Hackers Cook Supermarket Freezers Across Europe for a Second Time, Google Pulls the Plug on 1.3 Million Hijacked TV Boxes, and Anthropic's Growth Cools in Its IPO Filing

By Noah Smith, Owner & Consultant, KeyChange Technologies · November 3, 2026

Here is your AI and IT news for Tuesday, November 3, 2026: a second wave of hackers cranked up the heat inside supermarket freezers across Europe, Google shut down a botnet hiding in 1.3 million cheap TV boxes, and Anthropic's updated IPO filing shows its blistering growth starting to cool. If you only have a minute, the list below is the whole day at a glance. (Missed yesterday? Catch up with the November 2 recap.)

📌 The AI and IT news at a glance

• 🔝 Hackers spoil food in supermarket freezers across at least nine European countries, three weeks after hitting hundreds of French stores the same way.
• 📈 Anthropic's revised IPO filing shows $17 billion in quarterly revenue, but growth slowed sharply and costs jumped.
• 🏦 Goldman Sachs pulls Claude Code and GitHub Copilot from its bankers and traders, keeping them for engineers only.
• 💸 Latin America's biggest crypto platform freezes withdrawals after a cyberattack and roughly $46 million in outflows.
• 📺 Google takes down a botnet built into 1.3 million TV boxes and bans the manufacturer it says sold the access.
• 📱 Apple warns iPhone users in 99 countries that they may have been targeted by mercenary spyware.
• 🚨 Hackers hijack emergency alert apps in Ukraine and Russia to push fake nuclear and chemical warnings.
• 🎓 A ransomware gang claims 1.3 million Michigan State student records, a claim the university has not confirmed.
• 🌐 Squarespace lays off 19% of its staff as AI "vibe-coding" tools upend website building.

🔝 Top story

Hackers spoil food in supermarket freezers across Europe for the second time in a month

Overnight into Monday, November 2, someone remotely changed the settings on refrigeration systems in supermarkets and small shops across Europe, flipping freezers into defrost mode or setting them to heat up. Stores in Belgium, Luxembourg, Sweden, Ireland, Estonia, the Netherlands, Finland, Portugal, and Italy were affected. In Belgium alone, more than 50 stores were identified, including several dozen Delhaize locations and about 15 Carrefour stores. Ireland's Musgrave pulled chilled and frozen food from 13 SuperValu stores as a precaution. One Swedish store found its freezers set to 50°C (122°F), and a Belgian butcher estimated about €15,000 of meat was ruined.

This is the second wave. About three weeks earlier, attackers hit hundreds of French supermarkets the same way, through internet-exposed remote controllers for refrigeration gear. Danfoss, a major refrigeration-controls maker, said its products were involved again, and that the Dutch systems it looked at sat on unsecured networks and still used default passwords. Much of the hardware involved is older equipment that no longer receives security updates. No group has claimed the attacks, and Belgian prosecutors have opened a criminal investigation.

In short: Attackers remotely heated up supermarket fridges and freezers in at least nine European countries, forcing stores to throw out or pull food.

What it means for your business: Any building system that can be reached from the internet, from fridges and HVAC to cameras and door controllers, is part of your attack surface. If a vendor installed it and set it up for remote access, you need to know how it is connected and what password it uses.

My take: This is the clearest example I have seen of a cyberattack that costs real money without touching a single computer most people think of as "IT." The fix is boring and cheap: get these controllers off the open internet, put them behind a VPN, and change the factory passwords. If you run a restaurant, a clinic, or anything with refrigeration, ask your equipment vendor this week exactly how they connect to your system remotely. If they cannot answer clearly, that is your answer.

Source: The Hacker News

🤖 AI

Anthropic's revised IPO filing shows $17 billion in quarterly revenue, and a slowdown

Anthropic filed an amended S-1 on Monday ahead of its planned public listing, and the numbers are enormous in both directions. Revenue for the quarter ended September 30 was $17 billion, up from $11.6 billion the quarter before and $1.4 billion a year earlier. But quarter-over-quarter growth slowed to about 47%, down from about 144% in the second quarter. Operating expenses jumped to $17.5 billion, turning a $974 million operating profit in Q2 into a $567 million operating loss in Q3. The headline net loss was $23.3 billion, mostly an accounting charge tied to the rising value of its convertible notes.

Two other figures stand out. Anthropic says price cuts and contractual discounts reduced revenue by about $600 million from Q2 to Q3, and it has roughly $895.4 billion in committed spending, mostly for compute and infrastructure. It reported $146.6 billion in cash, short-term investments, and available credit as of September 30.

In short: Anthropic's updated IPO filing shows $17 billion in Q3 revenue, slowing growth, rising costs, and nearly $900 billion in spending commitments.

