Saturday, 17 October 2026

Super tanker ablaze after striking mine in Hormuz, IRGC says

New since yesterday's record count of ship attack reports near Hormuz: a super tanker is ablaze after striking a mine in the Strait, according to the Iranian Revolutionary Guards (IRGC). Dutch broadcaster NOS reports that Iran also cites further incidents elsewhere in the Persian Gulf. The IRGC is a party to the conflict, so the cause and the casualty picture remain unverified. A mine strike matters because it moves the risk from harassment to physical damage, and a mine does not care about a ship's flag. Insurers, charterers and crewing managers will reassess transit decisions quickly. Companies with cargo, crew or contractors in the region should confirm vessel positions, review war-risk and evacuation clauses, and decide in advance who may authorise a diversion. Energy buyers should test what a prolonged slowdown in exports would mean for their supply contracts. Teams protecting travellers in Gulf ports should refresh contact trees and check that duty-of-care plans still match the threat. Treat IRGC statements as claims until independent confirmation arrives.

Our advisory and intelligence team tracks maritime and Gulf developments to support travel, cargo and crew decisions.

Trump signs order waiving new Russia sanctions package

President Trump has signed an executive order waiving a new package of Russia sanctions, Euronews reports. BBC and DW describe several sanctions as waived or put on hold amid a widening row with Ukrainian President Zelensky. Zelensky addressed the EU summit, where leaders pledged support. An Italian minister told the BBC that restricting support for Ukraine is 'completely wrong', and Trump denies limiting Ukraine's access to Starlink. For companies, the practical effect is divergence: US and EU sanctions regimes may stop moving together, and compliance teams that treat one as a proxy for the other will find gaps. Test counterparties, financing and logistics chains with Russian exposure against each regime separately. Expect pressure on European governments to fill the gap, with possible new EU measures and a risk of countermeasures from Moscow. Keep legal counsel close and record the basis of every sanctions decision, because guidance may change at short notice.

Suspected Chinese espionage actors abuse BeyondTrust zero-day

Suspected Chinese espionage actors are exploiting a zero-day in BeyondTrust Remote Support, according to The Record, and Dark Reading places it in a run of exploited edge-device bugs. Attribution is suspected, not established. Remote support tools are high-value targets because they sit at the network edge and carry privileged access into customer and internal systems. A compromise can give an intruder the same reach as your helpdesk. Organisations running the product should check the vendor's advisory today and apply any available fix or mitigation. Where the tool is reachable from the internet, restrict access to known addresses and review authentication and session logs for unfamiliar activity over recent weeks. Treat any unexplained remote session as a potential incident and preserve the logs. Ask managed service providers whether they use the product on your behalf, since their exposure becomes yours. Agree with the board that this is a suspected espionage campaign, not opportunistic crime, and set the response priority accordingly.

Our cyber security service reviews remote-access exposure and helps check logs for signs of intrusion.

Dozens arrested on day of mass protest across France

Dozens of people were arrested in France on a day of mass protest, NOS reports, and DW likewise says the country is braced for nationwide demonstrations. NOS describes participants ranging from school pupils to yellow vests. Large, dispersed protests in French cities tend to bring transport disruption, localised clashes and heavy police deployment. The headlines do not state the trigger or expected turnout, so organisations should rely on live local reporting rather than assumptions. Companies with offices, retail sites or staff in France should check today's protest routes with local contacts, tell employees to avoid city centres, and reconsider deliveries or events near demonstration areas. Executives travelling through France should keep flexible itineraries and a fallback route to airports and stations. Review access control and glazing exposure for premises on known protest routes, and confirm who can authorise a temporary closure.

Manned guarding protects premises and staff on or near protest routes.

Putin seizes five more European firms

Euronews reports that President Putin has seized five more European firms, continuing what it calls Russia's 'hostile asset crackdown'. The headline does not name the companies or sectors, so exposure cannot be judged from this report alone. The pattern matters for any European organisation with Russian subsidiaries, joint ventures or staff on the ground: assets can be taken at short notice, and local managers and employees may come under pressure. Organisations with Russian operations should map every legal entity, bank account and data store held there, and work out what would be lost or exposed if control were seized. Review insurance cover for expropriation, limit sensitive data held locally, and give local staff a clear, lawful route to safety and to contact with headquarters. Run a tabletop exercise on a sudden seizure announcement, including who speaks to staff, regulators and the press in the first hour.

Our advisory and intelligence team helps map exposure in Russia and plan for sudden loss of control.

Albert Heijn extends delivery halt after cybersecurity incident

Albert Heijn has extended its delivery halt until at least Tuesday after what NL Times calls a 'cybersecurity incident'. NOS adds that the supermarket chain had to report the hack under the new cyber law, and carries the view that responsibility 'reaches further'. The headlines do not say what was affected or whether data was taken. For a retailer of this scale, a multi-day delivery stop shows how an IT incident becomes a physical supply problem within hours. Suppliers, logistics partners and franchise operators sit inside that impact zone. Organisations in food, retail and logistics should check which systems their ordering, warehouse and transport processes depend on, and whether those processes can run manually for several days. Confirm your own reporting duties under the new cyber law and who decides to notify. Test supplier contact trees now, and ask key partners what they would do if your ordering channel went dark.

Thousands of Novo Nordisk insulin pens stolen from Dutch wholesaler

Thousands of Novo Nordisk insulin pens have been stolen from a Dutch wholesaler, NL Times reports. The headline gives no detail on how the theft happened, how many pens were taken or whether anyone has been arrested. Pharmaceutical stock attracts thieves because it is compact, high in value and easy to move, and stolen medicine can re-enter the supply chain without a proper storage history. Insulin is also temperature-sensitive, so product of unknown handling carries a patient-safety risk. Wholesalers, hospital suppliers and pharmacies should reconcile stock records, check batch numbers against anything offered outside normal channels, and tighten access control and alarm response at storage sites, including after-hours deliveries and internal access rights. As with any theft of this size, review whether inside knowledge played a part. Report suspicious offers of insulin from unfamiliar sellers to the police and the manufacturer.

Alarm and mobile response covers storage sites outside working hours.

IMF board member warns of cyber threat to Dutch infrastructure

An IMF board member warns that cyberattacks pose a major threat to Dutch infrastructure, NL Times reports. This is one official's assessment, not a reported incident, and the headline names no threat actor or target. It lands on the same day as the Albert Heijn disruption and the new cyber law reporting duty, which makes the abstract risk concrete for Dutch boards. Critical services depend on supply chains, remote-access tools and operational technology that many organisations have not fully mapped. Boards should ask their security leads for an up-to-date map of critical dependencies, including suppliers with remote access, and test whether core services could run manually for several days. Check that incident reporting duties and escalation routes are written down and rehearsed, and that someone outside IT owns the decision to notify. Include scenarios in which a supplier, not your own network, is the point of failure.

Resilience training rehearses how management teams decide and report during a cyber disruption.