Cyber Breach Tracker
A curated, fact-checked log of recent notable breaches, and, for each one, the specific security control that would have blunted it. Every incident is mapped to a real control from the cyber-insurance checklist and to a primary source. This is a hand-maintained list, not a real-time feed.
Score your own posture in 2 minutes, then close the gaps the breaches below exploit · no login, no email gate
How to read this tracker
Every breach has a control that would have changed the outcome
Most breaches are not exotic. They are a missing second factor, an exposed admin interface, an un-vetted vendor, or a staff member talked through an MFA prompt on the phone. For each incident below we name what happened, link the primary source, and map it to the exact control, by id, from the 47-control Cyber Insurance Prep Checklist that would have blunted it. The same controls your carrier asks about.
Recent breaches & the control that would have caught it
Newest first. Figures are reported as the cited sources report them, including where the numbers are still contested.
ConnectWise
· MSP / SaaS
Third-party / supply chainCredential leakSaaSIdentityOn October 16, 2026, ConnectWise published an advisory disclosing that attackers had obtained a compromised application credential belonging to ConnectWise Cloud Backup (formerly SkyKick, acquired September 2024) and used it to request Microsoft Graph tokens inside customer Microsoft 365 tenants. Because the sign-in occurred as an application rather than a human user, MFA was not triggered. Scripted access from IP address 144.172.64.128 was first observed on October 13–14, 2026; on October 15, 2026, malicious activity ran between 06:13 and 08:34 UTC. Huntress confirmed unauthorized sign-ins in at least 162 tenants, with sign-in activity from the attacker's address observed in almost 1,000 tenants across intermediate counts. In at least one tenant, the ConnectWise Cloud Management Teams application (App ID 24205314-2b89-4e07-a2a4-579e898a5640) self-assigned Global Administrator rights and added credentials to two other applications. ConnectWise identified the issue on October 14, 2026, and on October 17, 2026 at 07:00 UTC disabled seven application identities, suspending Cloud Backup, SaaS Security, and Cloud Management services. ConnectWise stated that existing backup archives remain encrypted and preserved, with no evidence they were accessed by attackers, though disabling the affected identities does not reverse changes already made inside individual tenants. No threat actor has been publicly attributed and no CVE has been assigned as of October 18, 2026.
The control that would have caught it
- CI-36CRITICALData
Encrypt sensitive customer data at rest (PII, PHI, payment card).
Customer data held within Microsoft 365 tenants accessed via the compromised app credential; encryption at rest limits what an attacker can read or exfiltrate even after obtaining valid Graph tokens.
- CI-32CRITICALVendor Access
Limit third-party vendor remote access to approved windows, with MFA.
The attack succeeded because ConnectWise's application credential granted persistent, broad access to customer tenants; scoping and time-limiting third-party vendor remote access (including app-based access) would have reduced the window of exposure.
- CI-33CRITICALVendor Access
Log all vendor remote-access sessions.
Logging all vendor remote-access sessions, including application sign-ins, would have surfaced the scripted movement between tenants (only seconds apart) far earlier than October 14, 2026, when ConnectWise says it identified the issue.
- CI-40LOWLogging
Put centralized logging in place for critical systems.
Centralized logging of Microsoft 365 application sign-in events across tenants would have allowed MSPs and their customers to detect sign-ins from 144.172.64.128 in near-real-time rather than retrospectively after the advisory.
DTU (Technical University of Denmark)
· Higher Education
Credential leakData exfiltrationIdentityData retentionOn 2 October 2026, DTU publicly disclosed that attackers had gained access to DTUBasen, its identity and access management system, using compromised DTU user credentials. Up to 200,000 current and former users may have had data exposed, though DTU stated it cannot determine precisely what information was downloaded or the exact number of individuals affected. DTUBasen holds records on approximately 40,000 active users and 160,000 former users, with data dating back to 2003. Information potentially exposed includes CPR numbers (Danish national ID), full names, home addresses, work email addresses, profile photos, employment data, and next-of-kin names, relationships, and phone numbers. DTU notified affected individuals via e-Boks, reported the breach to Datatilsynet under GDPR, and contacted Denmark's National Special Crime Unit (NSK). No threat actor has been publicly attributed.
The control that would have caught it
- CI-03CRITICALMFA
Require MFA for every privileged and administrator account.
Attackers accessed DTUBasen using compromised user credentials with no zero-day involved; MFA on privileged and administrator accounts would have blocked or significantly limited the ability to authenticate into a sensitive IAM system with stolen passwords alone.
- CI-36CRITICALData
Encrypt sensitive customer data at rest (PII, PHI, payment card).
DTUBasen held highly sensitive data including CPR numbers, next-of-kin details, and employment records dating to 2003; encryption at rest would have reduced the value of any data exfiltrated during the breach.
- CI-45LOWPolicy
Document a data retention and disposal policy.
Records in DTUBasen extended back to 2003, meaning data on former users was retained for over two decades; a documented data retention and disposal policy would have limited the volume of personal data at risk by ensuring records were purged once no longer necessary.
- CI-40LOWLogging
Put centralized logging in place for critical systems.
DTU stated it cannot determine precisely what information was downloaded, suggesting insufficient logging on DTUBasen; centralised logging of access and query activity on the IAM system would have enabled investigators to scope the exfiltration with confidence.
Bitget
· Crypto exchange · Attributed to TraderTraitor (suspected DPRK)
Data exfiltrationThird-party / supply chainCredential leakIdentityAt approximately 18:31 UTC on September 24, 2026, Bitget detected unauthorized transfers from a portion of its hot and warm wallet infrastructure across seven blockchain networks including Ethereum, XRP Ledger, Arbitrum, Avalanche, Optimism, BNB Chain, and Base. The revised total of assets transferred to attacker-controlled addresses reached approximately $387.5 million. According to Bitget CEO Gracy Chen in a September 28 livestream, the attacker exploited a vulnerability in a third-party security product and obtained high-level internal network credentials, which were then used to send fraudulent withdrawal commands to the wallet system; private key compromise and cold wallet access were both ruled out. XRP was the largest single asset stolen, with on-chain monitor Lookonchain counting approximately 102.93 million XRP (worth around $157 million at the time). Bitget suspended withdrawals immediately after detection while deposits and trading continued; a phased restoration schedule was announced September 26, with Bitcoin withdrawals resuming at 08:00 UTC on September 28. Bitget pledged its User Protection Fund, which held more than $464 million at the time, to cover the full financial impact. TRM Labs identified multiple on-chain overlaps with wallets linked to prior North Korean hacks including Bybit and AFX Bridge, pointing to the TraderTraitor group; Elliptic similarly identified on-chain connections to prior DPRK-attributed exploits. CEO Gracy Chen described the attacker as "likely a North Korean group," and ZachXBT referred to the incident as "the Bitget exploit by DPRK," though North Korean attribution remains suspected and not officially confirmed by law enforcement at the time of writing.
The control that would have caught it
- CI-32CRITICALVendor Access
Limit third-party vendor remote access to approved windows, with MFA.
The attacker exploited a third-party security product vulnerability to gain high-level internal credentials; restricting and MFA-gating all vendor remote access would have raised the bar for pivoting from a compromised third-party product into wallet infrastructure.
- CI-33CRITICALVendor Access
Log all vendor remote-access sessions.
Comprehensive logging of all vendor and third-party remote-access sessions would have provided earlier forensic visibility into how the compromised third-party product was used to obtain internal credentials and issue fraudulent withdrawal commands.
- CI-28CRITICALAccess Control
Use no shared or generic admin credentials, each admin has a unique account.
The attacker obtained "high-level internal network credentials" to authorize fraudulent withdrawals; enforcing unique, non-shared privileged accounts would have limited the blast radius and made anomalous credential use easier to detect.
- CI-36CRITICALData
Encrypt sensitive customer data at rest (PII, PHI, payment card).
Funds were moved across seven blockchains by spoofing transaction data and triggering the authorization process; encrypting sensitive wallet configuration and authorization data at rest would have complicated the attackers ability to craft convincing fraudulent withdrawal commands after gaining internal access.
WaterPlum (Contagious Interview) Campaign
· Cybercrime / Nation-state · Attributed to WaterPlum (North Korea, also known as Contagious Interview)
Credential leakData exfiltrationIdentityThird-party / supply chainA North Korean hacking group tracked as WaterPlum (also called Contagious Interview) compromised at least 30,000 devices across more than 100 countries during a campaign running from approximately December 2025 through July 2026, according to a joint advisory published on September 18, 2026 by the FBI, Japan's National Police Agency and National Cybersecurity Office, the US Department of Defense Cyber Crime Center, Australia's ACSC, and Germany's BND and BfV. The group contacted software developers on LinkedIn, GitHub, and freelance platforms with convincing job offers, then directed targets to run malicious code during fake "coding tests," including weaponized npm packages and VS Code projects with malicious .vscode/tasks.json files. Five malware families were named in the advisory: BeaverTail (a JavaScript infostealer), InvisibleFerret (a Python-based backdoor), OtterCookie (a JavaScript RAT and infostealer), OtterCandy, and StoatWaffle. Cybersecurity firm Socket tracked 26 malicious npm packages tied to the campaign. The advisory also noted that actors used AI face-swapping tools. WaterPlum is assessed by the FBI and Japan's NPA to operate under the 313 General Bureau of the Munitions Industry Department, subordinate to the Central Committee of the Workers' Party of Korea. The group reportedly stole funds or credentials from approximately 7,000 cryptocurrency wallets and transferred at least $10.71 million in stolen cryptocurrency to North Korea.
The control that would have caught it
- CI-39MEDIUMApplication
Inventory software dependencies and check them for known vulnerabilities.
WaterPlum delivered BeaverTail and related malware through malicious npm packages; inventorying software dependencies and scanning them for known-malicious packages before execution would have broken this delivery path.
- CI-34HIGHAwareness
Provide security awareness training to all employees annually.
Developers were socially engineered into running untrusted code during fake job interviews; annual security awareness training covering recruitment-based lure tactics would have reduced susceptibility to this specific social-engineering vector.
- CI-35HIGHAwareness
Conduct phishing simulation exercises at least annually.
Phishing simulation exercises that include spear-phishing via LinkedIn and freelance platforms would have familiarised developers with the outreach patterns WaterPlum used to initiate contact.
- CI-36CRITICALData
Encrypt sensitive customer data at rest (PII, PHI, payment card).
BeaverTail and OtterCookie targeted credentials and cryptocurrency wallet data stored on infected devices; encrypting sensitive data at rest would have reduced the value of what the malware could exfiltrate.
Brevo
· SaaS / Email Marketing
Third-party / supply chainCredential leakData exfiltrationSaaSOn September 14, 2026, attackers exploited a long-lived Cloudflare API key that had been hardcoded in Brevo application source code, using it to deploy a malicious Cloudflare Worker across Brevo's CDN zones. Brevo defines the exposure window as 16:07 to 20:30 UTC (roughly five and a half hours); Sansec, which first reported the incident, recorded activity from 16:05:18 to 20:12:53 UTC. During that window the Worker rewrote the Brevo forms script, Conversations widget, and SDK loader scripts that customers embed on their own websites, presenting visitors with a fake Cloudflare verification page followed by ClickFix social-engineering prompts urging them to run a command on Windows. On WordPress sites where an affected widget was embedded and the visitor was logged in as an administrator, the script attempted to silently upload a malicious plugin from cdn10.sendibt1[.]com, disguised as "Web Media Optimizer," which acted as a persistent backdoor and JavaScript loader containing a hardcoded authentication key capable of generating a valid WordPress admin session without a password. Sansec estimates the attack may have affected more than 100,000 websites embedding Brevo components, a scale consistent with PublicWWW identifying 114,371 pages referencing affected Brevo resources. The malware included anti-analysis checks that suppressed activation for crawlers, developers, and automated scanners. Brevo confirmed that app.brevo.com, its API, email delivery infrastructure, and customer account data were not affected. Remediation included removing the Worker and its routes, revoking the compromised key, removing the hardcoded credential from source code, deleting attacker-controlled DNS records, and purging CDN caches; all malicious subdomains stopped resolving by September 15, 2026. A separate Brevo incident on September 10, 2026, in which a SAML SSO flaw was exploited to access 138 customer accounts (including Trezor, with phishing emails reaching approximately 347,000 addresses), preceded this supply chain compromise; Brevo has not confirmed or denied whether the two incidents are connected.
