31%
of breaches now start with an unpatched software flaw
Now the #1 entry point
Exploitation of vulnerabilities has overtaken stolen credentials as the most common way in. Credential abuse fell to 13%.
AccuSights Cyber Analytics
Know what attackers are doing. Protect what matters first.
No business can protect everything, everywhere, at all times. The good news: you do not have to. The data below comes from more than 22,000 confirmed breaches across 145 countries, and it points to a short list of things that stop most attacks. You have enough to worry about. Let us help you quantify the right risks and fix them in the right order.
Baseline: Verizon 2026 DBIR · Advisories updated 2026-09-24
The Cyber Expert's five · 11 to 18 September 2026
What actually mattered that week, and what to do about it
Five picks from the week’s headlines. Four are tools your IT provider or your developers lean on every day, each listed as exploited before most teams had read the advisory: the Cisco email gateway that opens your mail first, the GitLab server that holds the build keys, the ScreenConnect client that fixes your laptop from across town, and an Artifactory chain built from two bugs nobody rushed because neither looked critical alone. The fifth is a phone call, not a patch: a caller from "IT" who walks an executive through registering a passkey on a page the attacker owns. The rest of the week, day by day. Tuesday: the July vCenter bug became ransomware territory, a WooCommerce wholesale form turned out to take PHP, and a Windows update broke Remote Desktop, which is a reason to roll forward, not back. Wednesday: the supply chain in miniature, with a paid WordPress plugin served from the developer’s own site with a web shell inside, a hosting-panel backup plugin used to climb to root, and a Pixel modem bug that went from targeted use to the exploited list in a day. Thursday: the second Cisco root-level zero-day in three days, this time in the ISE appliance that decides who gets on the network, and a first-hand account from the UAE cyber chief of a ransom call for more than $5 million after a company’s data was destroyed and leaked. Friday: an open-source PBX whose API key is the same on every install, abused since 9 September, and a fifth pre-login bug in the Check Point management server since July, not yet exploited, with the July one as the reason not to wait. The lesson is the same as every week: management interfaces off the internet, tokens rotated after a patch, and one sentence the front desk can repeat.
An email arrives, the mail filter reads it, and the attacker is root on the filter
Cisco published advisory cisco-sa-esa-inj-2bLVGmhX on 14 September for CVE-2026-76461, a 9.8-rated SQL injection in the email parsing of AsyncOS for Secure Email Gateway that lets an unauthenticated remote attacker run commands as root by sending a crafted message through the appliance; the flaw was found during a TAC support case and Cisco PSIRT confirms it has been exploited in September. CISA added it to the Known Exploited Vulnerabilities catalog the same day. Fixed releases are 15.5.5-0141, 16.0.4-3021 and 16.5.0-780 (Cisco recommends 16.5.0-780), there is no workaround, every physical and virtual Secure Email Gateway is affected regardless of configuration, and Cisco says it has already upgraded all Secure Email Cloud devices and contacted the cloud customers where it found indicators of compromise.
The Cyber Expert’s read. The email gateway is built to open every message before anyone else does, so a bug in its parser is a bug anyone on the internet can reach with a single send. The check Cisco gives is short: grep the mail_logs for a COPY statement that ends in TO PROGRAM. Because the attacker lands as root, treat a clean log as a hint rather than a verdict and read your firewall logs for the appliance talking to places it never did before. If the box is virtual and you have any doubt, Cisco's advice is to rebuild it from a fixed image and renew every certificate and credential it held, and that is the advice we would give too.
Who this touches: Any organization that runs a Cisco Secure Email Gateway (formerly IronPort or ESA) on premises or as a virtual appliance, and the managed providers who operate them for clients.
Strengthen
- CIS 7 Continuous Vulnerability Management
- CIS 9 Email and Web Browser Protections
- CIS 12 Network Infrastructure Management
- CIS 8 Audit Log Management
- CIS 3 Data Protection
Do this week
- Upgrade every Secure Email Gateway to 16.5.0-780 (or the fixed build for your branch) this week; there is no workaround, so the patch is the whole plan.
