The day's cybersecurity headlines from public sources, in one place. Search them, filter by theme or CVE, or show only vulnerabilities CISA has confirmed are being exploited. Every headline links to the original.
For my own read on what the news means for your business, see Insights.
48 stories match. Clear filters
-
Microsoft details NeedyMantis, a modular backdoor used in targeted operations
NeedyMantis is a post-compromise framework using DLL sideloading through legitimate apps (Poedit, curl, Vim, TightVNC), a custom encrypted archive format, and WebSocket C2 with RC4. Targets seen: telecoms, universities, medical nonprofits, intergovernmental bodies and government contractors…
-
OpenAI research agent bypassed Australian Medicare portal access controls, disclosure delayed weeks
An OpenAI research agent, during an internal task in June 2026, was repeatedly blocked by access controls on Australia's Medicare statistics portal and found a workaround on June 18, pulling non-public files (aggregate health stats, internal file names — no patient records). OpenAI found this in…
-
RunSafe index finds 24 percent of healthcare organizations hit by a medical device attack or exploited flaw
RunSafe Security's 2026 Medical Device Cybersecurity Index found 24 percent of surveyed healthcare organizations experienced an attack or exploited vulnerability involving a medical device, up from 22 percent in 2025. Among those affected, 80 percent reported a moderate or significant effect on…
-
Health-ISAC publishes a nine-domain MedTech security baseline for device procurement and lifecycle decisions
Health-ISAC's Medical Device Security Council released a MedTech Security Baselines paper naming nine foundational cybersecurity capability domains for healthcare delivery organizations and device manufacturers to use during evaluation, procurement, deployment, exception review, and lifecycle…
-
CISA publishes healthcare and industrial advisories: NextGen Mirth Connect, Orthanc DICOM Server, AVEVA Pipeline Integrity Monitor
CISA released three advisories on September 10. ICSMA-26-253-01 covers NextGen Healthcare Mirth Connect, where versions 4.7.1 and earlier allow an authenticated user to execute arbitrary SQL through a Database Connector API, potentially disclosing stored credentials for connected systems, writing…
-
New N0va phishkit uses device code phishing to reach Primary Refresh Token SSO access
ANY.RUN documented N0va, a phishkit targeting organizations across North America and Europe in government, technology, consulting, and healthcare. It uses lures imitating Microsoft Teams, SharePoint, OneDrive, DocuSign, Google Drive, Dropbox, Zoom, and Adobe Sign, then runs device code phishing to…
-
Veradigm discloses third-party vendor breach exposing patient SSNs, ransomware gang claims 3.5 million records
Veradigm, formerly Allscripts, told the SEC that an attacker obtained credentials from a vendor's environment for a Veradigm API reserved for customer services, then used that access to copy patient data including names, addresses, and Social Security numbers. Clinical and medical information was…
-
CNIL fines Loire Private Hospital €500,000 over patient data breach
France's data protection authority fined Loire Private Hospital €500,000 after an attacker used an external physician account, lacking VPN or MFA, to access the electronic patient record system undetected over several days during summer 2025, exposing 524,867 patients and 202,246 associated…
-
DOJ corrects its China hacking statement: federal agencies were targets, not confirmed victims
The Department of Justice revised a press statement that had described NASA, the Federal Reserve, the Department of Energy, DOJ, HHS, NIH, and the U.S. Senate as victims of intrusion activity by the PRC-affiliated group QTFY. The updated language lists those agencies as "among the targets of…
-
North Korean fraudulent worker scheme expands into healthcare and sales roles
DPRK-linked operators long associated with fraudulent IT employment are now placing workers in sales, marketing, and medical roles. The scheme relies on stolen or forged identity documents, VPNs, and proxy services to conceal location, with proceeds funding weapons programs. The activity is…
-
Falcon ransomware group claims 2.96 TB from medical device maker Globus Medical, including FDA submission and adverse event records
The Falcon ransomware group listed Globus Medical (NYSE: GMED), a publicly traded spinal and orthopedic implant manufacturer, and claims 2.96 TB of data centered on a full Microsoft Power BI environment with more than 51,000 customer records. The claimed contents include FDA feedback, 510(k)…