The control that would have caught it
- CI-28CRITICALAccess Control
Use no shared or generic admin credentials, each admin has a unique account.
The hardcoded Cloudflare API key with full account permissions in application source code is precisely what this control guards against: every privileged credential must be unique, individually issued, and never embedded in code where it can be extracted.
- CI-36CRITICALData
Encrypt sensitive customer data at rest (PII, PHI, payment card).
Storing a full-permission infrastructure credential (the Cloudflare API key) in plaintext within source code is an unauthorized sensitive-credential location; secrets management tooling aligned with this control would have kept the key out of the codebase.
- CI-04CRITICALMFA
Require MFA for all cloud service consoles (AWS, Azure, M365 admin).
MFA on the Cloudflare account console would have prevented the stolen API key alone from being sufficient to create and deploy the malicious Worker, adding a second factor the attacker did not possess.
- CI-33CRITICALVendor Access
Log all vendor remote-access sessions.
Logging all privileged Cloudflare account activity, including Worker creation and route modification, would have surfaced the attacker's actions within the five-and-a-half-hour window rather than relying on external CSP violation reports from Sansec to trigger detection.
Multiple Organizations (Microsoft Cloud)
· Cloud / SaaS · Attributed to Storm-3121, Storm-3032 (UNC6671)
VishingIdentityData exfiltrationSaaSMicrosoft Threat Intelligence disclosed on September 9, 2026 two active campaigns observed since at least May 2026. In the first, threat actors attributed to Storm-3121 and Storm-3032 (UNC6671, now operating under the Helix extortion brand) call or message employees on personal phone numbers, impersonate the target organization's IT help desk, and pressure targets to update a passkey, MFA, or SSO setting. Targets are directed to adversary-in-the-middle lookalike Microsoft sign-in pages or tricked into authorizing device-code authentication flows. Once inside, attackers add their own MFA methods for persistence and conduct automated collection via proxy-associated infrastructure, including Microsoft Graph API reconnaissance, SharePoint Online and OneDrive downloads, and mailbox exfiltration via REST APIs. Storm-3121's access has been linked to subsequent ShinyHunters and Falcon (CL-CRI-1182) extortion operations. In the second campaign, over one million scam emails were sent between August 3 and 5, 2026 via third-party email delivery infrastructure, impersonating target company CEOs to persuade accounts payable teams to initiate ACH transfers for a supposed ServiceNow renewal, using AI-generated templates, forged invoices, and fake email threads.
The control that would have caught it
- CI-03CRITICALMFA
Require MFA for every privileged and administrator account.
Attackers bypassed standard MFA by socially engineering targets into approving credential updates on AiTM pages; phishing-resistant MFA bound to hardware on privileged accounts would have broken this chain.
- CI-34HIGHAwareness
Provide security awareness training to all employees annually.
The entire initial-access chain relied on employees believing an unsolicited call impersonating IT help desk was legitimate; trained staff aware of vishing and passkey-update pretexts are far less likely to comply.
- CI-40LOWLogging
Put centralized logging in place for critical systems.
High-volume Microsoft Graph API reconnaissance, SharePoint downloads, and mailbox REST-API collection would produce anomalous signals detectable in centralized cloud audit logs if those logs were actively monitored.
- CI-18HIGHEmail Security
Configure anti-phishing policies (link scanning, spoofing protection).
Compromised accounts were subsequently used to send passkey-phishing lures via Microsoft Teams and email; anti-phishing policies scoped to internal senders and link-scanning would have reduced lateral spread from hijacked identities.
N-able
· MSP Software
RCEUnpatched vulnerabilitySupply chain riskMSP platformCVE-2026-86218, a static code injection flaw (CWE-96) in N-able N-central scored at CVSS 4.0 10.0, allows unauthenticated remote code execution on the N-central server with no credentials and low attack complexity. N-able released N-central 2026.3 Hotfix 4 (build 2026.3.1.14) on September 5, 2026, its fourth emergency hotfix in approximately five weeks. The Shadowserver Foundation identified roughly 1,500 internet-exposed N-central servers, concentrated in the United States and Europe. Huntress flagged the flaw as a potential zero-day and confirmed exploitation activity in the wild; Help Net Security reported active exploitation on September 7, 2026. CISA added CVE-2026-86218 to its Known Exploited Vulnerabilities catalog on September 8, 2026, setting an FCEB patch deadline of September 11, 2026. N-able stated it had no confirmations of exploitation in production environments at the time of BleepingComputer's reporting, and withheld the specific affected component and exploitation method from public disclosure. Hosted NCOD instances were patched automatically; only on-premises customers required manual installation of Hotfix 4.
The control that would have caught it
- CI-11HIGHPatching
Apply critical operating-system patches within 30 days of release.
A maximum-severity, actively exploited pre-auth RCE with a vendor patch available on September 5, 2026 is precisely the scenario the 30-day critical-patch window is designed for; on-premises N-central operators who applied Hotfix 4 promptly eliminated the attack surface before CISA's September 11 deadline.
- CI-23MEDIUMVulnerability Management
Run external vulnerability scans at least quarterly.
Quarterly external vulnerability scans against internet-facing assets would have surfaced unpatched N-central instances (roughly 1,500 were publicly reachable per Shadowserver), giving operators an earlier trigger to remediate before exploitation was confirmed.
- CI-42MEDIUMAsset Management
Maintain an inventory of all internet-facing assets.
An accurate inventory of all internet-facing assets, including on-premises N-central servers, is a prerequisite for knowing which systems require the emergency hotfix; operators without such an inventory risk leaving exposed instances unpatched.
- CI-22MEDIUMNetwork
Segment the network, servers and workstations on separate VLANs.
Because N-central servers sit at the top of managed-endpoint trust hierarchies, network segmentation limiting lateral movement from a compromised N-central host to downstream managed devices would have reduced blast radius for any intrusion achieved through the pre-auth RCE.
Manchester Airports Group
· Aviation / Transport · Attributed to FulcrumSec
Data exfiltrationExtortionCredential leakData retentionManchester Airports Group (MAG), the UK's largest airport operator, detected unauthorised access to its systems on August 25, 2026, and publicly disclosed the incident on August 27. MAG confirmed that a quantity of customer data relating to car park, lounge, Fast Track, and airport Wi-Fi bookings was compromised, affecting approximately 8.7 million customers across Manchester, London Stansted, and East Midlands airports; MAG stated that the majority of those affected had only their email addresses exposed, with some also having phone numbers, vehicle registration numbers, or postcodes taken. MAG confirmed no payment card or banking details were accessed, and airport operations were unaffected. MAG received a ransom demand and rejected it. On approximately August 29-30, extortion group FulcrumSec claimed responsibility, telling BleepingComputer it had stolen approximately 86 GB of data (unconfirmed by MAG or an independent investigator as of August 30-31, 2026) by exploiting Iterable API credentials exposed in client-side JavaScript. FulcrumSec also claimed its haul includes nearly 200,000 records tied to upcoming 2026 travel, with samples reviewed by BleepingComputer appearing to contain more detailed information than MAG initially disclosed; one record was independently validated against a traveller's known booking. The ICO confirmed receipt of a breach report and was assessing details as of August 29, with no enforcement action announced. FulcrumSec stated it intends to publish the stolen data and a technical account of the intrusion.
The control that would have caught it
- CI-37CRITICALData
Don’t store sensitive data in unauthorized locations.
FulcrumSec claims access was gained via Iterable API credentials embedded in client-side JavaScript, a form of sensitive credential storage in an unauthorised location; prohibiting secrets in front-end code would have closed this entry path.
- CI-36CRITICALData
Encrypt sensitive customer data at rest (PII, PHI, payment card).
With approximately 8.7 million customer records including PII such as email addresses, phone numbers, vehicle registrations, and postcodes exposed, encryption at rest would have limited the usable value of data exfiltrated from MAG's systems.
- CI-45LOWPolicy
Document a data retention and disposal policy.
FulcrumSec claimed to have retrieved nearly 200,000 records tied to upcoming 2026 travel alongside historical booking data; a defined data retention and disposal policy limiting how long completed-booking PII is held would have reduced the volume of data available to exfiltrate.
- CI-39MEDIUMApplication
Inventory software dependencies and check them for known vulnerabilities.
The attested entry vector was API credentials exposed in client-side JavaScript, a vulnerability that routine dependency and configuration auditing of web application assets would be positioned to surface before exploitation.
SafePal
· Cryptocurrency / Hardware Wallets
Data exfiltrationThird-party / supply chainExtortionData retentionSafePal, a Binance Labs-backed cryptocurrency hardware wallet provider, disclosed on August 16, 2026 that an authorization flaw in a third-party order-tracking plug-in exposed the personal data of approximately 39,798 customers who placed orders between March 2, 2025 and April 11, 2026. The flaw, described as an IDOR-style vulnerability, allowed unauthorized parties to access other customers' order details by manipulating order numbers. Exposed data includes names, email addresses, shipping addresses, phone numbers, and purchase details; wallet seed phrases, private keys, and payment card numbers were not affected, and SafePal found no evidence that wallets or funds were accessed. SafePal says it first received a report consistent with the incident in early May 2026 but initially treated it as an isolated case, identifying the root cause only around July 2026, while affected customers reported phishing attempts as early as May 2026. A threat actor was subsequently found offering the stolen data for sale on a cybercrime forum, with the listing spotted by DarkWebInformer. SafePal patched the vulnerability, engaged a third-party security firm to validate the fix, tightened data retention in the affected environment to 90 days, and took down more than 30 fraudulent websites linked to the stolen data. Because the exposed records identify home addresses of known cryptocurrency hardware wallet buyers, security researchers and outlets including Decrypt have noted the elevated risk of physical coercion attacks against affected individuals.
The control that would have caught it
- CI-32CRITICALVendor Access
Limit third-party vendor remote access to approved windows, with MFA.
The vulnerable component was a third-party order-tracking plug-in. Limiting and formally governing third-party vendor and plug-in access to order data, including scoping permissions to the minimum necessary, would have reduced the blast radius of the authorization flaw.
- CI-45LOWPolicy
Document a data retention and disposal policy.
SafePal itself acknowledged the breach window spanned over a year of retained order records. A documented data retention and disposal policy, enforced at the point of integration with third-party plug-ins, would have reduced the volume of personal data exposed; SafePal remediated by cutting retention to 90 days post-breach.
- CI-36CRITICALData
Encrypt sensitive customer data at rest (PII, PHI, payment card).
Encrypting sensitive customer data at rest, including shipping addresses, phone numbers, and email addresses held in the order-processing environment, would have limited the value of records accessed through the IDOR-style plug-in flaw even if the authorization control failed.
