The CEO of Canada’s largest grocery retailer is apologizing to about two million shoppers for a data breach earlier this year where hackers accessed private information, including names, addresses, phone numbers, birthdates and purchase details. 

Brampton, Ont.-based Loblaw operates about 2,500 stores nationwide under its namesake Loblaws banner, as well as numerous sub-brands including No Frills, Real Canadian Superstore, Zehrs and Fortinos. 

In March, Loblaw announced that unauthorized activity took place “in certain Loblaw technology systems” around Feb. 23. In an email this week to impacted customers, the company says its internal investigation found an “unauthorized third party” accessed certain personal information.

“We know you trust us to protect your information, and we take that responsibility seriously,” Loblaw CEO Per Bank states in the email seen by CBC News. “We’re sorry for the concern this may cause, and are committed to supporting you and helping protect your information.”

As a precaution, Loblaw says customers were logged out of applications that use the company’s PCiD credentials. These include loyalty programs like PC Optimum, the PC Express online grocery service and the PC Financial portal. 

The company is offering two years of free credit monitoring and identity restoration services through TransUnion. Impacted shoppers have until Feb. 28, 2027 to enroll.

Loblaw is also advising those who receive the email to “be cautious” about unexpected emails, calls or texts asking for personal information or asking you to click a link or download an attachment.

“Keep an eye on your accounts and report any suspicious activity to the appropriate organization,” the CEO says in the email.

Understanding credit monitoring services

Consumers should know that credit monitoring services offer limited protection, warned Cat Coode, a Waterloo, Ont.-based privacy and data strategist.

“It only covers if someone is going to use your information in order to apply for a credit card or apply for certain government documents. It doesn’t cover the spectrum of the things that you could do with that data,” she told CBC News on Friday.

“The privacy issue can never be resolved … Once your data is available, it is available. … You can change your credit card number, but you can’t change your birthdate.”

More than a ‘slap on the wrist’?

All organizations in Canada have a legal…

The cyberattack on French supermarkets earlier this week that ultimately spoiled hundreds of fridges worth of food should be a wake-up call about the vulnerabilities of digitized systems and devices that are connected to the internet, cybersecurity experts say.

“The more we rely on connected technology, the more we need to keep in mind the crucial aspect that is their security and privacy,” said Montreal-based cybersecurity expert Steven Lachance.

The attack appeared to target centralized control systems that allow the temperature of fridges to be changed remotely. Hackers were able to access those controls and jack up fridge temperatures at hundreds of grocery stores — in some cases as high as 50 C — causing their contents to spoil, and potentially causing fires.

The Paris prosecutor’s office said Tuesday that its cybercrime unit was investigating the large-scale attack to determine the extent of the damage and pin down the hackers behind it. No group has claimed responsibility so far, nor was there a ransom demand, according to Reuters.

Here’s what you need to know about the supermarket cyberattack and what it shows about the vulnerability of our tech — from commercial systems to household devices.

What happened in France?

Toronto-based tech and cybersecurity analyst Ritesh Kotak says the fridges in stores are usually connected to the internet through a centralized panel that allows metrics like temperature to be monitored and adjusted remotely.

Dominique Schelcher, CEO of Coopérative U, one of the affected French grocery store chains, said on social media that its fridges are connected to the internet in this way in order to monitor temperatures around the clock “in the event of an anomaly.”

On Monday, France’s national cybersecurity agency, ANSSI, said it was aware of numerous refrigerator control panels being compromised. 

ANSSI said the remote monitoring systems targeted were made by a Dutch company called Danfoss. The cybersecurity agency later said similar systems made by Copeland and Dixell were also targeted.

Danfoss told news agencies on Monday that the affected units were running “outdated firmware,” or had “reached end of life and no longer receive software or security updates.”

Cybersecurity firm ​Claroty published a report in August detailing a vulnerability with Danfoss’s firmware that could allow hackers to bypass the standard login process and gain access in order to make changes remotely. Danfoss released a patch to fix the vulnerability shortly afterwards and urged users to install it.

