Ransomware often dominates cybersecurity headlines, but stolen data has become an equally valuable commodity in the cybercrime economy. In the first half of 2026, one threat actor stood out in the data leak ecosystem: Tanaka, a prolific data leak broker responsible for more publicized leak activity than any other actor tracked by Cyble.  Cyble researchers recorded 367 data breach and leak incidents worldwide between January and June 2026. While dozens of actors participated in selling or publishing stolen information, Tanaka emerged as the most active, accounting for 25 distinct leak posts — more than double the activity of several other major actors. 

A Data Leak Operation Without Industry Boundaries 

Unlike threat actors that specialize in a single vertical, Tanaka followed a broad targeting approach across multiple industries and regions. The actor’s campaigns showed no strict preference for a specific sector, instead focusing on organizations where stolen information could hold financial or strategic value.  The Banking, Financial Services, and Insurance (BFSI) sector remained the most targeted industry globally, accounting for 38 breach incidents during the reporting period. Financial organizations continue to attract attackers due to the value of customer information, account data, and personally identifiable information (PII).  Government and Technology organizations were also frequent targets, reflecting the wider value of sensitive records, intellectual property, and institutional data. 

Regional Presence Across Major Markets 

Tanaka’s activity was visible across multiple regions. In North America, the actor was responsible for seven leak posts, making it the most active data leak actor in the region alongside other prominent sellers.  Europe and the UK also saw significant activity, with Tanaka linked to six leak posts during H1 2026. The region’s BFSI, Telecommunications, and Retail sectors faced heightened exposure due to the amount of valuable customer and financial data they hold.  The actor’s global footprint demonstrates how modern data leak operations can function independently of geography. Instead of focusing on a single country or industry, operators like Tanaka exploit opportunities wherever valuable information becomes available. 

The Rise of the Data Leak Marketplace 

Tanaka’s activity reflects a broader shift in the cybercrime ecosystem. Data leaks are no longer only a byproduct of ransomware attacks; they have become a standalone business model.  Threat actors monetize stolen information through underground marketplaces, using leaked databases for fraud, extortion, intelligence gathering, or resale. This specialization mirrors other parts of the cybercrime economy, where access brokers, ransomware affiliates, and data sellers perform separate roles.  For organizations, this means a breach does not always begin with a ransomware demand. A stolen database appearing in underground channels may indicate an earlier compromise that requires immediate investigation. 

Staying Ahead of Data Exposure Risks 

Security teams must treat underground data exposure monitoring as part of their broader defense strategy. Identifying leaked credentials, compromised databases, or mentions in cybercrime marketplaces can provide early warning before stolen information is weaponized.  To understand the 2026 data breach landscape, including the most active threat actors, targeted industries, and regional trends, access the full Cyble H1 2026 Cyber Threat Landscape Report. 

The Fairlife ransomware attack has temporarily halted production operations at Coca-Cola-owned dairy company fairlife in the United States after unauthorized access was detected in a portion of its systems, including production-related systems. According to The Coca-Cola Company, fairlife identified unauthorized access by a third party in connection with a ransomware event. Following the discovery, the company activated its incident response and business continuity protocols while launching an investigation with the support of external advisors and cybersecurity experts. Law enforcement has also been notified. The company said the investigation is ongoing and that the full scope, nature, and impact of the incident are not yet known.

Fairlife Ransomware Attack Suspends U.S. Production

The Fairlife ransomware attack has resulted in the temporary suspension of production operations at fairlife facilities across the United States. However, the company stated that product quality and safety have not been affected by the incident. According to the company's statement, fairlife's production operations in Canada remain operational and have not been impacted by the ransomware event. The Coca-Cola Company also confirmed in a Form 8-K filing dated July 16, 2026, that fairlife detected the unauthorized access on Thursday. The filing reiterated that the company immediately activated its incident response procedures and business continuity protocols after identifying the intrusion. While the company continues to assess the incident, it said it has not yet determined whether the ransomware attack is reasonably likely to materially affect its business because the full impact remains unknown. The company added that it is working to complete its investigation and restore affected systems and production operations as quickly as possible.

Investigation Into Unauthorized Access Continues

The ongoing investigation is being conducted with assistance from outside cybersecurity experts. According to the company, the incident involved unauthorized access to a portion of fairlife's systems, including systems related to production. At this stage, The Coca-Cola Company has not disclosed how the attackers gained access, whether any data was compromised, or if a ransomware group has claimed responsibility for the attack. The company emphasized that its assessment is still underway and that additional details will be shared as more information becomes available.

Food and Beverage Sector Faces Growing Cybersecurity Risks

The food and beverage cyberattack trend has continued to affect manufacturers and logistics providers worldwide in recent months. On July 16, a cyberattack targeting Nichirei disrupted food deliveries across Japan after the frozen food and logistics provider confirmed unauthorized access to its servers. The incident affected logistics operations supporting KFC Japan, leading to temporary service disruptions while systems were being restored. Earlier this year, in February 2026, Australian poultry processor Hazeldenes also experienced a cybersecurity incident that disrupted production across its network. The Victoria-based company later announced it had begun a phased return to production to restore operations safely and securely while investigations continued. The latest incident involving fairlife adds another major food producer to the list of companies dealing with operational disruptions linked to cyber incidents. While production has been paused at fairlife's U.S. facilities, the company has maintained that product quality and safety remain unaffected and that its Canadian production continues without disruption. As the investigation progresses, The Coca-Cola Company said it remains focused on restoring impacted systems and resuming normal production operations. The company also noted that the complete scope and potential business impact of the incident have not yet been determined.