- CI-39MEDIUMApplication
Inventory software dependencies and check them for known vulnerabilities.
Maintaining an inventory of software dependencies, including third-party plug-ins integrated into order workflows, and checking them for known vulnerabilities would have provided a mechanism to identify the authorization flaw in the order-tracking plug-in before it was exploited across a 13-month window.
Multiple Corporate AWS Accounts
· Cloud / Software
Credential leakData exfiltrationThird-party / supply chainIdentityOn August 10, 2026, Truffle Security published research showing that of 10,616 publicly leaked AWS access key pairs re-verified that day, 88% (more than 9,300) still authenticated. The leaked keys had surfaced across git history, Hugging Face datasets, Docker images, package registries, and CI logs between August 2022 and August 2026, yielding 431,875 raw findings and 64,024 unique key pairs across 50,654 AWS accounts. Of the live keys, 817 were linked to businesses; 526 were AWS root keys and 242 held IAM AdministratorAccess (non-overlapping sets), meaning 768 corporate keys gave full control of a company AWS environment. Among those, 130 live root keys were tied to AWS Organizations management accounts, where a single compromise could expose every member account in the organization. Hugging Face was the largest single source, with 8,482 unique live keys found across 3,394 public datasets. Among keys for which creation dates were available, the median age was 1,831 days (approximately five years), and Truffle Security reported that 86% had never been rotated. Accounts behind the readable keys collectively spent $420,631 in July 2026 alone, and only 9.5% of those accounts had any AWS budget alert configured.
The control that would have caught it
- CI-28CRITICALAccess Control
Use no shared or generic admin credentials, each admin has a unique account.
Many of the 768 full-admin keys were long-lived credentials shared or embedded across projects; unique, per-service IAM accounts would have contained the blast radius of any single leaked key.
- CI-36CRITICALData
Encrypt sensitive customer data at rest (PII, PHI, payment card).
Credentials embedded in Hugging Face datasets, Docker images, and public repositories represent sensitive data stored outside authorized systems; encrypting and scanning for secrets at rest before publication would have prevented exposure.
- CI-37CRITICALData
Don’t store sensitive data in unauthorized locations.
AWS keys surfaced in git history, CI logs, and public dataset files, indicating they were committed or embedded in unauthorized locations; a policy prohibiting storage of credentials outside a secrets manager would have directly blocked this pattern.
- CI-45LOWPolicy
Document a data retention and disposal policy.
The median leaked key was approximately five years old and 86% had never been rotated; a documented credential rotation and disposal policy would have eliminated the long-lived keys that made 88% of the leaked pairs still usable at time of discovery.
JetBrains
· Software / DevTools
Data exfiltrationCredential leakPatching gapThird-party / supply chainUnidentified threat actors exploited CVE-2026-63077, a CVSS 9.8 unauthenticated remote-code-execution flaw in JetBrains TeamCity On-Premises (CWE-502, deserialization of untrusted data), to breach JetBrains' own Cadence cloud-compute environment. The intrusion ran from August 8 to August 24, 2026, with malicious activity detected on August 23 and the Cadence API server taken offline the following day. JetBrains later acknowledged that the Cadence server should have been patched under its own vulnerability-response process but was not, despite the company having published its advisory for CVE-2026-63077 on July 27, 2026, and CISA having added the vulnerability to its Known Exploited Vulnerabilities catalog on August 5, 2026. The attackers accessed a full Cadence server backup from 2024 containing AWS IAM credentials and configuration data. Data potentially exposed for current Cadence users includes usernames, real names, email addresses, last-login timestamps, last-accessed IP addresses, and AWS IAM credentials. JetBrains is urging all Cadence users to treat any executions and outputs between August 8 and August 24, 2026 as untrusted and to immediately revoke and rotate all credentials and secrets used in their Cadence environments. The number of individuals affected has not been publicly disclosed.
The control that would have caught it
- CI-11HIGHPatching
Apply critical operating-system patches within 30 days of release.
JetBrains' own Cadence server was running a vulnerable version of TeamCity On-Premises after the patch for CVE-2026-63077 was publicly available and CISA-flagged; applying critical OS and application patches within 30 days would have closed the window exploited here.
- CI-12HIGHPatching
Apply critical application patches within 30 days of release.
The exploit targeted an unpatched TeamCity application instance that JetBrains itself had already fixed for Cloud customers; prompt application-level patching would have prevented the unauthenticated RCE entry point from being available to attackers.
- CI-36CRITICALData
Encrypt sensitive customer data at rest (PII, PHI, payment card).
The exfiltrated 2024 server backup contained AWS IAM credentials and configuration data in a form that was directly usable by attackers; encrypting sensitive credential material at rest would have reduced the value of that backup to anyone who obtained it.
- CI-45LOWPolicy
Document a data retention and disposal policy.
A backup from 2024 containing live AWS IAM credentials remained available on the Cadence server years after it was created; a documented data-retention and disposal policy would have limited how long high-value credential material persisted in backup storage.
Undisclosed Organisation
· Undisclosed · Attributed to Akira ransomware affiliate
RansomwareData exfiltrationExtortionMFA gapOn August 4, 2026, an Akira ransomware affiliate gained initial access at 03:52 UTC through an exposed SonicWall SSL VPN device that had no multi-factor authentication configured, using a credential-spraying attack. Within roughly two hours the attacker moved laterally via RDP to the domain controller, enumerated Active Directory users and computers (dumping results into AdUsers.txt and AdComp.txt under ProgramData), then pivoted to an application server. The attacker installed AnyDesk as a Windows service for persistent remote access, used WinRAR to archive mapped file shares, and exfiltrated data to an attacker-controlled S3 bucket via the s5cmd tool. At 06:29 UTC the attacker forced the host into Safe Mode with Networking, disabling the Huntress MDR agent and Microsoft Defender real-time protection for approximately 10 minutes. The Akira encryptor (akira.exe) was launched at 06:34 UTC, but Safe Mode's constrained virtual memory environment was insufficient for the encryptor's multi-threaded, memory-mapped design; Windows began generating "Virtual Memory Minimum Too Low" and "Out of Virtual Memory" errors roughly 13 seconds after reboot, and encryption failed. Defender detected the binary as Ransom:Win32/Akira.B!ibt but could not quarantine it while Safe Mode remained active. When the attacker rebooted into normal Windows at 08:10 UTC, Defender's real-time protection was restored and the file was quarantined. The total intrusion lasted approximately 4 hours 18 minutes. Although encryption failed, data and credential exfiltration had already succeeded, leaving the attacker with leverage for double extortion. Huntress, whose analysts investigated and published findings on August 12, 2026, noted this is the first Akira affiliate use of Safe Mode for EDR evasion they have observed, and cautioned that the encryption failure was a lucky accident of low virtual memory rather than a repeatable defense.
The control that would have caught it
- CI-02CRITICALMFA
Require MFA for all remote access, VPN, RDP, and SSH.
The attacker entered entirely through an exposed SonicWall SSL VPN with no MFA; a credential-spraying attack against an MFA-protected VPN would have been blocked at the perimeter before any lateral movement began.
- CI-10HIGHEndpoint
Actively manage EDR, alerts are monitored, not just installed.
The EDR agent was silenced for roughly 10 minutes by a Safe Mode reboot; active MDR monitoring (as Huntress provided here) caught the incident, but a control requiring that EDR blind-spots trigger an immediate alert or automatic isolation would have cut the attacker's window to execute the payload.
- CI-36CRITICALData
Encrypt sensitive customer data at rest (PII, PHI, payment card).
Data exfiltration to an attacker-controlled S3 bucket succeeded even though encryption failed; encrypting sensitive data at rest would have reduced the value of the stolen files and blunted the double-extortion threat.
- CI-40LOWLogging
Put centralized logging in place for critical systems.
Centralised logging of the Safe Mode registry modification, AnyDesk service installation, and s5cmd S3 upload activity across all critical systems would have provided earlier detection signals before the encryptor was launched.
N-able
· MSP Software
Third-party / supply chainCredential leakIdentitySaaSOn July 31, 2026, N-able first observed anomalous licensing activity on on-premises N-central servers, which turned out to be the earliest signal of active exploitation. By August 2, 2026, N-able confirmed that CVE-2026-18577, an authentication bypass and account takeover vulnerability caused by an incomplete fix for the earlier CVE-2026-18556, had allowed remote unauthenticated attackers to gain administrative access to N-central servers running any build prior to 2026.3.1.7. Once inside, attackers leveraged N-central's own Take Control feature to reach downstream customer-managed endpoints, then registered Cloudflare tunnel services on those devices as a persistence mechanism that survives reboots and remains active even after access to the N-central server is revoked. N-able released build 2026.3.1.7 (2026.3 Hotfix 1) on August 2, 2026 as the minimum safe version; upgrading only to 2026.3, as initially instructed, is no longer sufficient. A limited number of affected customers were identified and contacted, though no public count of compromised servers or organizations has been disclosed.
The control that would have caught it
- CI-11HIGHPatching
Apply critical operating-system patches within 30 days of release.
CVE-2026-18577 was exploitable on any N-central build prior to 2026.3.1.7; a policy requiring critical patches within 30 days, applied to the earlier CVE-2026-18556 fix, would have prompted faster evaluation and upgrade before the incomplete patch was itself bypassed.
- CI-22MEDIUMNetwork
Segment the network, servers and workstations on separate VLANs.
Network segmentation between the N-central management plane and downstream managed endpoints would have limited attackers' ability to pivot from a compromised N-central server through the Take Control feature to customer devices.
- CI-40LOWLogging
Put centralized logging in place for critical systems.
Centralized logging of N-central administrative sessions and licensing activity would have surfaced the anomalous licensing signals observed on July 31 more quickly and correlated them with unauthorized admin access earlier in the timeline.
- CI-42MEDIUMAsset Management
Maintain an inventory of all internet-facing assets.
Maintaining an inventory of all internet-facing N-central server versions would have allowed operators to identify unpatched instances immediately when CVE-2026-18556's incomplete fix was disclosed, reducing exposure before CVE-2026-18577 was actively exploited.
BeyondTrust
· Identity / Remote Access · Attributed to ARMORY CASTLE (UNC5221 / Warp Panda), assessed as a China-nexus state-sponsored espionage group by Mandiant and Google GTIG
Zero-day exploitCredential theftThird-party / supply chainData exfiltrationBeginning in late August 2026, roughly seven weeks before public disclosure, the China-nexus group tracked as ARMORY CASTLE (also known as UNC5221 / Warp Panda) exploited CVE-2026-102764, a critical authentication bypass vulnerability (CVSS 9.3) in BeyondTrust Remote Support versions up to and including 26.2.3. The flaw, described by SecurityWeek and BeyondTrust as an improper validation issue allowing an unauthenticated remote attacker to perform file operations on an affected appliance, enabled attackers to escalate from a web service account to root-level control of the appliance host, granting access to every credential the appliance stored or handled. Post-exploitation activity, attributed to ARMORY CASTLE by Mandiant and Google Threat Intelligence Group during an incident response engagement, included deploying backdoors, modifying account permissions, pivoting to systems managed through the appliance, and deleting forensic artifacts. Attackers demonstrated detailed knowledge of BeyondTrust internal components, including command-line utilities and reverse-proxy routing. BeyondTrust patched SaaS tenants on October 9, 2026, and publicly disclosed the advisory (BT26-05) on October 15, 2026, instructing self-hosted customers to apply patch BT26-05-RS. CISA added CVE-2026-102764 to its Known Exploited Vulnerabilities catalog in response to confirmed active exploitation across critical infrastructure operators. Google GTIG and Mandiant warned of potential widespread exploitation following disclosure, drawing parallels to prior Ivanti exploitation waves conducted by the same actor.
