Loading story…
Security and privacy leaders are reporting increased pressure to improve attack surface visibility and strengthen privacy programs as digital transformation expands exposure across cloud, SaaS, APIs, endpoints, and third parties. A LinkedIn poll cited by SC Media ranked attack surface visibility as the top infrastructure security priority (40%), ahead of cloud/hybrid security and identity and access security (25% each), while a separate SC Media commentary tied modern privacy risk to the same drivers—rapidly growing environments and increasingly industrialized cybercrime—arguing that breach risk remains a direct threat to business resilience and consumer trust.
Multiple reports highlighted how breach activity and downstream abuse continue to shape priorities. DataBreaches.net relayed BBC reporting that criminals are buying stolen customer databases (including alleged data from Kering) to identify high-value targets and run tailored crypto scams, with one hacker claiming to have used cross-referenced breach data to steal from Coinbase users. In healthcare, a Fortified Health Security report cited by DataBreaches.net found breach frequency more than doubled in 2025 while exposed patient records decreased, attributing the shift to ransomware, identity compromise, and third-party weaknesses—a pattern emphasizing operational resilience over sheer record counts. Separately, figures reported for the UK’s North West Ambulance Service NHS Trust showed nearly 400 breach incidents over three years, with many categorized as confidentiality failures and misdisclosures, and the trust suggesting improved reporting/training may be contributing to higher counts. An ISACA study summarized by Help Net Security added that privacy teams face budget and staffing strain, and that AI use for privacy tasks (e.g., data discovery and monitoring) tends to correlate with program maturity and board support rather than urgency, while consistent privacy-by-design adoption remains uneven.
See the actors and campaigns active against you right now.
7 events from the most recent confirmed update back to the earliest known activity.
Results from a LinkedIn poll reported by The Cyber Express showed attack surface visibility was the leading infrastructure security concern among CISOs, receiving 40% of votes. The findings reflected growing focus on inventorying and securing cloud, SaaS, API, endpoint, and third-party assets.
A BBC report described how criminals used breached personal data, including alleged Kering customer spreadsheets, to identify wealthy cryptocurrency holders and scam them. A hacker interviewed by the BBC claimed the campaign generated at least $1.5 million in stolen cryptocurrency.
An ISACA global study published in January 2026 reported that privacy teams are under pressure from breach risk, emerging technology, compliance demands, and staffing constraints. It also found uneven privacy-by-design adoption, limited AI use in privacy operations, and training weaknesses that contribute to privacy failures.
Fortified Health Security's 2025 report found that healthcare data breaches more than doubled over the year, while the number of exposed patient records fell significantly. The report attributed the pattern largely to ransomware, identity compromise, and third-party weaknesses.
In the most recent year covered by the figures, NWAS recorded 172 data breach incidents. The trust said part of the increase may reflect improved staff training and reporting practices.
The same multi-year figures show NWAS reported 143 data breach incidents in the year after 2022/23, indicating a marked year-on-year increase in reported privacy and information-handling incidents.
Figures later cited by Data Breach Claims UK show the North West Ambulance Service NHS Trust recorded 75 data breach incidents in the 2022/23 year, establishing the baseline for a subsequent rise in reported incidents.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
6 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcescworld.com
Open sourcedatabreaches.net
Open sourcedatabreaches.net
Open sourcedatabreaches.net
Open sourcehelpnetsecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Reporting on healthcare security trends indicates **breach incidents increased sharply between 2024 and 2025**, even as the total number of compromised patient records declined, suggesting attackers are increasingly prioritizing **operational disruption** over mass data theft. Drivers cited include **ransomware**, **third‑party/vendor exposure**, and expanding “shadow AI” usage; the same reporting highlights low confidence in vendor risk assessments and in rapid detection/containment/recovery capabilities, reinforcing the need for improved visibility across overlapping technology stacks and more resilient security programs. Separately, the U.S. **HHS Office for Civil Rights (OCR)** stated it will continue HIPAA privacy/security enforcement despite federal office closures, and outlined 2026 priorities that include: continuing the **HIPAA Right of Access** initiative, expanding **Security Rule risk analysis** work into risk management, and emphasizing enforcement actions tied to **hacking and ransomware** (described as the leading driver of large breaches reported to OCR). OCR also noted preparation for a new enforcement program related to confidentiality of substance use disorder treatment records under **42 C.F.R. Part 2**, with breach reports and complaints expected to begin in February 2026.
Jun 29, 2026
European regulators issued about **€1.2B in GDPR fines in 2025** and received an average of **443 personal data breach notifications per day**, according to DLA Piper’s GDPR Fines and Data Breach Survey. The report attributes the sustained reporting surge to multiple factors—geopolitical instability, repeated cyber incidents, and commoditized attack tooling—while warning that organizations are also contending with overlapping and faster disclosure expectations under newer regimes such as **NIS2** and **DORA**, increasing operational and management-level accountability pressure. In the US healthcare sector, HHS **OCR** used its 2026 quarterly cybersecurity newsletter to urge **HIPAA-regulated entities** to harden systems, standardize security controls, reduce attack surface, and strengthen **risk analysis and risk management**, signaling continued enforcement focus on Security Rule compliance. Separately, OCR breach-portal reporting showed **unusually low counts** of large healthcare breaches in October–November 2025 that likely reflect a **government shutdown backlog** rather than a true decline, while individual incidents continued to surface—**Central Maine Healthcare** reported unauthorized network access from **March–June 2025** affecting up to **145,000** individuals, with exposed data including **names and Social Security numbers** plus treatment/insurance-related information and credit monitoring offered to impacted patients.
Jul 12, 2026
Recent reporting highlights a shift in enterprise cyber risk toward **external dependencies and identity abuse**. Coverage of the EU’s **NIS2** directive emphasizes that organizations are expected to treat **supply-chain security** as a core governance and architecture issue, reflecting the reality that third parties (e.g., cloud providers, software suppliers, maintenance access, and outsourced services) are frequent intrusion paths rather than risks contained “inside the firewall.” Separately, findings cited from Eye Security’s *State of Incident Response Report 2026* indicate attackers are increasingly **exploiting existing access** rather than “hacking in,” with **identity-based attacks** dominating and **passwords** implicated in the vast majority of such incidents; common initial compromise paths still include phishing, exposed/misconfigured internet-facing systems, social engineering, and software supply-chain attacks. In healthcare, a Trellix threat intelligence report based on **54.7 million detections** from 2025 healthcare environments warns cyber incidents are escalating from IT disruption into a **patient safety** issue due to highly interconnected systems and “cascading” outages. The report identifies **email** as the leading threat vector and the **U.S.** as the primary target, and describes ransomware and extortion activity intensifying, including groups such as **Qilin** (noted for targeting EHR databases), **INC Ransom**, and newer actors like **Sinobi** focusing on biotech; it also reports a sharp rise in **extortion-only** tactics with per-patient ransom demands intended to sidestep corporate insurance dynamics. Across these sources, **phishing** remains a dominant initial access method, with lures increasingly tailored to privileged IT roles (e.g., “AI Transformation” themes).
Jul 12, 2026