The investigation into the Odido cyberattack has uncovered possible involvement of Dutch nationals, according to Dutch police, as authorities continue to investigate the ShinyHunters ransomware-linked attack that exposed the personal data of approximately 6.39 million customers. Law enforcement has urged the public to come forward with information as investigators work to identify those responsible for one of the country's largest telecom data breaches.

The cyberattack took place on February 5 and 6 after attackers allegedly used voice phishing (vishing) to deceive Odido's customer service team.

According to the company, the attackers posed as members of its internal IT staff, gaining unauthorized access before exfiltrating customer data. Odido said its teams detected the unauthorized access immediately on both occasions and revoked the attackers' access, but the incident still resulted in a large-scale data breach.

Odido Cyberattack Investigation Finds Possible Dutch Link

Under the direction of the National Public Prosecution Service, the High Tech Crime Team (THTC) of the National Investigation and Intervention Unit launched an extensive investigation into the breach.

Authorities said investigators have found strong indications that Dutch criminals may have been involved. One key lead centers on a phone call made shortly before the breach in which a Dutch-speaking man allegedly impersonated an Odido IT employee while speaking with customer service representatives. Police are continuing efforts to identify the caller and have indicated that his voice could be made public if necessary.

Investigators believe people within cybercrime circles may have information about those responsible and are encouraging anyone with relevant details to contact law enforcement.

ShinyHunters Named as Threat Actor

Odido attributed the attack to the cybercriminal group ShinyHunters, which the company said carried out the social engineering campaign.

Chief Executive Officer Søren Abildgaard acknowledged the incident in a public statement, apologizing to customers and outlining the company's commitment to strengthening its cybersecurity capabilities. He said Odido would continue investing in security, improve data protection practices, expand customer support, and share lessons learned from the incident.

The CEO also explained why the company refused to pay the ransom demand. According to Odido, paying cybercriminals would reward illegal activity and could encourage future attacks against other Dutch organizations. The company said the decision was made following guidance from authorities, despite knowing that stolen data could eventually be published.

Millions of Customers Impacted

Odido confirmed that approximately 6.39 million active and former customers of Odido and its Ben brand were affected by the breach. Customers of Simpel were not impacted.

The exposed information varied by individual and included names, addresses, mobile phone numbers, customer numbers, email addresses, IBAN numbers, dates of birth, identification details, nationality, and gender.

The company clarified that My Odido account passwords, call records, location data, billing information, and scans of identity documents were not compromised.

Odido also addressed reports claiming customer passwords had been leaked, stating that login passwords remain securely encrypted and were never accessible during the attack. Instead, a separate telephone verification field known as "password_c," used as a customer challenge code, was included for a limited number of customers. The company has since discontinued using that verification method.

Customer Support and Security Measures Expanded

Following the breach, Odido increased customer support by adding more than 140 service agents and introduced additional security measures. These include its "Check je Gesprek" verification service, allowing customers to confirm whether communications claiming to be from Odido are legitimate, along with access to the F-Secure digital security service.

The telecom provider said all customers identified as affected have been notified by email or SMS, while customer service teams continue assisting users with questions related to their specific data exposure.

Meanwhile, Dutch authorities expect investigations into the Odido cyberattack to continue for several months. Police have also warned that cyberattacks targeting businesses and institutions are becoming increasingly common, urging organizations to strengthen cybersecurity defenses and encouraging citizens to remain vigilant against follow-on fraud and phishing attempts.

A newly disclosed zero-day vulnerability, CVE-2026-20245, has been exploited by a threat actor targeting Cisco Catalyst SD-WAN Manager. By exploiting a flaw in the platform's file to upload functionality, the threat actor escalated privileges from a compromised administrative account to root access and used extensive anti-forensic measures to erase evidence of the attack. 

Threat Actor Abused Cisco Catalyst SD-WAN Manager to Gain Root Access 

Mandiant found that the threat actor initially established unauthorized peering connections before accessing Cisco Catalyst SD-WAN Manager over SSH. In March 2026, the attacker authenticated using the default vmanage-admin account, changed the default admin account password, logged into the web interface, and exfiltrated SD-WAN fabric configurations, including device, controller, and template information.   The original password was then restored to reduce the likelihood of detection. The researchers noted that neither the vmanage-admin nor admin accounts provide root shell access, prompting the attacker to exploit CVE-2026-20245 for privilege escalation. 