The control that would have caught it
- CI-36CRITICALData
Encrypt sensitive customer data at rest (PII, PHI, payment card).
Credentials stored or handled by the BeyondTrust appliance were exposed once attackers reached root-level control; encrypting sensitive credential material at rest would have limited the usability of exfiltrated data even after the appliance was fully compromised.
- CI-23MEDIUMVulnerability Management
Run external vulnerability scans at least quarterly.
Regular external vulnerability scanning against internet-facing BeyondTrust appliances would have surfaced the exposure of affected versions (up to 26.2.3) and prompted earlier version tracking, narrowing the window between patch availability and deployment for self-hosted customers.
- CI-33CRITICALVendor Access
Log all vendor remote-access sessions.
Comprehensive logging of all sessions on the BeyondTrust appliance would have provided earlier forensic visibility into the unauthorized file operations and privilege escalation activity that ARMORY CASTLE conducted and then attempted to erase over the seven-week dwell period.
- CI-40LOWLogging
Put centralized logging in place for critical systems.
Centralized logging for the BeyondTrust appliance and the systems it managed would have allowed defenders to correlate anomalous root-level activity and lateral movement across managed endpoints, reducing the seven-week dwell time before detection.
Multiple North American Organizations (STAC4749 Campaign)
· Cross-sector · Attributed to STAC4749 (assessed by Sophos as financially motivated; Chaos ransomware linked with moderate confidence by Cisco Talos to former BlackSuit/Royal members)
RansomwareVishingData exfiltrationExtortionBetween February and June 2026, a threat cluster Sophos tracks as STAC4749 conducted a Microsoft Teams voice-phishing campaign targeting dozens of organizations across Canada and the United States. Operators impersonated IT helpdesk staff via Teams chats and calls, socially engineering employees into granting remote access through Microsoft Quick Assist and, from approximately April 2026 onward, the RemSupp RMM tool. Once inside, attackers installed additional remote-access tools including DWAgent and AnyDesk, attempted to enable RDP for lateral movement, and deployed a modular custom loader and backdoor. At least three intrusions culminated in Chaos ransomware deployment, with at least one victim having data exfiltrated beforehand in an apparent double-extortion arrangement. In at least one case, encryption was achieved in under 17 hours of initial access. STAC4749 continually evolved its attack chain throughout the campaign, cycling payload names, persistence labels, and delivery methods. Sophos assessed with high confidence that the group is financially motivated and either deployed ransomware directly or coordinated with affiliates.
The control that would have caught it
- CI-34HIGHAwareness
Provide security awareness training to all employees annually.
Employees were socially engineered into granting remote access after brief Teams calls averaging roughly two to two-and-a-half minutes; annual security awareness training covering vishing and IT-impersonation tactics would have reduced the likelihood of compliance.
- CI-35HIGHAwareness
Conduct phishing simulation exercises at least annually.
Regular phishing and vishing simulation exercises would have familiarized staff with the exact helpdesk-impersonation scenario STAC4749 used, making employees less likely to install remote-access tools on request.
- CI-32CRITICALVendor Access
Limit third-party vendor remote access to approved windows, with MFA.
STAC4749 abused legitimate RMM tools (Quick Assist, RemSupp, DWAgent, AnyDesk) to establish persistent remote access; restricting third-party and unsanctioned remote-access tools to approved, MFA-gated windows would have denied the attackers their primary foothold.
- CI-05CRITICALBackups
Take offline or immutable backups at least weekly.
Chaos ransomware encrypted systems in under 17 hours of initial access; offline or immutable backups taken at least weekly would have constrained recovery scope and reduced the leverage available to the extortion threat.
Kratos PhaaS Platform
· Cybercrime infrastructure · Attributed to Kratos PhaaS operator (developer arrested in Indonesia)
PhishingMFA gapCredential leakIdentityOn 20 July 2026, Germany's BKA and ZIT, working with the FBI Dallas Field Office and the US Attorney's Office for the Northern District of Texas, announced the dismantling of the Kratos Phishing-as-a-Service platform under Operation Olympus Blade. Indonesian authorities arrested the alleged developer and technical administrator. More than 200 servers were seized, and a seizure banner naming the operation was placed on the Kratos service website, with domain ownership transferred to the FBI. The BKA described Kratos as one of the most widespread and dangerous phishing kits in the world, with more than 1,800 criminal customers running approximately 15,000 phishing campaigns per month since at least 2024, generating more than €300,000 in criminal revenue. The platform primarily cloned Microsoft 365 sign-in pages and used an Adversary-in-the-Middle technique to steal session cookies alongside credentials, allowing attackers to bypass multi-factor authentication entirely. Approximately 850 victims were confirmed across 35 countries, with law enforcement estimating potential victims in the hundreds of thousands across more than 30 countries, concentrated in Europe and the United States. ANY.RUN research identified 148 suspected victim organizations concentrated in the US, Spain, and Southern Europe, while Forescout noted the campaign used rotating calendar-themed lures (tax themes in winter, seasonal invitations later) active since at least January 2026. Microsoft Threat Intelligence tracks the same kit as "SneakyLog," though KnowBe4 assessed Kratos evolved from an earlier infostealer family and the two research teams have not reconciled their accounts.
The control that would have caught it
- CI-01CRITICALMFA
Require multi-factor authentication on every email account.
Kratos used AiTM session-cookie theft precisely to defeat standard MFA on Microsoft 365 accounts; phishing-resistant MFA methods (such as hardware security keys or passkeys) bound to the legitimate origin would have prevented stolen cookies from granting access even after a victim submitted credentials to a fake portal.
- CI-18HIGHEmail Security
Configure anti-phishing policies (link scanning, spoofing protection).
The platform relied on mass delivery of convincing Microsoft 365 lure emails using rotating seasonal themes; anti-phishing policies with link scanning and spoofing protection would have blocked or flagged the fraudulent sign-in links before employees clicked them.
- CI-34HIGHAwareness
Provide security awareness training to all employees annually.
Kratos succeeded at scale partly because employees did not recognize fake Microsoft 365 login pages or seasonal-lure pretexts; annual security awareness training covering AiTM phishing and credential-harvesting pages would have reduced the number of victims who voluntarily submitted their credentials.
- CI-35HIGHAwareness
Conduct phishing simulation exercises at least annually.
Regular phishing simulation exercises using realistic Microsoft 365 lure templates would have measured and improved employee resistance to the exact social-engineering patterns Kratos customers deployed across approximately 15,000 campaigns per month.
SickKids
· Healthcare
Third-party / supply chainData exfiltrationData retentionIdentityOn July 9, 2026, SickKids (The Hospital for Sick Children in Toronto) identified unauthorized access to personal information belonging to current and former employees and job applicants, according to a letter sent to affected individuals and reviewed by CTV News. Reporting by CP24, Toronto Today, and BleepingComputer indicates the incident was caused by a vulnerability in a third-party software application used by SickKids and other organizations (the specific vendor has not been publicly named). The compromised system supported the hospital's external careers website (temporarily taken offline and subsequently restored) as well as certain Human Resources functions including payroll. Individuals who were part of the SickKids workforce between December 12, 2016 and August 31, 2018 may have had sensitive personal information on the affected system. Clinical systems and patient records were not impacted, and patient care continued without interruption. SickKids offered all potentially affected individuals 24 months of complimentary credit monitoring and identity protection services. The total number of individuals affected has not been disclosed publicly.
The control that would have caught it
- CI-32CRITICALVendor Access
Limit third-party vendor remote access to approved windows, with MFA.
The breach originated in a third-party software application with access to sensitive HR and careers data; scoping and time-windowing vendor remote access would have limited the attack surface available through that supplier.
- CI-33CRITICALVendor Access
Log all vendor remote-access sessions.
Logging all vendor remote-access sessions to the third-party application would have enabled earlier detection of the unauthorized access identified on July 9, 2026, potentially reducing the window of exposure.
- CI-45LOWPolicy
Document a data retention and disposal policy.
The exposed data included records of individuals employed between December 12, 2016 and August 31, 2018, held in an active third-party system nearly a decade later; a documented data retention and disposal policy would have prompted earlier purging of that aged HR data, reducing what was available to exfiltrate.
- CI-36CRITICALData
Encrypt sensitive customer data at rest (PII, PHI, payment card).
Encrypting sensitive employee and applicant personal information at rest within the third-party platform would have reduced the value and usability of any data accessed through the exploited vulnerability.
Tata Electronics (Apple & Tesla contract manufacturer)
· Electronics manufacturing / supply chain · Attributed to World Leaks (assessed rebrand of Hunters International)
Third-party / supply chainData exfiltrationExtortionIP / trade-secret theftThe headline-grabbing "confidential Apple files leaked on the dark web" was not a breach of Apple, it was a breach of Tata Electronics, an Indian contract manufacturer that builds iPhone components and assembled devices and is reported to account for roughly a third of Apple’s Indian iPhone output. The data-extortion group World Leaks (assessed by Group-IB as a rebrand of the former Hunters International operation, and now an extortion-only crew that steals and threatens to publish rather than encrypting) listed Tata on its leak site and claimed more than 630 GB across about 204,341 files. Researchers who reviewed a sample for Reuters said the trove appears to contain Apple supplier specifications and manufacturing documents, including a 52-page file carrying Apple’s proprietary markings detailing quality-inspection standards for iPhone circuit boards, plus Outlook email, SAP data, years of event logs, and employee passport scans; a separate set of files appears to include Tesla engineering documents. These contents are actor-claimed and only sample-verified, not fully confirmed by Apple or Tata. Tata confirmed it "identified a cybersecurity incident on some of [its] systems," said it activated its response protocols and saw "no impact on [its] operations," and declined to confirm whether Apple or Tesla data specifically was exposed; Apple is reportedly investigating and has not commented publicly. A ransom demand was reportedly made to Tata; no amount has been disclosed, and the initial access vector has not been disclosed. The durable lesson is supply-chain data exposure: Apple’s own perimeter was not the failure point, a vendor holding a copy of Apple’s confidential design data was.
The control that would have caught it
- CI-32CRITICALVendor Access
Limit third-party vendor remote access to approved windows, with MFA.
This is a third-party exposure: the breached systems belonged to a contract manufacturer holding Apple’s and Tesla’s confidential data, not to Apple or Tesla. Governing the vendors that hold or touch your sensitive data, access scoped to approved windows, MFA-gated, with contractual security and audit rights, is the control that keeps a supplier’s breach from becoming your IP leak.
- CI-37CRITICALData
Don’t store sensitive data in unauthorized locations.
The leaked cache reportedly mixed proprietary design specs with general-purpose systems, Outlook mailboxes, SAP, and years of event logs. Sensitive IP sprawling into everyday business systems (and onto a vendor’s estate) is exactly what data-location controls exist to prevent; the less your crown-jewel data proliferates, the less there is to steal.
- CI-36CRITICALData
Encrypt sensitive customer data at rest (PII, PHI, payment card).
Component specifications, trade-secret documents, and employee passport scans are precisely the categories that should be encrypted at rest, so that a copied file store is far less useful to an extortion crew than plaintext design documents.
- CI-45LOWPolicy
Document a data retention and disposal policy.
