Blogs
Subscribe to learn about new product features, the latest in technology, solutions, and updates.
Latest Blogs
All Blogs
Coordinated Cyberattack on U.S. Water Infrastructure: FBI Investigating 30+ Minnesota Systems.
Between July 26 and July 27, 2026, a coordinated cyberattack struck the operational technology of more than 30 community water and wastewater systems in Minnesota. The intrusions targeted internet exposed programmable logic controllers, briefly taking one treatment plant offline and forcing several utilities onto manual operations. Within days, the FBI and EPA confirmed similar activity across at least seven states in total, and Michigan separately reported impacts to nine of its own water systems. A leaked WaterISAC memo, based on a Minnesota Fusion Center assessment, tied the campaign to Iran affiliated actors.
Aug 04, 2026
Hacktivist Attacks Target India's Government, Critical Infrastructure & Education Sectors Ahead of Independence Day
Hacktivist activity targeting Indian government, critical infrastructure, healthcare, education, and private-sector entities has intensified significantly, with at least ten hacktivist groups conducting or claiming over 23 attacks between 16 July–02 August 2026 through DDoS, defacement, and data breach/leak operations. This surge aligns with a recurring seasonal pattern, as hacktivist activity against India has historically intensified in the weeks before Independence Day (15 August), driven by nationalist symbolism and narrative-driven mobilization, including several groups invoking domestic protest movements to justify their campaigns. Given the current attack tempo and demonstrated cross-group collaboration through shared hashtags and coordinated targeting, the risk of continued hacktivist activity against Indian entities is assessed as HIGH through mid-August 2026.
Aug 04, 2026
Ransomware Report - July 2026
This report provides an in-depth assessment of ransomware victim distribution by sector and geography during July 2026, including a comparative analysis with June 2026 to identify shifts in threat actor activity, sector targeting patterns, geographic impact, and overall victim volume. The findings are intended to support cybersecurity leaders and response teams in strengthening defensive posture and operational preparedness.
Aug 03, 2026
Hacktivism Watch: June 2026 — Top 10 Threat Actors & Global Targeting Trends
This report profiles the top 10 hacktivist groups observed during June 2026, based on their operational activity and public attack claims, while analyzing their campaigns and evolution from 2023 to mid-2026. Most rely on DDoS attacks, website defacement, and Telegram to disrupt services, claim attacks, and amplify visibility. Four groups UNiT313, 404 Cyber Crew, GORZ ROSTAM, and Elite Squad demonstrate more advanced capabilities, including wiper malware, infostealers, extortion, and credential leaks. Government organizations are the primary targets, followed by finance, telecommunications, healthcare, and education, with Israel and Thailand emerging as the most targeted countries. Overall, these groups prioritize disruption, publicity, and psychological impact over long-term network persistence or espionage.
Jul 29, 2026
Inside Triple X: A New Ransomware Group Targeting Banks and Law Firms
Triple X is a financially motivated data-extortion group first observed in May 2026, with three claimed victims (India, Indonesia, US) across financial services and legal sectors, totaling over 4.5 TB of claimed data. The most severe incident, disclosed July 24, 2026, targeted Bank of Baroda, with claims of 100,000–300,000 leaked account-opening forms containing national IDs, photos, and financial data. The group runs a dark-web leak site and free-data extortion model, publicly posting samples to pressure victims. No publicly available evidence currently confirms the malware, initial access vector, or encryption methodology used by the group. Its TTP profile remains provisional.
Jul 27, 2026
SETTRA Ransomware: The New Adjacent Data Extortion Group Disrupting the Threat Landscape
SETTRA is a data-extortion group that emerged in late June 2026, publishing 25 victims across 11 countries within two weeks, with the United States the most affected. The group steals and publishes data through a Tor-based leak site instead of using a confirmed ransomware encryptor, operating as a data-broker-style extortion group. Claiming to be financially motivated, SETTRA uses automated leak deadlines, revenue-based targeting, and public engagement metrics to increase pressure on victims.
