Retail Breaches, NetScaler Zero-Days, and the Password That Exposed Denmark

In today’s briefing, we examine three incidents that reveal a troubling pattern: security failures that require no sophisticated adversary, only the absence of basic controls. TFG London, owner of Hobbs and Whistles, confirms a cyberattack that’s part of a wider autumn assault on UK retail. Two zero-day vulnerabilities in Citrix NetScaler are being actively exploited right now, with webshells already deployed in production environments. In Denmark, a small IT firm’s use of the password ‘123456’ exposed personal data on 8.8 million people, nearly the entire population. We also cover internet-connected refrigeration system attacks in France and critical SAP vulnerabilities. The thread connecting these stories is not technical complexity but organisational failure to implement known protections. For UK SMBs, the lesson is clear: your risk often lives in the systems and suppliers you’re connected to, not just in your own infrastructure. This episode provides specific, actionable questions to ask your IT providers and MSPs today, because the gap between guidance and implementation remains dangerously wide.

Chapters

• Introduction Mauven introduces three incidents requiring no sophisticated adversary, only the absence of action: a UK retail breach, actively exploited zero-days, and a catastrophic password failure in Denmark.
• UK Retail Hit Again: TFG London Confirms Cyberattack TFG London, parent of Hobbs and Whistles, confirms a cyberattack with systems offline and orders delayed. The incident fits a pattern of autumn attacks on UK retail. Businesses sharing supply chains, logistics platforms, or IT connections with affected retailers should review access logs and understand their exposure through shared infrastructure.
• Call to Action A reminder to follow the show and share it with others who need daily threat intelligence.
• NetScaler Zero-Days: Active Exploitation, Right Now Two zero-day vulnerabilities in Citrix NetScaler ADC and Gateway are under active exploitation. CVE-2026-88771 allows unauthenticated remote code execution with webshells already deployed. CVE-2026-88772 is a DTLS memory overflow enabling similar attacks. UK SMBs should ask MSPs and IT providers in writing whether they run affected NetScaler products and confirm patching status, treating silence as confirmation of risk.
• ‘123456’: The Password That Exposed 8.8 Million People A small Danish IT firm with access to Denmark’s civil register was breached via weak passwords, including ‘123456’, exposing data on 8.8 million people. UK businesses must conduct due diligence on data processors, require MFA on privileged accounts, and update data processor agreements to specify minimum security standards as required under UK GDPR.
• Today’s Wider Context: Refrigeration, SAP, and What Physical Systems Tell Us Attackers compromised internet-connected refrigeration systems at hundreds of French supermarkets by exploiting outdated firmware. SAP published October security updates addressing 20 vulnerabilities, including a maximum-severity flaw in Cloud SDK for Python. UK businesses should review building management system security and confirm SAP patching with their ERP providers.
• Conclusion The consistent pattern across today’s incidents is not technical sophistication but the gap between knowing security best practices and implementing them. UK SMBs should review supplier connections, particularly those established years ago, and start by asking one supplier with data access about MFA enforcement on privileged accounts.

Links

• https://unit42.paloaltonetworks.com/netscaler-zero-day-vulnerabilities/
• https://www.ncsc.gov.uk/collection/s