The reported trove included multi-year event logs and older records. A real data-retention-and-disposal schedule shrinks the blast radius of any breach, you cannot leak what was already purged on a clock.
Madison Square Garden Entertainment
· Entertainment / venues · Attributed to ShinyHunters
Data exfiltrationExtortionBiometric dataData retentionThe extortion group ShinyHunters published a trove of data it says it stole from Madison Square Garden Entertainment after MSG let a June 15 ransom deadline pass; the group says it took the data on June 5 and posted it on June 16. ShinyHunters claims roughly 42-45 GB (sources differ) and up to 26 million customer and corporate records, a figure that has not been independently verified, and MSG has not publicly confirmed the breach’s scope or commented. What stands out is the reported content: biometric facial-recognition surveillance logs, internal “threat assessment” dossiers ranking attendees by risk (reporting cited a “low risk” Ben Stiller and a “high risk” A Boogie wit da Hoodie), background checks, credit scores, and Social Security numbers. MSG has run facial recognition across its venues for years, including the contested practice of banning lawyers from firms that sue it. The entry point has not been disclosed, so the durable lesson is less about how attackers got in and more about how much sensitive data was retained to lose. A class action (Avalo v. MSG Entertainment) was filed June 17 in the Southern District of New York. It is MSG’s second disclosed incident in under a year: in February 2026 the Cl0p group exploited a zero-day (CVE-2025-61882) in a vendor-hosted Oracle E-Business Suite app used for MSG payroll and HR, exposing names, addresses, and SSNs of roughly 130,000 current and former employees.
The control that would have caught it
- CI-45LOWPolicy
Document a data retention and disposal policy.
The blast radius was set years before the breach, by retaining biometric surveillance logs, risk dossiers, background checks, credit scores, and SSNs. A real data-retention-and-disposal schedule that purges what is no longer needed is what shrinks a leak like this, you cannot lose what you have already deleted.
- CI-36CRITICALData
Encrypt sensitive customer data at rest (PII, PHI, payment card).
Biometric identifiers, Social Security numbers, and credit data are exactly the categories that should be encrypted at rest, so a copied database is far less useful to an extortion crew than plaintext dossiers.
- CI-32CRITICALVendor Access
Limit third-party vendor remote access to approved windows, with MFA.
MSG’s other 2026 breach ran through a vendor-hosted Oracle E-Business Suite application. Time-boxed, MFA-gated, logged third-party access is the control that keeps a partner’s system from becoming your breach.
- CI-03CRITICALMFA
Require MFA for every privileged and administrator account.
MSG has not disclosed this breach’s entry point, but ShinyHunters’ established playbook is identity compromise, social-engineering a login into cloud/SaaS, as in its Charter intrusion. Phishing-resistant MFA on every privileged and SaaS account is the control that blunts that pattern.
Fortinet FortiGate firewalls (FortiBleed campaign)
· Network edge / multi-sector
Credential leakNetwork edgeMFA gapA large-scale campaign nicknamed FortiBleed harvested working administrator and SSL-VPN credentials from internet-facing Fortinet FortiGate firewalls. Attackers pulled configuration files from exposed devices and cracked the stored credential hashes offline, older FortiOS versions stored admin passwords with a legacy, comparatively fast-to-crack SHA-256 scheme (Fortinet has since moved to a stronger PBKDF2 hash in FortiOS 7.2.11, 7.4.8, and 7.6.1). Researchers verified working credentials on roughly 30,000 devices, with broader estimates near 75,000, about half of all internet-facing Fortinet firewalls, across 194 countries. This was a credential-cracking campaign, not a zero-day: there is no single CVE behind FortiBleed.
The control that would have caught it
- CI-02CRITICALMFA
Require MFA for all remote access, VPN, RDP, and SSH.
A cracked password is worthless to an attacker who also needs a second factor on the VPN. MFA on all remote access is the control that turns a harvested credential into a non-event.
- CI-03CRITICALMFA
Require MFA for every privileged and administrator account.
The leaked logins were administrator credentials; MFA on every privileged account is what stops a cracked admin hash from becoming live access.
- CI-19HIGHNetwork
Do not expose Remote Desktop Protocol (RDP) directly to the internet.
The campaign only worked against firewalls whose management was reachable from the open internet; not exposing admin interfaces removes the attack surface entirely.
- CI-11HIGHPatching
Apply critical operating-system patches within 30 days of release.
Upgrading to a FortiOS version with stronger password hashing was core remediation guidance, applying critical OS patches promptly is what closes the underlying weakness.
Palo Alto Networks PAN-OS GlobalProtect (multiple victim organizations)
· Multi-sector · Attributed to Qilin (aka Agenda) RaaS affiliates
RansomwareData exfiltrationExtortionCredential leakBeginning as early as May 17, 2026, threat actors exploited CVE-2026-0257, an authentication bypass vulnerability (CVSSv4 7.8) in the Palo Alto Networks PAN-OS GlobalProtect portal and gateway, to establish unauthorized VPN sessions without credentials. Palo Alto Networks had disclosed the flaw and issued fixes (PAN-OS 10.2.10, 11.0.5, and 11.1.3) on May 13, 2026; CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on May 29, 2026, mandating federal agencies to remediate within three days, the same day the vendor updated the advisory to confirm active exploitation and raised the CVSSv4 score from 4.7 to 7.8. Arctic Wolf Labs investigated multiple intrusions in June 2026 sharing this initial access vector, all culminating in Qilin ransomware deployment. Post-exploitation activity included domain password hash theft, defense disabling, lateral movement via PsExec over administrative shares, ransomware staging in C:\PerfLogs\, and aggressive Windows event log clearing. In double-extortion cases, attackers exfiltrated data to cloud storage before encrypting victim systems domain-wide. Qilin, also known as Agenda, has operated as a Ransomware-as-a-Service since August 2022 and has been linked to over 2,000 victim organizations according to available reporting.
The control that would have caught it
- CI-11HIGHPatching
Apply critical operating-system patches within 30 days of release.
Palo Alto Networks issued fixed PAN-OS versions on May 13, 2026; organizations that applied critical OS-level patches within 30 days would have closed CVE-2026-0257 before Arctic Wolf observed the June 2026 Qilin intrusion cluster.
- CI-02CRITICALMFA
Require MFA for all remote access, VPN, RDP, and SSH.
The vulnerability allowed unauthenticated VPN session establishment; requiring MFA on all remote-access entry points, including GlobalProtect, would have added a credential barrier that the authentication-override cookie bypass alone could not satisfy.
- CI-36CRITICALData
Encrypt sensitive customer data at rest (PII, PHI, payment card).
Attackers exfiltrated data to cloud storage as part of double-extortion; encrypting sensitive customer data at rest would have limited the leverage gained from that exfiltration even after perimeter compromise.
- CI-40LOWLogging
Put centralized logging in place for critical systems.
Attackers aggressively cleared Windows event logs to hinder forensic reconstruction; centralized logging for critical systems, shipping events off-host in near real time, would have preserved the audit trail and accelerated detection of lateral movement via PsExec.
Charter Communications
· Telecommunications · Attributed to ShinyHunters
VishingIdentitySaaSMFA gapAccording to reporting, the extortion group ShinyHunters breached Charter Communications with no malware and no zero-day, a vishing (voice phishing) call compromised a Microsoft Entra identity account, which opened the door to Charter’s Salesforce environment, from which data was exfiltrated. The numbers are contested: ShinyHunters claimed more than 42 million records; Charter confirmed a breach but gave no figure, stating sensitive customer (CPNI) data was not exfiltrated. The breach-tracking service Have I Been Pwned later catalogued roughly 4.9 million unique email addresses from the leaked data. The entry method is the headline, a human, a convincing call, and a second factor that could be talked around.
The control that would have caught it
- CI-03CRITICALMFA
Require MFA for every privileged and administrator account.
The compromised account was an identity/admin login; carriers now expect phishing-resistant MFA (FIDO2 keys, passkeys) on privileged accounts, not just SMS or approve/deny push that a caller can talk a user through.
- CI-04CRITICALMFA
Require MFA for all cloud service consoles (AWS, Azure, M365 admin).
The path ran through Microsoft Entra into Salesforce; MFA on every cloud console is the control that keeps one social-engineered login from cascading across SaaS platforms.
- CI-34HIGHAwareness
Provide security awareness training to all employees annually.
The attack was a phone call. Security-awareness training that specifically covers vishing and help-desk impersonation is the human control that breaks the chain before MFA is ever tested.
- CI-35HIGHAwareness
Conduct phishing simulation exercises at least annually.
Simulated social-engineering exercises are how an organization proves staff can recognize the exact pretext used here, rather than relying on a once-a-year video.
Canvas (Instructure)
· Education / SaaS vendor · Attributed to ShinyHunters
Third-party riskSaaSVendor breachThe learning platform Canvas, run by Instructure and used across a large share of higher education, was breached twice in the span of two weeks. Unauthorized access began April 25; Instructure detected the intrusion and revoked access April 29 and posted initial disclosure May 1; a second incident on May 7 defaced login pages with a ransom message during final-exam season and was claimed by ShinyHunters. Instructure reported exposed data included names, email addresses, student ID numbers, and private messages, while stating it found no evidence that passwords, dates of birth, government IDs, or financial data were involved. Reporting tied the entry point to an issue connected to free teacher accounts and put affected institutions in the thousands; exact figures are still being established. The lesson: the attackers broke into the vendor schools depend on, not the schools themselves.
The control that would have caught it
- CI-32CRITICALVendor Access
Limit third-party vendor remote access to approved windows, with MFA.
Your data lives in vendors you don’t control. Limiting and governing third-party access, knowing which vendors hold your sensitive data and on what terms, is the third-party-risk control insurers price because they pay for it.
- CI-25HIGHIncident Response
Maintain a written incident response plan.
A written incident-response plan that covers a vendor breach (who you notify, on what timeline, how you contain access) is what separated organizations that fared well from those that scrambled.
- CI-43MEDIUMAsset Management
Monitor and address shadow IT (unapproved SaaS tools).
Free/unmanaged accounts were tied to the entry point; tracking shadow IT and unapproved SaaS is how an organization avoids inheriting a breach through a tool nobody vetted.
OnTrac (Lasership Inc.)
· Logistics / Delivery
Data exfiltrationCredential leakIdentityData retentionLasership Inc., doing business as OnTrac Final Mile, reported to the Maine Attorney General that unauthorized actors accessed a portion of its network between April 13 and April 15, 2025, with suspicious activity detected on April 15. The breach affected 40,017 individuals and exposed names, dates of birth, Social Security numbers, driver's license or state ID numbers, medical information, and health insurance information. OnTrac engaged third-party forensic specialists to investigate and stated that the data was re-secured and, as of the time of notification, had not been distributed or used to commit fraud. Notification letters were mailed to affected individuals on August 27, 2025, and 12 months of complimentary credit monitoring through TransUnion/CyberScout was offered. No ransomware or data extortion group had claimed responsibility at the time of reporting.
The control that would have caught it
- CI-36CRITICALData
Encrypt sensitive customer data at rest (PII, PHI, payment card).
Social Security numbers, medical information, and health insurance data were exposed in this breach; encrypting sensitive PII and PHI at rest would have reduced the value of any data accessed during the April 13–15 intrusion window.
- CI-45LOWPolicy
Document a data retention and disposal policy.
A documented data retention and disposal policy would limit how long highly sensitive data such as SSNs and PHI are held on network-accessible systems, shrinking the pool of records available to an intruder.