CVE-2026-20245 was Exploited Through a Malicious CSV Upload 

The vulnerability exists because Cisco Catalyst SD-WAN Manager fails to properly filter malicious data uploaded through its tenant file upload feature. The threat actor exploited CVE-2026-20245 by uploading a crafted file named evil_tenant.csv using the command: 

request tenant-upload tenant-list /home/admin/evil_tenant.csv vpn 0 

Reported to Cisco by Mandiant, CVE-2026-20245 affects the command-line interface of Cisco Catalyst SD-WAN Controllers and allows an authenticated local attacker to execute arbitrary commands as root through a specially crafted file.  The malicious payload backed up configuration files, preserved copies of /etc/passwd and /etc/shadow, and created a new root-level account named troot. Mandiant later observed the threat actor switching from the admin account to troot using the su command.

Rogue Peering Activity Preceded Exploitation 

Mandiant observed multiple unauthorized peering connections between late 2025 and January 2026. Researchers believe these may have exploited CVE-2026-20127 or CVE-2026-20182, two critical Cisco vulnerabilities affecting peering authentication that allow remote attackers to bypass authentication and gain administrative privileges.  Further rogue peering activity in March 2026 targeted software versions not vulnerable to CVE-2026-20127. Cisco confirmed the activity also did not rely on CVE-2026-20182, suggesting the threat actor may have reused stolen certificate material from an earlier compromise. Mandiant said it remains unclear whether the same group conducted both campaigns.  To conceal the intrusion, the threat actor deleted evil_tenant.csv, restored modified configuration files, removed temporary artifacts, and executed a validation script to confirm that malicious files, the troot account, and altered configuration files had been removed or restored.

Implications and Mitigation 

Mandiant said the campaign reflects the growing "living off the edge" trend, where attackers target network appliances that often lack detailed forensic visibility while providing centralized control over enterprise environments. Such platforms remain attractive to state-sponsored actors seeking long-term intelligence collection.  Organizations are advised to collect diagnostic logs using the request admin-tech command, investigate any indicators of compromise, and report confirmed incidents to Cisco TAC. Cisco recommends upgrading Cisco Catalyst SD-WAN Manager to versions 20.9.9.2, 20.12.7.2, 20.15.4.5, 20.15.5.3, 20.18.3.1, 26.1.1.2, or later to remediate CVE-2026-20245 and following its SD-WAN hardening guidance.  Recovered indicators include the malicious evil_tenant.csv file with SHA-256 hash b82936f37648518425c7d3cf9e09eaffa41d7cdb3840f6a40287e3a108880f7b and rogue IP addresses including 126.51.108[.]152, 76.92.245[.]217, 207.190.37[.]94, 23.245.7[.]178, 153.186.231[.]233, 167.179.79[.]189, 45.32.38[.]160, and 209.137.225[.]101.   Google SecOps also released detections covering behaviors associated with the threat actor, while Mandiant acknowledged Cisco PSIRT for its collaboration during the coordinated disclosure process. 

The legal fallout from the Stryker cyberattack continues to unfold, as the medical technology manufacturer has asked a federal court to dismiss a proposed class action lawsuit brought by current and former employees. The plaintiffs allege that their personal information was compromised during the cyberattack on Stryker, but the company argues that its investigation found no evidence supporting those claims. 

Employee Data Was Not Accessed During the Stryker Cyberattack 

In a court filing submitted Monday, Michigan-based Stryker said an internal review conducted with independent experts found that none of the eight named plaintiffs had personally identifiable information (PII) accessed during the incident. According to a statement from Chief Information Security Officer Juan Pablo Calderon, investigators examined files and data that the threat actor may have accessed during the attack.  “Those files and data were searched for plaintiffs' PII, and Stryker determined as a purely factual matter that none of the plaintiffs' PII exists in those files and data,” Calderon stated. He added that business email addresses belonging to two plaintiffs were found, but no sensitive personal information was identified. 

Iranian Hacktivists Claimed Massive Data Theft and Destruction 

The Stryker cyberattack was claimed by Handala, a group widely suspected of acting as a front for Iran’s Ministry of Intelligence. The Iranian hacktivists alleged in March that they had stolen 50 terabytes of critical company data. They further claimed to have erased 200,000 devices and 12 petabytes of data “in just a few hours,” describing the information as assets that had taken years to collect and billions of dollars to protect.  The cyberattack on Stryker occurred nearly two weeks after the United States and Israel launched major military operations against Iran on February 28. While Stryker maintained that customer-connected devices and systems were not affected, the incident disrupted electronic ordering and related services used by clients. Those systems remained unavailable for several weeks before being fully restored in early April. 

Legal Experts Weigh In on the Cyberattack on Stryker 

Stryker also argued that the plaintiffs rushed to court, filing lawsuits “merely 48 hours” after the company disclosed the cyberattack on March 11. According to the company, the lawsuits relied on speculation that names, Social Security numbers, and other personal information had been exposed.  The company further contends that each plaintiff’s PII had already been exposed in previous breaches involving other organizations, making it difficult to connect any alleged harm, including identity theft, directly to the cyberattack on Stryker. None of the named plaintiffs received breach notifications from the company, yet they seek to represent all U.S. individuals whose information was allegedly compromised.  Legal experts say the case highlights broader questions surrounding data breach litigation. Steven Teppler of Mandelbaum Barrett noted that “the complaint may outrun the facts” when lawsuits are filed immediately after a cyberattack. He added that courts increasingly require plaintiffs to show “more than speculation” that their information was affected. 