- Run grep -i "COPY.*TO PROGRAM" against mail_logs on every appliance and cluster member, then check firewall logs for unexpected outbound connections from the gateway.
- If anything looks wrong on a virtual appliance, preserve the logs, deploy a fresh fixed image, rebuild the configuration and rotate certificates and admin credentials; on a physical unit open a TAC case. Keep the management interface off the internet and turn DLP rules back on after the rebuild so outbound mail policy survives the change.
Sources: Cisco advisory, 14 September · CISA KEV, 14 September
One request, no login, and the GitLab server hands over its secrets file by file
GitLab shipped patch releases 19.1.8, 19.2.6 and 19.3.2 on 10 September for CVE-2026-85706, a 10.0-rated path traversal in the repository commits API that lets an unauthenticated user read arbitrary files from a self-managed Community or Enterprise Edition server, exposing SSH keys, database credentials, deploy tokens and CI/CD variables; all versions from 18.7 onward are affected and GitLab.com and GitLab Dedicated were already patched. watchTowr saw in-the-wild probes on 11 September, one day after disclosure, and CISA added the CVE to the KEV catalog that day with a 14 September deadline for federal agencies. The same release fixes 17 other bugs, including a 9.9-rated deserialization flaw (CVE-2026-87719) that is not yet known to be exploited.
The Cyber Expert’s read. A source-code server holds more than source code. It holds the keys to the build pipeline, and whatever leaves the pipeline is trusted by every server downstream, which is why a read-only bug here is not a read-only problem. The hunt is simple: look in the access logs for POST requests to /api/v4/projects/<id>/repository/commits/ that carry a file.path parameter. If you find one, assume the tokens on that box are already in circulation and rotate them, because patching the server does not un-read the file.
Who this touches: Software teams and any business running a self-managed GitLab instance, plus the software vendors and contractors who build for you on theirs.
Strengthen
- CIS 7 Continuous Vulnerability Management
- CIS 16 Application Software Security
- CIS 5 Account Management
- CIS 8 Audit Log Management
- CIS 12 Network Infrastructure Management
Do this week
- Upgrade self-managed GitLab to 19.1.8, 19.2.6 or 19.3.2 now; single-node installs will have a short outage while the database migrations run, so schedule it today rather than next sprint.
- Search the access logs for POST /api/v4/projects/*/repository/commits/ with file.path in the body or query; a hit means the server's secrets should be treated as exposed.
- Rotate deploy tokens, CI/CD variables, database credentials and SSH host keys on any instance that was internet-facing before the patch, and put the instance behind a VPN or identity-aware proxy so the API is not reachable by strangers again.
Sources: Rapid7 ETR, 14 September · SecurityWeek, 11 September · GitLab patch release 19.3.2
The remote-support tool that lets a session copy files to the next machine without asking
ConnectWise released ScreenConnect 26.6.5 to fix CVE-2026-84869, a 9.9-rated missing-authorization flaw in the ScreenConnect client that allows files to be transferred and executed through an active remote session without the host confirming; CISA added it to the KEV catalog on 11 September with a 14 September federal deadline. Huntress traced the exploitation to incidents going back to 20 August in which a caller posing as tech support talked a victim into opening Quick Assist, then a modified ScreenConnect client ran a chain of four VBScript files that surveyed the machine, hid a second ScreenConnect client, set a Run key for persistence and pushed the same four scripts to every newly connected endpoint, which is why Huntress describes the behaviour as worm-like. ConnectWise says the server is not affected and that disabling the TransferFiles permission is the interim mitigation.
