PRIVACY RISK
Nikkei Data Breach Exposes Personal Information of Over 17,000 Employees via Compromised Slack Platform
Japanese publishing giant Nikkei confirmed a major data breach in September 2025 that potentially exposed personal information of 17,368 employees and business partners after hackers infiltrated its internal Slack messaging platform. Attackers gained unauthorized access by stealing login credentials from an employee's malware-infected personal computer. The compromised data potentially includes names, email addresses, and chat histories for individuals registered in the internal workspace.
Nikkei stated there was no leakage of information related to journalistic sources or reporting, and implemented security measures including mandated password resets. While the exposed data is not covered by Japan's Personal Information Protection Law, Nikkei voluntarily notified the country's Personal Information Protection Commission. This marks the third major cybersecurity incident for the group, following a May 2022 ransomware attack on its Singapore subsidiary and a September 2019 business email compromise attack on Nikkei America that resulted in a $29 million loss.
Andy Ward, senior vice-president for international at Absolute Security, stated: "When employees use non-enterprise-managed endpoints to access corporate resources, organizations lose visibility and control, creating a blind spot that attackers are quick to exploit."
Why This Matters: Organizations using collaboration platforms and supporting hybrid work may wish to review endpoint security policies for personal devices accessing corporate systems, particularly regarding visibility and control over unmanaged endpoints.
More info
PHYSICAL RISK
Multiple Explosions at Argentine Industrial Complex Injure 15, Disrupt Air Traffic
Powerful explosions rocked an industrial complex in Ezeiza, outside Buenos Aires, on Friday night, injuring at least 15 people who were taken to hospitals with minor to moderate burns and injuries from shattered glass caused by shock waves. Gaston Granados, mayor of Ezeiza, described the situation: "The explosions and fire breaking out in the different factories are huge. We are trying to control the fire and extinguish it but have not been able to so far."
Five factories caught fire, including a chemical plant where warehouses ignited and a plastics plant, though the cause of the explosions remains unknown. Smoke from the blaze reduced visibility in the area, forcing Argentina's Ministro Pistarini International Airport, the country's main international gateway located close to the explosion site, to delay or divert several flights. Over a dozen fire extinguishers and ambulances responded to the scene. Fabian Garcia, civil defense director for Buenos Aires province, stated: "It is a complex fire. It will be a long fire."
The provincial Ministry of Health reported that hospitals in the region were coordinating to receive the injured, while the Cuenca Alta Nestor Kirchner Hospital activated its contingency plan for catastrophic situations.
Why This Matters: Organizations with operations near industrial zones may wish to review emergency response protocols and business continuity plans. The incident demonstrates how industrial accidents can affect regional infrastructure including air traffic and healthcare systems.
More info
REPUTATIONAL RISK
Six Former Glencore Executives Face Bribery Charges Related to West Africa Operations
Four former Glencore Plc staffers, Martin Wakefield, David Perez, Paul Hopkirk, and Ramon Labiaga, pleaded not guilty on Monday at Southwark Crown Court to bribery charges brought by the UK's Serious Fraud Office. The four face charges of conspiracy to give corrupt payments related to winning business for the commodity trading firm in West Africa, while Perez and Wakefield also face one count of conspiracy to falsify invoices between 2007 and 2011. Andrew Gibson and Alexander Beard, the billionaire former head of oil at Glencore, are also charged in the case and will enter their pleas at a later date.
The charges relate to allegations the men conspired to win business for Glencore from state-owned companies in Cameroon, the Ivory Coast, and Nigeria between 2007 and 2014, including allegations of bribes paid to government officials and executives at state-run oil companies. A spokesperson for the SFO stated: "We continue to progress our bribery case against six former Glencore employees ahead of trial on 4 October 2027."
Glencore was fined £276 million in 2022 for paying corrupt payments in Africa, in addition to approximately $1.1 billion the company paid in related cases in the US and Brazil. Beard was among Glencore's longest-serving top executives before his departure in 2019 and became a billionaire in 2011 after Glencore's London Stock Exchange listing.
Why This Matters: Organizations in commodities trading and resource extraction sectors may face sustained scrutiny of historical business practices in emerging markets.