Japanese telecommunications company KDDI has disclosed a major cybersecurity incident in which up to 14.22 million email addresses and passwords may have been exposed through systems used by multiple internet service providers. The KDDI data breach has now become one of the most recent security events involving shared ISP infrastructure in Japan.  The company confirmed that the data breach at KDDI was detected on June 17, 2026, after unauthorized access was identified in an email system provided to ISP operators. KDDI said it immediately took steps to modify the affected system and deployed protective measures after identifying the entry point used by a threat actor. 

KDDI Data Breach Linked to Third-Party Software Vulnerability 

The data breach at KDDI impacted email services operated through six internet service providers: STNet, KDDI Web Communications, JCOM, Chubu Telecommunications, Nifty, and Biglobe. Affected services include Pikara Hikari Service, Pikara Mobile Service, Oshigoto Pikara Service, CPI rental server email services, J:COM NET, Commufa Hikari, Business Commufa, @nifty Mail, and BIGLOBE Mail.  KDDI’s investigation found that the threat actor exploited vulnerabilities in third-party software integrated into the email system. This allowed unauthorized access to information associated with user mailboxes, potentially exposing credentials needed to operate email accounts.  According to the company, the compromised data may include email addresses and passwords linked to user accounts created across the affected services. The maximum number of records potentially exposed is estimated at 14.22 million. This figure includes inactive accounts and users who had previously closed their services. Some passwords were stored in hashed or encrypted form, though KDDI emphasized that the number represents a worst-case estimate while investigations continue.  In its official disclosure, KDDI apologized to ISP partners, customers, and stakeholders for the disruption caused by the incident. The company also confirmed that it is cooperating with Japan’s Personal Information Protection Commission and the Ministry of Internal Affairs and Communications in line with legal and regulatory obligations related to the KDDI data breach. 

KDDI Data Breach Prompts Password Reset Measures and Ongoing Response 

Following the detection of the data breach at KDDI, the company has been working with affected ISPs to notify users and encourage them to change their passwords immediately. KDDI stated that although security controls have been strengthened, there remains a possibility that email credentials were obtained by a threat actor, making user action necessary to reduce ongoing risk.  The company has been contacting affected providers since June 17 and continues to coordinate mitigation efforts, including customer alerts and system-level countermeasures. It has also urged users to follow guidance issued by their respective ISPs and update login credentials without delay. 

Rising Cybersecurity Risks Highlighted by KDDI Data Breach 

The KDDI data breach has emerged amid a broader increase in cyberattacks affecting Japanese organizations. According to Tokyo Shoko Research, listed companies and their subsidiaries reported 180 personal information breach cases in 2025, exposing data tied to approximately 30.6 million individuals. More than 60% of these incidents involved unauthorized access or malware infections.  Ransomware activity has also continued to rise, with Japanese police confirming 226 cases of ransomware-related incidents last year, marking the second-highest total on record. While small and midsize firms accounted for roughly 60% of victims, several large organizations also suffered significant operational disruption.  Among them, Asahi Group Holdings reported that a ransomware attack in September exposed 115,513 personal records and disrupted production and distribution across most domestic facilities, forcing manual order processing for an extended period. Similarly, Askul disclosed that a ransomware incident discovered in October resulted in the exposure of approximately 740,000 records involving customers, corporate clients, and employees. 

Nintendo of America has confirmed that employee survey data was exposed in the recent TinyPulse cyberattack, although the company emphasized that its own systems were not breached and that no customer or financial information was accessed. The disclosure follows claims by the threat actor Shadowbyt3$, which alleged it had stolen sensitive information linked to Nintendo employees.  In a statement addressing the TinyPulse cyberattack, Nintendo said it was aware of an issue involving TinyPulse, a third-party platform used for internal employee surveys. According to the company, the incident was limited to data held by the service provider rather than Nintendo's internal infrastructure.  “We are aware of an issue involving TinyPulse, a third-party service used for internal employee surveys at Nintendo of America,” Nintendo stated.  The company further clarified that “Nintendo’s systems have not been compromised, and no personal customer or financial data has been accessed.” 

Nintendo Says Exposure Was Limited in the TinyPulse Cyberattack

According to Nintendo, the data affected by the TinyPulse cyberattack consisted of internal survey content involving only a small subset of employees. The company added that most of the information dated back several years.  “The data involved is limited to internal survey content comprising a small subset of our employees, and most of the information dates back several years,” Nintendo told media outlets.  Nintendo of America, a subsidiary of the Japanese gaming giant Nintendo, oversees operations across the United States, Canada, and parts of Latin America. TinyPulse is an employee engagement and feedback platform that supports anonymous surveys, workplace culture assessments, engagement analytics, and feedback collection.  Nintendo said it is currently “working with the service provider to address the issue.”  The Cyber Express has also reached out to Nintendo for additional details regarding the TinyPulse cyberattack. However, no further statement had been received at the time of publication. 