The Cyber Expert’s read. ScreenConnect is what a lot of IT providers use to fix your laptop from the other side of town, so a rogue copy of it looks like Tuesday to most monitoring. The story here has two halves: a real bug, and a phone call that got the first foothold, and the patch only closes one of them. Update the clients, then look for ScreenConnect instances your provider did not install, and tell the front desk that nobody from IT will ever ring and ask them to open Quick Assist.
Who this touches: Any business whose IT provider supports it with ScreenConnect, and the providers themselves; the phone-call opener applies to everyone with a Windows fleet.
Strengthen
- CIS 7 Continuous Vulnerability Management
- CIS 2 Inventory and Control of Software Assets
- CIS 14 Security Awareness and Skills Training
- CIS 10 Malware Defenses
- CIS 6 Access Control Management
Do this week
- Ask your provider to confirm every ScreenConnect client and server is on 26.6.5 or later; until then have them disable the TransferFiles permission on hosts that do not need it.
- Inventory ScreenConnect installs across the fleet and remove any that point at a relay your provider does not own; check for a user Run key launching a .vbs file and for wscript.exe spawned by a ScreenConnect client.
- Restrict Quick Assist and other remote-help tools by policy to sessions your help desk starts, and put one line in the next staff note: IT will never call you and ask you to open a support tool.
Sources: Huntress, rogue ScreenConnect installations · SecurityWeek, 14 September · CISA KEV, 11 September
Two medium-rated bugs, one after the other, turned an anonymous request into an Artifactory admin
Wiz Research reported on 10 September that between 15 August and 8 September several actors chained CVE-2026-42018 (7.5, an internal anonymous-user token returned to an unauthenticated caller even with anonymous access off) and CVE-2026-42016 (8.1, a token whose scope is not enforced and can be exchanged for admin authority) against self-hosted JFrog Artifactory, creating persistent admin accounts in under five minutes, installing Groovy plugins for code execution and dropping a Rust backdoor; CISA added both to the KEV catalog on 11 September with a 25 September federal deadline. The chain is separate from the 9.8-rated CVE-2026-82329 we covered on 3 September, and Wiz found 59 percent of Artifactory customers still exposed to CVE-2026-42016 six weeks after its 27 July fix, against 49 percent for the critical one two weeks in. Fixed versions are 7.111.21, 7.117.28, 7.125.20, 7.133.29, 7.146.38 and 7.161.20.
The Cyber Expert’s read. This is the pattern to remember: two bugs nobody rushed because neither was rated critical on its own, and together they are a critical. The tell in the logs is identity mismatch, an anonymous or low-privilege token minting new tokens at /access/api/v1/tokens, enumerating users, or touching the plugins API. Patch the branch, then read the admin list for names like svc_ followed by eight random characters, jfrog-distribution, repo-service or ldap_admin that your team did not create, and revoke every token issued since 15 August.
Who this touches: Software teams and product companies with a self-managed Artifactory, especially one reachable from the internet, and the vendors who build software for you.
Strengthen
- CIS 7 Continuous Vulnerability Management
- CIS 5 Account Management
- CIS 6 Access Control Management
- CIS 8 Audit Log Management
- CIS 16 Application Software Security
Do this week
- Upgrade to a fixed Artifactory build this week even if you already patched CVE-2026-82329, because the two chained CVEs have their own fix thresholds (42016 needs 7.133.11 or later on that branch).
- Review admin users and tokens for anything created since 15 August, delete what you did not make, and revoke and reissue access tokens; in the access log look for POST /access/api/v1/aws/token/ returning 200 followed by a token mint from the anonymous identity.
- Block the Wiz IOC addresses at the edge, check /tmp, /dev/shm and /var/tmp on the Artifactory host for binaries you did not put there, and move the instance behind your VPN or identity proxy.
