Alex: Monday, October 19th, 2026. This is Cleartext. I'm Alex Chen.

Jordan: And I'm Jordan Reeves. So, the feds now believe that at least one executive at a ransomware negotiation firm was moonlighting as infrastructure support for ShinyHunters. The same ShinyHunters that just breached the FBI. Let that sink in for a second. The people you might hire to negotiate your way out of an extortion event may have been helping run the extortion operation. If that doesn't make you rethink your incident response vendor stack, I don't know what will.

Alex: Yeah, that's a gut punch of a story, and we're going to get deep into it. But Jordan, that's one of several heavy stories today. We've got DHS formally banning DeepSeek from federal civilian agencies, which has immediate implications for how every enterprise thinks about AI procurement. ConnectWise is dealing with a supply chain breach that's hit at least 300 organizations through a stolen API secret. Conduent just settled for 80 million dollars over a breach affecting 62 million people. Ahold Delhaize, one of the world's largest grocery retailers, confirmed a cyberattack that took systems offline across the U.S. and Europe. And we're going to talk about the structural decline in cybersecurity hiring, ransomware gangs now threatening employees' families, and why open-weight AI models are creating a security ownership gap nobody planned for. Let's get into it.

Jordan: Let's start with DeepSeek. DHS issued a formal order banning DeepSeek from all federal civilian agency systems. The cited concerns are specific: data transmission to servers in China, potential for malware delivery, and broad risk to federal IT infrastructure. This follows the playbook we saw with TikTok and Kaspersky, but it's notable because it's the first formal federal action against a Chinese-origin AI platform at this scale.

Alex: And the ripple effects here are what matter for our audience. If you're a CISO at a Fortune 500, this isn't just a government problem. Federal procurement bans have a gravitational pull on private sector governance. Your board is going to ask whether you have DeepSeek anywhere in your environment, and honestly, the harder question is whether it's embedded in any third-party tools or developer workflows you don't fully control. Shadow AI is the new shadow IT, and this order just made it a board-level question.

Jordan: Right. And the data routing concern is the substantive one. It's not hypothetical. DeepSeek's architecture, by design, transmits certain data to infrastructure in China. For any organization subject to ITAR, HIPAA, financial regulations, or frankly any data sovereignty requirement, that's a non-starter. The DHS order gives CISOs political cover to enforce what should have already been policy.

Alex: My advice: if you haven't already, run an AI inventory. Not just sanctioned tools. Everything. Developer environments, research teams, analytics platforms. Know where your data is going.

Jordan: Let's pivot to the ShinyHunters story, because this one is genuinely extraordinary. Brian Krebs is reporting that federal investigators have identified executives at two ransomware negotiation firms who maintained what they're calling "unusually close relations" with ShinyHunters. One executive in the U.S. allegedly helped operate a victim-pressure extortion website on behalf of the group.

Alex: This is a conflict of interest so profound it borders on criminal conspiracy. And it forces a very uncomfortable question for every CISO who's ever engaged a negotiation firm during an incident. Did the people you hired to de-escalate the situation have a financial interest in the threat persisting?

Jordan: The incentive structure has always been questionable. Negotiation firms get paid when there's a negotiation to conduct. But this goes way beyond misaligned incentives. This is alleged active participation in the extortion ecosystem. And the fact that ShinyHunters recently stole highly sensitive data from the FBI adds a national security dimension that's going to accelerate scrutiny.

Alex: Practically, CISOs need to treat incident response and negotiation vendors with the same rigor you'd apply to any critical third party. Background checks, conflict of interest disclosures, contractual representations about relationships with threat actors, and ideally, separation between the firm that does your forensics and the firm that negotiates. You don't want one entity controlling both the diagnosis and the remedy.

Jordan: Vet them like you'd vet a bank. Because that's essentially what they are during an incident.

Alex: Now let's connect this to another ransomware story. Semperis released their 2026 Ransomware Risk Report, and the headline finding is alarming. Thirty-seven percent of organizations that experienced a successful ransomware attack reported that threat actors threatened employees' family members or friends.

Jordan: This is the evolution we've been tracking. Ransomware operators have fully professionalized. They're running extortion like organized crime because that's what they are. Physical intimidation, targeting families, showing up at employees' homes in some cases. This isn't theoretical. It's happening at more than a third of victim organizations.

Alex: And this is where the CISO's mandate expands in ways that are genuinely uncomfortable. This is no longer just an IT problem or even a business continuity problem. It's a duty-of-care issue. It's an HR issue. It's a physical security issue. If your incident response plan doesn't account for the safety of employees and their families during a ransomware event, you have a gap that could expose the company to liability.

Jordan: Brief your general counsel. Brief your CHRO. Make sure your executive protection team, if you have one, is read in on the ransomware playbook. And honestly, this is a board conversation. Directors need to understand that the threat landscape now includes physical intimidation of their workforce.

Alex: Let's move to the breaches. ConnectWise suspended its Cloud Backup, SaaS Security, and Cloud Management services after attackers used a stolen API secret to access Microsoft 365 environments across at least 300 client organizations.

