Researchers have discovered methods to bypass Windows 11's strongest security defenses without physical access to the machine, though the attack requires the attacker to already possess privileged system access. Last week also saw reports of records allegedly stolen from Azure tenants and Medusa ransomware targeting over 500 organizations, along with law enforcement actions against cybercrime operations.
The private equity firm said attackers broke into some of its cloud platforms during a five-day period in early July, compromising sensitive personal data. The post Apollo discloses data breach from ongoing wave of attacks hitting financial sector appeared first on CyberScoop.
Canada's Hospital for Sick Children has suffered another cybersecurity incident involving theft of employee data, reportedly linked to a vulnerability in a third-party software application. This marks the second significant attack on the institution, following a 2022 ransomware incident that disrupted hospital systems.
Russian network monitoring firm Microolap has confirmed a cyberattack claimed by pro-Ukraine hacking group Black Spark, which alleged it maintained access to the company's network for over a month. The attackers claimed to have compromised internal systems including EtherSensor, Microolap's network traffic analysis platform, according to statements made by the threat group.
This week's cybersecurity landscape spans government agencies, retailers, and software platforms, with France's tax authority confirming a breach affecting 678,000 individuals' tax and property information, Ukraine's asset recovery agency facing a suspected coordinated cyberattack ahead of a critical tender, and a critical GitLab vulnerability allowing unauthenticated attackers to delete public projects. Enterprise AI adoption is simultaneously expanding the threat surface through shadow AI, data leakage, insecure integrations, and prompt injection risks, while incidents like the Oz Hair and Beauty breach underscore ongoing risks to customer data across sectors.
Healthcare technology provider CareCloud disclosed a March data breach impacting 3.75 million individuals, exposing sensitive personal and financial information including medical records, Social Security numbers, and bank details. The incident underscores ongoing risks to healthcare infrastructure and the personal data aggregated by healthcare technology platforms.
France's tax authority disclosed a breach affecting approximately 600,000 individuals, with compromised data spanning contact information, household finances, and tax withholding rates. The incident also resulted in the exposure of some private messages, according to the agency's statement.
A researcher discovered an exposed database containing 9 million facial images belonging to ClarityCheck, a people finder service. The exposure represents a significant privacy breach affecting the sensitive biometric data stored by the reverse lookup platform.
Oz Hair and Beauty confirmed a data breach affecting customer information accessed through its online platform before August 2026, exposing names, email addresses, phone numbers, and purchase history, though credit card details and banking information were not compromised. The company has launched a forensic investigation with external specialists, notified affected customers, and is implementing enhanced cybersecurity measures, while warning customers to remain vigilant against phishing attempts and unsolicited requests for personal information.
Clop data theft extortion group likely exploited a critical vulnerability in PTC's product lifecycle management software in June, with threatening extortion emails following a month later. The full scope of compromised data and affected organizations is still emerging in the aftermath of the incident.
Cybersecurity researchers at Hunt.io have disclosed Operation CameraSwarm, a campaign that compromised over 14,530 Dahua devices between June and July 2026 through credential attacks and two authentication-bypass vulnerabilities. The attackers leveraged a peer-to-peer relay technique to facilitate the compromise, with evidence reconstructed from an exposed working directory containing 2,616 files totaling 407 MB.
A reverse image search service operated by ClarityCheck failed to secure its database, leaving over 9 million facial image files publicly accessible despite claims of privacy and security. The exposure represents a significant breach of personal data through an improperly protected people-search tool, potentially affecting millions of individuals whose photos were indexed in the service.
Ukraine's Asset Recovery and Management Agency (ARMA) experienced a cyberattack on its servers ahead of the August 22 deadline for selecting a manager for assets linked to sanctioned Russian oligarch Mikhail Fridman, prompting investigations by the Security Service of Ukraine and the National Anti-Corruption Bureau into whether the incident was part of a broader coordinated campaign. ARMA has documented signs of unauthorized interference since spring, including unauthorized access to officials' email accounts and inquiries, raising concerns about possible coordinated efforts to disrupt operations, apply pressure, or affect the competition, though the agency has not identified the alleged perpetrators. Despite the incident, ARMA said it will proceed with the IDS Ukraine asset manager competition according to established legal procedures and timelines.
An actor known as TheHatman claimed in August 2026 to have compromised large volumes of credentials from organizations' Microsoft Entra tenants, highlighting the continued risk of large-scale credential theft. Unit 42 provides mitigation guidance addressing this class of attack against cloud identity infrastructure. Security teams managing Entra environments should review the recommended defenses to reduce exposure to similar compromise attempts.
A single piece of infrastructure has been pulling records out of Salesforce and ServiceNow customer portals across multiple industries for more than a year, according to research published this week by agent security platform Reco. The activity, which Reco has named the City Forum campaign after a domain tied to the attacker's IP address, traces back to one server: 158.220.87.79, hosted on a
UT San Antonio has taken IT systems offline in response to a cyber incident, affecting critical student-facing services including registration and tuition payment processing. The timing of the disruption is particularly disruptive, occurring just days before the start of the academic term when these systems are essential for operational continuity.
Heights Finance suffered a data breach exposing personal and financial information for approximately 750,000 US customers, including Social Security numbers and bank details. The compromised data creates significant risk for affected individuals, who may become targets for identity theft and phishing attacks.
SafePal disclosed an authorization flaw in its order-tracking plug-in that exposed personal and purchase information for approximately 39,798 customers, including names, emails, shipping addresses, and phone numbers. The hardware wallet maker notified all affected customers via email on August 16 with details about the breach and remediation steps.