- CI-40LOWLogging
Put centralized logging in place for critical systems.
Centralized logging on critical systems would have supported faster detection of the unauthorized access and provided a clearer picture of which records were touched during the intrusion.
- CI-22MEDIUMNetwork
Segment the network, servers and workstations on separate VLANs.
Network segmentation separating systems holding employee or customer PII and PHI from general operational infrastructure would have limited the attacker's lateral reach during the confirmed two-day access window.
Salesforce & ServiceNow (multiple victim organizations)
· SaaS / Multi-sector
Data exfiltrationSaaSCredential leakThird-party / supply chainA campaign tracked by Reco as "City-Forum" has been systematically scraping Salesforce Experience Cloud sites and ServiceNow Service Portals since at least March 2025, with infrastructure (IP 158.220.87.79, hosted by German VPS provider Contabo) remaining stable for over 17 months. The attacker does not exploit software vulnerabilities; instead, the purpose-built Go-based tool (identifiable by its Go-http-client/1.1 user agent) abuses overly permissive guest-user configurations to extract data without authenticating. On Salesforce Aura sites the tool invokes HostConfigController.getConfigData and SelectableListDataProviderController.getItems; on newer LWR sites it sweeps Salesforce UI API GraphQL endpoints across versions v56.0 through v66.0 (a technique Reco says it had not previously seen documented). The tool also probes /SiteRegister and /CommunitiesSelfReg paths to test whether self-registration is enabled, which would elevate a guest to an authenticated external user. ServiceNow portals are targeted through a POST /api/now/sp/search endpoint that Reco says had almost no prior public documentation. Targeted sectors include telecommunications, banking and financial services, enterprise software vendors, security and data-privacy companies, and public-sector portals; the busiest single target logged over 560,000 events. Reco observed only guest-user activity but notes it cannot rule out authenticated access. The threat actor is unknown and the infrastructure is not linked to any named group; Reco notes surface similarity to ShinyHunters' separate Salesforce Aura campaign (disclosed March 2026, affecting around 100 high-profile companies and nearly 400 websites) but explicitly states there is no evidence tying City-Forum to that group.
The control that would have caught it
- CI-36CRITICALData
Encrypt sensitive customer data at rest (PII, PHI, payment card).
Sensitive customer records exposed through misconfigured Salesforce and ServiceNow guest-user sharing rules would have been unreadable to an unauthenticated scraper if encrypted at rest with keys not accessible to the guest context.
- CI-43MEDIUMAsset Management
Monitor and address shadow IT (unapproved SaaS tools).
Inventory and governance of approved SaaS configurations (including guest-user sharing rules and Experience Cloud site settings) would surface the overly permissive access that the City-Forum tool exploits before an attacker does.
- CI-40LOWLogging
Put centralized logging in place for critical systems.
Centralized logging of Aura, LWR, and ServiceNow portal requests, with alerting on the Go-http-client/1.1 user agent and the specific endpoint paths the tool uses, would have detected the campaign far earlier given that infrastructure persisted unchanged for over 17 months.
- CI-45LOWPolicy
Document a data retention and disposal policy.
A data retention and disposal policy limiting what records are stored in Salesforce and ServiceNow guest-accessible objects reduces the blast radius when guest sharing rules are misconfigured, as less data is available to scrape.
Snowflake customer accounts (UNC5537 campaign)
· Cloud data platform (multi-sector) · Attributed to UNC5537
Stolen credentialsCloudMFA gapInfostealerA financially motivated actor tracked by Mandiant as UNC5537 used login credentials stolen by infostealer malware to break into Snowflake cloud-database accounts that were not protected by multi-factor authentication. This was not a breach of Snowflake itself, it was customer accounts with no MFA, opened with passwords that had been harvested by earlier malware infections. Mandiant notified roughly 165 affected organizations; victims publicly tied to the campaign included Ticketmaster and AT&T, with AT&T disclosing that call and text records for about 110 million customers were taken. The takeaway: a cloud data warehouse is a console like any other, and a username and password alone is not enough to guard it.
The control that would have caught it
- CI-04CRITICALMFA
Require MFA for all cloud service consoles (AWS, Azure, M365 admin).
Every compromised account lacked MFA on the cloud console. Requiring MFA on all cloud service consoles is the single control that would have neutralized the stolen passwords.
- CI-09HIGHEndpoint
Deploy Endpoint Detection & Response (EDR) on all endpoints.
The credentials were harvested by infostealer malware on endpoints; managed EDR is what catches and kills that malware before it ships passwords to an attacker.
- CI-40LOWLogging
Put centralized logging in place for critical systems.
Centralized logging of cloud access is how a login from a brand-new location gets spotted and cut off before millions of records leave.
Change Healthcare (UnitedHealth Group / Optum)
· Healthcare / payments clearinghouse · Attributed to ALPHV/BlackCat
RansomwareMFA gapRemote accessA ransomware attack by the ALPHV/BlackCat group took down Change Healthcare, the clearinghouse that processes a large share of U.S. medical claims, disrupting pharmacies, providers, and payments for weeks. In Congressional testimony, UnitedHealth’s CEO said attackers got in through a Citrix remote-access portal that did not have multi-factor authentication enabled. UnitedHealth paid a ransom reported at $22 million. The company first put the toll at about 100 million people, then revised it upward in a later estimate reported as affecting roughly 190 million, figures that have shifted as the investigation continued, but that still rank it among the largest healthcare data breaches on record. A single remote-access door without a second factor undid one of the largest companies in U.S. healthcare.
The control that would have caught it
- CI-02CRITICALMFA
Require MFA for all remote access, VPN, RDP, and SSH.
The confirmed entry point was a remote-access portal with no MFA. Requiring MFA on all remote access (VPN, RDP, Citrix/SSH) is the exact control that would have stopped the initial intrusion.
- CI-09HIGHEndpoint
Deploy Endpoint Detection & Response (EDR) on all endpoints.
EDR on the servers reached after entry is what detects and contains ransomware staging before it detonates across the environment.
- CI-05CRITICALBackups
Take offline or immutable backups at least weekly.
Offline or immutable backups are the difference between restoring and paying; recovery here dragged on for weeks, exactly what tested, separated backups are meant to prevent.
MOVEit Transfer (Progress Software), Cl0p mass exploitation
· File transfer / supply chain (multi-sector) · Attributed to Cl0p
Zero-daySupply chainMass exploitationThe Cl0p extortion group mass-exploited a zero-day SQL-injection flaw (CVE-2023-34362) in Progress Software’s MOVEit Transfer, a widely used managed file-transfer product, stealing data from internet-facing servers before victims could patch. Because so many organizations moved sensitive files through MOVEit (often via a vendor or payroll/benefits provider rather than running it themselves), the blast radius was enormous and largely a supply-chain story: by independent tracking the campaign affected on the order of 2,700+ organizations and tens of millions of individuals. The lesson is that an internet-facing application you, or a vendor, run is part of your attack surface, and an emergency patch is only as good as how fast it is applied.
The control that would have caught it
- CI-12HIGHPatching
Apply critical application patches within 30 days of release.
This was an application vulnerability, not an OS one. Applying critical application patches fast, Progress shipped the emergency fix within days, is what shrank the window attackers had to pull data.
- CI-42MEDIUMAsset Management
Maintain an inventory of all internet-facing assets.
You cannot defend an exposed MOVEit server you forgot you had. An inventory of internet-facing assets is the prerequisite to patching or pulling them offline in an emergency.
- CI-39MEDIUMApplication
Inventory software dependencies and check them for known vulnerabilities.
Knowing which software, and which vendors’ software, touches your data is how you react in hours, not weeks, when a product like MOVEit is named in an advisory.
Sources, in full
- Huntress, "ConnectWise (SkyKick) Vendor Credentials Abused in M365 Attacks (Oct 16, 2026)", https://www.huntress.com/blog/vendor-credential-enables-unauthorized-access
- BleepingComputer, "Hackers breach Microsoft 365 tenants via ConnectWise supply-chain attack", https://www.bleepingcomputer.com/news/security/hackers-breach-microsoft-365-tenants-via-connectwise-supply-chain-attack/
- The Hacker News, "ConnectWise Suspends Cloud Backup After Attackers Compromise Microsoft 365 Tenants", https://thehackernews.com/2026/10/connectwise-suspends-cloud-backup-after.html
- Blumira, "ConnectWise Cloud Backup (SkyKick) Compromise", https://www.blumira.com/blog/connectwise-cloud-backup-skykick-compromise
- ConnectWise, "Cloud Backup Technical Investigation and Remediation Guide", https://www.connectwise.com/contentassets/10777cd3364d440c86ed5270a94a5f24/connectwise-cloud-backup-technical-investigation-and-remediation-guide-1.pdf
- DTU Official Advisory, "Cyberattack on DTU: notification of a personal data breach", https://www.dtu.dk/english/newsarchive/2026/10/cyberattack-on-dtu_notification-of-a-personal-data-breach
- BleepingComputer, "Danish university DTU breach exposes data of up to 200,000 people", https://www.bleepingcomputer.com/news/security/danish-university-dtu-breach-exposes-data-of-up-to-200-000-people/
- The Copenhagen Post, "DTU data breach may affect personal information of 200,000 current and former users", https://cphpost.dk/2026-10-02/life-in-denmark/dtu-data-breach-may-affect-personal-information-of-200000-current-and-former-users/
- Cybernews, "DTU university hacked, 200,000 people potentially exposed", https://cybernews.com/news/dtu-university-hacked-200000-people-potentially-exposed/
- Tech-Insider.org, "DTU breach: Datatilsynet and NSK GDPR probe 2026", https://tech-insider.org/dtu-breach-datatilsynet-nsk-gdpr-probe-2026/
- Bitget, "Official Security Notice", https://www.bitget.com/support/articles/12560603896024
- Bitget, "Official Incident Update (Fund Tracing and Recovery Bounty)", https://www.bitget.com/support/articles/12560603896108
- TRM Labs, "Bitget Loses $351.6 Million in Hot Wallet Breach in Likely North Korea Attack", https://www.trmlabs.com/resources/blog/bitget-loses-usd-3516-million-in-hot-wallet-breach-in-likely-north-korea-attack