Shadowbyt3$ Claims Broader Data Theft

Despite Nintendo's assessment of the incident, the threat actor Shadowbyt3$ has claimed that the stolen information extends beyond employee survey responses and includes personal employee data.  In an initial message, Shadowbyt3$ alleged that nearly 1GB of data had been exfiltrated from Nintendo and gave the company 48 hours to enter negotiations before the information would be leaked.  The threat actor claimed the dataset contains full names, email addresses, analytics and survey data, bank statements, W-9 forms with employee IDs, progress plans, and reports spanning from 2016 to 2026.  “If you contact us we give you an extra day to think this through. We are demanding a ransom payment of 2 million dollars,” the Shadowbyt3$ post stated. 

Threat Actor Issues Additional Warnings

In a follow-up message, Shadowbyt3$ clarified that the alleged breach “doesn't affect nintendo gaming” but instead impacts “a small amount of employees that work for nintendo and have used tinypulse.”  The threat actor later published another post warning that more victims would emerge. The message included a link to allegedly leaked data containing direct messages and employee conversations, suggesting Nintendo did not agree to pay the $2 million ransom demand.  As of now, Nintendo maintains that the TinyPulse cyberattack was limited in scope and did not compromise its internal systems, while Shadowbyt3$ continues to assert that more sensitive employee information was stolen. 

Cardiac monitoring company iRhythm Technologies has disclosed a cybersecurity incident involving unauthorized access to data stored within certain third-party-hosted business applications. The company revealed details of the iRhythm data breach in a recent SEC filing, stating that sensitive information, including protected health information (PHI), may have been accessed and exfiltrated by a threat actor.  According to the SEC filing, iRhythm identified suspicious activity on June 8 and immediately activated its cybersecurity response protocols. The company launched an investigation with assistance from external advisors and cybersecurity specialists to determine the scope of the incident and implement containment measures. 

Decoding the iRhythm Data Breach 

The company reported that on June 9, it received communications from a threat actor who claimed to have obtained "sensitive information" from the affected systems. According to iRhythm, the allegedly compromised data included proprietary company information, patient protected health information, and other forms of personal information.  The threat actor also demanded payment in exchange for withholding the information from public disclosure.  Following the communication, iRhythm conducted additional reviews and confirmed that certain data had indeed been exfiltrated from the impacted third-party-hosted applications. By June 10, the company determined that the incident was material due to the volume of potentially affected information.  The SEC filing noted that the company continues to investigate the full nature and scope of the iRhythm data breach. 

Company Says Core Operations Remain Unaffected 

Despite the seriousness of the incident, iRhythm stated that it has not identified any disruption to its products, patient services, or operational capabilities.  According to the SEC filing, the company has found no impact on: 

• Products and services 
• Clinical systems 
• Medical device systems 
• Patient safety 
• Manufacturing operations 
• Distribution activities 
• Financial reporting systems 
• The company's ability to continue serving patients 

iRhythm said the data breach at iRhythm stemmed from a social engineering attack targeting certain third-party-hosted business applications rather than its clinical infrastructure.  The company further emphasized that the incident did not affect its clinical or medical device systems, nor did it involve connections used by customers. Additionally, iRhythm stated that it does not store or retain individual financial account information or payment card information, reducing the likelihood that such data was compromised. 

Investigation Continues as Company Assesses Impact 

As of the latest SEC filing, iRhythm reported that it has found no evidence of ongoing unauthorized access within its systems.  The company stated that its investigation remains active and that it is continuing to evaluate the extent of the exposure and any potential consequences arising from the incident. At present, iRhythm believes the cybersecurity event is "not reasonably likely" to have a material effect on its financial condition or operating results.  The company also noted that it maintains cybersecurity insurance that could potentially offset certain losses related to the incident. However, iRhythm cautioned that there can be no assurance that insurance coverage would fully compensate for all losses associated with the breach. 

The U.S. telecom sector is strengthening its cybersecurity coordination efforts with the launch of a new private ISAC designed to help major communications companies respond more effectively to AI-powered cyberattacks, state-backed espionage campaigns, and emerging threats targeting national communications infrastructure.  The Communications Cybersecurity Information Sharing and Analysis Center, known as the C2 ISAC, was created by some of the country’s largest telecommunications providers to establish a more confidential environment for exchanging cybersecurity intelligence. The founding members include AT&T, Charter, Comcast, Cox, Lumen, T-Mobile, Verizon, and Zayo. The chief information security officers from these companies will serve on the organization’s board.  The newly formed private ISAC will be led by Valerie Moon, a former senior official with both the Cybersecurity and Infrastructure Security Agency (CISA) and the FBI’s Cyber Division, who has been appointed executive director.  According to Mark Clancy, chief security officer at T-Mobile and a board member of the C2 ISAC, the evolving threat landscape was a major factor behind the creation of the private ISAC.  “The main driver for us is our recognition that the threat environment has evolved, and we as a sector and private entities need to evolve and really keep up with the pace and velocity [at which] that’s happening,” Clancy said in an interview with Cybersecurity Dive.  Clancy explained that telecom companies recognized the need for more direct collaboration during the industry’s response to Salt Typhoon. “The need for us to collaborate on a private-to-private basis really became amplified,” he added. 