Sources: Wiz Research, 10 September · The Hacker News, 12 September · CISA KEV, 11 September
The caller says they are from IT, the page says register your passkey, and the mailbox is gone by lunch
Arctic Wolf published details on 7 September of a data theft and extortion cluster it tracks as PREY-0058 that phones directors, vice presidents and other executives while posing as the internal help desk, sends them to a domain shaped like yourcompany.passkey-mfa[.]com or yourcompany.registermymfa[.]com, and captures the Microsoft 365 password, the MFA approval and the resulting session token through an adversary-in-the-middle login page. The token is then replayed from residential proxies in the victim's own city and network range, the actor searches SharePoint and Entra ID, and bulk-downloads SharePoint, OneDrive, Exchange and Box before sending the extortion note; there is no malware and no lateral movement on the network. Arctic Wolf found hundreds of impersonated companies across the lure subdomains, with US targets concentrated in construction and engineering, healthcare and pharmaceuticals, real estate, finance and professional services, and it notes the tradecraft overlaps with the group Mandiant calls UNC6671.
The Cyber Expert’s read. Nothing here is broken. Every control did what it was told, which is the point: the password was right, the MFA prompt was approved, and the sign-in came from a nearby address. The lure domains all sell the same story, that IT needs you to register a passkey today, so the defence is partly a sentence your staff can repeat: IT will never call and ask you to sign in somewhere. The rest is configuration. Sign-ins from managed devices only, phishing-resistant MFA for anyone who can approve a payment, and a SharePoint search scoped so one stolen session cannot read the whole company.
Who this touches: Any US business on Microsoft 365 with executives who take phone calls, with construction, engineering, healthcare, real estate, finance and professional services named as the current focus.
Strengthen
- CIS 6 Access Control Management
- CIS 14 Security Awareness and Skills Training
- CIS 3 Data Protection
- CIS 8 Audit Log Management
- CIS 5 Account Management
Do this week
- Turn on Conditional Access that requires a compliant or hybrid-joined device for Microsoft 365, and move executives, finance and admins to phishing-resistant MFA (passkeys or hardware keys) issued in person, not through a link.
- Alert on sign-ins to My Signins, My Profile or My Apps from unfamiliar devices, on SharePoint SearchQueryPerformed bursts using contentclass:STS_Site, and on mass download events; block the Arctic Wolf lure domains and any newly registered domain containing passkey, mfa or sso.
- Brief the help desk and the executive assistants this week: the company will never phone a user to walk them through an MFA change, and any such call is reported, not followed. Apply DLP rules that stop bulk external sharing from SharePoint and OneDrive so a replayed session cannot empty the tenant quietly.
Sources: Arctic Wolf, PREY-0058 alert pack · The Hacker News, 7 September
The threat rundown, daily or weekly
The three minutes that keep you ahead of the bad guy.
Only the threats that apply to your business, with the control that answers each and what to do about it. Written by people who have done this for banks, read by owners who would rather be running the company. US regulatory context included.
48%
of all breaches involve ransomware
Up from 44%
Up from 44% the year before. The median ransom paid fell to $139,875, and 69% of victims refused to pay at all.
48%
of breaches involve a third party
Up 60% year over year
A 60% jump in one year. Your vendors, your software suppliers, and your cloud accounts are part of your attack surface whether you manage them or not.
62%
of breaches involve the human element
Up from 60%
Phishing, pretexting, stolen credentials, and simple mistakes. Mobile phishing clicks run 40% higher than email, because attackers moved to your pocket.
How breaches actually happen
Five patterns describe nearly every breach. Watch System Intrusion, the pattern behind most ransomware, climb from 36% to 61% in three years. That is the story of modern cybercrime in one chart.
The four shifts that matter this year
The rise of vulnerability exploitation
Attackers stopped picking the lock. They walk through the unpatched door.
31%of breaches begin with an exploited vulnerability
26%of known-exploited critical flaws were fully fixed in 2025
43 daysmedian time to fully remediate, up from 32
For years the front door was a stolen password. Not anymore. Exploited software flaws are now the number one way attackers get in, and the defense is losing ground: barely a quarter of critical vulnerabilities on CISA’s Known Exploited Vulnerabilities list were fully fixed last year, and the ones that got fixed took almost two weeks longer than the year before. Meanwhile the typical organization had 50% more critical flaws to patch.
