The ballot box meets the bot.

State election officials question CISA’s commitment to election security. Stolen credentials force ConnectWise to suspend cloud services. Fake calendar invites steal Microsoft logins. Temu settles Texas privacy allegations. Toronto police arrest seven in a cryptocurrency kidnapping case. The G7 sounds the alarm on quantum threats. Monday business briefing. Ben Yelin, sits down with Kevin Tian, CEO and Co-Founder of Doppel, to share how AI is changing the threat landscape for sports organizations. MapQuest puts surveillance on the map.

Today is Monday October 19th 2026. I’m Dave Bittner. And this is your CyberWire Intel Briefing.

State election officials question CISA’s commitment to election security. 

According to ProPublica, political appointees at the Department of Homeland Security asked CISA to secretly acquire and hack a voting machine, then report its findings to the White House. Career employees resisted, concerned the results could be used to challenge election outcomes. The request was eventually dropped.

The revelation comes amid a dramatic retreat from CISA’s election security mission. Since President Trump returned to office, the agency has lost more than a thousand employees, roughly a third of its workforce, while cutting critical monitoring and support services.

State election officials say CISA was largely absent during preparations for November’s midterms. Meanwhile, the administration’s release of previously confidential election security information has damaged relationships built over years of cooperation.

CISA finally released an election security plan in late September, but state officials say it arrived too late to make much difference. Several now question whether they can trust the agency with sensitive information.

Meanwhile, the FBI and CISA released a joint warning that AI-generated phishing attacks could threaten November’s midterm elections. Election officials, candidates, and political organizations are attractive targets because of their access to sensitive voter and campaign information.

Attackers are using AI to produce convincing emails, text messages, and deepfake audio and video, eliminating traditional warning signs like poor grammar.

The agencies recommend phishing-resistant multifactor authentication, stronger email filtering, and independent verification of suspicious requests.

The alert describes an emerging threat rather than a specific ongoing attack.

ConnectWise suspends its Cloud Backup service following stolen credentials. 

ConnectWise has suspended its Cloud Backup service and taken two other cloud services offline after attackers stole credentials associated with seven application identities, potentially exposing customer Microsoft 365 environments.

The stolen credentials allowed attackers to impersonate trusted ConnectWise applications without needing customer passwords.

Security firm Huntress identified suspicious sign-ins across roughly a thousand Microsoft tenants, including approximately 300 successful authentications. Researchers also observed a targeted campaign against 16 organizations in sensitive sectors, though those attempts failed.

ConnectWise says it has disabled the compromised credentials and found no evidence that encrypted backup archives were accessed.

However, backups and restoration services remain unavailable. Huntress warns that attackers may have established persistent access inside affected tenants before the credentials were revoked, making additional investigation essential.

Calendar invites steal credentials. 

Cybercriminals are turning ordinary calendar invitations into credential-stealing traps. Researchers at Check Point identified more than 300,000 unique phishing emails targeting over 40,000 organizations, disguised as Microsoft Teams meetings and other workplace appointments.

The invitations contain links to counterfeit Microsoft login pages designed to capture usernames and passwords. Some include legitimate calendar attachments, making the invitations appear more convincing.

The campaign has accelerated dramatically, with Check Point recording more than 740,000 messages during the first two weeks of October alone.

Researchers emphasize that attackers aren’t exploiting vulnerabilities in Microsoft products. Instead, they’re exploiting employees’ familiarity with routine meeting requests.

Check Point recommends checking unexpected invitations carefully and using phishing-resistant authentication, such as passkeys or hardware security keys, to protect accounts against credential theft.

Temu settles with Texas over privacy allegations. 

Chinese online retailer Temu has agreed to pay Texas three million dollars to settle allegations that it improperly collected user data potentially accessible to the Chinese government.

The agreement requires Temu to store personal data on U.S. servers and restrict transfers to China. It also mandates independent product safety testing and stronger consumer protections.

Violations of certain data security provisions could trigger annual penalties of eight million dollars.

Temu denies wrongdoing. Several other states have filed similar lawsuits, making Texas the first to reach a settlement.

Toronto police make arrests in connection with the alleged kidnapping of a cryptocurrency exchange owner. 

