Week of Sunday, October 11, 2026

In July and August 2024, the head of global treasury, the executive who manages the company's cash, at a German carbon-black manufacturer made 59 transfers totaling more than €50 million to fraudsters. They had spoofed his supervisor's number from the company directory, told him he would run a new subsidiary in Asia, and moved the instructions to a messaging app on his private phone. He never checked with his supervisor, and he skipped the company's rules on payment approval and private messengers. The court did not name the company.

On July 31st the Cologne state labor appeals court upheld his dismissal and ordered him to repay the transfers, minus what the company has recovered. It found gross negligence: he had watched a training video on CEO fraud, and a financial manager at his level should have confirmed the instructions with his supervisor in person.

German employment law normally shields an employee from the full cost of a workplace mistake. Courts scale the loss to fault, nothing for slight negligence, a share for ordinary negligence, and the full loss for gross negligence. Even then they can reduce it if the amount would ruin the employee, and the court accepted that this sum was far beyond what he could pay. It refused to reduce it anyway. His employer pays for a directors-and-officers liability policy, the insurance companies buy against claims made personally against their managers, and the policy names him as insured, with up to $150 million of insurance coverage. The court's reasoning is that the protection exists to keep an employee from financial ruin, and this policy already covers that risk. The company can collect from him, and he can look to the insurer.

Whether the insurers will pay is disputed. His employer says they approved coverage while the case was under way; he says they made no commitment and are still examining the claim. The court put the burden on him to show the policy will not pay, and said that waiting on the insurers' answer does not meet it. It allowed an appeal to Germany's Federal Labor Court, and one is pending.

Zohar Pinhasi, 50, owns MonsterCloud LLC, a Florida company that sold itself as a ransomware remediation service. A federal grand jury in Brooklyn indicted him on September 23rd, and he was arraigned on October 7th on wire-fraud charges carrying up to 20 years. Prosecutors allege MonsterCloud told victims it could unlock their files with its own tools, so they would not have to pay criminals, when it had no such tools. Instead, they say, it contacted the attackers in secret, bought the decryption key and billed the client far more than it paid: over $19 million charged to clients against over $8 million in ransoms. In one August 2023 case, the Justice Department says, it paid about $8,200 and billed about $150,000. A 2019 message quoted by prosecutors reads: "Monstercloud doesn't hold any Proprietary technology [to] decrypt the ransomware data." The US Attorney said Pinhasi "re-victimized his clients while extracting a hefty profit for himself." He is presumed innocent.

Edward Dubrovsky, 54, a Canadian executive in ransomware negotiation, was arrested on Thursday, October 8th, in Pennsylvania, where he was attending a cyber risk conference. The court docket charges him with conspiracy to extort money by threatening to compromise the confidentiality of information, and with extortion by threats affecting commerce. The complaint is sealed, so what he is accused of doing is not public, and the FBI has not said how he fits. The next day FBI Director Kash Patel announced the arrest of "another suspected co-conspirator" of ShinyHunters, the extortion group the FBI believes breached its job-applicant portal, without naming anyone. The New York Times reported the suspect was a Canadian arrested in Pennsylvania, and Krebs on Security's sources tie Dubrovsky to the investigation. Krebs's sources also say charges against principals at other negotiation firms may follow. Cypfer, the Canadian negotiation firm he worked for, says he resigned as a managing director in November 2025.

This is not the first such case. In July, Angelo Martino, a negotiator at the ransomware-payment firm DigitalMint, was sentenced to 70 months for running attacks as an affiliate of the BlackCat ransomware gang, extracting about $75 million, including from five companies that had hired his own firm. DigitalMint is not accused of knowing.

Two of these cases are about a response vendor working against its own clients, one proven and one alleged. The third is an arrest tied to an extortion investigation, and nothing public says whether his clients were involved. Paying a ransom through a third party is not itself illegal for most victims.

The Office of the Comptroller of the Currency, the regulator that supervises national banks, fined American Express National Bank $350 million on October 8th and ordered it to rebuild its anti-money-laundering program. The Federal Reserve issued a separate cease-and-desist order against the parent, American Express Company, and American Express Travel Related Services Company. The bank neither admits nor denies the findings.

The regulator says American Express's bank pointed its anti-money-laundering controls at the wrong business. They were built around its small deposit-account business, and its much larger credit and charge card business got too little attention. From June 2014 to May 2025, about $13 billion in suspected money laundering passed through the bank. The order calls it trade-based laundering, which means moving money across borders by faking the paperwork on goods that were bought and sold. Some of it ran through card charges and the payments that paid them off, and some through accounts tied to bank insiders. The bank did report suspicious activity now and then, but it did not have the controls to catch and report all of it. The orders do not say what the charges were, how many accounts were involved or who the insiders were.