Telecom Sector Pushes for Faster Intelligence

Although the telecom sector already participates in information-sharing initiatives through the Communications ISAC, also referred to as the National Coordinating Center for Communications, that organization differs from most ISACs because it operates within the federal government under CISA rather than as an independent private entity.  According to Clancy, that government affiliation created hesitation among some telecom companies when it came to sharing sensitive cybersecurity intelligence.  “There’s been concerns and hesitations about it,” he said.  The new private ISAC aims to address those concerns by limiting participation to industry members and excluding government agencies from its internal discussion channels. Organizers believe this structure will encourage companies to exchange threat intelligence more openly and at earlier stages of investigations.  “When you have public-sector entities involved, there’s more review and deliberation about what gets put into that channel,” Clancy explained, adding that the new arrangement allows companies to be “a little more raw and early in sharing information.”  Over time, telecom providers realized they had become overly cautious in the information they shared through the existing Communications ISAC. Clancy acknowledged that companies often withheld lower-level threat indicators that later turned out to be connected to broader malicious campaigns.  “We were being too restrictive in what we were sharing,” he said, noting that some seemingly isolated activities were “actually tethered to bigger activity.”  Moon emphasized that the private ISAC is not intended to replace the existing Communications ISAC. Instead, both organizations are expected to operate alongside each other, with the older structure continuing to focus on broader operational concerns such as physical infrastructure threats.  “We really see this as a complementary effort,” Moon said. “When you think about each of these companies and their adherence to ensuring that the privacy of their data is very much at the forefront of their minds, they see this as a trusted space.” 

Private ISAC May Expand Beyond Threat Sharing

Information-sharing efforts within the telecom sector have already proven valuable in combating cybercrime and network abuse. One example involved the detection of SIM boxes — devices commonly used by cybercriminals to generate large volumes of difficult-to-block spam calls and text messages.  After T-Mobile identified indicators connected to SIM box activity, the company shared those findings with other telecom providers, enabling them to locate and block similar operations on their own networks.  Clancy noted that addressing such threats requires coordinated action because malicious infrastructure often spans multiple providers. “In order to figure out what’s happening, you’ve got to look at both sides,” he said.  Beyond direct threat intelligence, telecom companies have also exchanged operational strategies and defensive techniques through existing partnerships. Clancy recalled learning an effective method for handling residential proxy networks from another telecom operator.  “I learned a technique for dealing with some of the residential proxy networks from another operator that was really clever,” he said. “And I’m, like, ‘Yeah, we’re going to go do that.’”  While the immediate focus of the private ISAC is improving information sharing related to AI-powered cyberattacks and network threats, its leaders are also considering broader future capabilities. Clancy suggested the group could eventually develop shared automation platforms and collaborative technologies that would be easier to coordinate privately than through government-led regulatory frameworks.  The organization may also explore involvement in coordinated cybersecurity operations such as botnet disruptions, though Moon said those discussions are still in early stages.  “It just depends on what the operation is and where the authorities lie and what we are trying to accomplish,” she said.  Moon described the private ISAC as being “in its nascent stages,” adding that several long-term objectives remain under discussion.  Membership expansion is another unresolved issue. Although the current founding members represent some of the largest companies in the telecom sector, Clancy acknowledged that broader participation will be necessary for maximum effectiveness.  “There are more than eight companies in the communications sector, and so we won’t be fully effective until we increase that membership base,” he said.  The launch of the private ISAC also coincides with significant uncertainty surrounding federal cybersecurity programs. Budget reductions, staffing cuts, and shifting priorities across government agencies have forced many private-sector organizations to reconsider how they coordinate cybersecurity defense efforts.  “Obviously, what’s happening in the public sector informs what we need to do,” Clancy said, referencing challenges involving government funding, agencies, and legislative processes.  He also encouraged the Department of Homeland Security to accelerate efforts to replace the now-defunct Critical Infrastructure Partnership Advisory Council framework, which previously supported confidential discussions between industry and government stakeholders. Despite operating independently, the private ISAC still plans to maintain communication with federal agencies. According to Clancy, the group intends to share relevant intelligence either directly with government partners or through the existing Communications ISAC framework. “We could have a more freewheeling private-to-private conversation [and] we could distill the useful, important bits and push them … over to the government side,” he said.

A major QLearn cybersecurity incident has affected thousands of educational institutions globally, including Queensland state schools and universities, after a cyber breach involving third-party education technology provider Instructure exposed personal information linked to students and staff. Queensland Education Minister John-Paul Langbroek confirmed the incident in an official statement, saying the Queensland Department of Education was briefed about the international cybersecurity breach involving Instructure, the provider behind the Department’s online learning platform, QLearn. According to early assessments, the breach may affect more than 200 million people and over 9,000 institutions worldwide, making it one of the largest education-sector cybersecurity incidents disclosed this year.

QLearn Cybersecurity Incident Impacts Queensland Schools

The Department of Education said students and staff who have worked or studied at Education Queensland schools since 2020 may have been affected by the QLearn cybersecurity incident. Authorities stated that compromised information currently appears limited to names, email addresses, and school locations. Officials added there is currently no evidence that passwords, dates of birth, or financial information were accessed during the breach. The online learning platform QLearn was introduced in Queensland schools in 2020 under the previous government and has since become a widely used digital education system across the state. Minister Langbroek said school principals have already begun contacting affected families and teachers to notify them about the breach and provide further guidance. “This morning I have been briefed by the Department of Education about an international cybersecurity breach involving a third-party provider, Instructure, which delivers the Department’s online learning platform, QLearn,” Langbroek said in the statement.