What it means for your business: The companies behind the AI tools you use are spending at a scale that depends on continued growth. Price cuts are already showing up in their numbers, which is good for buyers today, but it is a reminder not to build your whole operation around one vendor's current pricing.

My take: The $600 million in price cuts is the line I would pay attention to as a customer. The big AI labs are competing hard on price right now, and that tends to benefit small businesses. Lock in what is working, but keep your prompts, data, and workflows portable enough that you could switch providers in a week if you had to.

Source: Fortune via Yahoo Finance

Goldman Sachs pulls Claude Code and GitHub Copilot from its bankers and traders

Goldman Sachs has cut off most of its non-technical staff from advanced AI coding tools, including Anthropic's Claude Code and Microsoft's GitHub Copilot, Bloomberg reported Monday. Access is now limited to engineers, plus the bank's "strats" group, which mixes software engineering with quantitative work. Traders and bankers had been using the tools for months to monitor trading flows and build content, and the change was based on internal guidance updated in October.

A Goldman spokesperson cited "a variety of factors including productivity and risk management," and said the tools are going to the people "best suited to leverage them for the long term." The move is a reversal in tone: as recently as July, Goldman's CIO had praised non-technical staff "vibe coding" their own prototypes.

In short: Goldman restricted Claude Code and GitHub Copilot to its engineers, removing access for bankers and traders.

What it means for your business: Even the most AI-forward companies are deciding who should and should not have powerful tools that can write and run code. If your staff are building their own automations with AI, someone should know what they built and what it can touch.

My take: This is not Goldman giving up on AI; it is Goldman getting organized about it. Letting everyone experiment is a fine first phase, but tools that can write code and reach company data need an owner. For a small business, that does not mean a ban. It means a short list of approved tools, a rule that anything touching customer data or money gets a second set of eyes, and someone who knows what is running.

Source: The Decoder

🛡️ IT and security

Latin America's biggest crypto platform freezes withdrawals after a cyberattack

Brazil's Mercado Bitcoin suspended all deposits and withdrawals Monday after what it confirmed was a cyberattack. Blockchain security firms reported more than $46 million leaving the platform late Sunday night, a figure the company has not confirmed. Mercado Bitcoin says it has about 4.5 million customers and calls itself the largest digital-assets investment platform in Latin America.

The company said the attack did not harm customers or expose their data, and it is working with authorities to track the stolen funds. Several blockchain security experts disputed that, pointing to on-chain evidence that some customer wallets were drained. Tether said it froze about $4.5 million, and other platforms froze about $2 million more. The attack comes days after the record Binance theft that the FBI has tied to North Korean hackers.

In short: Mercado Bitcoin halted deposits and withdrawals after a cyberattack, with about $46 million reportedly flowing out.

What it means for your business: If you hold crypto or accept it as payment, an exchange freeze can lock up your money with no warning. Treat exchanges as a place to trade, not a place to store anything you cannot afford to have frozen.

My take: Two huge crypto exchange hits in one week tells you attackers are concentrating on where the money is easiest to move. The company's "no customer harm" line is already being contested by people reading the blockchain, which is why I would wait for an independent accounting before believing either side's numbers.

Source: The Record

Google takes down a botnet built into 1.3 million TV boxes and bans the maker

Google says it has disrupted "x.cpe," a botnet that was built into more than 1.3 million Android devices, mostly cheap TV set-top boxes. Google says it is "highly confident" that Shenzhen-based manufacturer Videostrong intentionally shipped the backdoor and sold access to criminals. Those criminals used the boxes to silently install apps, capture screens, map home and office networks, steal account details, run ad fraud, and rent out the boxes' internet connections as proxies. The backdoor also turned up in telehealth devices, karaoke machines, and digital signage.

Google used legal action, with help from Japan's National Police Agency and several security firms, to take down the botnet's servers and domains. It also banned Videostrong and any future affiliates from making certified Android devices. Researchers say the backdoor lives in the firmware, cannot be removed by owners, and reinstalls itself on restart. The U.S., U.K., Germany, Australia, and Canada each had roughly 26,000 to 42,000 infected devices.

In short: Google dismantled a botnet preinstalled on 1.3 million Android TV boxes and banned the manufacturer it blames.

What it means for your business: That bargain streaming box running the TV in your waiting room or the menu board in your shop could be someone else's foothold on your network. Off-brand smart devices should never share a network with your business computers.

My take: You cannot patch your way out of a backdoor the factory put there. The practical move is to put every TV, sign, speaker, and gadget on a separate guest or IoT network, and to throw away no-name Android boxes rather than trying to clean them. Spending $50 more on a mainstream streaming device is cheap insurance.