Neither order restricts new customers, products or accounts or mentions commercial or corporate cards. They do require stricter due diligence for higher-risk customers, risk-based transaction limits on the bank's products, controls on ACH, the bank-to-bank electronic payment system, and a look-back at past accounts and suspicious-activity reports filed with the Treasury. A board compliance committee is due in 15 days and an action plan in 90. The Federal Reserve's order also bars the company from rehiring anyone it disciplined and let go over the misconduct, and does not say how many people that covers.

For cardholders, the orders point to little more than extra questions. The new limits apply to the bank's own products, and American Express does not say which of its companies issues corporate cards, so some business cardholders may notice nothing at all. The first earnings call since the orders is October 23rd.

Starting October 13th, the Federal Communications Commission will not approve a new electronic device if it contains a chip or module made by a company on its Covered List. The list names makers the FCC considers a national-security risk, including Huawei and ZTE. Surveillance-camera and radio makers such as Hikvision are listed for certain uses.

The FCC's worry is hidden code or backdoors in the chip. In its words, a compromised component can enable sabotage or unauthorized access "regardless of their visibility to end users or the branding of the final product." The buyer cannot see inside the chip.

Only a few makers are named, and nothing already approved changes. It can still be sold, imported and used. What changes is new products and new versions: if a contract manufacturer swaps in a part from a listed maker, the changed device cannot be approved. That is the exposure for a company that sells hardware under its own brand and has someone else build it. If you only buy equipment, the effect is on what you can buy later, not on what you already own.

Colin McDonald, the Assistant Attorney General who heads the Justice Department's new National Fraud Enforcement Division, starts from a problem: criminals "often spend or hide criminal proceeds before investigators and prosecutors can identify assets, bring charges, and recover the stolen funds," and once caught, fraudsters are "usually unable to pay back their victims." His prosecutors "will therefore prioritize early seizure of fraud proceeds and early disruption of fraud schemes." The memo covers fraud against health-care and government programs, tax and trade fraud, securities and consumer fraud, and cybercrime.

The tools it lists include freezing money at banks and cryptocurrency exchanges "shortly after they have been stolen," seizing websites, domains and online accounts, and going after property in court "before initiating criminal charges." Only that last one is explicitly pre-charge. The stated goal is to "maximize recovery for victims" and have fraudulent proceeds "returned to their rightful owners." The memo does not promise any particular victim a recovery.

It also says the division will "identify and hold accountable all persons and entities that knowingly enable, facilitate, conceal, or profit from" such schemes. Banks and exchanges appear only as the places where money gets frozen; the memo says nothing about their liability or about notifying them first.

Saudi Arabia is talking with customers about writing the workaround it has used during the Iran war into long-term contracts, with loadings outside the Strait of Hormuz starting next year, Bloomberg reported on October 8th. The workaround already runs: Aramco, the Saudi state oil company, lets some buyers take cargo by ship-to-ship transfer off India. The talks must conclude by year-end and are not final; pricing, freight and volumes are still under discussion. Bloomberg, citing people familiar with the talks, is the only outlet reporting this. Aramco and the Energy Ministry did not respond to requests for comment.

Traffic through the strait is a fraction of normal. IMF PortWatch, which counts ships from tracking data, recorded 4 transits on October 4th, the latest day in its series, against an average of about 85 a day through 2025. Passage is also costly: Fortune reports that war-risk insurance can command 6% to 10% of a ship's value, up to $20 million for a supertanker, and Lloyd's List reported that before the war the extra premium for Gulf trips was 0.15% to 0.25%.

On October 8th, Vice President Vance and Labor Secretary Keith Sonderling announced that the Labor Department has suspended eight employers from permanent labor certification, the first step in an employer-sponsored green card. They are Microsoft, Adobe, Cognizant, Infosys, Tata Consultancy Services, Wipro, HCL Technologies and Capgemini. The department will not accept new applications from them or process pending ones. No end date has been set, and the administration cites alleged visa abuse and "multiple active federal investigations." The suspension does not touch their workers' H-1B status, the temporary skilled-worker visa most of them hold, or their authorization to work. One immigration law firm reads the rule as allowing a pause of up to 180 days, as in software company Cloudera's May suspension, and then longer. The department had posted no written notice as of Sunday; the details come from the press conference as reported by Reuters, CNBC and the Associated Press, and from immigration law firms.