This week’s offer: a free exposure scan for your business, through December 31. We check whether your company email addresses and passwords show up in known breach data, whether someone can send email that looks like it came from your domain, and what your network shows to the outside world. You get a one-page report and a 15-minute Teams call to walk through it.
Reply "scan" to this email and we will set it up. No sales pitch, no obligation.
1. The calendar invite that steals your Microsoft 365 password
Check Point Research reported on Thursday that a phishing campaign using fake calendar invites has hit more than 40,000 organizations with over 300,000 unique emails. Volume spiked to almost 200,000 emails on October 8 alone.
Here is why it works. The email carries a calendar file or an invite link. Calendar files are harmless as a file type, so they slip past most email filters, and some calendars add the event automatically. The event description, location, or a QR code then sends the person to a fake Microsoft 365 sign-in page or a fake payment portal. No malware, no software flaw. Just a meeting that looks normal.
Year-end is when this lands best: offices are booking vendor calls, reviews, and client meetings. Law firms, CPAs, county offices, and anyone with a busy shared calendar are the sweet spot.
2. A record Patch Tuesday, including Outlook
Microsoft’s October 13 updates fixed more than 1,400 security flaws, including three zero-days. The one to care about: five critical Outlook flaws rated 9.8 out of 10 that can run an attacker’s code just by displaying a malicious email in the reading pane. Nobody has to click anything.
If your PCs have not installed this month’s updates and restarted, they are exposed. If you still run your own Exchange server, there is a critical Exchange fix in this batch too.
3. Cyber insurance is getting cheaper. Claims are getting harder.
Insurance Journal reported Friday that cyber insurance rates have fallen four years in a row, yet only an estimated 10% to 20% of small and midsize businesses carry it. Meanwhile, U.S. cyber losses reported to the FBI hit nearly $21 billion in 2025, up from about $16 billion the year before. A separate report this week found 56% of U.S. small businesses had at least one cyberattack in the past year.
The catch: insurers increasingly ask for proof after a claim. If your application says you have multi-factor authentication on every account and you do not, that is a problem when you need the policy most.
Do this Monday
Ask whoever manages your Microsoft 365 to stop calendar invites from outside senders from adding themselves to calendars automatically.
Tell your team: any meeting invite that asks you to sign in or pay gets a phone call to the sender first, at a number you already have.
Check that every PC installed the October updates and actually restarted.
Pull out your cyber insurance application and confirm every "yes" is still true today.
Reply "scan" and let us look at your exposure before someone else does.
This week’s offer: a free exposure scan for your business, through December 31. We check whether your company email addresses and passwords show up in known breach data, whether someone can send email that looks like it came from your domain, and what your network shows to the outside world. You get a one-page report and a 15-minute Teams call to walk through it.
Reply "scan" to this email and we will set it up. No sales pitch, no obligation.
JK Computer Solutions is MSP Today’s Trusted Tech Partner. Prefer to talk it through? Book a 15-minute Teams call.
Sources: TechRadar Pro, Oct. 16, 2026 (Check Point Research); IT-Connect, Oct. 13, 2026; BleepingComputer; Insurance Journal, Oct. 16, 2026; Rochester Business Journal, Oct. 15, 2026 (Hiscox Cyber Readiness Report).