Major Incidents or Breaches

• Ledger confirmed that cryptocurrency hardware wallets sold via Southeast Asian reseller CryptoBilis were compromised with unauthorized hardware implants, resulting in theft of user funds. Ledger has paused sales through the reseller pending investigation ^[4][8].
• Retail giant Ahold Delhaize took systems offline following a cybersecurity incident affecting its network ^[11].
• iRhythm disclosed a data breach impacting at least 360,000 individuals, with hackers stealing personal information including names, addresses, email addresses, dates of birth, and phone numbers ^[22].
• A cyberattack targeted Danfoss refrigeration controllers, remotely defrosting refrigerators and disrupting operations at multiple French supermarket chains ^[9].
• Denmark’s government disclosed a breach involving unauthorized access to sensitive information ^[26].
• A security failure involving the use of the password “123456” resulted in the exposure of almost 9 million individuals’ personal data ^[27].

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• A credential-theft campaign has compromised two high-profile open-source maintainer accounts, resulting in the deployment of malicious GitHub Actions workflows to over 34,000 repositories, enabling widespread credential stealing^[5].
• British retailer ASOS suffered a breach that demonstrated how compromising a single identity within a customer-facing SaaS application can enable deeper penetration into corporate networks^[14].
• An insider cyber extortion incident led to a former core infrastructure engineer deleting admin accounts, resetting hundreds of passwords, and demanding 20 bitcoin in ransom from an industrial firm^[21].

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• The British retailer ASOS suffered a breach that demonstrated how compromising a single user identity can enable attackers to penetrate deeper into a corporate network, highlighting risks associated with customer-facing SaaS platforms ^[13].
• The FBI arrested another suspected member of the ShinyHunters extortion group, believed to be involved in the recent breach of FBI systems and other high-profile attacks ^{[5][10][15][18]}.
• Germany arrested a Russian national alleged to be a core member of the Qilin ransomware group, following extradition from Japan ^[11].
• A former infrastructure engineer was sentenced to prison after an insider cyber extortion attempt against an industrial firm, involving deletion of admin accounts, resetting of hundreds of passwords, and a ransom demand ^[20].

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• ASOS confirmed that hackers stole customer personal details and shopping search histories, increasing the risk of targeted phishing attacks against affected customers ^[44].
• IDC Frontier disclosed a ransomware attack that disrupted its IDCF Cloud service, causing outages at a data center cluster serving government clients in Japan ^[23].
• Japanese organizations have experienced a sharp rise in personal data leaks, with attackers abusing mobile app APIs and exploiting known software vulnerabilities ^[14].
• Hackers hijacked the .gh, .sl, and .as country-code top-level domains (ccTLDs), obtaining HTTPS certificates for Google domains and enabling impersonation of trusted services ^[35][45].
• Over 17,000 malicious repositories were created on GitHub as part of the revived FakeGit malware campaign, distributing SmartLoader and StealC infostealer ^[25].
• A Ukrainian-Russian dual citizen pleaded guilty to operating a network of 15,000 money mules, laundering millions for cybercriminals worldwide ^[18].
• Low-cost Android phones in over 150 countries were found shipping with preinstalled residential proxy malware, dubbed ‘Midnight Mimosa’, enabling attackers to silently install apps and abuse devices as proxies ^[24][37].

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• ASOS confirmed a data breach resulting from a social engineering attack and credential theft, with personal data of customers accessed by attackers. Notifications have been sent to affected individuals ^[14].
• Attackers hijacked the .gh, .sl, and .as country-code top-level domain registries, obtaining unauthorized HTTPS certificates for several Google domains. Google stated its own systems were not breached, but domain hijacking and certificate misuse occurred ^[6][19].
• Oracle Health’s breach tally has increased to nearly 20 million affected individuals, significantly higher than previously reported figures ^[39].
• The FBI and other sources report ongoing FortiBleed attacks targeting Fortinet FortiGate firewalls and SSL VPN gateways. Attackers are creating new accounts, deleting existing ones, and locking out legitimate administrators ^[18][40].
• The decentralized crypto exchange Uranium Finance suffered two breaches in April 2021, with a hacker convicted for stealing over $53 million ^[12].
• Over 3,400 servers running exposed AI and LLM infrastructure have been infected with PoeLLM malware, which is being used to expand a cryptomining botnet ^[10][21].