Jordan: This is a textbook supply chain compromise. ConnectWise is deeply embedded in the MSP ecosystem. Thousands of managed service providers use it, and those MSPs serve tens of thousands of end clients. So 300 confirmed organizations is likely the floor, not the ceiling.

Alex: The mechanism matters here. A single stolen API secret gave attackers a skeleton key to M365 tenants. This is the aggregation risk that we keep warning about with SaaS-to-SaaS integrations. You grant an OAuth token or API credential to a third-party backup provider, and you're trusting that provider's security posture with your entire email and document environment. When they get popped, you get popped.

Jordan: If you're a ConnectWise Cloud Backup customer, obviously follow their guidance. But the broader lesson is: audit your API integrations. Understand what secrets and tokens exist between your M365 tenant and third-party services. Apply least-privilege principles. And have a revocation plan you can execute in hours, not days.

Alex: Meanwhile, Conduent reached a preliminary 80 million dollar class action settlement for their 2024 breach. 62.2 million individuals affected. It was the largest health data breach reported in 2025. Conduent is a back-office services firm. They handle benefits administration, payment processing, HR services for government agencies and large enterprises.

Jordan: The dollar figure is instructive for any CISO trying to quantify third-party risk for the board. Eighty million dollars. And that's just the class action settlement. It doesn't include incident response costs, regulatory fines, or reputational damage. When your vendor handles health data for 62 million people and gets breached, the liability flows uphill.

Alex: This is why vendor risk management can't be a checkbox exercise. If a back-office vendor has access to your most sensitive data, they need to be assessed and monitored with the same rigor as your crown jewels. Contractual indemnification isn't enough if the settlement exceeds their insurance coverage.

Jordan: And then there's Ahold Delhaize. One of the world's largest grocery retailers. They confirmed Monday that a cyberattack forced system takedowns across most of their U.S. and European brands. Stop & Shop, Giant, Food Lion, Hannaford in the U.S. Albert Heijn in Europe. Shoppers on both continents impacted simultaneously.

Alex: The simultaneous impact across multiple brands is the tell. It strongly suggests shared infrastructure was compromised. This is the consolidation trade-off. You centralize IT to reduce cost and complexity, but you also centralize your blast radius. One compromise takes down everything.

Jordan: For CISOs in retail, manufacturing, or any sector with OT and supply chain dependencies, this is the scenario to plan for. Not a single brand going down, but your entire portfolio of operations going offline at once. Your business continuity plan needs to account for that scale.

Alex: Let's hit two more stories quickly. Pegasus spyware was found on devices of prominent Serbian critics, including a university rector and a prosecutor, weeks before parliamentary elections. Jordan, this is your wheelhouse.

Jordan: It's depressingly familiar. Commercial spyware continues to be deployed against civil society, political opposition, and institutional figures. What's notable here is the targeting of a prosecutor linked to investigations involving U.S. political figures, which adds a geopolitical wrinkle. For CISOs, the takeaway is that mobile threat defense isn't optional for executives, board members, or anyone in your organization who might be a target of interest. And if you operate in politically sensitive markets, your threat model needs to include state-sponsored surveillance.

Alex: And finally, two stories that connect. U.S. cybersecurity job postings fell 26 percent in 2026, hitting a four-year low, with CISO and Director roles seeing particularly steep declines. At the same time, Microsoft and NVIDIA jointly published a paper warning that enterprises running open-weight AI models need to supply their own safety and security controls, controls that cloud AI providers would normally handle.

Jordan: So we're cutting security headcount while simultaneously taking on new security responsibilities that didn't exist two years ago. That math doesn't work.

Alex: It doesn't. The job posting decline likely reflects consolidation of security leadership roles and some AI-driven automation of operational tasks. But the open-weight AI paper highlights a real and growing gap. When you download and self-host an open-weight model, you inherit the entire security and safety stack. Content filtering, prompt injection defense, model integrity, access controls, all of it. The provider isn't doing it for you.

Jordan: Most organizations deploying open-weight models haven't budgeted for that security overhead. They see the cost savings of self-hosting versus API fees and miss the hidden security tax.

Alex: CISOs need to be in the room when AI deployment decisions are made. Not after the fact. Before the model is downloaded. Before the infrastructure is provisioned. You need to understand what controls are required and who owns them.

Jordan: Looking at the week ahead, Alex, the through-line across every story today is trust and the cost of misplacing it. Trust in your AI vendors, trust in your negotiation firms, trust in your backup providers, trust in your back-office processors. The organizations getting burned are the ones who extended trust without verification.

Alex: Agreed. And I'd add that the scope of what CISOs are responsible for keeps expanding. Physical safety of employees. AI governance. Geopolitical risk. Vendor integrity. The role is becoming genuinely executive in the fullest sense of the word. If your board still thinks the CISO is just the firewall person, these stories are your briefing material.

Jordan: Busy week ahead. Stay sharp.

Alex: That's Cleartext for Monday, October 19th. Show notes and links to every story we covered are at cleartext.fm. We'll see you tomorrow.