Cyber insurance: the events of the week from 7 to 14 November 2026

Five cyber events from the week of 7 to 14 November 2026, from Expedia hit through a supplier's data platform to Maersk, the Brenner Base Tunnel, Nitori and Vanderbilt University, linked by peripheral, inherited or outsourced systems. With the insurance impact and the questions to bring to renewals.

Week of 7 to 14 November 2026

The week of 7 to 14 November 2026 has a common thread: the weak point is where the company looks least. A large online travel group is reached through a supplier's data platform, while a criminal group claims almost a billion stolen records. A logistics giant discovers an intrusion into a system inherited through an acquisition. The company building the Brenner Base Tunnel confirms the theft of data from a server used to exchange files with outside parties. In Japan a large furniture retailer estimates up to 37.6 million records exposed, and in the United States a university asks everyone to switch off their computers. For underwriters of cyber risk, the question is not only how the insured's main system is protected, but which secondary, inherited or outsourced systems remain connected to its data.

In brief

Expedia Group: on 12 November the group confirms access to its systems through a compromised data platform provider; the n0n group claims more than 830 million loyalty programme records, figures not confirmed.
Maersk: on 11 November the group confirms data theft from a legacy system inherited through an acquisition; no impact on operations reported.
Brenner Base Tunnel: on 7 November BBT SE confirms a mid-October attack on data accessible from the internet; the Everest group claims 812 GB and demands a ransom, which the company refuses.
Nitori: on 10 November the Japanese furniture retailer reports up to 37.62 million personal records potentially stolen.
Vanderbilt University: on 9 November the university announces an attack and asks everyone to switch off all devices; the BYOD group lists it on its site.

The attacks of the week

1. Expedia Group: the data platform supplier

On Thursday 12 November 2026 Expedia Group confirmed that attackers reached its systems through a compromised data platform provider, in a supply chain attack that also hit other companies. The group says it contained the incident, is investigating with outside experts and that its platforms remain safe; it has named neither the supplier nor the extent of the data involved. Researchers at Wiz and Sentra documented an attack between 14 and 26 October involving Qubole, a cloud data platform that was once an Expedia supplier; Expedia has not confirmed the link (Skift).

The extortion group n0n, which appeared in mid-September 2026 and focuses on data theft rather than encryption, claims to have stolen more than 830 million records from 35 loyalty programmes, 58 million traveller profiles, more than 333 million account and credential records and about 2.5 million card spending records linked to hashed email addresses. According to Security Affairs, Wiz and Sentra say the attackers used a stolen Qubole supplier key to access Expedia's big data platform. Expedia has not confirmed n0n's figures (Security Affairs).

2. Maersk: the system inherited through an acquisition

On 11 November 2026 Maersk reported an IT security incident in «a legacy system inherited through a previous acquisition». The attackers gained unauthorised access and extracted data; according to initial checks no sensitive information was disclosed. Maersk says the incident appears limited to that system, with no sign of compromise of its other infrastructure or of customer and partner systems connected through APIs and EDI, and has reported no disruption to logistics operations (IT Nerd).

The WhiteArmour group listed Maersk on its site, claiming to hold more than 16,000 driver passwords stored in plain text and demanding 5 million dollars in bitcoin; Maersk has not confirmed the link. Cybernews researchers connect the incident to LF Logistics, a logistics company Maersk acquired in 2022 (Cybernews). For a group hit by NotPetya in 2017, the case confirms that acquisitions bring systems, credentials and connections that need to be re-examined.

3. Brenner Base Tunnel: the construction site's data

On 7 November 2026 BBT SE, the company building the Brenner Base railway tunnel between Italy and Austria, controlled by ÖBB and RFI, confirmed a targeted attack that took place in mid-October. The attackers gained partial access to data «accessible via the internet»; the affected systems were isolated and outside experts and the authorities were brought in. On 17 October the Everest group had listed the tunnel on its site, claiming to have stolen 812 GB; the figure is unverified (bluewin).

According to Escudo Digital, the entry point was an internet-connected server used to exchange data with outside parties, and the stolen data include administrative documents, topographical data and tender documents. Everest demanded a ransom of an undisclosed amount; BBT SE refuses to negotiate or pay and reports every contact to the police. The company says the attack had no technical effect on the excavation and that industrial safety systems are intact; investigations in Austria and Italy are open (Escudo Digital).