“These vulnerabilities should be considered serious,” the company said in its security advisory at the time.

The exact mechanism used to hack the fridge controllers in France is still unknown, but…

A stolen Flock Safety license-plate camera yielded roughly 1.6 million images after hackers physically removed and reverse-engineered the device, but a former Secret Service cybercrime expert says the incident does not appear to have compromised Flock’s broader cloud network.

Jason Brown, director of customer advisory and counter-fraud lead at threat intelligence firm iCOUNTER, spent 25 years with the U.S. Secret Service and specialized in cybercrime.

Brown told FOX Business that the distinction between accessing one physically stolen camera and breaching Flock’s network is critical.

“The biggest thing I keep hammering at home [is] that Flock was never compromised,” Brown said. “So there’s never been a large dump of information out of their network.”

AUSTRALIAN PRIME MINISTER SAYS OPENAI AGENT ACCESSED GOVERNMENT HEALTH WEBSITE, RAISES ‘EXTREME CONCERN’

According to WIRED, hackers physically removed a Flock camera from above a roadway and reverse-engineered it. They reportedly discovered encrypted and unencrypted portions of the device’s storage and recovered an encryption key stored on the camera that allowed them to unlock additional data.

“This was a situation where somebody physically had access to a camera because they stole it off of a pole, took it home, and then did backward engineering on that camera,” Brown said.

“That did not give them the capability to actually log into the cloud portion of Flock, and nothing in the cloud of Flock proper was accessed.”

According to WIRED’s analysis, the recovered logs covered roughly 21 days of activity, including 1.6 million images, 50,200 vehicles and 27,000 short video clips.

Flock told FOX Business that “the unauthorized removal and tampering of a Flock camera is illegal.”

“Flock takes security seriously and maintains a public Vulnerability Disclosure Policy for security researchers to report potential vulnerabilities directly to us. We received no report through that process,” the company said.

Flock cameras capture images and short videos of passing vehicles, which are transmitted to the company’s cloud infrastructure for processing and can then be searched by authorized law enforcement users.

OPENAI, 100+ COMPANIES WARN OF COMING SURGE IN AI-POWERED CYBERATTACKS, CALL FOR GLOBAL DEFENSE PUSH

Brown characterized the stolen-camera incident and an earlier security issue…

Approximately $1.1 million of the nearly $388 million stolen from crypto exchange Bitget in last week’s cyberattack has been frozen, as the platform continues efforts to trace and recover the assets.

Frozen assets had not necessarily been returned to the exchange, CEO Gracy Chen told CNBC in an email interview. She did not disclose how much had been recovered.

Speaking on CNBC’s “Squawk Box Europe” on Wednesday, Chen said she was “not expecting to recover a lot of funds,” citing the limited recovery from previous cryptocurrency exchange hacks. However, “exchanges have a responsibility to demonstrate how they protect users, particularly when something goes wrong,” she said.

Bitget said user account balances were unaffected.

The exchange valued its protection fund at more than $464 million before the theft. It was drawn down to below $200 million following the hack, according to Bloomberg’s calculation of the fund’s disclosed wallet addresses, before being restored to more than $300 million. Chen said the replenished fund remained publicly verifiable on-chain and was separate from the reserves backing customer balances.

Bitget’s latest Proof of Reserves, based on a Sept. 29 snapshot, showed a self-reported overall reserve ratio of 131%, with all 19 covered assets backed above 100%.

“We restored the Fund using Bitget’s own capital,” Chen said. “The financial impact is being absorbed by Bitget rather than passed on to our users.”

Investigation reports released Sept. 30 by Mandiant, part of Google Cloud, and blockchain security firm SlowMist found that the attackers compromised two third-party security products before gaining access to Bitget’s production wallet systems.

SlowMist traced the earliest malicious activity in available logs to Aug. 31, when a previously unknown, or zero-day, vulnerability was exploited in one of the products.

