SAG Strategic Advisory Group
✆

Masked home invasion of a CEO's family; Ivanti flaw is exploited

Overall posture: Elevated5-minute read

The most serious report this morning is a violent home invasion at a Bridle Path residence in Toronto, where a real estate CEO and his daughters were shot and his wife was attacked with a hammer, and three suspects remain at large. On the cyber side, CISA says attackers are actively exploiting an authentication flaw in Ivanti Connect Secure, and the Binance hack tied to North Korea keeps crypto custody in focus. Closer to home, a gun turned up at a Washington school event and Fairfax County is debating the future of its crime cameras, while large Halloween crowds are expected on French streets today.

United States

Cyber & FraudUnited StatesHigh

Attackers are exploiting an Ivanti Connect Secure authentication flaw right now

CISA added two vulnerabilities to its Known Exploited Vulnerabilities catalog on Friday, citing evidence of active exploitation. One is CVE-2026-111357, a missing-authentication flaw in a critical function of Ivanti Connect Secure. Inclusion in the catalog means the flaw is being used in real attacks, not just theorized.

Why it matters. The family office, the corporate executive and any IT provider that runs Ivanti Connect Secure for remote access are exposed, and so are the accounts and files behind it. A compromised gateway can open the door to email, financial records and household data.

What to do
  • Ask your IT provider or family office technology lead today whether Ivanti Connect Secure is in use.
  • If it is, have them apply the vendor's fix and review recent access logs for unusual sign-ins.

Sources: CISA  |  See the Exposure Assessment →

A gun surfaced inside a candy box at a DC school's fall festival
Targeted ViolenceWashington, DCModerate

A gun surfaced inside a candy box at a DC school's fall festival

Police are investigating how a gun ended up in a box of candy during a fall festival event at a Washington, D.C., school on Thursday. The report does not say who brought it or whether anyone was hurt.

Why it matters. Parents, children and the staff who handle school pickups and events are exposed at crowded, informal school gatherings. This reaches your family through the open-access events your children attend.

What to do
  • Ask your children's school how it screens bags and items at festivals and open events.
  • Brief drivers and nannies on whom to call and where to move children if something looks wrong.

Sources: WTOP News  |  See the Exposure Assessment →

Fairfax County may end the camera program it expanded for Annandale crime
Privacy & ExposureAnnandale, Fairfax County, VirginiaLow

Fairfax County may end the camera program it expanded for Annandale crime

In 2024 Supervisor Andres Jimenez asked police to add cameras monitored by the Real Time Crime Center after crime rose along Wadsworth Court in Annandale. He may now want to end the program, WTOP reports. No decision is reported.

Why it matters. Families and household staff in Northern Virginia who count on public cameras near their streets could lose that layer of coverage. Your own property cameras and their storage then carry more of the load.

What to do
  • Confirm your own cameras cover entries and driveways and that recordings are stored off site.
  • Do not assume a public camera saw anything near your home; keep a direct line to local police.

Sources: WTOP News  |  See the Exposure Assessment →

Global

Masked intruders shot a CEO and his daughters inside their Toronto home
Targeted ViolenceBridle Path, Toronto, CanadaHigh

Masked intruders shot a CEO and his daughters inside their Toronto home

A real estate CEO and his two daughters were shot and his wife was attacked with a hammer by masked intruders in a robbery at their home in Toronto's Bridle Path, according to BBC News and Fox Business. CBS News reports that three suspects are at large and a manhunt is under way. The victim has said his family is traumatized.

Why it matters. The principal, spouse, children and live-in or visiting staff of any prominent family face the same exposure: a visible name and a large home. Entry points, alarm response and what everyone does in the first minute decide the outcome.

What to do
  • Walk every entry point with your security lead and test alarm and police response times.
  • Rehearse a safe-room plan with your children and staff, including who calls for help.
  • Keep trauma and bleeding-control supplies where the family actually lives.

Sources: BBC News · CBC · CBS News · Fox Business · Us Weekly  |  See the Exposure Assessment →

French authorities prepare for Halloween protest crowds in masks and costumes today
Travel & RegionFranceModerate

French authorities prepare for Halloween protest crowds in masks and costumes today

Thousands of people, possibly masked and costumed, are expected on French streets on Saturday, and authorities are preparing another large security response, the New York Times reports. The Times separately describes recent violent unrest in France that has shifted the country's politics.

Why it matters. Traveling executives and families in France this weekend, and the drivers and hotels serving them, may meet blocked routes and crowds where protesters are hard to tell from revelers. Your movements today need a plan.

What to do
  • Keep itineraries away from demonstration areas and confirm routes with your driver before leaving.
  • Ask your hotel for current guidance and set a check-in time for each family member out in the city.

Sources: The New York Times · The New York Times  |  Book a Private Call →

A $6.3bn exchange hack tied to North Korea puts crypto custody in question
Cyber & FraudGlobalModerate

A $6.3bn exchange hack tied to North Korea puts crypto custody in question

Binance says it is trying to recover $6.3bn stolen in what is believed to be the largest crypto attack ever. Two analytics firms attribute it to a North Korean hacking unit called TraderTraitor. This remains a developing recovery effort.

Why it matters. Family offices and executives who hold digital assets on exchanges, and the staff who approve transfers, are exposed to the same kind of skilled attacker. Confirming every transfer by a second channel limits the damage.

What to do
  • Confirm where family or company digital assets are held and who can authorize moves.
  • Require a call-back on a known number for any transfer instruction.

Sources: BBC News · BBC News · BBC News  |  Set up a Verification Protocol →

Worth watching

One thing to do today

See your home the way an intruder would

The Toronto attack shows how fast a family can be hurt at home when entry points, alarms and household routines are not tested. SAG's Exposure Assessment maps how your homes, staff and public profile look from outside, and SAG can put it in place for your family this week.

Train for it: Golden Hour, trauma response, bleeding control and casualty care.

See the Exposure Assessment

Something here affect your family? Email connect@sagglobal.com or call 203-770-5461 and a firm principal will answer.

Daily · 6:00 AM Eastern · Free

Get Morning Intelligence by email

The same brief, in your inbox before the day starts. Every issue stays free to read here at sagglobal.com/brief.