4. Nitori: up to 37.6 million records

On 10 November 2026 Nitori, a large Japanese furniture and homeware retailer, reported that up to 37.62 million personal records «may have been leaked externally». The company detected and blocked the intrusion on 6 November; according to the investigation the attacker had access to the system from around mid-October. Potentially involved are membership numbers, names, emails, addresses, phone numbers, dates of birth and gender of customers, data on corporate customers and online order information; Nitori rules out passwords and credit cards. The figure is an upper estimate and the number of customers actually affected has not yet been determined; the company is also checking whether ransomware was involved (BleepingComputer).

5. Vanderbilt University: switch everything off

On Monday 9 November 2026 Vanderbilt University announced a cyberattack that could affect campus devices and systems. The university asked everyone to switch off their devices, disconnect from Wi-Fi and report pop-up warnings, file changes or password requests. The attack came to light after the BYOD group listed the university on its site, with claims of data theft. It is not stated whether Vanderbilt University Medical Center is affected. BYOD, active since late September according to expert Allan Liska, is the same group that claimed the attack on the University of New Mexico (The Record).

Other events worth noting

Microsoft 365 (technology): from 12 November a failure takes down Outlook, Exchange Online and other services in several regions for almost 24 hours; Microsoft points to an overloaded server process and says there is no sign of malicious activity. Morningstar DBRS gives a preliminary estimate of global insured losses between 300 and 500 million dollars (Actuarial Post).
Quantum Systems (defence): the German drone maker confirms a late-October attack; according to Der Spiegel and the Financial Times a malicious update of the mission planning software was distributed from the manufacturer's server, and the German armed forces grounded the drones as a precaution.
TSMC (semiconductors): on 12 November the chipmaker reports that personal data of current and former employees, matching records held by a cloud provider, appeared online; no evidence that its own systems were compromised.
Baker Tilly (professional services): the accounting firm notifies clients of a breach at an unnamed supplier, involving Social Security numbers; 10,456 people in Texas alone.

Insurance impact

The common picture is the periphery: data suppliers, inherited systems, file exchange servers and shared cloud services. For each event, the possible impact on policies can be read as follows.

Expedia Group. Coverages potentially triggered: incident response, notification, privacy liability, extortion. Accumulation potential: high, because the same data platform served several companies. Contractual issue: a loss originating at a supplier and the possibility of recourse, together with unverified claims by the criminal group.
Maersk. Coverages potentially triggered: incident response, notification, extortion. Accumulation potential: low. Contractual issue: the systems of acquired companies and whether they fall within the definition of the insured's computer system.
Brenner Base Tunnel. Coverages potentially triggered: incident response, extortion, third-party liability for tender and technical documents. Accumulation potential: low. Contractual issue: the confidentiality of technical data on strategic infrastructure and the exclusions for state operations, should a link emerge.
Nitori. Coverages potentially triggered: notification, privacy liability, fines where insurable. Accumulation potential: low. Contractual issue: notification sublimits against a number of people not yet determined.
Vanderbilt University. Coverages potentially triggered: restoration, business interruption, extortion, notification. Accumulation potential: medium, as the same group is active against several universities. Contractual issue: the shutdown decided by the insured to contain the attack.

The data supplier is an accumulation point. Expedia, TSMC and Baker Tilly see their data hit at third parties. The questionnaire must ask where the data sits, not only who owns it.

Acquisitions bring hidden risks. Maersk discovers an intrusion in an inherited system. In underwriting, the systems of acquired companies and the time planned to integrate or decommission them matter.

A failure is not an attack, but it weighs just as much. The Microsoft 365 outage does not stem from an attack and for many policies may not trigger cover. The conditions on system failure and on suppliers show who really pays.

What to bring to renewals

Which data platform and analytics suppliers hold copies of the insured's customer data, and with which access keys?
Are keys and credentials granted to suppliers rotated and revoked when the relationship changes or ends?
Which systems of acquired companies remain active and connected to the group's network or data?
Are servers used to exchange files with outside parties inventoried, protected and monitored?
Does the policy cover interruption caused by a non-malicious failure of a cloud provider, and with what waiting period?
Does the insured have a procedure to shut devices down in an orderly way and restart, and has it been tested?
How are extortion demands for stolen data without encryption of systems treated?

On the portfolio side, it is worth mapping insureds that use the same cloud data platforms and the same email and collaboration provider, and simulating a scenario in which a single supplier hits many insureds with a data theft or an outage.