Instructure Data Breach Raises Concerns Across Education Sector

The QLearn cybersecurity incident has once again highlighted the growing cybersecurity risks facing the global education sector, particularly as schools and universities continue relying heavily on third-party digital learning platforms. Because the breach involves Instructure, a provider serving institutions across multiple countries, the incident extends far beyond Queensland. Authorities indicated that educational institutions across Australia and overseas are also impacted. While officials stressed that no sensitive financial or authentication data has been identified as compromised so far, cybersecurity experts often warn that exposed personal information such as names and email addresses can still be valuable to cybercriminals. Threat actors frequently use this type of information in phishing campaigns, identity-based scams, and social engineering attacks targeting students, parents, and school employees. The Department of Education has not publicly disclosed how the cybersecurity breach occurred or whether any ransomware or unauthorized network access was involved. Investigations into the incident are ongoing.

Queensland Department Prioritizes Support for Vulnerable Families

In response to the QLearn cybersecurity incident, the Queensland Department of Education said it is prioritizing support for vulnerable individuals and families potentially affected by the breach. According to the Minister’s statement, the Department is providing priority assistance to families and teachers with known family and domestic violence concerns, as well as individuals connected to Child Safety services. The additional support measures appear aimed at reducing potential risks associated with the exposure of school-related location information and contact details. Government agencies increasingly recognize that cybersecurity incidents affecting education systems can carry broader safety implications, especially for vulnerable groups whose personal or location-related information may require additional protection.

Global Education Sector Continues Facing Cybersecurity Threats

The QLearn cybersecurity incident adds to a growing list of cyberattacks and data breaches targeting educational institutions worldwide. Schools, universities, and online learning providers have become frequent targets due to the large amount of personal information they manage and the widespread use of interconnected digital platforms. Education systems often rely on multiple third-party vendors for online learning, communications, and student management services, increasing the potential attack surface for cybercriminals. The Queensland Department of Education said it will continue updating the public as more information becomes available from the ongoing investigation into the breach. At this stage, authorities have not advised affected individuals to reset passwords or take additional security measures, though officials are continuing to assess the full scope and impact of the incident. The investigation into the Instructure-related breach remains active as educational institutions worldwide work to determine the extent of the exposure and any potential long-term cybersecurity implications.

The ChipSoft ransomware incident has disrupted healthcare operations across multiple institutions after the Dutch software vendor was hit by a cyberattack on April 7. The attack forced hospitals to disconnect critical systems and triggered widespread precautionary actions, highlighting the ongoing risks ransomware poses to the healthcare sector. Z-CERT confirmed it has been working closely with ChipSoft, healthcare institutions, and other stakeholders since the incident was first detected. The organization is actively monitoring the situation while providing support and threat intelligence to affected entities.

ChipSoft Ransomware Incident Forces System Shutdowns

In response to the ransomware incident, the company disabled connections to key platforms, including Zorgportaal, HiX Mobile, and the Zorgplatform, as a precaution. These systems remain temporarily unavailable as ChipSoft works to restore services in phases. Users are being issued new login credentials as part of the recovery process. ChipSoft has maintained direct communication with its customers, outlining steps to manage disruptions while systems are gradually brought back online. According to reports, 11 hospitals disconnected ChipSoft software from their networks following the attack. A confidential advisory also urged customers to cut secure VPN connections after the compromise was identified.

Hospitals Face Operational Challenges, Not Critical Disruptions

The ChipSoft ransomware incident has led to logistical challenges across healthcare institutions rather than critical failures in patient care. Hospitals have increased staffing at service desks, expanded telephony support, and relied more heavily on direct communication channels. Systems were reported unavailable at several hospitals, including Sint Jans Gasthuis, Laurentius Hospital, VieCuri Medical Center, and Flevo Hospital. Despite these disruptions, Z-CERT noted that no critical care processes have come to a standstill so far, suggesting that contingency plans and manual workflows are helping maintain essential medical services.

Investigation Ongoing, Attackers Yet to Be Identified

At this stage, the source of the ChipSoft ransomware incident remains unknown, and no ransomware group has claimed responsibility. ChipSoft’s website was also reported unreachable at the time of writing, indicating ongoing technical or security challenges. The attack appears to have originated from a compromise within ChipSoft’s environment, prompting widespread defensive actions by its customers to limit further risk.

Ripple Effects Extend Beyond Immediate Disruptions

The impact of the ransomware incident has extended beyond system outages. Leiden University Medical Center (LUMC) announced it has postponed the rollout of a new electronic patient record system supplied by ChipSoft following the breach. The hospital clarified that there are no indications that patient data has been leaked, reinforcing the current assessment that the incident has not resulted in data exposure.