-
McKesson discloses breach, ShinyHunters claims 284 million patient records and a $55.2 million demand
McKesson discovered the incident on August 25 and filed an SEC Form 8-K the same day it went public, stating it has not determined the incident to be material. ShinyHunters told BleepingComputer it vished multiple McKesson employees using a mckesson[.]claims lookalike domain, compromised their…
-
More than 130 technology and finance companies sign a joint warning on a closing window for cyber defense
OpenAI published a call for collective action on cyber defense signed by more than 130 organizations including Anthropic, AWS, Google, Microsoft, and Oracle, warning of a "limited window" before AI-enabled attacks become far more widespread and sophisticated. The letter names hospitals, water…
-
DOJ and FBI disrupt QScan and QTRouter, Chinese platforms used against NASA, the Federal Reserve, and the Senate
DOJ announced the disruption of two hacking platforms operated by a Chinese state-sponsored group tracked as QTFY, employed by Nanjing Xinjiuwei Network Technology Company. Named victims include NASA, the Federal Reserve, the Department of Energy, DOJ, HHS, NIH, and the US Senate. Lumen Black…
-
Treasury sanctions six Iranian MOIS operatives who hit US energy, defense, healthcare, and universities
Operation Economic Outcast designated nearly 60 Iran-linked entities, individuals, and vessels across nuclear, missile, oil, and cyber networks, and named digital assets as a sanctionable sector. Six Iranian Ministry of Intelligence and Security operatives were sanctioned for compromising US…
-
Hospital operator Nutex Health discloses data exfiltration in SEC 8-K
Nutex Health, a Nasdaq-listed operator of 28 facilities across 12 states with 2025 revenue of about 875 million dollars, disclosed that an unauthorized third party accessed and exfiltrated information from its servers. The company engaged outside forensics, activated its response plan, implemented…
-
SickKids hospital breach exposes employee and job applicant data via third-party software flaw
Toronto's Hospital for Sick Children disclosed that a vulnerability in a third-party software application exposed personal information of current and former employees of SickKids, its Boomerang pediatric clinic, and the SickKids Foundation, plus job applicants. Clinical systems and patient records…
-
Inotiv pharmaceutical/life-sciences ransomware (Qilin) confirmed
Inotiv, a pharmaceutical and drug-research firm, disclosed a ransomware attack affecting 9,542 individuals with theft of personal information. The Qilin group claimed responsibility and alleged exfiltration of more than 162,000 files, a figure not independently verified at time of reporting.
-
AnMed health system claimed by TheGentlemen ransomware group
TheGentlemen ransomware group has now formally claimed AnMed, the nonprofit health system serving upstate South Carolina and northeast Georgia, and set a 72-hour deadline before threatening to leak stolen data. The underlying attack, first disclosed July 26 as a "cybersecurity disruption involving…
-
Unlimited Technology Systems breach impacts 3.8 million (healthcare)
Healthcare software firm Unlimited Technology Systems reported that more than 3.8 million people were affected by a breach dating to an October 2025 incident. Disclosure timing keeps healthcare data-handling and vendor risk in focus.
-
CareCloud healthcare data breach impacts over 350,000
CareCloud disclosed that attackers stole personal, financial, and medical data from its AWS environment in a March 2026 incident affecting more than 350,000 people. Healthcare records plus a cloud-hosting angle make this a double-relevant item. Disclosure timing (now) versus incident timing…
-
Healthcare ransomware exposes 245,000+ patients (Bell Ambulance, Alabama Ophthalmology Associates)
Ransomware attacks on Bell Ambulance and Alabama Ophthalmology Associates compromised protected health information for more than 245,000 patients combined. Both are the type of mid-size healthcare provider that carries HIPAA exposure and thin security staffing.
-
MagMutual, a medical malpractice insurer, listed as breached by threat actor "LeakNet"
MagMutual Insurance Company, an Atlanta-based medical professional liability insurer serving physicians and healthcare organizations nationwide, was listed by threat actor LeakNet. As an insurer, MagMutual is subject to state insurance data-security laws requiring a written information security…