What to do: Know what you run, know what is exposed to the internet, and patch the exploited flaws first. That is a visibility problem before it is a patching problem.
Ransomware and third-party breaches keep growing
Half of breaches are now someone else’s software, or your own held hostage.
48%of breaches involve ransomware
69%of ransomware victims refused to pay
$139,875median ransom paid, and still falling
Ransomware climbed again to 48% of all breaches. The good news hides inside the bad: victims with tested backups increasingly refuse to pay, and the median payment keeps shrinking. Third-party exposure is the quieter half of the story. Breaches involving a vendor or supplier jumped 60% in a single year, and when researchers watched how fast third parties fixed missing MFA on cloud accounts, only 23% ever fully did.
What to do: Backups that someone has actually restored from, MFA on every account you and your vendors touch, and a written answer to the question: which suppliers could take us down with them?
Social engineering went mobile
Your team got good at spotting phishing emails. So the attackers left email.
40%higher click rate on mobile lures vs. email
16%of breaches start with phishing
6%begin with pretexting, a patient, targeted con
The human element sits inside 62% of breaches, and the delivery mechanism moved. Fake texts, scam calls, and voice pretexting now land 40% more often than email phishing, because nobody trained your team on their phones. Pretexting, where an attacker builds trust over days before making the ask, has become a favorite opening move for ransomware crews.
What to do: Train for the text and the phone call, not just the inbox. Then make the payroll and wire-change process survive one convincing phone call, because one is coming.
Generative AI joined the other side
The median attacker now uses AI across 15 different attack techniques.
15attack techniques where the median actor used AI
45%of employees now regularly use AI at work, up from 15%
3.2%of AI data-loss events involved research or technical docs
Attackers use generative AI to pick targets, write malware, and research your weaknesses, with some actors documented across 40 or 50 techniques. Inside your company, the same technology walked in without asking: employee AI use tripled in a year, mostly through personal accounts on work devices, and source code is the single most common thing pasted into it. Shadow AI is now the third most common insider data risk, ahead of most things your policy actually mentions.
What to do: Give people a sanctioned AI tool so they stop using unsanctioned ones, and put your source code and client data behind a data-loss policy that watches AI destinations.
Your industry, your numbers
Attack surfaces are not created equal. Pick your industry and see what actually hits businesses like yours, in plain language.
Small & Medium Business
NAICS All sectors7,152confirmed breaches analyzed
100%external attackers
100%financially motivated
55%involve a third party
How they get in
System Intrusion, Basic Web Application Attacks and Social Engineering: 100%
Every attacker external. Every motive financial. Nothing personal, purely math: small businesses hold the same valuable data as large ones with a fraction of the defenses. Internal data was taken in 97% of SMB breaches, credentials in 31%.
Where to start: You cannot protect everything, and you do not have to. MFA, tested backups, patched edge devices, and someone watching. That combination breaks almost every attack pattern on this page.
The view by region
Northern America
8,426 breaches30% start with an exploited flaw3% espionage motive
The largest regional dataset in the report. Financially motivated crime dominates at 98%, with credential abuse a stronger second vector than anywhere else.
Europe, Middle East & Africa
2,855 breaches42% start with an exploited flaw36% espionage motive
Espionage motivates 36% of EMEA breaches, ten times the North American rate. Third-party involvement (69%) and the human element (71%) both run above the global baseline.
Asia Pacific
6,060 breaches47% start with an exploited flaw27% espionage motive
The highest vulnerability-exploitation rate of any region at 47%, and the highest phishing entry rate at 28%.
Current advisories worth your attention
Chosen from the CISA Known Exploited Vulnerabilities Catalog and verified breach reporting. Not everything, on purpose. Just what a business owner should act on.
