Wednesday, 11 November 2026

US charges three alleged Iranian operatives over plots against Jewish communities and a UK airbase

The US has charged three alleged Iranian operatives over plots that, according to BBC News and DW, targeted Jewish communities and included an incident at RAF Fairford, a UK airbase. The headlines give no further operational detail, so the full scope of the plots remains unclear. The case matters because it shows state-linked activity reaching into Western Europe while the wider Iran conflict continues. Organisations with Jewish staff, tenants or event programmes, and those located near military sites, have reason to review their exposure now. Practical steps: refresh threat assessments for sites and events linked to Jewish communities, check how suspicious approaches and photography near perimeters are reported and escalated, and confirm that publicly visible executives have current travel and residence guidance. Brief reception, guarding and facilities teams on what hostile reconnaissance looks like, and agree who decides on heightened measures if authorities issue further warnings. Share the charges with your security partners so that patterns can be matched across sites and over time.

Mission Support's executive protection teams plan travel, residence and event security for principals whose communities or profiles attract state-linked attention.

US soldier arrested in England on suspicion of spying for Russia

A US soldier has been arrested in England on suspicion of spying for Russia, according to Euronews, The Record and Al Jazeera. The headlines do not say what was allegedly passed on, and an arrest is not a conviction. The case still points to a familiar risk: Russian services recruiting insiders within allied forces and the contractors around them. For companies that supply, host or service military personnel in Europe, the exposure is practical. Insider access to schedules, site layouts and people is often worth more to a hostile service than a network intrusion. Organisations should revisit vetting and re-vetting for staff with access to sensitive facilities, tighten need-to-know on movement and logistics data, and make sure employees know how to report unusual approaches. Physical and technical countermeasures matter too: sweep meeting rooms where sensitive briefings take place and review who carries personal devices into them. The next official statement will show how far the case reaches.

Mission Support's TSCM specialists sweep meeting rooms and executive spaces for covert listening devices where sensitive briefings take place.

Microsoft Patch Tuesday passes 1,000 bugs for a second month running

Microsoft's November Patch Tuesday again surpassed 1,000 bugs, the second month in a row, according to The Record. Dark Reading describes the release as an overflowing cornucopia of CVEs. The volume is the story. Security teams cannot test and deploy every fix at once, so the risk lies in the gap between release and rollout, when attackers study the patches and look for unpatched systems. Organisations should triage rather than wait for a full cycle: start with internet-facing servers, remote access gateways, identity systems and anything flagged as actively exploited by the vendor or national cyber authorities. Keep a short list of business-critical systems that need a tested rollback plan, and record any exceptions with a named owner and an expiry date. Check that asset inventories are current, because unknown systems are never patched. Finally, brief the board on why two consecutive record months mean patch teams need capacity and clear priorities, not blanket deadlines that nobody can meet.

Mission Support's cyber security team helps prioritise patching by exposure and business impact.

Hundreds of Italian schools hit by suspected bomb hoax as threats reach Scotland and Northern Ireland

Hundreds of Italian schools received threats in what BBC News describes as a suspected bomb hoax. NOS reports that schools in Italy, Scotland and Northern Ireland were evacuated after bomb threats. Neither report names a sender or motive, and the spread across several countries suggests a coordinated, possibly automated campaign rather than separate incidents. Even if the threats prove empty, the cost is real: lost teaching time, stretched emergency services and a template that can be reused against offices, hotels, event venues and transport hubs. Organisations should check that their bomb-threat procedures are written down and rehearsed, that reception and switchboard staff know how to record a threat call or message word for word, and that evacuation and search decisions have a named owner. Agree in advance how threats are passed to police and to the facility manager, and how staff and visitors are informed without causing panic. Review whether email and web contact forms are monitored out of hours, since written threats often arrive there.

Mission Support's alarm and mobile response teams can support evacuation, search and site-control procedures when a threat is received.

Northern Europe's new drone and warship plan to counter Russia

Al Jazeera explains a new northern European plan that combines drones and warships to counter Russia. Only this explainer is available to us, so details such as force levels, funding and timelines should be checked against official announcements before anyone plans around them. The direction is still clear: northern European states are building unmanned systems and naval capacity to watch and deter Russian activity. For businesses, the practical effect is likely to be felt at sea and in ports. Companies with maritime, port, offshore or energy assets should expect more military activity near their sites and possible requests for information or coordination from authorities. Contingency plans should cover disruption to navigation and communications as a planning scenario, not a prediction. Review contracts and insurance terms for exclusions linked to military activity, confirm who in the organisation is the point of contact for government liaison, and make sure site security teams know how to report unidentified drones or vessels near critical infrastructure.

American data company tried to spy on oil storage tanks at Dutch ports with drones

NL Times reports that an American data company tried to spy on oil storage tanks at Dutch ports using drones. The headline does not say how the attempt was detected or what followed, and this is a single-outlet report. Even so, it points at a gap that many port and energy operators share. Commercial data firms can turn aerial imagery of storage tanks into market intelligence on inventory levels, which is valuable to traders and, in other hands, to hostile actors. Operators should check what drone detection and reporting they have around tank farms and terminals, and whether guards know the procedure for a drone sighting, including who calls police and how evidence is kept. Review the legal basis for restricting flights over sites, and whether signage and perimeter rules are clear. Look at contracts with data and imagery suppliers for what they may collect or resell. Finally, treat inventory data as commercially sensitive and decide who may see it, internally and externally.

Hundreds of Dutch sports clubs report cyberattack exposing members' personal data

NL Times reports that hundreds of Dutch sports clubs have reported a cyberattack that exposed members' personal data. The headline does not name the platform or supplier involved, and the type of data exposed is not stated. The number of clubs affected suggests a shared service provider rather than individual breaches. That pattern matters well beyond sport: any organisation that outsources membership, ticketing or event administration carries the same concentration risk. Members of the clubs, including children and parents, should expect phishing that uses real names and club details. Organisations should map which suppliers hold personal data on their behalf, check what the contract says about breach notification times, and confirm who inside the company files a report with the Dutch data protection authority within the 72-hour window. Warn staff who sit on club boards or volunteer with clubs to treat unexpected payment or login requests with suspicion. Prepare a short, factual message for affected people before one is needed.

Utrecht considers banning AI camera glasses in municipal buildings

NL Times reports that Utrecht is considering a ban on AI camera glasses in municipal buildings. The report describes a proposal under consideration, not a decision. The concern is easy to grasp: glasses that look ordinary can record video and audio and pass it to AI services without anyone in the room noticing. In a town hall that can mean residents' personal data, staff conversations and confidential files. Companies face the same issue in boardrooms, client meetings, secure areas and hotel lobbies. Organisations should decide now whether wearable cameras are allowed on site, then state the rule in visitor terms, meeting invitations and building signage. Train reception and guarding staff to recognise camera glasses and to handle the conversation politely and consistently. For the most sensitive meetings, combine the rule with technical checks of the room and a clear device-handling routine at the door. Keep the policy proportionate, so that it can actually be enforced.

Mission Support's TSCM team checks boardrooms and secure meeting spaces for covert recording devices, including wearables.