Major Incidents or Breaches

• Brightspeed, a major US broadband provider, is investigating claims of a security breach and data theft made by the Crimson Collective extortion gang. The group alleges theft of personal information of over 1 million customers.
• Sedgwick confirmed a cyberattack on a file transfer system at its government subsidiary, affecting agencies it serves.
• Ledger notified customers of a data breach at third-party payment processor Global-e, resulting in exposure of personal data.
• Multiple corporate data theft incidents have been linked to threat actor Zestix, who breached ShareFile, Nextcloud, and OwnCloud instances and is offering stolen data from dozens of companies.
• Artisans’ Bank and VeraBank, two US banks, disclosed security incidents.
• NordVPN denied breach claims, stating that attackers only accessed dummy data from a third-party automated testing platform.
• No evidence of cyberattack was found in the communications failure that grounded flights in Greece.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• The ShinyHunters hacking group claims to have breached cybersecurity firm Resecurity and stolen internal data. Resecurity states the attackers only accessed a honeypot system, not production infrastructure or sensitive client data.

Notable Threat Actor Activity

• ShinyHunters publicly claimed responsibility for the alleged breach of Resecurity, posting purported evidence of internal data access.

Trends, Tools, or Tactics of Interest

• Cryptocurrency scam emails and fraudulent web pages have been observed increasing at the start of 2026, targeting users with social engineering tactics to steal funds or credentials.
• Continued proliferation of sophisticated spyware targeting both iOS and Android devices is noted, with experts highlighting the need for vigilance and up-to-date security practices.

Regulatory or Policy Developments Affecting the Security Industry

Major Incidents or Breaches

• The ShinyHunters hacking group claims to have breached cybersecurity firm Resecurity and exfiltrated internal data. Resecurity states that the attackers only accessed a honeypot system and no sensitive information was compromised.

Notable Threat Actor Activity

• ShinyHunters, a known hacking group, publicly claimed responsibility for the alleged breach of Resecurity, continuing their pattern of targeting high-profile organisations.

Trends, Tools, or Tactics of Interest

• Experts continue to warn about the proliferation of sophisticated spyware targeting both iPhone and Android devices, advising heightened vigilance and protective measures for all users.
• Cryptocurrency scam campaigns via emails and fraudulent web pages remain active, with increased activity observed as 2026 approaches.

Regulatory or Policy Developments

Major Incidents or Breaches

• Covenant Health confirmed a data breach impacting nearly 478,000 individuals, with attribution to the Qilin ransomware group. Data was stolen from systems in May 2025.
• Ongoing cryptocurrency thefts have been traced to the 2022 LastPass breach, with attackers draining wallets years after the theft of encrypted vaults.
• Trust Wallet reported that approximately $8.5 million was stolen from over 2,500 crypto wallets, likely linked to the “Shai-Hulud” NPM supply chain attack in November, described as an industry-wide compromise.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Researchers have disclosed a persistent nine-month campaign by the RondoDox botnet, which has hijacked IoT devices and web applications by exploiting a critical vulnerability (React2Shell). Compromised devices are being enrolled into the botnet for further malicious activity.
• A new wave of the GlassWorm malware campaign is targeting macOS developers. Attackers are distributing trojanized crypto wallet applications via malicious VSCode/OpenVSX extensions.

Newly Discovered Vulnerabilities

• The React2Shell vulnerability has been identified as a critical flaw actively exploited by the RondoDox botnet to compromise IoT devices and web servers.

Notable Threat Actor Activity

Major Incidents or Breaches

• Trust Wallet Chrome Extension Hack: Trust Wallet disclosed that a supply chain attack involving the Shai-Hulud worm in November 2025 compromised its Chrome extension, resulting in the theft of $8.5 million from 2,520 wallets. The attacker exploited exposed developer GitHub secrets to publish a backdoored browser extension.
• Unleash Protocol Hack: The decentralized intellectual property platform Unleash Protocol suffered a loss of approximately $3.9 million in cryptocurrency after an unauthorized contract upgrade enabled asset withdrawals, attributed to a multisig hijack.
• European Space Agency Breach: The European Space Agency confirmed that external science servers were compromised and that a hacker is offering to sell stolen data. An investigation is ongoing.
• DarkSpectre Browser Extension Campaigns: The threat actor behind previous ShadyPanda and GhostPoster campaigns has been attributed to a third campaign, DarkSpectre, impacting 2.2 million users. In total, the campaigns have affected 8.8 million users worldwide.
• Ivanti EPMM Attacks: April/May zero-day exploitations of Ivanti’s mobile device management platform resulted in the compromise of thousands of organisations by a Chinese APT.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• The European Space Agency (ESA) confirmed a breach of external servers containing unclassified information related to collaborative engineering and project management activities. The compromised systems were outside ESA’s corporate network.
• Korean Air reported that data belonging to approximately 30,000 employees was stolen following a breach at its former subsidiary KC&D, which was linked to an Oracle E-Business Suite (EBS) hack.
• Two former employees of cybersecurity incident response firms Sygnia and DigitalMint pleaded guilty to conducting BlackCat (ALPHV) ransomware attacks against U.S. companies in 2023.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Coupang, South Korea’s largest retailer, will compensate 33.7 million customers with $1.17 billion following a data breach that exposed customer information.
• Aflac suffered a data breach affecting 22 million individuals, with hackers stealing names, addresses, Social Security numbers, ID numbers, and medical/health insurance information.
• Sax, a major US accounting firm, disclosed a 2024 data breach impacting 220,000 individuals; the investigation took over a year.
• Korean Air experienced a data breach affecting thousands of employees after its in-flight catering supplier, KC&D, was hacked.
• Trust Wallet reported that attackers compromised its browser extension, draining approximately $7 million from 2,596 cryptocurrency wallets.
• Romanian energy provider Oltenia Energy Complex was hit by a Gentlemen ransomware attack, disrupting its IT infrastructure.
• A hacker claimed theft of 40 million Condé Nast records following a Wired data leak, with 2.3 million Wired subscriber records made public.
• The EmEditor website was compromised in a supply chain attack, serving a malicious installer that delivered infostealer malware.
• Over 90% of parked domains now lead users to scams or malware, a significant increase from less than 5% a decade ago.
• A Lithuanian national was arrested for distributing clipboard-stealing malware disguised as KMSAuto, infecting 2.8 million systems.
• A former Coinbase support agent was arrested in India for assisting hackers in stealing sensitive customer information from a company database.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• A hacker claims to have breached Condé Nast and leaked an alleged WIRED database containing more than 2.3 million subscriber records. The attacker also stated intentions to release up to 40 million additional records.
• Ubisoft’s Rainbow Six Siege experienced a breach where attackers abused internal systems to ban and unban players, manipulate in-game moderation feeds, and grant players large amounts of in-game currency.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Ubisoft’s Rainbow Six Siege experienced a significant breach in which attackers exploited internal systems to ban and unban players, manipulate in-game moderation feeds, and grant players billions of in-game credits. The incident exposed weaknesses in the game’s backend infrastructure and moderation controls.

Newly Discovered Vulnerabilities

• A high-severity vulnerability in MongoDB (CVE-2025-14847, CVSS 8.7) was disclosed, allowing unauthenticated attackers to read uninitialized heap memory. This flaw could potentially expose sensitive data processed by the database.

Notable Threat Actor Activity