Major Incidents or Breaches

• Wynn Resorts confirmed an employee data breach following an extortion threat, with the ShinyHunters extortion group listing the company on its data leak site.
• CarGurus suffered a data breach exposing information of 12.4 million accounts, with ShinyHunters publishing the stolen personal information.
• ShinyHunters claimed responsibility for a breach at Dutch telecommunications provider Odido, reportedly affecting millions of user records.
• A phishing campaign by the “Diesel Vortex” threat group targeted freight and logistics organisations in the US and Europe, stealing credentials via 52 domains.
• Wynn Resorts, CarGurus, and Odido incidents all point to continued large-scale data theft and extortion targeting enterprises.
• Roblox faces a lawsuit from Los Angeles County over alleged failure to protect children from predators.
• A Taiwan security firm confirmed exploitation of a vulnerability in TeamT5 ThreatSonar Anti-Ransomware, likely by Chinese APTs.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Optimizely, a New York-based ad tech company, confirmed a data breach following a voice phishing (vishing) attack that led to unauthorised access to customer data.
• Vanta Diagnostics (formerly Vikor Scientific), a US healthcare diagnostics firm, reported a data breach affecting 140,000 individuals, attributed to the Everest ransomware group.
• The University of Mississippi Medical Center was forced to close all clinics and cancel elective procedures following a ransomware attack.
• PayPal disclosed that an application error led to a data breach, exposing customer personal information for nearly six months and resulting in fraudulent transactions.
• France’s Ministry of Economy disclosed a data breach, as noted in Check Point Research’s latest threat intelligence bulletin.

Newly Discovered Vulnerabilities

Notable Threat Actor Activity

• Arkanix Stealer, an information-stealing malware, emerged as a short-lived operation promoted on dark web forums towards the end of 2025. The malware was likely developed as an AI-assisted experiment, indicating ongoing interest in leveraging AI for cybercrime. The operation appears to have been discontinued, but demonstrates the continued experimentation with AI-driven infostealers by threat actors.

Trends, Tools, or Tactics of Interest

• Cybercriminals are increasingly employing advanced phishing techniques, including text-based attacks using social engineering and highly targeted spear phishing. The evolving tactics highlight the adaptation of threat actors to bypass traditional email security solutions.
• There is a growing comparison between Integrated Cloud Email Security (ICES) solutions and Secure Email Gateways (SEG), with emphasis on the need for organisations to evaluate their email security posture in response to evolving phishing threats.

Regulatory or Policy Developments Affecting the Security Industry

Major Incidents or Breaches

• Over 600 FortiGate firewalls in 55 countries were compromised over a five-week period by a Russian-speaking, financially motivated threat actor. The campaign leveraged commercial generative AI services for various stages of the attack, including reconnaissance, exploit development, and scripting. Amazon has issued warnings regarding the scale and sophistication of the breaches.

Newly Discovered Vulnerabilities

• A critical vulnerability (CVE-2026-2329) in Grandstream phone systems allows unauthenticated remote code execution with root privileges. Exploitation of this flaw could enable attackers to intercept calls and gain full control over affected devices.

Notable Threat Actor Activity

Major Incidents or Breaches

• Japanese tech company Advantest disclosed a ransomware attack impacting its corporate network, with ongoing investigation into potential compromise of customer and employee data.
• The University of Mississippi Medical Center (UMMC) closed all statewide clinics following a ransomware attack.
• A data breach at the French bank registry affected 1.2 million accounts, as confirmed by the French Ministry of Finance.
• PayPal notified customers of a data breach caused by a software error in a loan application, which exposed sensitive personal information, including Social Security numbers, for nearly six months.
• Age verification vendor Persona was found to have left its frontend exposed, enabling access to extensive identity and watchlist screening processes behind a basic age check.
• Attackers leveraged Facebook ads to distribute fake Windows 11 downloads, which delivered password-stealing malware targeting credentials and cryptocurrency wallets.

