Cybersecurity Brief – 2026-01-14

Wed, 14 Jan 2026 00:00:00 +0000

Major Incidents or Breaches

Central Maine Healthcare experienced a data breach affecting over 145,000 individuals, exposing sensitive personal information.
Belgian hospital AZ Monica was forced to shut down all servers, cancel procedures, and transfer critical patients due to a cyberattack.
Betterment, a US digital investment advisor, confirmed a breach resulting in fake crypto-related emails being sent to customers.
Target source code samples were leaked and confirmed as authentic by employees, prompting an accelerated lockdown of internal systems.
JPMorgan disclosed that the law firm Fried Frank suffered a data security incident impacting high-profile clients.
Spanish energy company Endesa was hacked, resulting in the theft of customer data, including contact, payment, and national identity information.

Microsoft’s January 2026 Patch Tuesday addressed 114 vulnerabilities, including three zero-days (one actively exploited, two publicly disclosed). Updates also replaced expiring Secure Boot certificates and fixed vulnerabilities in Windows 10 and 11.
ServiceNow patched a critical AI platform vulnerability that allowed unauthenticated user impersonation, exposing customer data and systems.
Adobe released patches for 25 vulnerabilities, including a critical Apache Tika flaw in ColdFusion.
SAP’s January 2026 updates addressed 17 vulnerabilities, with four rated critical (including SQL injection, remote code execution, and code injection).
Broadcom Wi-Fi chipset vulnerability was disclosed, allowing attackers to disrupt networks on affected devices, including Asus routers.
Apple confirmed active exploitation of a vulnerability, with full protections available only for iPhones running iOS 26+.

Ukrainian Defense Forces were targeted with PLUGGYAPE malware via Signal and WhatsApp in a charity-themed campaign between October and December 2025.
A long-running web skimming campaign, active since January 2022, has targeted major payment networks by stealing credit card data from online checkout pages.
A new malicious Chrome extension was discovered stealing MEXC cryptocurrency exchange API keys by posing as a trading tool.
The SHADOW#REACTOR campaign used multi-stage Windows attack chains and text-only files to deliver Remcos RAT, employing techniques to bypass detection and leverage native utilities.
Attackers are abusing Python and Cloudflare services to deliver AsyncRAT, leveraging legitimate cloud infrastructure and open source tools.
GoBruteforcer botnet is targeting crypto and blockchain projects, exploiting AI-generated server deployments with weak credentials and legacy web stacks.
Dutch port hacker sentenced to prison for planting remote access malware on a logistics firm’s systems, with insider assistance.

AI-powered deepfakes are being used to impersonate religious figures and solicit fraudulent donations from congregations.
Attackers are increasingly using agentic AI to automate and scale traditional attack techniques, optimising established playbooks rather than relying solely on novel exploits.
Phishing campaigns are leveraging LinkedIn comment-reply tactics, posting convincing fake replies to lure users into clicking malicious links.
AI agents such as Copilot, Claude Code, and Codex are now capable of building, testing, and deploying software autonomously, raising concerns about shadow API key sprawl and tool misuse.
Web skimming and supply chain attacks remain persistent threats, with campaigns demonstrating long-term stealth and adaptability.
CISO turnover is highlighted as a compounding risk factor for organisational security posture.
Data brokers are being scrutinised for selling sensitive health and personal profiles, as evidenced by regulatory fines.

A data broker was fined by California regulators for selling sensitive information on Alzheimer’s patients and millions of other individuals.
Microsoft’s security updates and certificate rollouts have implications for compliance and device security baselines.
CrowdStrike announced the acquisition of browser security firm Seraphic for $420 million, following its agreement to acquire identity security startup SGNL for $740 million.