Toronto police have arrested seven men in connection with the alleged kidnapping of a cryptocurrency exchange owner, including three active members of the Canadian Armed Forces.

Investigators say the victim was abducted at gunpoint in July, handcuffed, and assaulted as his captors attempted to access cryptocurrency holdings and business security systems. He was eventually released after being threatened not to contact police.

The investigation uncovered an extensive collection of weapons, including firearms with 3D-printed receivers, silencers, and more than 2,700 rounds of ammunition. Approximately 2,500 rounds were allegedly stolen from the Canadian military.

Police also seized substantial quantities of illicit drugs, GPS tracking devices, and other equipment.

The seven suspects face a combined 82 charges. The investigation remains ongoing.

The G7 urges post-quantum readiness. 

The G7 is urging governments and businesses to accelerate their transition to post-quantum cryptography, warning that quantum computing could eventually undermine widely used encryption systems.

In a call to action led by France’s national cybersecurity agency, the group argues that quantum threats should be treated as a near-term concern, even though the timeline for developing cryptographically capable quantum computers remains uncertain.

The recommendations include identifying critical systems, inventorying cryptographic assets, and developing phased migration plans. Organizations are encouraged to incorporate quantum-safe technologies into routine equipment upgrades to reduce costs.

The G7 also calls for national strategies, additional research, public-private partnerships, and updated cybersecurity requirements.

France plans to begin rejecting security products without quantum-safe encryption during certification reviews starting in 2027.

Monday business briefing. 

Investment in AI-driven cybersecurity continues to attract substantial funding, with eight companies announcing rounds totaling nearly $143 million.

San Francisco-based Harmonic Security leads the pack with a $50 million Series B, followed by Israeli startups Pluto Security, raising $42 million, and Rein Security, securing $25 million.

Other recipients include France’s Netsec and Fleuret AI, Tennessee-based Hilt, London’s CodeWall, and Utah’s Guardrail Technologies. The funding will support product development, hiring, and international expansion.

On the acquisition front, quantum computing company IonQ has agreed to purchase zero-trust security firm Elisity in an all-stock deal valued at up to $1.3 billion.

CrowdStrike is reportedly negotiating a $500 million acquisition of Israeli data loss prevention startup Orion Security.

Meanwhile, government contractor SAIC has acquired cryptographic software provider Information Security Corporation, and Singapore-based V-Key has announced a majority investment in AI security firm CloudsineAI.

 

MapQuest puts surveillance on the map. 

MapQuest, the venerable mapping service that once helped drivers navigate the world with printed directions and a healthy supply of printer ink, has found a new way to stay relevant.

Its latest mobile app update introduces a surveillance layer that shows users the locations and directions of known license plate readers and outdoor security cameras.

The feature covers equipment from Flock Safety, Motorola Solutions, Axon, Verkada, and several other surveillance vendors.

Flock alone reportedly operates at least 120,000 cameras across the United States, and independent projects have already been mapping their locations.

Now MapQuest is bringing that information directly into its navigation app, helping users identify surveillance infrastructure along their routes.

Apparently, the company that once helped you avoid getting lost can now help you see who’s watching you.

And that’s the CyberWire.

For links to all of today’s stories, check out our Daily Briefing at the cyberwire dot com.

 

We’d love to know what you think of this podcast. Your feedback ensures we deliver the insights that keep you a step ahead in the rapidly changing world of cybersecurity. If you like the show, please share a rating and review in your podcast app. Please also fill out the survey in the show notes or send an email to cyberwire@n2k.com

We’re proud that N2K CyberWire is part of the daily routine of the most influential leaders and operators in the public and private sector, from the Fortune 500 to many of the world’s preeminent intelligence and law enforcement agencies.

N2K helps cybersecurity professionals and organizations grow, learn, and stay ahead. We’re the nexus for discovering the people, tech, and ideas shaping the industry.  Learn how at n2k.com.

 

N2K’s lead producer is Liz Stokes. We’re mixed by  Tré Hester, with original music by and sound design Elliott Peltzman. Our contributing host is Maria Varmazis. Our executive producer is Jennifer Eiben. Peter Kilpe is our publisher. And I’m Dave Bittner. Thanks for listening.