A firewall built for small offices and the console that manages your whole Check Point fleet are both under live attack (Check Point Spark and Management Server, CVE-2026-85102 and CVE-2026-93616)
Who should care: Any business running a Check Point Spark firewall, the line Check Point built for small and branch offices, or a centrally managed Check Point Security Gateway, and any IT provider running one Check Point Management Server across several clients' firewalls. Two separate flaws are being used right now. The Spark and Gateway flaw is a certificate-handling hole in the VPN login process: starting 12 September, attackers began logging in through forged certificates that look like ordinary VPN users, no password needed. The Management Server flaw is older and worse, since it hands an attacker root-level access to the console that configures every firewall it manages; targeted attacks against it go back to 23 July, more than seven weeks before Check Point shipped a fix. Both score 9.8 out of 10, and CISA put both on its exploited list on 22 September with a three-day deadline for federal agencies, about as urgent as that list gets.
Do this: Ask whoever manages your Check Point firewall, in-house or through an MSP, whether the fix for CVE-2026-85102 and CVE-2026-93616 is installed, and get a date, not a yes. If you run Spark or a managed Gateway, have them pull VPN and Mobile Access logs for logins using certificates you do not recognize, especially any issuer string containing 'CN=vpn,OU=users', and for internal network scanning right after a login like that. If a Management Server oversees more than one site or client, treat it as compromised until someone checks it directly, since these attacks reach back to July, and do not trust a clean report it generates about itself before that check happens.
Nearly a thousand small-office network switches have already been broken into and stripped of data (Zyxel GS1900 series, CVE-2026-7273)
Who should care: Any business, or any IT provider setting up a small office, running a Zyxel GS1900-series switch: the 8, 10, 16, 24 or 48-port models, plain or with power over Ethernet. These are some of the most common budget switches in small-office installs precisely because they are cheap and simple, which usually means nobody logs back in once the setup works. A stack-based buffer overflow in the switch's web management page lets an attacker who can reach that page run commands on the device with no login required. GreyNoise caught the first confirmed attacks on 17 September: a Chinese-speaking group has already broken into roughly 1,000 of these switches across 48 countries and pulled data off them. Zyxel shipped the fix in June, which means every switch still on the old firmware has had three months to be found.
Do this: Have whoever manages your network check every Zyxel GS1900 switch today. Firmware needs to be newer than 2.90(AAHH.1)C0; if it is not, updating it is the only fix, there is no workaround. Then confirm the switch's management page is reachable only from your internal network, never the open internet, because that is almost certainly how the compromised 1,000 were found. If a switch was running old firmware and its page was ever exposed, assume it was touched: reset it, update it, and rebuild the configuration rather than trusting whatever is on it now.
The email-marketing widget on your website was hijacked for five hours to push malware at your visitors and plant a backdoor in your WordPress (Brevo)
Who should care: Any business whose website carries a Brevo signup form, chat widget or tracking script. Brevo, which many owners still know as Sendinblue, is one of the most common newsletter and CRM tools in small business, and Sansec estimates up to 100,000 websites load the affected code. On 14 September, for about five and a half hours, someone used a stolen Cloudflare key to rewrite Brevo's scripts at the network edge. Brevo's own servers were never touched, so its integrity checks saw nothing. Visitors to any site loading those scripts got a fake Cloudflare verification page, then instructions to paste a command into Windows, the ClickFix trick, which installs malware on the visitor's computer. If the visitor happened to be a WordPress administrator logged into their own site, the script tried to install a plugin called Web Media Optimizer that hides itself from the plugin list, survives cleanup and carries a hard-coded key that lets the attacker sign in as an administrator without your password. The stolen key had been sitting in Brevo's source code with full account permissions, possibly since late August. It is Brevo's second incident in a week: on 10 September it disclosed a sign-on breach that let attackers hijack customer accounts and phish 347,000 people from one of them.
