Major Incidents or Breaches

  • Central Maine Healthcare experienced a data breach affecting over 145,000 individuals, exposing sensitive personal information.
  • Belgian hospital AZ Monica was forced to shut down all servers, cancel procedures, and transfer critical patients due to a cyberattack.
  • Betterment, a US digital investment advisor, confirmed a breach resulting in fake crypto-related emails being sent to customers.
  • Target source code samples were leaked and confirmed as authentic by employees, prompting an accelerated lockdown of internal systems.
  • JPMorgan disclosed that the law firm Fried Frank suffered a data security incident impacting high-profile clients.
  • Spanish energy company Endesa was hacked, resulting in the theft of customer data, including contact, payment, and national identity information.

Newly Discovered Vulnerabilities

  • Microsoft’s January 2026 Patch Tuesday addressed 114 vulnerabilities, including three zero-days (one actively exploited, two publicly disclosed). Updates also replaced expiring Secure Boot certificates and fixed vulnerabilities in Windows 10 and 11.
  • ServiceNow patched a critical AI platform vulnerability that allowed unauthenticated user impersonation, exposing customer data and systems.
  • Adobe released patches for 25 vulnerabilities, including a critical Apache Tika flaw in ColdFusion.
  • SAP’s January 2026 updates addressed 17 vulnerabilities, with four rated critical (including SQL injection, remote code execution, and code injection).
  • Broadcom Wi-Fi chipset vulnerability was disclosed, allowing attackers to disrupt networks on affected devices, including Asus routers.
  • Apple confirmed active exploitation of a vulnerability, with full protections available only for iPhones running iOS 26+.

Notable Threat Actor Activity

  • Ukrainian Defense Forces were targeted with PLUGGYAPE malware via Signal and WhatsApp in a charity-themed campaign between October and December 2025.
  • A long-running web skimming campaign, active since January 2022, has targeted major payment networks by stealing credit card data from online checkout pages.
  • A new malicious Chrome extension was discovered stealing MEXC cryptocurrency exchange API keys by posing as a trading tool.
  • The SHADOW#REACTOR campaign used multi-stage Windows attack chains and text-only files to deliver Remcos RAT, employing techniques to bypass detection and leverage native utilities.
  • Attackers are abusing Python and Cloudflare services to deliver AsyncRAT, leveraging legitimate cloud infrastructure and open source tools.
  • GoBruteforcer botnet is targeting crypto and blockchain projects, exploiting AI-generated server deployments with weak credentials and legacy web stacks.
  • Dutch port hacker sentenced to prison for planting remote access malware on a logistics firm’s systems, with insider assistance.

Trends, Tools, or Tactics of Interest

  • AI-powered deepfakes are being used to impersonate religious figures and solicit fraudulent donations from congregations.
  • Attackers are increasingly using agentic AI to automate and scale traditional attack techniques, optimising established playbooks rather than relying solely on novel exploits.
  • Phishing campaigns are leveraging LinkedIn comment-reply tactics, posting convincing fake replies to lure users into clicking malicious links.
  • AI agents such as Copilot, Claude Code, and Codex are now capable of building, testing, and deploying software autonomously, raising concerns about shadow API key sprawl and tool misuse.
  • Web skimming and supply chain attacks remain persistent threats, with campaigns demonstrating long-term stealth and adaptability.
  • CISO turnover is highlighted as a compounding risk factor for organisational security posture.
  • Data brokers are being scrutinised for selling sensitive health and personal profiles, as evidenced by regulatory fines.

Regulatory or Policy Developments

  • A data broker was fined by California regulators for selling sensitive information on Alzheimer’s patients and millions of other individuals.
  • Microsoft’s security updates and certificate rollouts have implications for compliance and device security baselines.
  • CrowdStrike announced the acquisition of browser security firm Seraphic for $420 million, following its agreement to acquire identity security startup SGNL for $740 million.