Source: The Hacker News

Apple warns iPhone users in 99 countries they may have been targeted by spyware

Apple sent a new round of threat notifications to people it believes were targeted by "mercenary spyware," according to a screenshot of the notice shared by security researcher Costin Raiu. The notice listed 99 countries. As usual, Apple did not name the spyware or say who was behind it, citing the "extreme cost, sophistication, and worldwide nature" of these attacks. Apple has not publicized this round on its website.

Recipients who spoke publicly include journalists and a documentary filmmaker. Citizen Lab's John Scott-Railton said Apple made these notifications more visible in August to push people to act on them, and that the change appears to be working.

In short: Apple notified users in 99 countries that they may have been targeted by mercenary spyware.

What it means for your business: These attacks mostly target journalists, activists, and officials, but executives with access to sensitive deals can be targets too. Anyone in your company who gets one of these notices should treat it as real and get help.

My take: Most business owners will never get one of these, and that is fine. But if you or a key executive does, do not shrug it off: Apple only sends them when it has real reason to. Turn on Lockdown Mode, update the phone, and talk to a security professional before using that device for anything sensitive.

Source: The Record

Hackers hijack emergency alert apps in Ukraine and Russia to push fake nuclear warnings

Late Sunday, residents of Kyiv got push notifications on Air Alert, a widely used Ukrainian warning app with about 6.6 million active users, warning of a radiation hazard, a chemical threat, and street fighting. Ukraine's Air Force said the app had "likely been compromised by the enemy" and told people to ignore the messages. The app's developers confirmed unauthorized interference, switched off push notifications, and began restoring service Monday. A group called Hitcore Corp claimed the attack.

On the other side, Russia's Emergency Situations Ministry acknowledged that its own mobile app was hacked. A group calling itself DC8044 claimed it used the app's API to send warnings that nuclear warheads had been launched toward Russia and told residents to shelter in basements. Both governments said their official national warning systems were not affected.

In short: Hackers on both sides of the war took over emergency alert apps and sent fake warnings about nuclear and chemical attacks.

What it means for your business: Whoever controls your notification channel controls what your customers believe. If your app, email list, or SMS service can send a message to every customer at once, it needs the strongest protection you have.

My take: We worry a lot about data being stolen, but a hijacked "send to everyone" button can do damage faster. Check who has access to your mass email, text, and push-notification tools, make sure each account has multi-factor sign-in, and have a plan for how you would tell customers "that message was not from us."

Source: The Record

A ransomware gang claims 1.3 million Michigan State student records

The BYOD ransomware gang added Michigan State University to its leak site Sunday evening, claiming it stole personal information on 1.3 million current and former students. That figure is the gang's claim and has not been verified. MSU says it spotted suspicious activity in early October and forced everyone with a university login to reset their password to at least 15 characters. The university says the activity looked like a credential compromise, and that it has no evidence other data was accessed or stolen.

BYOD is the same group behind last week's attack on the University of New Mexico that shut down its hospital and diverted ambulances. MSU officials tied the gang's claims to the October incident but did not answer questions about the specific data the hackers say they took.

In short: A ransomware gang claims it stole 1.3 million Michigan State student records; MSU confirms an October incident but not the data theft.

What it means for your business: Many breaches start with one stolen password. Long passwords, multi-factor sign-in, and a fast forced reset when something looks off are still the controls that matter most.

My take: Gangs exaggerate on their leak sites because it pressures victims to pay, so I would not take the 1.3 million number at face value yet. What MSU did right is worth copying: it acted quickly on a suspected login compromise and forced a reset across the board. If you have never practiced resetting every password in your company at once, now is a good time to figure out how.

Source: The Record

🧰 Tools for builders and business AI

Squarespace lays off 19% of its staff as AI site builders reshape the market

Squarespace is cutting about 19% of its global workforce, roughly 300 employees, TechCrunch reported Monday, and the company confirmed the cuts. A spokesperson described them as a restructuring "intended to simplify how we operate, sharpen our priorities" so the company can move faster. The backdrop is AI "vibe-coding" site builders, which generate working site designs from a plain-English prompt and have shaken up the website business. Lovable raised $400 million in August at a $13.3 billion valuation, and Wix bought Base44 in 2025.

Squarespace launched an AI tool called Blueprint in 2024 and has announced Forma, an upcoming AI-native platform with a waitlist. The company went private in a $7 billion deal in 2024.

In short: Squarespace is laying off about 300 people, or 19% of staff, as AI tools transform how websites get built.

What it means for your business: If your site runs on Squarespace, nothing changes today, but the platform is clearly in transition. Make sure you own your domain and can export your content, whichever builder you use.

My take: The website builders are getting squeezed by AI tools that can produce a decent site in minutes, and that is mostly good news for small businesses on cost. The risk is lock-in: keep your domain registered in your own name, keep a copy of your text and images, and do not let any one platform become the only place your business exists online.

Source: TechCrunch