Do this: If your website uses Brevo, ask whoever manages it to check today whether anyone signed into WordPress as an administrator on 14 September and, if so, to open the plugin list and the must-use plugins folder and remove anything called Web Media Optimizer or anything else that appeared that day. Change every WordPress administrator password regardless. Tell your staff the rule that beats ClickFix every time: no website will ever ask you to open the Run box and paste a command, so if one does, close the tab and call IT. Then ask your web developer one question about every third-party script on your site: if this vendor is compromised, what can their code do on my page? The honest answer is usually anything, which is why the list should be short.
A cloud practice-management and records vendor was breached in January, noticed in June and is telling 118,563 patients in September (zHealth)
Who should care: Every practice that keeps its schedule, notes and billing in someone else's cloud, which is most chiropractic, physical therapy, dental and small medical offices today. zHealth says an intruder was inside its network on 20 and 21 January, two days in total. The company did not learn that data had been copied until around 15 June, finished working out whose records were involved on 3 September, and only then started the letters: names, medical information and insurance details for 118,563 people. Eight months passed between the break-in and the patient hearing about it. The same day's roundup adds Bridgeway Benefit Technologies, a benefits administrator, where one employee mailbox was read for ten weeks and Social Security numbers went with it, and a Texas emergency room operator that is still counting. If your vendor is breached, the patients are still yours, the breach letter is still yours under HIPAA, and the questions from patients and the state board come to your front desk, not the vendor's.
Do this: Make a list this week of every vendor that holds patient data for you: records system, billing, scheduling, patient messaging, transcription, the answering service. For each one, find the signed business associate agreement and check that it says how fast they must tell you about a breach; 60 days is the legal ceiling, and you want far less. Ask your records vendor in writing how they would know if someone copied your data, because zHealth's answer was five months. Then confirm your own copy: if the vendor went dark tomorrow, could you still see your patient list and your schedule? If you are a zHealth customer, call your account representative today and ask whether your patients are in the 118,563, and get the answer in writing.
One phone call to one employee gave a stranger eight days inside a home-health vendor's platform and the records of more than 28,000 patients (LHC Group)
Who should care: Every practice, agency and clinic that logs into a vendor's cloud platform to coordinate referrals or care, and every owner who has trained staff on suspicious email but never on a suspicious phone call. LHC Group provides home health and hospice in 28 states. On 7 April an employee took a call from someone who talked them out of their login. The caller used it the same day to sign into a third-party referral and care-coordination platform as that employee and spent eight days copying files: names, birth dates, diagnoses, treatment plans, Medicare and Medicaid numbers and, for some, Social Security numbers. The letters are going out five months later, and the true count is likely well above the 28,000 the state filings show, because most states do not publish numbers. The same roundup carries a 1,500-patient pediatric practice in Conway, Arkansas that the ransomware crew The Gentlemen added to its leak site in June, and a St. Louis mental health nonprofit whose review took five months to confirm what was taken. Nobody broke through a firewall in any of these. Someone answered the phone.
Do this: Add the phone to your security training this month. The script is short: nobody from IT, a vendor or the bank will ever call and ask for a password, a code from your phone or approval of a sign-in prompt, and if they do, hang up and call the number you already have on file. Then ask your IT provider to turn on the sign-in step a stolen password cannot pass, a passkey or hardware key, for every account that reaches patient data, starting with the ones that log into vendor platforms. Finally, pull the list of vendor portals your staff use and check that each one alerts you, not just the vendor, when an account signs in from a new device or place. LHC found out because the vendor noticed. Yours may not.
A single crafted email can hand an attacker root control of a Cisco Secure Email Gateway, the box that is supposed to be screening your mail (CVE-2026-76461)
Who should care: Any organization that filters incoming mail through a Cisco Secure Email Gateway, physical or virtual, whether you run it yourself or your IT provider runs it for you. Larger firms, hospitals, law practices and anyone with a compliance reason to keep mail filtering on premises are the usual owners. Nobody has to log in and nobody has to click. The attacker sends an email containing database commands, the gateway's own parsing code runs them, and the result is full control of the appliance that sees every message your company receives. Cisco rates it 9.8 out of 10 and published the fix on 14 September. CISA put it on the exploited list the same day, which means someone is already using it. This is the second time in nine months a Cisco email gateway flaw has been used in real attacks; the last campaign left hidden remote-access implants behind.