- BleepingComputer, "Bitget resumes Bitcoin withdrawals after $387.5 million crypto heist", https://www.bleepingcomputer.com/news/security/bitget-resumes-bitcoin-withdrawals-after-3875-million-crypto-heist/
- Elliptic, "Bitget Attack Pushes Suspected North Korea Crypto Heists Over $1 Billion in 2026", https://www.elliptic.co/insights/bitget-attack-pushes-suspected-north-korea-crypto-heists-over-1-billion-in-2026/
- IC3 / FBI Joint Cybersecurity Advisory, "North Korean WaterPlum Advisory", https://www.ic3.gov/CSA
- Australian Cyber Security Centre (ACSC), "North Korean WaterPlum, commonly referred to as Contagious Interview, cyber actor group targeting IT professionals", https://www.cyber.gov.au/about-us/view-all-content/alerts-and-advisories/north-korean-waterplum-commonly-referred-to-as-contagious-interview-cyber-actor-group-targeting-it-professionals
- The Record, "North Korean hackers infect thousands of devices in WaterPlum scheme", https://therecord.media/north-korean-hackers-infect-thousands-of-devices-waterplum-scheme
- BleepingComputer, "North Korean WaterPlum hackers infected 30,000 devices worldwide", https://www.bleepingcomputer.com/news/security/north-korean-waterplum-hackers-infected-30-000-devices-worldwide/
- The Register, "North Korea's fake job interviews infected 30,000 devices", https://www.theregister.com/security/2026/09/18/north-koreas-fake-job-interviews-infected-30000-devices/5297461
- BleepingComputer, "Brevo supply chain attack injected ClickFix scripts on customer sites", https://www.bleepingcomputer.com/news/security/brevo-supply-chain-attack-injected-clickfix-scripts-on-customer-sites/
- Sansec, "Brevo Supply Chain Attack", https://sansec.io/research/brevo-supply-chain-attack
- GBHackers, "Brevo Widgets Supply Chain", https://gbhackers.com/brevo-widgets-supply-chain/
- Brevo Status Page (Official Post-Mortem), "SSO Incident Write-Up", https://status.brevo.com/incidents/pawbvhq8/write-up
- BleepingComputer, "Malicious Admin Menu Editor Pro plugin backdoors 1,500 WordPress sites", https://www.bleepingcomputer.com/news/security/malcious-admin-menu-editor-pro-plugin-backdoors-1-500-wordpress-sites/
- Windows Forum, "Admin Menu Editor Pro 2.35/2.36 backdoor: restore sites", https://windowsforum.com/news/admin-menu-editor-pro-2-35-2-36-backdoor-restore-sites.444522/?amp=1
- Microsoft Security Blog, "Passkey-themed social engineering leads to identity and cloud compromise", https://www.microsoft.com/en-us/security/blog/2026/09/09/passkey-themed-social-engineering-leads-identity-cloud-compromise/
- BleepingComputer, "Passkey-themed phishing attacks lead to Microsoft 365 data theft", https://www.bleepingcomputer.com/news/security/passkey-themed-phishing-attacks-lead-to-microsoft-365-data-theft/
- The Hacker News, "Attackers Use Passkey Phishing to Hijack Microsoft Cloud Accounts and Exfiltrate Data", https://thehackernews.com/2026/09/attackers-use-passkey-phishing-to.html
- Help Net Security, "Microsoft 365 social engineering via personal phones", https://www.helpnetsecurity.com/2026/09/10/microsoft-365-social-engineering-personal-phones/
- RH-ISAC, "Passkey-themed social engineering lures attempt to compromise identity and cloud platforms", https://rhisac.org/threat-intelligence/passkey-themed-social-engineering-lures-attempt-to-compromise-identity-and-cloud-platforms/
- N-able Status Page, "N-central 2026.3 Hotfix 4 (CVE-2026-86218)", https://status.n-able.com/2026/09/06/n-central-2026-3-hotfix-4-cve-2026-86218/
- CISA, "CISA Adds Four Known Exploited Vulnerabilities to Catalog", https://www.cisa.gov/news-events/alerts/2026/09/08/cisa-adds-four-known-exploited-vulnerabilities-catalog
- The Hacker News, "N-able Issues Fourth N-Central Hotfix", https://thehackernews.com/2026/09/n-able-issues-fourth-n-central-hotfix.html
- BleepingComputer, "N-able Patches Max-Severity N-Central Flaw Amid Ongoing Attacks", https://www.bleepingcomputer.com/news/security/n-able-patches-max-severity-n-central-flaw-amid-ongoing-attacks/
- TechNadu, "N-able Patches Max-Severity N-Central RCE Flaw CVE-2026-86218, Nearly 1,500 N-Central Servers Exposed", https://www.technadu.com/n-able-patches-max-severity-n-central-rce-flaw-cve-2026-86218-nearly-1500-n-central-servers-exposed/635622/
- BleepingComputer, "FulcrumSec claims Manchester Airports hack, theft of 86 GB of data", https://www.bleepingcomputer.com/news/security/fulcrumsec-claims-manchester-airports-hack-theft-of-86-gb-of-data/
- BleepingComputer, "Manchester Airports Group says hackers stole travelers' data", https://www.bleepingcomputer.com/news/security/manchester-airports-group-says-hackers-stole-travelers-data/
- Infosecurity Magazine, "Manchester Airports Data Breach", https://www.infosecurity-magazine.com/news/manchester-airports-data-breach/
- Security Affairs, "Extortion group FulcrumSec claims 86GB Manchester Airports Group data theft", https://securityaffairs.com/198143/cyber-crime/extortion-group-fulcrumsec-claims-86gb-manchester-airports-group-data-theft.html
- The Register, "Cybercrooks jet off with Manchester Airports Group customer data", https://www.theregister.com/security/2026/08/27/cybercrooks-jet-off-with-manchester-airports-group-customer-data/5292943
- SafePal Official Security Advisory, "Security Update", https://www.safepal.com/en/blog/security-update
- BleepingComputer, "SafePal data breach impacts 39,798 customers, stolen info for sale", https://www.bleepingcomputer.com/news/security/safepal-data-breach-impacts-39-798-customers-stolen-info-for-sale/
- The Block, "Wallet provider SafePal says data breach exposed personal info of nearly 40,000 customers", https://www.theblock.co/news/business/2026-08-16-wallet-provider-safepal-says-data-breach-exposed-personal-info-of-nearly-40000-customers-411934
- CryptoTimes, "Binance-backed SafePal data leak sparks phishing fears for 40k buyers", https://www.cryptotimes.io/2026/08/16/binance-backed-safepal-data-leak-sparks-phishing-fears-for-40k-buyers/
- Decrypt, "SafePal Bitcoin Wallet Data Breach", https://decrypt.co/375743/safepal-bitcoin-wallet-data-breach
- Truffle Security, "Leaked Corporate AWS Keys Held Full Admin Rights", https://trufflesecurity.com/blog/leaked-corporate-aws-keys-held-full-admin-rights
- BleepingComputer, "Hundreds of leaked AWS keys give full control over corporate accounts", https://www.bleepingcomputer.com/news/security/hundreds-of-leaked-aws-keys-give-full-control-over-corporate-accounts/
- Infosecurity Magazine, "Researchers: Thousands of Leaked AWS Keys Still Work", https://www.infosecurity-magazine.com/news/researchers-thousands-eaked-aws/
- SC Media, "Thousands of active AWS access keys remain publicly exposed", https://www.scworld.com/brief/thousands-of-active-aws-access-keys-remain-publicly-exposed
- JetBrains Blog, "Cadence Security Incident August 2026", https://blog.jetbrains.com/pycharm/2026/08/cadence-security-incident-august-2026/
- JetBrains Blog, "CVE-2026-63077", https://blog.jetbrains.com/teamcity/2026/07/cve-2026-63077/
- The Hacker News, "Attackers Breached JetBrains Cadence", https://thehackernews.com/2026/09/attackers-breached-jetbrains-cadence.html
- The New Stack, "JetBrains Told Everyone to Patch — It Didn't Patch Itself", https://thenewstack.io/jetbrains-told-everyone-to-patch-it-didnt-patch-itself/
- CISA, "CISA Adds One Known Exploited Vulnerability to Catalog", https://www.cisa.gov/news-events/alerts/2026/08/05/cisa-adds-one-known-exploited-vulnerability-catalog
- BleepingComputer, "Akira hackers disable EDR with Safe Mode, steal data, but fail to encrypt", https://www.bleepingcomputer.com/news/security/akira-hackers-disable-edr-with-safe-mode-steal-data-but-fail-to-encrypt/
- Huntress, "Akira Hits Safe Mode: Ransomware Rebooting Around EDR", https://www.huntress.com/blog/akira-hits-safe-mode-ransomware-rebooting-around-edr
- The Register, "Akira ransomware scum blocked victims' security tools and broke their own encryptor", https://www.theregister.com/research/2026/08/12/akira-ransomware-scum-blocked-victims-security-tools-and-broke-their-own-encryptor/5286515
- GBHackers, "Akira Ransomware Reboots Windows Into Safe Mode to Bypass EDR", https://gbhackers.com/akira-ransomware-reboots-windows/amp/
- CSO Online, "Akira ransomware reboots into Windows Safe Mode to knock EDR offline", https://www.csoonline.com/article/4209606/akira-ransomware-reboots-into-windows-safe-mode-to-knock-edr-offline.html
- N-able Blog, "N-central Security Update August 2, 2026", https://www.n-able.com/blog/n-central-security-update-august-2-2026
- N-able Blog, "N-central Security Update August 1, 2026", https://www.n-able.com/blog/n-central-security-update-august-1-2026
- N-able Status Page, "N-central 2026.3 Hotfix 1 Mitigation for CVE-2026-18577", https://status.n-able.com/2026/08/02/n-central-2026-3-hotfix-1-mitigation-for-cve-2026-18577/
- The Hacker News, "N-able Says Attackers Take Over N-central Servers", https://thehackernews.com/2026/08/n-able-says-attackers-take-over-n.html
- Huntress, "Rapid Response: Critical N-able N-central Vulnerability", https://www.huntress.com/blog/n-able-vulnerability-exploitation
- Google Cloud / Mandiant GTIG Blog, "ARMORY CASTLE Exploits BeyondTrust", https://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust
- SecurityWeek, "Chinese APT Exploited BeyondTrust Vulnerability as Zero-Day", https://www.securityweek.com/chinese-apt-exploited-beyondtrust-vulnerability-as-zero-day/
- Bleeping Computer, "BeyondTrust Patches Zero-Day Exploited in Attacks Since August", https://www.bleepingcomputer.com/news/security/beyondtrust-patches-zero-day-exploited-in-attacks-since-august/
- Infosecurity Magazine, "China Actor Exploited BeyondTrust Flaw, Google Reports", https://www.infosecurity-magazine.com/news/china-actor-beyondtrust-flaw-google/
- CSO Online, "BeyondTrust Zero-Day Tied to Chinese Spies Puts Remote Support Users on Alert", https://www.csoonline.com/article/4236421/beyondtrust-zero-day-tied-to-chinese-spies-puts-remote-support-users-on-alert.html
- FOITT/BIT, "Official Press Release on the SharePoint Incident", https://www.bit.admin.ch/de/newnsb/1CjmpBBHQaMV82PjKEpcL
- SWI swissinfo.ch, "Cyberattack on the Federal Office for Information Technology's SharePoint server", https://www.swissinfo.ch/eng/various/cyberattack-on-the-federal-office-for-information-technologys-sharepoint-server/91843136
- BleepingComputer, "Swiss government SharePoint breach compromised 200 accounts", https://www.bleepingcomputer.com/news/security/swiss-government-sharepoint-breach-compromised-200-accounts/
- SC Media, "Swiss Federal IT agency FOITT compromised about 200 accounts due to SharePoint flaws", https://www.scworld.com/brief/swiss-federal-it-agency-foitt-compromised-about-200-accounts-due-to-sharepoint-flaws
- CISA, "CISA Urges SharePoint Hardening After New Exploitations", https://www.cisa.gov/news-events/alerts/2026/07/14/cisa-urges-sharepoint-hardening-after-new-exploitations
- Sophos Threat Research Blog, "Chaos in Teams: Vishing", https://www.sophos.com/en-us/blog/chaos-in-teams-vishing