Newly Discovered Vulnerabilities

Major Incidents and Breaches

• The French Ministry of Economy reported unauthorized access to the national bank account registry (FICOBA), exposing 1.2 million bank accounts.
• Blockchain-based lender Figure confirmed a data breach after threat actor ShinyHunters leaked over 2GB of data, compromising nearly 1 million user records.
• German rail operator Deutsche Bahn experienced a large-scale DDoS attack that disrupted information and booking systems for several hours.
• Abu Dhabi Finance Week inadvertently exposed VIP passport details due to unprotected cloud storage.
• Intimate products company Tenga suffered a phishing attack, potentially exposing US customer data.
• A Nigerian national was sentenced to eight years in prison for hacking tax preparation firms in Massachusetts and filing fraudulent tax returns worth over $8.1 million.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Figure Technology Solutions suffered a data breach impacting nearly one million accounts, exposing personal and contact information.
• Betterment’s data breach is more severe than initially reported, with leaked data including sensitive personal and financial details.
• A vast online database containing billions of records, including Social Security Numbers, was found exposed and accessible, posing significant identity theft risks.

Newly Discovered Vulnerabilities

• Grandstream GXP1600 series VoIP phones are affected by a critical unauthenticated remote code execution vulnerability (CVE-2026-2329), allowing attackers root-level access and enabling call interception, toll fraud, and user impersonation.
• Four widely used Microsoft Visual Studio Code extensions (collectively over 125 million installs) were found to contain multiple vulnerabilities, potentially enabling threat actors to compromise developer environments.
• Multiple Honeywell CCTV products used in critical infrastructure are vulnerable to an authentication bypass flaw, allowing unauthorized access to video feeds and account hijacking.
• Dell RecoverPoint for Virtual Machines is affected by a maximum severity zero-day vulnerability (CVE-2026-22769), exploited since mid-2024 by a China-linked threat group (UNC6201) for lateral movement, persistence, and malware deployment.
• Foxit and Apryse PDF platforms contained 16 vulnerabilities that could be exploited for account takeover and data exfiltration via malicious documents or URLs.
• CISA has added a vulnerability in TeamT5’s ThreatSonar Anti-Ransomware to its Known Exploited Vulnerabilities (KEV) catalog; the issue was patched in 2024 but is being actively exploited.

Notable Threat Actor Activity

Major Incidents or Breaches

• Eurail confirmed a data breach with millions of user records being offered for sale on cybercrime forums. The full scope of affected individuals is still under investigation.
• Poland’s energy sector survived wiper attacks targeting wind and solar infrastructure, as well as a manufacturer and a heating/power plant. Russia-aligned groups are suspected.
• Singapore and its four major telecommunications providers successfully fended off a zero-day attack attributed to Chinese hackers.
• Microsoft Teams experienced a significant outage affecting users in the United States and Europe, causing delays and access issues.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Washington Hotel in Japan disclosed a ransomware attack that compromised its servers and exposed business data.
• Eurail B.V. confirmed that data stolen in a breach earlier this year is now being sold on the dark web. The breach impacted traveler data for the European rail operator.
• Dutch telecom provider Odido was hit by a data breach, as noted in Check Point’s weekly threat intelligence report.
• Dior, Louis Vuitton, and Tiffany were fined $25 million in South Korea following data breaches linked to attacks on Salesforce instances by the Scattered LAPSUS$ Hunters group.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• ShinyHunters, a known data extortion group, claims to have stolen over 600,000 Canada Goose customer records containing personal and payment-related information. Canada Goose is investigating the incident.

Newly Discovered Vulnerabilities

• Google released an emergency security update for Chrome to address CVE-2026-2441, a high-severity zero-day vulnerability that is being actively exploited in the wild.

Notable Threat Actor Activity

• ShinyHunters are responsible for the reported breach at Canada Goose, involving the leak of a large volume of customer records.
• CTM360 identified a campaign leveraging over 4,000 malicious Google Groups and 3,500+ Google-hosted URLs to distribute Lumma Stealer infostealer malware and a trojanized “Ninja Browser.”
• Multiple reports detail the ongoing use of ClickFix social engineering attacks. Recent variants abuse DNS (via nslookup) to retrieve PowerShell payloads and leverage Pastebin comments to distribute JavaScript targeting cryptocurrency users. These tactics are used for malware staging and to hijack crypto swaps.

Trends, Tools, or Tactics of Interest