The attackers were then able to obtain privileged internal access and bypass the normal customer-facing withdrawal process without stealing private keys, Mandiant reported.

“The method, I would say, is quite sophisticated,” Chen said on “Squawk Box Europe,” adding that the attackers deleted traces after transfers to hinder the investigation.

Neither report identified the affected security products. When asked, Chen declined to disclose further vendor or product details, citing the potential to introduce additional security risks by releasing information beyond the published findings.

The reports did not attribute the attacks to North Korea. Chen had previously said preliminary technical indicators were highly consistent with known North Korean hacking groups.

“We will have to wait further for further details on this,” she told CNBC.

Withdrawals for bitcoin, ether and USDT have resumed. Bitget has scheduled withdrawals for its remaining cryptocurrencies, along with fiat and peer-to-peer services, to resume on Friday.

AI agents tried to hack into a Canadian government website, an artificial intelligence research firm said Wednesday, casting the effort as a failed hacking attempt, while Canada said there were no indications its systems were compromised.

AI research firm Transluce said the attempts exhibited tactics “consistent with prior observed agent activity that we have attributed to OpenAI in a similar timeframe.” But it added it was not confidently attributing these attempts to OpenAI.

The agents attempted to access Library and Archives Canada on May 28 and June 9, Transluce said in a blog post. The company said it disclosed the action to the Canadian government on Monday.

The Canadian Centre for Cyber Security said Tuesday it was aware of reports of suspected AI agent activity. “There is no indication that government systems have been compromised at this time,” it said in a statement.

OpenAI also said it was “aware of reports of OpenAI models attempting to access publicly available information from Canadian government websites.” A spokesperson said OpenAI was reviewing the reported findings and had provided an initial briefing to Canadian officials conducting the government’s review.

When asked about the attempted hack, a spokesperson for Artificial Intelligence Minister Evan Solomon said protecting Canadians and safeguarding government systems is a top priority.

“At this time, there is no indication that Government of Canada systems were compromised. We are working closely with the Canadian Centre for Cyber Security as part of the ongoing assessment, and we will continue to be transparent with Canadians about this work,” the spokesperson wrote in an email to CBC News on Thursday.

Governments struggle to keep pace with AI advances

The ​world’s leading AI companies have warned ⁠of the risks posed by AI to ​humanity, appealing for governments to work together to ​manage the increasingly powerful technology. Governments around the world have struggled to keep pace with rapid advances in AI.

Free online service arquivo.pt, the national Portuguese web archive that is operated by the Portuguese Foundation for Science and Technology, captured 899 requests hitting the “collection-search” service of the Library and Archives Canada, including a series of…

Nvidia on Monday announced the release of software safety tools for artificial intelligence (AI) agents that it said would’ve stopped the hack of Hugging Face by rogue OpenAI agents.

The incident involving Hugging Face, which was acquired by Nvidia for $13 billion, involved OpenAI agents that broke containment from an internal test and the two companies ultimately worked together to defeat the attack.

Nvidia’s announcement comes as OpenAI and Anthropic, the two top AI labs in the U.S. that develop frontier models, are investigating numerous instances in which AI agents hacked into commercial and government systems.

Justin Boitano, vice president and general manager of enterprise computing at Nvidia, said at a media briefing, “From what we know, this new security platform could have stopped the breach if it was being used in frontier labs for model evaluation early on.”

TOP AI COMPANIES CALL FOR SAFETY MEASURES WHILE CRITICS WARN REGULATION COULD STIFLE INNOVATION

Nvidia’s OpenShell provides what the company described as an open-source secure runtime for executing autonomous AI agents in sandboxed environments with kernel-level isolation.

It said that “every agent should run in a zero-trust environment out of the box. They need isolation, monitoring, and behavior detection,” which the software can offer.

