Major Incidents or Breaches

• Hightower Holding Data Breach: Hightower Holding disclosed a data breach impacting 130,000 individuals. Attackers stole names, Social Security numbers, and driver’s license numbers.
• Ajax Football Club Hack: Ajax Amsterdam reported a breach in which a hacker exploited IT system vulnerabilities, accessing data of several hundred fans and enabling ticket hijacking.
• TeamPCP Supply Chain Attack: The TeamPCP supply chain campaign has expanded in scope, now included in CISA’s Known Exploited Vulnerabilities (KEV) catalog. Detection tools are available.
• LiteLLM Supply Chain Attack: A supply-chain attack on LiteLLM, a gateway used in AI agents, was dissected, highlighting the presence of malicious code designed to steal data.
• GlassWorm Attack: The GlassWorm attack campaign installs a fake browser extension for surveillance, hiding inside developer tools and enabling data theft and potential supply chain spread.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Russian law enforcement arrested the alleged administrator of LeakBase, a major stolen credential marketplace.
• Personal data of hundreds of HackerOne employees was compromised in a large-scale breach targeting Navia.
• A hacktivist group claims to have accessed sensitive data on millions of crime tipsters and those reported, with records dating back to 1987.
• Device code phishing campaigns have targeted over 340 Microsoft 365 organizations across five countries, abusing OAuth for initial access.
• Threat actors are leveraging the Bubble no-code app builder to create and host phishing sites targeting Microsoft account credentials.
• Ongoing phishing campaigns have impersonated Palo Alto Networks recruiters since August, using LinkedIn-scraped data to defraud job candidates.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• HackerOne disclosed a data breach impacting hundreds of employees, following a compromise of its US benefits administrator, Navia.
• Infinite Campus, a widely used K-12 student information system, warned of a data breach and extortion attempt, attributed to the ShinyHunters threat actor.
• The Dutch Ministry of Finance confirmed a breach affecting internal systems, detected in the previous week.
• QualDerm, a healthcare provider, suffered a breach impacting 3.1 million individuals, with personal, medical, and insurance data stolen.
• Extortion group Lapsus$ claimed to have compromised AstraZeneca, including internal code repositories, credentials, and employee data.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Mazda disclosed a security incident detected in December that exposed information belonging to employees and business partners.
• Crunchyroll is investigating claims of a data breach in which hackers allege theft of personal information for approximately 6.8 million users.
• Trio-Tech, a semiconductor services firm, reported a ransomware attack on a subsidiary in Singapore, resulting in file encryption.
• Navia Benefit Solutions, a U.S.-based employee benefits provider, was listed among recent victims in threat intelligence bulletins.
• Microsoft is addressing an ongoing issue affecting Exchange Online, intermittently preventing access to mailboxes via Outlook mobile and Mac desktop clients.
• Microsoft released emergency update KB5085516 to fix an issue breaking Microsoft account sign-ins across multiple apps, including Teams and OneDrive.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Threat actors are actively exploiting CVE-2025-32975 (CVSS 10.0), a critical vulnerability in Quest KACE Systems Management Appliance (SMA), to hijack unpatched systems. Arctic Wolf reported observed malicious activity targeting vulnerable appliances.
• There are indications that CVE-2026-21992, a critical vulnerability in Oracle Identity Manager allowing unauthenticated remote code execution, may have been exploited in the wild prior to the release of an emergency patch by Oracle.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• The Trivy vulnerability scanner was compromised in a supply chain attack attributed to the threat group TeamPCP. The attackers distributed credential-stealing malware via official Trivy releases and GitHub Actions, leading to the compromise of at least 47 npm packages with a self-spreading worm dubbed “CanisterWorm.”
• A cyberattack on a car breathalyzer firm resulted in operational disruption, leaving drivers unable to start their vehicles due to system outages.
• Iranian hackers conducted cyberattacks that disrupted medical care at hospitals in Maryland.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Navia Data Breach: Hackers accessed personal and health plan information of 2.7 million individuals from Navia’s environment between late December 2025 and mid-January 2026.
• Trivy Security Scanner GitHub Actions Breach: The Trivy open-source vulnerability scanner was compromised for the second time in a month, with attackers hijacking 75 tags to deliver malware aimed at stealing sensitive CI/CD secrets.
• Magento Defacement Campaign: Thousands of Magento sites, including e-commerce platforms, global brands, and government services, have been targeted in an ongoing defacement campaign since 27 February.
• Operation Alice: International law enforcement shut down over 373,000 dark web sites offering fake CSAM packages.
• Beast Gang Ransomware Server Exposure: The ransomware group exposed files on a central cloud server, revealing systematic targeting of network backups.
• Streaming Royalty Fraud: A North Carolina musician pleaded guilty to using AI bots to fraudulently collect over $10 million in streaming royalties from major music platforms.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Navia Benefit Solutions disclosed a data breach impacting approximately 2.7 million individuals, with sensitive information exposed to attackers.
• Security firm Aura reported a breach affecting 900,000 records after an employee was targeted via phone phishing, leading to data theft from a marketing tool.
• Marquis confirmed a data breach affecting 672,000 individuals, with previous estimates suggesting over 1.6 million may be impacted.
• Medical technology company Stryker suffered a destructive cyberattack that wiped around 80,000 devices. The FBI subsequently seized Handala hacktivist group’s data leak sites used to publicise the breach.
• Bitrefill, a crypto-powered gift card store, attributed a recent cyberattack to North Korean Lazarus (Bluenoroff) group activity.
• Ex-data analyst convicted of stealing company data and attempting to extort $2.5 million from Brightly Software while still employed as a contractor.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Aura, an identity protection company, confirmed a data breach exposing nearly 900,000 marketing contacts, including names and email addresses.
• Marquis, a Texas-based financial services provider, disclosed that a ransomware attack in August 2025 led to the theft of data belonging to 672,000 individuals and operational disruption.
• Nordstrom’s email system was abused to send cryptocurrency scam emails to customers from a legitimate company address.
• Stryker, a medtech company, continues recovery efforts following a cyberattack attributed to the Iranian-linked Handala group, likely using malware-stolen credentials.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• UK Companies House disclosed a vulnerability that exposed details of millions of firms, which could have been exploited to obtain sensitive company information and alter official records.
• Robotic surgery manufacturer Intuitive confirmed a cyberattack after an employee fell victim to a phishing scheme, resulting in unauthorised access to internal business applications.
• GlassWorm malware resurfaced in a supply-chain attack targeting over 400 code repositories and packages on GitHub, npm, VSCode, and OpenVSX, impacting the software supply chain.
• Sears exposed AI chatbot phone calls and text chats to the public web, allowing access to customer conversations containing contact information and personal details.
• LeakNet ransomware adopted the ClickFix technique via compromised websites for initial access and deployed a Deno-based in-memory loader, increasing stealth in attacks.
• The RondoDox botnet escalated its activity, targeting 174 vulnerabilities with up to 15,000 exploitation attempts per day.
• A phishing attack targeted cybersecurity firm Outpost24, using trusted brands and domains in an attempt to compromise C-suite credentials; the attack was unsuccessful.

Newly Discovered Vulnerabilities