Major Incidents or Breaches

• Over 300 malicious Chrome extensions, with a combined total of more than 37 million downloads, have been identified leaking or stealing user data, exposing users to tracking and personal information theft.
• Threat actors are conducting physical mail-based attacks targeting users of Trezor and Ledger cryptocurrency hardware wallets. The letters impersonate the companies and attempt to trick recipients into disclosing their wallet recovery phrases, enabling cryptocurrency theft.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Dutch telecommunications provider Odido disclosed a data breach impacting 6 million customers, with hackers stealing personal information including names, addresses, and phone numbers from a customer contact system.
• South Korea fined luxury brands Louis Vuitton, Christian Dior Couture, and Tiffany a combined $25 million for failing to implement adequate security measures, which resulted in unauthorized access and data breaches.
• Researchers identified malicious Google Chrome extensions stealing data associated with Meta Business Suite and Facebook Business Manager; a total of 30 credential-stealing Chrome extensions have been uncovered.
• Threat actors are abusing Claude LLM artifacts and Google Ads in ClickFix campaigns to deliver infostealer malware to macOS users.
• Fake online shops are targeting fans of the Winter Olympics 2026, with nearly 20 fraudulent sites identified selling counterfeit merchandise.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Dutch telecommunications provider Odido suffered a cyberattack resulting in exposure of personal data belonging to 6.2 million customers.
• Romania’s national oil pipeline operator Conpet S.A. confirmed data theft by the Qilin ransomware gang.
• ApolloMD disclosed a data breach impacting 626,000 individuals, with patient information from affiliated physicians and practices stolen.
• Hackers breached Senegal’s national biometric database, compromising personal and biometric data of nearly 20 million residents.
• The Outlook add-in AgreeTo, after being abandoned by its developer, was repurposed into a phishing kit that stole 4,000 credentials and payment data.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• The Conduent data breach has impacted at least 25 million individuals, including nearly 17,000 Volvo Group employees whose data was exposed.
• The AgreeTo Outlook add-in was hijacked and used as a phishing kit, resulting in the theft of over 4,000 Microsoft account credentials.
• A surge in LummaStealer infections has been reported, linked to campaigns using the CastleLoader malware and the ClickFix social engineering technique.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Warlock (Storm-2603) ransomware gang breached SmarterTools by exploiting an unpatched SmarterMail server on 29 January 2026.
• Volvo Group North America reported a customer data exposure due to a breach at Conduent, an IT services provider.
• Dutch Data Protection Authority and the Council for the Judiciary in the Netherlands confirmed cyberattacks exploiting Ivanti zero-day vulnerabilities, leading to exposure of employee contact data.

Newly Discovered Vulnerabilities

• Microsoft’s February 2026 Patch Tuesday addressed 58–60 vulnerabilities, including six zero-days (three actively exploited security feature bypass flaws) and three publicly disclosed vulnerabilities. Updates apply to Windows, Microsoft Edge, and other Microsoft products.
• Fortinet released patches for a critical SQL injection vulnerability in FortiClientEMS (CVE identifier not specified) that allows unauthenticated remote code execution.
• Adobe fixed 44 vulnerabilities in its Creative Cloud applications, several of which are critical and could allow arbitrary code execution.
• SAP patched 26 new and one updated vulnerability in CRM, S/4HANA, and NetWeaver products, including critical issues.
• Siemens, Schneider, Aveva, and Phoenix Contact issued patches for vulnerabilities in their industrial control systems as part of ICS Patch Tuesday.
• Microsoft began rolling out new Secure Boot certificates in Windows updates to replace expiring 2011 certificates, ahead of their June 2026 expiration.

Notable Threat Actor Activity

Major Incidents or Breaches

• Chinese threat actor UNC3886 breached Singapore’s four largest telecommunications providers (Singtel, StarHub, M1, Simba) in a targeted cyber espionage campaign. The intrusions were confirmed by Singapore’s Cyber Security Agency.
• The European Commission disclosed a breach involving its mobile device management platform, exposing staff data. An investigation is ongoing.
• SmarterTools suffered a ransomware breach by the Warlock gang, who exploited vulnerabilities in SmarterMail. The attack compromised internal systems but did not impact business applications or customer account data.
• A security researcher discovered an exposed database for the Chat & Ask AI app, leaking 300 million messages linked to 25 million users due to a Firebase misconfiguration.
• Two Connecticut men were charged in the US for defrauding FanDuel and other gambling sites of $3 million using the stolen identities of approximately 3,000 individuals.
• Malicious actors are deploying fake 7-Zip download sites, infecting home PCs and converting them into residential proxy nodes.
• Romania’s national oil pipeline operator, Conpet, was targeted in a cyberattack, as reported in Check Point’s weekly threat intelligence bulletin.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• BridgePay, a major U.S. payment gateway provider, confirmed a ransomware attack that caused significant outages across its services. The incident began on Friday and resulted in key systems being taken offline.
• Moltbook, a social network for AI agents, exposed personal data belonging to real users. The exposure was not limited to AI-generated content but included sensitive information about actual individuals.

Newly Discovered Vulnerabilities

• Organizations have been urged to replace discontinued edge devices following reports that unsupported hardware is being actively targeted by state-sponsored threat actors. The US government has highlighted ongoing attacks exploiting vulnerabilities in these obsolete devices.

Notable Threat Actor Activity

Major Incidents or Breaches

• BridgePay, a major U.S. payment gateway provider, confirmed a ransomware attack resulting in a widespread outage and disruption of multiple services. The incident began on Friday and impacted key systems.

• Moltbook, a social network platform for AI agents, exposed personal data belonging to real human users due to a security lapse.

Newly Discovered Vulnerabilities

• US authorities warned that discontinued edge devices lacking vendor support are being actively targeted in attacks by state-sponsored hackers.

Notable Threat Actor Activity

Major Incidents or Breaches

• Flickr has disclosed a potential data breach caused by a vulnerability at a third-party email service provider, exposing users’ real names, email addresses, IP addresses, and activity data.
• An Illinois man has pleaded guilty to hacking nearly 600 women’s Snapchat accounts to steal, sell, or trade private photos.
• Compromised npm and PyPI packages associated with dYdX have been used to deliver wallet stealers and remote access trojans (RATs) in a new software supply chain attack.
• Germany’s domestic intelligence agency has warned of suspected state-sponsored phishing attacks targeting high-ranking individuals via the Signal messaging app.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Spain’s Ministry of Science has partially shut down IT systems following breach claims, disrupting several citizen- and company-facing services.
• Rome’s La Sapienza University suffered a cyberattack causing widespread operational disruptions.
• Romanian oil pipeline operator Conpet disclosed a cyberattack that disrupted business systems and took down its website; the Qilin ransomware group is reportedly involved.
• Newsletter platform Substack notified users of a data breach after attackers stole email addresses and phone numbers (approx. 700,000 records) in October 2025.
• Fintech firm Betterment reported a breach exposing email addresses and personal information of 1.4 million accounts in January.
• Zendesk users experienced a renewed spam wave, with inboxes flooded by “Activate account” emails due to abuse of unsecured support systems.
• SystemBC malware remains active post law enforcement takedown, infecting over 10,000 devices and continuing to deliver ransomware and proxy traffic.
• VS Code configuration files in GitHub Codespaces were found to automatically execute when opening repositories or pull requests, exposing users to potential attacks.

Newly Discovered Vulnerabilities