Healthcare Sector Remains a Prime Target

The ChipSoft ransomware incident highlights the persistent threat facing healthcare organizations. Cybercriminals frequently target hospitals and medical software providers due to the critical nature of their services, where downtime can create pressure to restore systems quickly. A recent example includes the cyberattack on University of Hawaiʻi Cancer Center, where a ransomware incident impacted research systems and exposed sensitive personal data collected over decades. While clinical operations were not affected, the breach highlighted the long-term risks associated with storing large volumes of historical data.

Z-CERT Continues Support and Monitoring

Z-CERT continues to play a central role in managing the fallout from the ransomware incident. The organization is assisting healthcare institutions with prevention, detection, response, and recovery efforts, while also sharing updated threat intelligence. As restoration efforts progress, authorities and healthcare providers remain focused on minimizing disruption and ensuring patient care remains uninterrupted. The ransomware incident serves as another reminder of how cyberattacks on third-party vendors can cascade across critical sectors, reinforcing the need for stronger resilience in healthcare cybersecurity systems.

A newly identified ClickFix-style macOS attack demonstrates how threat actors are refining their techniques to evade security defenses. The campaign moves away from the traditional reliance on Terminal and instead uses macOS Script Editor as the primary execution vector. This change allows attackers to bypass controls designed to detect or block suspicious Terminal activity.  The shift is notable because it preserves the familiar ClickFix social engineering approach while altering how malicious commands are executed. By rerouting execution through macOS Script Editor, the attack reduces exposure to newer protections and introduces a different pathway that may be less scrutinized by both users and security tools. 

A Shift in ClickFix-Style macOS Attack Techniques 

For years, ClickFix campaigns have relied on social engineering tactics that trick users into copying and pasting malicious commands into the Terminal app. These instructions are often disguised as troubleshooting steps or routine maintenance tasks. However, this newly discovered ClickFix-style macOS attack abandons that approach entirely. Instead, attackers now leverage macOS Script Editor as the primary execution vector. While Script Editor has previously been abused for malware delivery, its use in this context, combined with a browser-triggered workflow, represents a shift in strategy. Notably, the attack is initiated through an Apple-themed webpage, which plays a central role in deceiving users. Jamf researchers noted that Apple attempted to mitigate Terminal-based abuse in macOS 26.4 by introducing a feature that scans pasted commands before execution. While this adds friction, attackers have responded by simply moving to a different tool, demonstrating the ongoing cat-and-mouse dynamic in cybersecurity. 

The Role of the Apple-Themed Webpage 

The attack begins with a convincing Apple-themed webpage designed to look like an official support page titled “Reclaim disk space on your Mac.” The page provides step-by-step instructions that closely mimic legitimate system maintenance guidance.  Users are instructed to run a cleanup script to free up storage space. When they click the “Execute” button, the page triggers an applescript:// URL scheme, which initiates the next stage of the attack.  This mechanism introduces several key differences from traditional ClickFix campaigns: 

• The browser invokes the applescript:// URL scheme  
• Users are prompted to use script Editor to open  
• A pre-filled script appears automatically inside macOS Script Editor  
• The user is encouraged to execute the script  

This workflow reduces the need for manual input, making the attack smoother and potentially more convincing. 

Execution Flow and Obfuscation 

Once inside macOS Script Editor, the user is presented with a script that appears to perform legitimate cleanup operations. However, behind the scenes, the script executes an obfuscated shell command.  The command uses string manipulation via the tr utility to decode a hidden URL at runtime. Once decoded, it resolves to a remote server hosting the malicious payload. The command follows a familiar structure: 

• Obfuscation: Encoded strings are transformed into valid URLs.
• Payload retrieval: A curl request fetches remote content, with the -k flag disabling TLS certificate validation.
• Execution: The downloaded content is piped directly into zsh, allowing in-memory execution without writing to disk.

If successful, this step delivers a second-stage payload, which is further obfuscated using base64 encoding and gzip compression. 

Second-Stage Payload and Atomic Stealer 

After decoding, the second-stage script downloads a Mach-O executable file to the /tmp directory. The script performs several actions: 

• Downloads the binary from a remote server  
• Removes extended file attributes  
• Assigns execution permissions  
• Executes the binary  

The final payload has been identified as a variant of Atomic Stealer, an infostealer known for targeting sensitive user data.  This staged delivery method allows attackers to keep the initial script small and less detectable while reserving the primary malicious functionality for later execution. 

Behavior Across macOS Versions 

The behavior of macOS Script Editor during this attack varies depending on the operating system version. On macOS 26.0, the script opens directly, allowing immediate execution. However, macOS 26.4 introduces additional safeguards.  In newer versions, users see a warning indicating that the script originates from an unidentified developer. They must explicitly permit the creation and execution of the script document, adding another layer of user interaction.  Despite this, the attack still succeeds if users follow the prompts, highlighting the continued effectiveness of social engineering. 

Indicators of Compromise 

The researchers identified several indicators associated with this ClickFix-style macOS attack: 

• Domain: dryvecar[.]com (linked to the infostealer payload)  
• Malicious webpages:  
• storage-fixes.squarespace[.]com  
• cleanupmac.mssg[.]me  
• File: helper (Mach-O executable)  
• SHA256: 3d3c91ee762668c85b74859e4d09a2adfd34841694493b82659fda77fe0c2c44  

These indicators can help security teams detect and respond to related threats.