More info
TECHNOLOGICAL RISK
Russian Threat Actors Deploy 4,300 Fake Travel Sites in Mass Hospitality Phishing Campaign
A Russian-speaking threat group has registered 4,344 domain names since February 2025 as part of an ongoing mass phishing campaign targeting hotel guests and customers of hospitality booking platforms, according to Netcraft security researcher Andrew Brandt. Of the fraudulent domains, 685 contain the name "Booking," followed by 18 with "Expedia," 13 with "Agoda," and 12 with "Airbnb," indicating attempts to impersonate all major booking and rental platforms. The campaign employs a sophisticated phishing kit that customizes pages based on unique URL strings, using logos from brands including Airbnb and Booking.com across 43 supported languages.
The attack begins with phishing emails urging recipients to confirm bookings within 24 hours using a credit card. Victims who click are redirected to fake sites following consistent naming patterns featuring phrases like "confirmation," "booking," "guestcheck," "cardverify," or "reservation." The sites feature fake CAPTCHA checks mimicking Cloudflare and request deposit payments with full card details including expiration dates and CVV numbers. Once information is entered, a fake "support chat" window appears with steps for "3D Secure verification" while the page attempts to process a transaction in the background. The use of Russian in source code comments suggests either the actors' origin or an attempt to market the phishing kit to Russian-speaking customers.
Sekoia recently warned of a related large-scale phishing campaign targeting hospitality industry managers through ClickFix-style pages that harvest credentials and deploy malware like PureRAT, then approach hotel customers via WhatsApp or email with reservation details. Netcraft confirmed to The Hacker News "significant overlap" between these campaigns. Group-IB researchers noted that such phishing kits represent "fully automated, multi-stage platforms designed for efficiency and stealth," exemplifying the growing phishing-as-a-service market enabling actors with limited technical expertise to execute attacks at scale.
Why This Matters: Organizations in the hospitality sector may face increased credential theft and payment fraud risks from sophisticated phishing campaigns. The automated nature of these kits enables rapid deployment and replication, potentially requiring enhanced email filtering and customer verification protocols.
More info
HEALTH RISK
Cuba Battles Mosquito-Borne Illness Outbreak Affecting Nearly One-Third of Population
Cuban authorities are confronting a severe wave of mosquito-borne illnesses, with Francisco Duran, national director of epidemiology at the Cuban Ministry of Public Health, warning that nearly one-third of the population has been impacted and large numbers of workers have been sickened. On Thursday, fumigators deployed fogging machines in Havana's alleys and crowded buildings, among areas hardest hit by dengue and chikungunya viruses. Duran described the situation as "acute," stating: "We are working intensely, as we did with COVID-19," referring to ongoing research projects for medications and vaccines.
While dengue fever has long plagued Cuba, the situation has worsened as the government's capacity to fumigate, clean roadside rubbish, and repair leaky pipes has been hampered by an ongoing economic crisis. The once-rare chikungunya virus, causing severe headaches, rashes, and joint pain that can persist for months and lead to long-term disability, has spread rapidly in recent months. Chikungunya, transmitted primarily by Aedes mosquitoes that also carry dengue and Zika, has no specific treatment. Cuban health authorities are conducting clinical trials testing Jusviza, an injectable drug for controlling hyperinflammation, and evaluating rectal ozone therapy for post-acute joint pain.
According to the European Centre for Disease Prevention and Control, chikungunya outbreaks have infected almost 340,000 people globally in 2025, resulting in 145 deaths across at least 16 countries. In July, the World Health Organization issued an urgent call to prevent another epidemic. Cuba's healthcare system has deteriorated under a decades-long US economic embargo, with citizens routinely suffering severe shortages of food, fuel, and medicine, while the poorest often cannot afford insect repellent. Frequent power outages force residents to open windows and doors for ventilation, facilitating mosquito entry and disease spread.
Why This Matters: Organizations with operations or personnel in Cuba and the Caribbean region may wish to monitor mosquito-borne illness developments and consider enhanced health precautions. The infrastructure challenges and economic constraints affecting disease control could signal prolonged public health impacts across the region.