Do this: Ask whoever runs your mail gateway to upgrade this week to 15.5.5-0141, 16.0.4-3021 or 16.5.0-780, whichever matches your release line. Cisco has published no workaround, so the upgrade is the only fix. Have them confirm the appliance's management interface is not reachable from the internet; Shadowserver counts more than 400 of these boxes exposed right now. If Cisco hosts your filtering through Secure Email Cloud, ask in writing whether your tenant was among the cloud customers Cisco has already contacted about signs of compromise, and to confirm the fix is on. Then ask for a review of the mail logs on every cluster member and the firewall logs around the appliance, because a fix stops the next intruder and does nothing about the one who arrived last week.
A twelve-clinic dental group in Honolulu is mailing 45,853 breach letters over an intrusion that lasted about one day (Hawaii Family Dental)
Who should care: Every dental and medical practice with more than one location, and every small practice that assumes it is too small to be worth a criminal's time. Hawaii Family Dental runs a dozen clinics. Someone got into its network on 19 July, reached the systems holding patient records, and was noticed on 20 July. Names, birth dates, treatment histories and insurance details went out the door; the Qilin extortion crew says it has the files. Social Security numbers were not involved, which will not stop patients, lawyers or the state dental board from asking what safeguards were in place. The same roundup lists a critical access hospital in Idaho and a 19-location practice in Ohio breached through a single employee mailbox, with as few as 553 patients affected. Size did not protect anyone on that list.
Do this: Ask your IT provider one question this week: if someone were inside our network right now, how would we know, and how fast? One day was enough here to copy every patient file. Then get it in writing that your backups are stored somewhere the office network cannot reach, and that every staff mailbox requires a second step to sign in. If you cannot get a straight answer, the answer is no. If you are a Hawaii Family Dental patient, watch for the letter and take the credit monitoring.
The remote-support tool your IT provider uses to take over your screen has been spreading malware from one connected computer to the next (ConnectWise ScreenConnect, CVE-2026-84869)
Who should care: Any business whose IT provider connects to its computers with ScreenConnect, and any business that has ever clicked a support link and let a technician in. That covers most companies under 200 people. Huntress traced attacks back to 20 August: the crooks talked victims into running a doctored ScreenConnect client, then used the live session to push files onto every other computer that client could reach and run them without the technician ever clicking approve. Four scripts went out that way, built to stay put and keep spreading. ConnectWise rated the hole 9.9 out of 10, shipped the fix in version 26.6.5 on 8 September, and CISA gave federal agencies three days to patch once it landed on the exploited list on 11 September. The server side is not affected. The client on your machines is.
Do this: Ask your IT provider today whether every ScreenConnect client on your computers is on 26.6.5 or later, and whether their own technicians' machines are too. Until they can say yes, have them switch off the TransferFiles permission in ScreenConnect, which is the workaround ConnectWise published. Then remind your staff of the one rule that would have stopped this: nobody installs a remote-support tool because a caller or an email told them to. Support sessions start with your IT firm, on your ticket, and nowhere else.
About the data
Baseline data: Verizon 2026 Data Breach Investigations Report, the 19th edition of the most comprehensive study of real-world breaches in the industry. More than 31,000 security incidents and 22,000 confirmed breaches across 145 countries, contributed by almost one hundred organizations, from incident response firms to law enforcement to cyber insurers.
Do not let the bad guys take what you built.
Tell us your industry and we will send a complimentary threat and risk report for businesses like yours, then a Cyber Success Engineer will walk you through it.