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• UK retailer ASOS confirmed a data breach after hackers sent unauthorized push notifications via its mobile app, claiming to have stolen customer data from the company’s Snowflake environment. The breach was linked to a compromise of a third-party communication platform ^[20][35].
• Advantest Corporation disclosed that a ransomware attack earlier this year resulted in the theft of personally identifiable information from its servers ^[16][32].
• Southern Company reported that hackers accessed utility account information for approximately 400,000 customers of Georgia Power and Alabama Power ^[29].
• Researchers identified over 100 compromised websites injected with malicious JavaScript to deliver the LunexStealer information-stealing malware ^[9].
• Security researchers demonstrated the exploitation of 32 zero-day vulnerabilities on the first day of the Pwn2Own Ireland 2026 competition, including successful attacks against the Samsung Galaxy S26 ^[18].

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Denmark’s Central Population Register suffered a breach exposing names, addresses, and personal identification numbers of approximately 8.8 million individuals, including both living and deceased citizens. Attackers accessed the data via a company account with lawful access to the system ^[11][21][32].
• The FBI removed an Accenture contractor after their failure to apply a security patch led to the ShinyHunters breach, which resulted in the theft of personal information of thousands of FBI employees ^[10][27].
• Nikkei disclosed that attackers breached two employee email accounts, using one to send thousands of phishing emails ^[16].
• Domino’s customers were targeted in a credential stuffing attack, leading to account compromises and subsequent warnings issued to affected users ^[36].

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Denmark’s Central Population Register (CPR) reported a data breach exposing the personal information of approximately 8.8 million individuals, including names, addresses, and other sensitive data ^[8].
• Data breaches at Clover Health Investments and AngMar Management Services in New Jersey and Texas affected 250,000 patients, with stolen information including health records ^[24].
• Arizona’s state court system suffered a phishing attack, as noted in a weekly threat intelligence report ^[29].

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• A data breach at the Technical University of Denmark (DTU) exposed the information of up to 200,000 users after attackers accessed the university’s identity and access management system and downloaded a large amount of data ^[8].

Notable Threat Actor Activity

• A suspected member of the ShinyHunters extortion group, known as “Rey,” has reportedly been detained by authorities in Jordan and is cooperating with the FBI to identify other group members ^[1][7].
• The China-linked threat actor Warlock continues to exploit Microsoft SharePoint vulnerabilities, both old and potentially new, to disable security tools and deploy ransomware in attacks targeting organizations in Portuguese-speaking countries ^[4].
• The China-aligned TA419 group has launched credential phishing campaigns targeting AI experts at US think tanks, universities, and policy organizations using adversary-in-the-middle (AitM) phishing tactics ^[2].
• MI5 has reported that over 100 UK-linked academics have participated in research funded by China’s Ministry of State Security (MSS), supporting Beijing’s intelligence-gathering efforts ^[3].

Trends, Tools, or Tactics of Interest

Major Incidents or Breaches

• Frontline Education suffered a data breach affecting school district employees after attackers exploited a vulnerability in third-party software to gain unauthorized access and steal employee information ^[5].
• The Warlock ransomware group, linked to China, targeted a water utility, a telecom provider, a regional government body, and a university by exploiting SharePoint vulnerabilities for initial access ^[6].
• U.S. Treasury sanctioned eight members of the Tren de Aragua gang for involvement in ATM jackpotting attacks resulting in the theft of millions of dollars across the United States and Europe ^[8].
• Fake Zoom installers targeting macOS users were observed delivering the CloudSyncD backdoor, using a universal Mach-O binary extracted at runtime ^[22].

Newly Discovered Vulnerabilities