More info
LEGAL & REGULATORY RISK
European Commission Opens Antitrust Investigation into Red Bull's Alleged Market Restriction Practices
The European Commission announced it has opened a formal antitrust investigation to assess whether energy drink manufacturer Red Bull has illegally restricted competition in breach of EU rules prohibiting abuse of a dominant market position. The Commission has indications that Red Bull may have developed a European Economic Area-wide strategy to restrict competition from energy drinks larger than 250ml in the off-trade channel, sales points like supermarkets and petrol stations where drinks are purchased for consumption elsewhere. The alleged strategy reportedly targeted energy drinks sold by Red Bull's closest competitor.
The Commission is particularly concerned about practices in the Netherlands, where Red Bull appears to hold a dominant position in the national market for wholesale supply of branded energy drinks. Two suspected anticompetitive practices are under scrutiny: granting monetary and non-monetary incentives to off-trade customers to delist or disadvantage competing energy drinks exceeding 250ml, and misusing its position as category manager at off-trade customers to delist or disadvantage competing products. This marks the Commission's first formal investigation into potential abuse relating to misuse of a category management position by a supplier to limit competing products.
The Commission conducted unannounced inspections at Red Bull's Austria headquarters and several EEA subsidiaries in March 2023, with continued inspections at Commission premises in Brussels between June and September 2023. Red Bull challenged the inspection decision, but in October 2025, the General Court rejected the challenge, confirming the decision was well-founded with sufficient indicia and was neither arbitrary nor disproportionate. The opening of formal investigation does not prejudge its outcome, and there is no legal deadline for completing antitrust investigations.
Why This Matters: Organizations in consumer goods sectors may face increased regulatory scrutiny of category management arrangements and exclusive dealing practices.
More info
OPERATIONAL RISK
Starbucks Workers Launch Strike Across 40+ US Cities, Call for Customer Boycott During Holiday Season
More than 1,000 Starbucks workers commenced an unfair labor practice strike on Thursday across over 40 US cities, affecting approximately 65 stores initially, amid stalled negotiations over a first union contract. The strike launched on Starbucks' annual "red cup day", a major promotional event marking the start of the lucrative holiday season when customers receive reusable red cups with holiday drink purchases. Rallies were planned in major cities including New York, Philadelphia, Chicago, Columbus, and Anaheim, with organizers threatening to expand the action should executives refuse to negotiate and urging customers to avoid the chain under a "no contract, no coffee" campaign.
Starbucks Workers United announced last week that workers voted to authorize an open-ended unfair labor practice strike with 92% support, following months of demanding that management consider proposals to improve staffing and pay and resolve hundreds of unfair labor practice charges filed during the organizing campaign. Since the first Starbucks store unionized in 2021, more than 650 locations have followed despite vehement opposition from management. Contract negotiations broke down earlier this year after the union rejected Starbucks' economic offer. Jasmine Leli, a barista and strike captain from Buffalo, stated: "The baristas are prepared to do whatever it takes to get this finalized contract."
Starbucks spokesperson Jaci Anderson said the company was "disappointed" that Workers United voted to strike rather than continue bargaining, noting the union represents only about 4% of partners. Anderson emphasized that "our customers can be assured that our partners will be ready to serve them at the vast majority of our more than 10,000 company operated coffeehouses." The strike comes as Starbucks scrambles to reverse sluggish US sales, having announced in September plans to close over 100 North American cafes and lay off approximately 900 corporate staff.
Why This Matters: Organizations in retail and hospitality sectors may face operational disruptions during peak business periods if labor disputes escalate.
More info
STRATEGIC RISK
Canadian Competition Bureau Closes Algorithmic Pricing Investigation in Rental Housing Market
The Competition Bureau of Canada announced on November 10, 2025, that it has concluded its civil investigation into the use of algorithmic pricing software in Canada's rental housing market, finding that revenue management tools have not been used widely enough by landlords to substantially harm competition. The Bureau investigated revenue management tools from RealPage Canada, Inc. and Yardi Canada, Ltd., which became gradually more common after their introduction in Canada. However, since late 2024, following public concern and scrutiny, landlords across the country significantly reduced their use of these tools. Based on the Bureau's analysis, adoption levels did not meet anticompetitive thresholds required to determine a Competition Act violation.
While the Bureau did not find sufficient evidence to conclude an abuse of dominance or anticompetitive collaboration by RealPage or Yardi at this time, it expressed ongoing concerns about the potential impact of algorithmic pricing tools on competition in the multi-family rental housing market. To support compliance with the Act, the Bureau issued guidance for landlords, property managers, and software providers. The Bureau stated it will continue to monitor the rental housing market closely and take appropriate action if evidence of anticompetitive conduct emerges.
