools are used across borders. Hostile-state activity tends to target people and access: employees with sensitive knowledge, suppliers, premises and communications. AI lowers the effort needed for convincing impersonation, targeted phishing and research on individuals. For security directors the practical task is to turn a national warning into local controls. Review which staff and executives are publicly exposed, check that unusual payment or access requests made by voice or video are verified through a second channel, and brief travellers and key personnel on approaches by unknown contacts. Set a date to revisit the threat assessment, so the warning leads to a documented decision rather than a note in a file.

Latin American organised crime 'may operate in 16 European countries'

The Guardian reports that Latin American organised crime may operate in 16 European countries. The wording is cautious and the headline names no groups or routes, so read the figure as an estimate, not a count. Even so, it points to a wide European footprint for drug-trafficking networks, and their impact reaches well beyond ports. Such networks typically rely on corrupting insiders, intimidating staff, laundering money through legitimate companies and violence that spills into public places. Transport, shipping, hospitality, real estate and cash-heavy retail are the usual points of exposure. Organisations in those sectors should review insider-risk controls for roles with access to containers, keys, manifests or customer data. They should apply deeper due diligence to new partners and subcontractors, and give staff a confidential channel to report approaches or pressure. Early reporting of a single approach often reveals a pattern across a whole site. Executives and managers in exposed positions should have their personal security arrangements reviewed, including home and commuting routes.

Albert Heijn restarts distribution as cyber problems continue, phishing warning issued

NOS reports that Albert Heijn's distribution is due to restart 'in the course of the day'. NL Times says the supermarket's cyber problems continue, carries a phishing warning and notes that rival chains are benefiting. The headlines do not state the nature of the attack or how long shelves were affected, so avoid speculation. The case shows how a cyber incident in a retailer's systems quickly becomes a physical supply problem: distribution stops, stores and suppliers wait, and customers switch. The phishing warning matters because incidents like this are followed by fraudulent messages that exploit public attention. Retailers, suppliers and logistics firms should confirm manual fallback procedures for orders and dispatch, warn staff and customers about unsolicited messages that mention the incident, and verify any changed payment or contact details through a known second channel. Test restoring distribution from backups, not only the systems behind it, and agree who decides when manual processes can be stood down.

Our cyber security team helps retailers and suppliers test incident response and recovery plans before an outage reaches the shelves.

Dutch lawmakers back plan for rapid response to Russian hybrid sabotage

NL Times reports that Dutch lawmakers have backed a plan for a rapid response to Russian hybrid sabotage. The headline gives no detail on the plan's content, funding or timetable, so its practical effect is not yet clear. The political signal is still relevant. Hybrid sabotage targets infrastructure, logistics and public services, and operators of such assets are likely to be asked for earlier reporting, closer coordination with authorities and clearer incident roles. Operators of energy, port, telecoms, transport and data-centre sites in the Netherlands should map which of their assets could be seen as targets, check how a suspicious drone, fire, cable cut or intrusion is escalated internally and to the police, and agree who speaks to the authorities in the first hour. Physical security and cyber teams should rehearse that sequence together at least once this quarter, because hybrid incidents rarely respect the boundary between the two.

Our advisory team turns national threat assessments into site-specific risk pictures for operators of critical locations.

Eighteen Ajax supporters arrested in Croatia, 'had weapons on them'

NOS reports that eighteen Ajax supporters were arrested in Croatia and 'had weapons on them'. The headline gives no detail on the type of weapons, the location or the group's intent, and no account from the Croatian authorities is provided, so conclusions should wait. Group travel by football supporters carries recurring risks: organised groups moving in numbers, rival fans and heavy policing. For organisations the relevance lies in staff, clients and reputation. Hospitality guests, corporate parties and employees who are fans can be caught up in disorder, detentions or travel disruption abroad. Event organisers, travel managers and companies running hospitality packages should check what intelligence they hold on the destination, agree meeting points and escalation contacts, and brief guests on local rules and safe routes. Staff should know whom to call if a colleague or client is detained, and managers should know how to reach legal support abroad quickly.