Jul 24, 2026
EY Data Breach: A Support Ticketing Platform Becomes a Tax Data Goldmine
Ernst & Young (EY), one of the Big Four professional services firms, has begun notifying clients of a data breach involving a third party IT service management platform used by its internal IT support staff. An unauthorized party accessed the platform between March 28 and April 12, 2026, and downloaded documents that included personal and financial information tied to client tax filings. EY detected the anomalous activity on April 23, 2026, eleven days after the intruder's known access window closed, meaning the attacker likely operated undetected inside the environment for over two weeks. EY filed a breach notification with the California Attorney General on July 15, 2026, and is offering affected individuals two years of identity monitoring through Experian. As of this writing, EY has not named the compromised vendor, has not disclosed the initial access method, and no ransomware or extortion group has publicly claimed responsibility. Separately, in an unrelated incident, a security research firm identified a 4TB unencrypted SQL Server backup file left publicly exposed on Microsoft Azure storage. EY attributed that exposure to an Italian entity it had acquired and stated the file was disconnected from EY's global systems and contained no client or confidential EY data. This appears to be a distinct exposure event, not connected to the ticketing platform intrusion.
Jul 23, 2026
Hugging Face Security Incident 2026: Autonomous AI Agent Compromises Production Infrastructure and Steals Credentials
On July 16, 2026, Hugging Face confirmed it had detected and responded to a security incident affecting part of its production infrastructure earlier that week. The incident is notable as the first publicly documented case in which the intrusion was driven end-to-end by an autonomous AI agent system rather than a human operator. The attacker gained unauthorized access to a limited set of internal datasets and to several service credentials by exploiting two code-execution flaws in Hugging Face's dataset-processing pipeline. The company confirmed it has remediated the affected access paths and rebuilt compromised infrastructure.
Jul 21, 2026
Ransomware Strikes Fairlife: Coca Cola Subsidiary Halts U.S. Dairy Production After Cyberattack
On July 16, 2026, The Coca Cola Company filed a Form 8 K with the U.S. Securities and Exchange Commission disclosing a ransomware incident affecting Fairlife, LLC, its dairy subsidiary. According to the filing, an unauthorized third party gained access to a portion of Fairlife's systems, including production related systems, as part of a ransomware event.Fairlife's Canadian production operations are reportedly unaffected. The investigation remains ongoing, and Coca Cola has not yet determined whether the incident is reasonably likely to have a material impact on the company as a whole.
Jul 17, 2026
World Leaks Ransomware Expands Its Victim List with Tata and Reliance-Linked NPCIL in India
World Leaks, launched on January 1, 2025, is a data-extortion group and rebrand of the former Hunters International RaaS operation, which shut down in November 2024. It follows an exfiltration-first model, stealing and leaking sensitive data instead of encrypting systems. The group has claimed over 170 victims across 29 countries and recently increased targeting of Indian entities, including a disclosure linked to the Kudankulam Nuclear Power Project through a contractor server hosted by Yotta.
Jul 16, 2026
CRPxO: A New Ransomware Group Zeroes In on Healthcare
A newly identified ransomware operation calling itself CRPxO has surfaced on the dark web, running a double-extortion leak site to pressure victims into paying after data theft. Since emerging, the group has listed six victims across the United States and China, with a pronounced and so far exclusive focus on the healthcare sector ( dental practices, pediatric clinics, and a biopharmaceutical manufacturer). Technically, CRPxO's v2.0 toolkit integrates ClickFix, a social-engineering delivery technique that tricks victims into manually executing a malicious PowerShell command via a fake browser error or CAPTCHA prompt - sidestepping email filters and endpoint defenses because there is no malicious attachment or link for security tools to catch. The payload builder supports both EXE and DLL output, with DLL side-loading offered specifically to reduce detection by antivirus and EDR tools.
Jul 13, 2026
Accenture Data Breach 2026: Source Code, RSA/SSH Keys, and Azure Credentials Exposed
On July 8, 2026, Accenture confirmed it had suffered a security breach after a threat actor “888” claimed to have stolen 35 GB of source code ,RSA and SSH keys, Azure credentials, and configuration files containing potentially sensitive environment details. Subsequently, it confirmed an isolated breach and said it had remediated the source.
Jul 08, 2026