- BleepingComputer, "Microsoft Teams vishing attacks lead to Chaos ransomware attacks", https://www.bleepingcomputer.com/news/security/microsoft-teams-vishing-attacks-lead-to-chaos-ransomware-attacks/
- Cisco Talos Intelligence Blog, "New Chaos ransomware", https://blog.talosintelligence.com/new-chaos-ransomware/
- SC Media, "New Chaos ransomware group linked to BlackSuit amid site seizures", https://www.scworld.com/news/new-chaos-ransomware-group-linked-to-blacksuit-amid-site-seizures
- Windows Forum, "Microsoft Teams vishing leads to Chaos ransomware in under 17 hours", https://windowsforum.com/windows-news.4/microsoft-teams-vishing-leads-to-chaos-ransomware-in-under-17-hours.440732/
- Bundeskriminalamt (BKA), "Schlag gegen Phishing-Gruppierung Kratos", https://www.bka.de/SharedDocs/Kurzmeldungen/DE/Kurzmeldungen/260720_Schlag_gegen_Phishing_Gruppierung_Kratos.html
- BleepingComputer, "Police dismantle Kratos phishing platform, arrest developer", https://www.bleepingcomputer.com/news/security/police-dismantle-kratos-phishing-platform-arrest-developer/
- The Register, "German authorities lead takedown of Kratos phishing platform", https://www.theregister.com/security/2026/07/21/german-authorities-lead-takedown-of-kratos-phishing-platform/5275666
- ANY.RUN, "Kratos PhaaS targets US and EU: how to reduce Microsoft 365 account takeover risk", https://medium.com/@anyrun/kratos-phaas-targets-us-and-eu-how-to-reduce-microsoft-365-account-takeover-risk-5696ddc8ab09
- SC Media, "German authorities dismantle Kratos phishing-as-a-service infrastructure", https://www.scworld.com/brief/german-authorities-dismantle-kratos-phishing-as-a-service-infrastructure
- CP24 / CTV News, "SickKids responding to cybersecurity incident which compromised personal information of current, former employees", https://www.cp24.com/local/toronto/2026/08/20/sickkids-responding-to-cybersecurity-incident-which-compromised-personal-information-of-current-former-employees/
- Toronto Today, "SickKids cyber attack", https://www.torontotoday.ca/local/health/sickkids-cyber-attack-12688848
- BleepingComputer, "SickKids data breach exposes employee and job applicant info", https://www.bleepingcomputer.com/news/security/sickkids-data-breach-exposes-employee-and-job-applicant-info/
- MacRumors, “Confidential Apple Files Leaked on Dark Web After Supplier Cyberattack”, https://www.macrumors.com/2026/06/23/apple-files-leaked-dark-web-cyberattack/
- TechCrunch, “Tata Electronics, a major tech supplier to Apple and Tesla, confirms data breach”, https://techcrunch.com/2026/06/22/tata-electronics-a-major-tech-supplier-to-apple-and-tesla-confirms-data-breach/
- CNBC, “India’s Tata Electronics hit by cyber breach claiming to expose Apple, Tesla trade secrets”, https://www.cnbc.com/2026/06/23/indias-tata-electronics-hit-by-cyber-breach-claiming-to-expose-apple-tesla-trade-secrets.html
- Cybernews, “Tata Electronics breach exposes thousands of Apple, Tesla secret files”, https://cybernews.com/security/tata-electronics-breach-apple-tesla-secret-files/
- BleepingComputer, “Hunters International rebrands as World Leaks in shift to data extortion”, https://www.bleepingcomputer.com/news/security/hunters-international-rebrands-as-world-leaks-in-shift-to-data-extortion/
- The Next Web, “ShinyHunters published 45GB of Madison Square Garden data, including facial recognition surveillance records”, https://thenextweb.com/news/shinyhunters-madison-square-garden-45gb-data-leak-facial-recognition
- Bloomberg Law, “Madison Square Garden Sued After ShinyHunters Data Leak”, https://news.bloomberglaw.com/privacy-and-data-security/madison-square-garden-sued-after-shinyhunters-data-leak-news
- Front Office Sports, “Madison Square Garden Hit With Class Action Lawsuit Over Apparent Data Breach”, https://frontofficesports.com/madison-square-garden-hit-with-class-action-after-apparent-data-breach/
- UpGuard, “Data breach reported for Madison Square Garden Entertainment due to Oracle EBS breach” (February 2026 Cl0p incident), https://www.upguard.com/news/msg-entertainment-data-breach-2026-03-01
- Arctic Wolf, "Active FortiBleed Campaign Impacting Fortinet Devices Across 194 Countries", https://arcticwolf.com/resources/blog/active-fortibleed-campaign-impacting-fortinet-devices-across-194-countries/
- SOCRadar, "FortiBleed 2026: The Compromise of Fortinet FortiGate Firewalls and Credential Leak", https://socradar.io/blog/fortibleed-fortinet-firewalls-compromised/
- Kudelski Security, "Fortinet 'FortiBleed' Global Compromise & Active Exploitation", https://kudelskisecurity.com/research/fortinet-fortibleed-global-compromise-active-exploitation-of-fortinet-vulnerabilities
- Arctic Wolf Labs, "Cookie Crumbles: How Exploitation of CVE-2026-0257 Leads to Qilin Ransomware", https://arcticwolf.com/resources/blog/exploitation-of-cve-2026-0257-leads-to-qilin-ransomware/
- Palo Alto Networks, "CVE-2026-0257 Security Advisory", https://security.paloaltonetworks.com/CVE-2026-0257
- Rapid7, "ETR: Rapid7 Observed Exploitation of PAN-OS GlobalProtect Authentication Bypass Vulnerability CVE-2026-0257", https://www.rapid7.com/blog/post/etr-rapid7-observed-exploitation-of-pan-os-globalprotect-authentication-bypass-vulnerability-cve-2026-0257/
- CISA, "CISA Adds One Known Exploited Vulnerability to Catalog", https://www.cisa.gov/news-events/alerts/2026/05/29/cisa-adds-one-known-exploited-vulnerability-catalog
- BleepingComputer, "Critical GlobalProtect VPN Bug Now Exploited in Ransomware Attacks", https://www.bleepingcomputer.com/news/security/critical-globalprotect-vpn-bug-now-exploited-in-ransomware-attacks/
- BleepingComputer, "Charter confirms data breach after ShinyHunters extortion threat", https://www.bleepingcomputer.com/news/security/charter-confirms-data-breach-after-shinyhunters-extortion-threat/
- BleepingComputer, "Charter Communications data breach affects 4.9 million accounts" (Have I Been Pwned email count), https://www.bleepingcomputer.com/news/security/charter-communications-data-breach-affects-49-million-accounts/
- eSecurity Planet, "ShinyHunters Alleges 42M Records Stolen from Charter Communications", https://www.esecurityplanet.com/threats/shinyhunters-alleges-42m-records-stolen-from-charter-communications/
- Wikipedia, "2026 Canvas data breach", https://en.wikipedia.org/wiki/2026_Canvas_data_breach
- NPR, "Canvas data breach rattles colleges during finals period", https://www.npr.org/2026/05/08/nx-s1-5815956/canvas-data-breach-school-finals
- EdWeek, "A Cyberattack on Canvas Could Cause Lasting Aftershocks for Schools", https://www.edweek.org/technology/a-cyberattack-on-canvas-could-cause-lasting-aftershocks-for-schools/2026/05
- Maine Attorney General, "Consumer Protection: Privacy, Identity Theft and Data Security Breaches", https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/a060a232-510d-49db-96b0-96f0c2d807e7.html
- BleepingComputer, "OnTrac notifies customers of data breach after network hack", https://www.bleepingcomputer.com/news/security/ontrac-notifies-customers-of-data-breach-after-network-hack/
- CyberNews, "Thousands exposed via data breach of major American delivery company", https://cybernews.com/privacy/ontrac-delivery-company-data-breach/
- Strauss Borrelli PLLC, "OnTrac Data Breach Investigation", https://straussborrelli.com/2025/08/28/ontrac-data-breach-investigation/
- ClassAction.org, "OnTrac Data Breach Affects 40K, Exposes SSNs, More", https://www.classaction.org/data-breach-lawsuits/ontrac-august-2025
- Reco, "City-Forum Campaign: Salesforce & ServiceNow", https://www.reco.ai/blog/city-forum-campaign-salesforce-servicenow
- BleepingComputer, "City-Forum data theft attacks target Salesforce, ServiceNow portals", https://www.bleepingcomputer.com/news/security/city-forum-data-theft-attacks-target-salesforce-servicenow-portals/
- Help Net Security, "Salesforce, ServiceNow guest user exposure", https://www.helpnetsecurity.com/2026/08/12/salesforce-servicenow-guest-user-exposure/
- The Register, "Mystery attacker spent a year raiding Salesforce and ServiceNow portals", https://www.theregister.com/cyber-crime/2026/08/13/mystery-attacker-spent-a-year-raiding-salesforce-and-servicenow-portals/5287368
- Dark Reading, "Long-running data theft campaign targets Salesforce, ServiceNow", https://www.darkreading.com/cyberattacks-data-breaches/long-running-data-theft-campaign-salesforce-servicenow
- Mandiant (Google Cloud), "UNC5537 Targets Snowflake Customer Instances for Data Theft and Extortion", https://cloud.google.com/blog/topics/threat-intelligence/unc5537-snowflake-data-theft-extortion
- Snowflake, statement on targeted threat activity against customer accounts, https://www.snowflake.com/en/blog/detecting-investigating-supply-chain-threats/
- BleepingComputer, "AT&T confirms data for 110 million customers stolen in Snowflake attack", https://www.bleepingcomputer.com/news/security/atandt-confirms-data-for-110-million-customers-stolen-in-snowflake-attacks/
- Reuters, "UnitedHealth hackers took advantage of Citrix vulnerability to break in", https://www.reuters.com/technology/cybersecurity/unitedhealth-hackers-took-advantage-citrix-vulnerability-break-2024-05-01/
- U.S. Senate Finance Committee, testimony of UnitedHealth CEO Andrew Witty (May 1, 2024), https://www.finance.senate.gov/hearings/hacking-americas-health-care-assessing-the-change-healthcare-cyber-attack-and-whats-next
- HIPAA Journal, Change Healthcare cyberattack coverage, https://www.hipaajournal.com/change-healthcare-responding-to-cyberattack/
- CISA, "#StopRansomware: CL0P Ransomware Gang Exploits MOVEit Vulnerability" (AA23-158A), https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-158a
- Progress Software, MOVEit Transfer critical vulnerability advisory (CVE-2023-34362), https://www.progress.com/security/moveit-transfer-and-moveit-cloud-vulnerability
- Emsisoft, "Unpacking the MOVEit breach: Statistics and analysis", https://www.emsisoft.com/en/blog/44123/unpacking-the-moveit-breach-statistics-and-analysis/
Stay ahead of the next one
Get the Breach Roundup
New breaches plus the one control that would’ve stopped each, straight to your inbox. No spam, unsubscribe anytime.
Almost there 📨
Check your inbox to confirm your subscription. If you don’t see it in a couple of minutes, check spam.
Don’t end up on a tracker like this
Every incident above maps back to controls underwriters verify. Find your gaps for free, then fix them with the checklist.
Start here · free
Cyber Insurance Readiness Score
- 14 plain-English questions
- Instant 0-100 score & gap list
- No login, no email gate
Most popular
Cyber Insurance Prep Checklist
- All 47 controls underwriters verify
- Verify & fix steps for each control
- Required vs. premium-affecting vs. disqualifying
Best value
Complete Compliance Bundle
- Every checklist & hardening pack
- Cyber insurance, M365, AWS, Azure, SOC 2, PCI
- The full library at one price
Reported figures vary by source and were accurate as of publication; this page is general security commentary, not specific security or underwriting advice. By purchasing you agree to our Terms. Digital products are non-refundable once accessed. A checklist supports your application; it does not guarantee an underwriting decision.