Business Technology News Roundup: Oct 10, 2025

Ransomware continued its relentless ascent according to Hornetsecurity’s October Threat Report, which reveals that 24% of organizations experienced at least one attack in 2025, marking a notable increase from the previous year. This rise in incidents has spurred a corresponding evolution in defenses, with only 13% of victims succumbing to ransom demands—a shift attributed to improved backup resilience and more comprehensive cyber insurance. Threat analyst Lars Nielsen observes that cybercriminals have intensified double-extortion tactics, pushing average business downtime to over eight days, compelling organizations to conduct regular backup integrity checks, ransomware response simulations, and thorough insurance policy reviews in anticipation of increasingly complex threats.

Italy’s digital transformation gained significant momentum as its new AI law (Law No. 132/2025) came into force, positioning the country as a European leader in artificial intelligence regulation. The legislation mandates that organizations operating high-risk AI in sectors like healthcare or public administration undergo extensive risk assessments, transparency reviews, and sectoral audits, with AgID and the National Cybersecurity Agency appointed to oversee compliance and safety. This proactive legal framework, praised by experts like Dr. Elena Ferrari from the University of Bologna, cements Italy’s role in shaping ethical AI deployment and places March 2026 as the deadline for formal system notifications, with hefty fines awaiting defaulters.

A major cybercrime operation targeting Oracle E-Business Suite spotlighted the severity of zero-day vulnerabilities as the CL0P ransomware group and their affiliates exploited CVE-2025-61882—an attack chain rated at a CVSS score of 9.8—against a slew of global organizations. According to findings from Google’s Threat Intelligence Group and Mandiant, campaign reconnaissance began as early as July, with attackers combining numerous exploits to extract sensitive data before encrypting it for ransom. Threat analyst John Hultquist notes that such sophisticated campaigns are becoming routine for advanced cybercrime groups, prompting urgent calls for the installation of Oracle’s emergency patches, privileged account audits, and the deployment of proactive intrusion detection.

The fallout from the Qantas data leak has placed supply-chain vulnerabilities and SaaS security failures in the global spotlight this week. A coalition of notorious ransomware actors, including Scattered Spider and Lapsus$, publicized sensitive information from 5.7 million Qantas frequent flyer accounts after efforts to extort payment failed. The compromised database, sourced from a Salesforce-hosted CRM, exposed customer names, contact data, birth dates, and points balances—an incident emblematic of a broader surge in supply-chain attacks that netted over a billion records across dozens of affected organizations. Cyber risk specialist Maria Chen draws attention to the escalating risk posed by third-party platforms, urging immediate customer notification, increased identity protection, and stricter vetting of integrated apps to curb rising exposure.

SonicWall’s recent confirmation of a breach in its cloud firewall backup service sent ripples through the enterprise security community, as attackers reportedly gained access to critical configuration data belonging to thousands of global users. With metadata serving as a digital roadmap through protected networks, experts such as Alex Rodriguez of CyberGuard Consulting emphasize that the incident starkly highlights the urgent need for organizations to adopt zero-trust architectures and reinforce endpoint segmentation. The breach’s scale—impacting more than 200,000 enterprise devices—serves as a clarion call for businesses to rotate backup credentials, activate multi-factor authentication, and rigorously review system logs for any unauthorized API activity, underscoring a pivotal moment for cloud security strategy in 2025.