RealPage Canada is affiliated with RealPage, Inc., a Texas-based software company offering products including YieldStar, AI Revenue Management, and Lease Rent Options. Yardi Canada is affiliated with California-based Yardi Systems Inc., which offers Revenue IQ (previously RENTmaximizer). These revenue management software systems use algorithmic pricing models relying on data to provide pricing recommendations, with some versions pooling competitors' data to help landlords maximize rental property revenues. From June to August 2025, the Bureau invited market participants to provide input on algorithmic pricing and its competition impacts.
Why This Matters: Organizations using algorithmic pricing tools in competitive markets may face regulatory scrutiny even when investigations conclude without enforcement action.
More info
FINANCIAL RISK
US Corporate Bankruptcies on Track for 15-Year High with 655 Filings Through October
Large US corporate bankruptcies are on pace to reach their highest level in 15 years, with total filings reaching 655 through October 2025 compared to 687 for all of 2024, according to S&P Global data released on Thursday. October alone accounted for 68 filings, following 76 in August, the highest monthly count since at least 2020. The data underscores mounting stress across corporate America as businesses face rising input costs while lower-income consumers grapple with persistent inflation and a weakening labor market, though the full impact of President Donald Trump's shifting tariff policies remains uncertain.
The industrials sector leads insolvency claims with 98 filings this year, reflecting exposure to potential supply-chain disruptions from tariffs, followed by consumer discretionary companies with 80 bankruptcies. Recent high-profile failures include auto parts maker First Brands, which filed for bankruptcy protection in September after disclosing liabilities exceeding $10 billion, shocking debt investors with rapidly deteriorating finances. Subprime lender and dealership Tricolor also filed for Chapter 7 bankruptcy in September, causing JPMorgan Chase to charge off $170 million, a move CEO Jamie Dimon described as "not our finest moment."
The S&P report indicated that bankruptcy filings across the US have risen every year since 2022, when decades-high inflation forced the Federal Reserve to raise interest rates. The wave of credit concerns has placed the multi-trillion-dollar global credit market under scrutiny, with risks extending to several high-profile financial institutions including major Wall Street banks and regional lenders.
Why This Matters: Organizations with credit exposure to corporate borrowers may face heightened default risks as bankruptcy filings accelerate.
More info
POLITICAL RISK
Ukrainian Anti-Corruption Agency Launches 70 Raids on Energy Sector Officials Amid Infrastructure Crisis
Ukraine's National Anti-Corruption Bureau (NABU) and the Special Anti-Corruption Prosecutor's Office (SAP) conducted 70 raids on Monday across Ukraine as part of an investigation into top officials at state energy companies, including nuclear energy operator Energoatom. The 15-month investigation involving NABU's entire staff and 1,000 hours of wiretapping targeted alleged corruption schemes involving noted businesspeople and energy officials. According to NABU, the main goal of the suspected scheme was to obtain illegal benefits amounting to 10-15 percent of state contract values—potentially worth millions of euros—from Energoatom counterparts, including companies involved in building protective structures for energy infrastructure.
The raids occurred two days after Russia launched its largest attack yet against Ukraine's energy system, targeting nuclear plants and electric substations and devastating power operator Centrenergo's electricity-generating capacity. Lengthy blackouts continue throughout the country as authorities struggle to restore power, while Ukrainians question whether energy facilities were properly protected from Russian attacks. Ukrainian President Volodymyr Zelenskyy stated Monday night: "Any effective action against corruption is very necessary. The inevitability of punishment is necessary. Energoatom provides Ukraine with the largest share of energy generation now. Cleanliness in the company is a priority."
Some wiretappings dated from July 2025, the same month Ukraine's government and parliament attempted to strip NABU of its independence and bring it under political control, citing Russian influence on the bureau—a move later reversed following nationwide protests. NABU refused to reveal the names of main suspects. Energoatom declined to comment due to the ongoing investigation.
Why This Matters: Organizations operating in or with Ukraine's energy sector may face increased scrutiny and potential operational disruptions as corruption investigations proceed during ongoing infrastructure challenges.