This week's failures didn't stop at company boundaries: a backup vendor's app identities, one zone of one London region, one building-automation vendor's CRM. Meanwhile, the Council agreed how companies should report incidents, one at a time and through 27 national front doors. Six stories for people who build and run software in Europe.
A backup app's identities became a way into Microsoft 365 tenants
What happened On 21 October, Microsoft attributed the ConnectWise Cloud Backup compromise to Storm-0940, a China-linked group. On 15 October the attackers took over the identities of several ConnectWise cloud apps, authenticated to customer environments, and worked through Microsoft Graph: reconnaissance, new app credentials for persistence, changes to groups and privileged roles. Microsoft says the group used ARTEX, an open-source framework of LLM-driven pentest agents, and used it to attempt sign-ins to more than 2,250 tenants at up to 2,900 attempts per minute. ConnectWise shut its services down and began restoring them on 21 October. Microsoft has not said how many customers were compromised.
Take The AI agents will get the headlines, but the real lesson is about consent. No user had to sign in: the attackers used permissions customers had already granted. Every third-party service principal with Graph application permissions is a privileged account you don't manage, and MFA and conditional access never see it. This week, list them, remove write and role-management permissions that a backup tool doesn't need, and alert on new credentials added to existing apps. Those keep working after the original app is cleaned up.
Sources: CyberScoop · The Hacker News · TNW
One power event in one London zone, and UK banking wobbles
What happened On 20 October, a "power event" in zone europe-west2-b took down services in Google Cloud's London region from 06:08 UTC. At 14:03 UTC, Google said the issue was mitigated for most customers. Affected services included GKE, Cloud Run, App Engine and Filestore. Customers of Lloyds, HSBC, Barclays and Revolut reported problems, and Royal Mail, DPD, BT and Rightmove were also hit. Google has promised a full analysis.
Take One zone of three failed, and some of the UK's biggest consumer services failed with it. So either they weren't really multi-zone, or their dependencies weren't. London is Google's only UK region, so for anyone bound by data residency, regional failover means leaving the country. Make that decision on paper before the next incident, not during it. And test zone loss for real by draining a zone during working hours. A three-zone diagram proves nothing.
Sources: The Register · Central Banking · Google Cloud status
Loxone's breach hit the CRM, and the problem is on the installer side
What happened Austrian building-automation maker Loxone detected an attack on its internal systems on 18 October. It believes data was copied from its CRM and applicant system, including partner contacts and support requests. It says customer Miniservers, Remote Connect and the update infrastructure run separately and were unaffected, and that its codebase wasn't reached. Loxone rebuilt its build pipeline and CRM middleware, rotated secrets and added 2FA. It also checked whether installation credentials had been sent in plain text in support requests, and contacted the partners concerned. Production was back on 23 October.
Take Loxone's response looks textbook: fast, specific, and it rebuilt the pipeline instead of declaring it clean. The uncomfortable part is the support inbox. A ticket system stores whatever installers paste into it, and in building automation that often means admin passwords. Last week it was refrigeration controllers; this week it's smart-building installers. Shared admin accounts and credentials sent by email are how small installers work, and that is now a supply-chain risk. Individual accounts and time-limited service access should be the default, not post-breach advice.
Sources: Loxone incident page · Born's IT blog · heise
The Council's Omnibus mandate: 96 hours, a higher bar, and 27 front doors
What happened On 21 October, EU ambassadors agreed the Council's Digital Omnibus position, after a trade-secrets dispute blocked two earlier votes. The GDPR breach-notification deadline would rise from 72 to 96 hours, with a higher threshold for reporting. The Council kept the existing definition of personal data and rejected the Commission's plan to treat pseudonymised data as non-personal for some controllers. It replaced the proposed single EU entry point for incident reports with national entry points plus an EU information point. Cookie rules stay in the ePrivacy Directive, with six consent-exempt purposes. The Parliament committee vote is expected in early 2027.
Take Keeping the personal-data definition is the right call. A definition that depends on who holds the data would have turned every pipeline into a legal argument. Dropping the single entry point is a step back: a cross-border incident still means filing with several authorities, the very burden the Omnibus was meant to remove. Don't change your runbooks yet; current law applies until trilogues finish.
Sources: Agence Europe · NicFab · PPC Land
Germany's AI pact: public money, Nvidia hardware
What happened At the Invest in Germany Summit in Berlin on 19–20 October, two federal ministries signed a declaration of intent with Nvidia on "physical AI" for robotics and manufacturing. Euronews reports that the government funding, in the hundreds of millions of euros, will mainly buy compute in Deutsche Telekom's Industrial AI Cloud, which runs Nvidia Blackwell hardware. Nvidia also announced stakes in four German startups, part of a nearly $10B European commitment.
Take Buying compute from a German operator under German law is sensible. Calling it sovereign is a stretch when the chips, the software stack and some of the cap tables come from one US vendor. The test is what the money leaves behind. If it pays for GPU hours, Germany gets results and a bill. If it pays for shared models, datasets and tooling that Mittelstand firms can run anywhere, it builds capability.
The EU's growth fund leads a round, and German VCs put a number on the gap
What happened Paris-based Pigment raised $250M at a $2.3B valuation, led by the Scaleup Europe Fund, the EQT-managed vehicle targeting about €5B, roughly €1B of it from the EU budget. On 19 October, the German Venture and Growth Forum said less than a third of the €5.1B German startups raised in H1 2026 came from German investors. German institutions manage about €2.8 trillion but allocate roughly 0.1% to VC; 2% would add about €15B a year, the GVGF says.
Take A European fund leading, not just joining, a late-stage round is what this newsletter asked for in W39. But €5B in total is a third of what Germany alone says it misses every year. The real fix is pension allocation rules, and that debate keeps getting postponed.
Quick hits
- GitLab fixed a CVSS 10.0 unauthenticated RCE (CVE-2026-110264) affecting self-managed releases back to 7.0. No workaround: patch. The Hacker News
- Legora (Sweden) raised $550M at an $8.8B valuation, led by Boston-based Atreides; the US is now its largest market. Tech.eu
- Linux Foundation Europe told Open Source Summit Europe that sovereignty needs upstream contribution, not just consumption. Tech.eu
- Blackwall (Estonia) raised a $100M Series C at a $2.2B valuation. Tech.eu
The thing nobody's saying
This week's serious failures all happened in layers many companies share, and nobody reports at that level. A backup vendor's app identities gave attackers a route into customers' Microsoft 365 tenants with no interactive sign-in. One power event in one London zone disrupted several banks and national delivery services at once. One vendor's support tickets forced it to check partners worldwide for pasted credentials. The day Microsoft disclosed, the Council voted for national entry points, a higher threshold and four days to report. EU incident law counts victims one company at a time; incidents spread along dependencies. Until reporting maps dependencies, Europe will learn about its biggest risks from vendor blog posts.
To watch next week
AWS's write-up of the European Sovereign Cloud disconnection exercise scheduled for 24 October, and whether it says how IAM and DNS behaved. Google's full post-incident report on europe-west2. The Commission's DMA gatekeeper decision on AWS and Azure cloud, expected in November, and Parliament's CADA draft report, due 1 December.
Facts link to their sources. Takes are the author's opinion.