AI agents can drift from their intended task or operating constraints in response to a policy block, a bug or a missing tool, if instructions are ambiguous or agents are left to run for days or weeks to solve difficult problems, and they fail repeatedly, Nvidia said.

AI EXPERT WARNS ‘MACHINE-SPEED’ CYBERTHREATS MAY REQUIRE FASTER DEFENSES THAN HUMAN-LED RESPONSES

Each agent runs in a sandbox in OpenShell, which checks the limits and instructions provided by the operator before an agent runs and enforces them as it works.

Organizations can also get an additional, independent layer of security through Nvidia Sentry, which extends monitoring and enforcement into Nvidia’s BlueField hardware.

The security foundation is programmable with Nvidia DOCA and can be connected with OpenShell to help identify drift, investigate suspicious behavior and determine when intervention or deeper analysis is needed.

BANKS WARN AI SHOPPING AGENTS COULD INCREASE RISK OF SCAMS, FRAUD AND DATA PRIVACY BREACHES

Ticker	Security	Last	Change	Change %
NVDA	NVIDIA CORP.	228.86	+3.79	+1.68%

OpenShell and Sentry are part of the Nvidia Open Agent Safety Platform, which is being adopted by a range of companies in the tech…

Crypto exchange Bitget suspects North Korean hackers may be behind a security breach that affected about $351.6 million in digital assets, citing preliminary evidence from an ongoing investigation.

Bitget CEO Gracy Chen said investigators identified internet protocol addresses linked to VPN services previously used by a North Korean hacking group. The pattern of the attack also resembled earlier operations attributed to the country, she said in a livestream on X earlier today.

Chen said the specific intrusion method used to enter Bitget’s systems remain under technical investigation.

Bitget detected unauthorized transfers from some wallets Thursday afternoon stateside, involving 19 transfers from parts of its hot and warm wallet infrastructure, while cold wallets remained secure, according to Chen.

Affected assets included ether, XRP, USDT, USDC, Avalanche and BNB across the Ethereum, XRP Ledger, Avalanche, BNB Smart Chain and Arbitrum networks. Earlier on-chain estimates put the outflows at about $183 million, but Bitget said those analyses had not captured activity across all affected blockchains.

The exchange’s security team found that the attacker breached a critical backend wallet system, used it to spoof transfer information and triggered Bitget’s authorization-signing process. Chen said that the breach had been contained, preventing further unauthorized outflows.

“Private key compromise has been ruled out,” she said.

Withdrawals remain suspended while technical teams repair and reinforce the affected systems, though deposits and trading continue normally.

While Chen declined to commit to a firm timetable, she said withdrawals could return within hours or days, but “shouldn’t take weeks,” in a broadcast on X a few hours after the attack.

The company maintains that customer balances are accurate and that the loss is fully covered by its User Protection Fund, which holds more than $464 million.

Bybit CEO Ben Zhou said his team was standing by to assist Bitget, which supported Bybit following its $1.5 billion hack in February 2025. Bybit is updating its LazarusBounty platform to help trace the stolen funds, Zhou added.

An estimated $351.6 million in crypto has been moved from digital asset exchange Bitget’s hot wallets in a suspected hack. 

The platform’s CEO said in a Thursday statement that Bitget’s security team activated an emergency response when the movements were detected. Blockchain security firms had flagged the issue earlier in the day.  

“At 18:31 UTC on September 24, 2026, Bitget’s security systems detected unauthorized transfers from some of our hot wallets,” Bitget CEO Gracy Chen wrote on X. “Our security team activated emergency response protocols immediately.”

She added: “Bitget has navigated multiple market cycles. We will not run from this. Every dollar and every decision will be accounted for, transparently and in full.”

[SECURITY NOTICE] Bitget Hot Wallet Incident — September 24, 2026

At 18:31 UTC on September 24, 2026, Bitget’s security systems detected unauthorized transfers from some of our hot wallets. Our security team activated emergency response protocols immediately.

What we have…

— Gracy Chen @Bitget (@GracyBitget) September 24, 2026