Loading story…
The provided items do not describe a single cohesive cybersecurity incident; they span multiple, unrelated topics. Dark Reading reported on calls for more detailed breach transparency, arguing that organizations often disclose too little about incidents and that the industry lacks structured post-incident feedback loops comparable to aviation and medicine; the piece highlights an upcoming RSAC session by Adam Shostack and Adrian Sanabria advocating for better disclosure and learning from failures.
Separately, Dark Reading covered wireless and drone-related risks for cities hosting major events (e.g., potential disruption to OT and public-safety communications where wireless components are present), and a distinct report described a real-world ransomware incident impacting the University of Mississippi Medical Center (UMMC), including disruption to IT systems and its Epic electronic medical records platform, alongside commentary on a fictional hospital ransomware storyline in HBO’s The Pitt. Other references in the set are not part of these Dark Reading stories: one is a weekly NCSC-themed roundup that briefly mentions an advisory on exploitation of Cisco Catalyst SD-WAN, and another is a conference write-up on Linux filesystem journal forensics tooling (FJTA) rather than an active threat event.
See the actors and campaigns active against you right now.
8 events from the most recent confirmed update back to the earliest known activity.
At RSAC 2026, Adam Shostack and Adrian Sanabria planned to argue for structured, institutionalized breach post-mortems so organizations disclose actionable details about how intrusions succeeded.
UMMC later said it was making significant progress restoring systems, but appointments and elective procedures remained canceled through at least Feb. 27 while phone lines were overwhelmed.
In response to the attack, UMMC shut down all 35 clinics to limit further damage and shifted operations into downtime conditions as systems were taken offline.
UMMC disclosed a ransomware attack that affected IT systems, including its Epic electronic medical records platform, creating operational disruption across the health system.
The board became inactive after its members were fired during the Salt Typhoon-related telecom breach investigation, ending a notable federal mechanism for detailed cyber incident review.
The US Cyber Safety Review Board was conducting an investigation into major telecom breaches attributed to the China-linked APT Salt Typhoon before the effort was disrupted.
Following a 2023 ransomware attack, the British Library publicly shared more detailed information about the incident, providing an example of the kind of breach transparency researchers say helps others learn from attacks.
The 2017 Equifax breach became a frequently cited example of how important technical and organizational lessons often emerge only later through regulatory filings, lawsuits, and congressional reporting rather than initial disclosures.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
3 references tracked. Mallory keeps watching after this page renders.
darkreading.com
Open sourcedarkreading.com
Open sourcedarkreading.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple organizations disclosed or were linked to **ransomware/data-extortion** activity with material operational or privacy impact. **Air Côte d’Ivoire** confirmed a cyberattack affecting parts of its information systems after **INC ransomware** claimed theft of **208 GB** and threatened to leak data, while the airline said it engaged the national CERT and external experts to contain impact and maintain flight operations. In the US healthcare sector, **University of Mississippi Medical Center (UMMC)** reported a ransomware incident that forced statewide clinic closures and disrupted access to **Epic** electronic medical records, prompting engagement with the **FBI** and **CISA** and use of downtime procedures to sustain patient care. Separately, **Conduent**’s earlier ransomware-linked breach continued to expand in scope, with breach notifications indicating at least **~25 million** people affected across multiple states and exposure of sensitive PII (including **SSNs** and health/insurance data). **Wynn Resorts** also confirmed an unauthorized party accessed and stole employee data after being listed by the **ShinyHunters** extortion group, with the company stating the actor claimed the data was deleted and that guest operations were not impacted. Other items in the set describe distinct, unrelated security events and broader threat research rather than the same incident: alleged data leaks involving **Burger King France** and **Wendy’s UK**; **Qilin** ransomware claims against a New York City transit union; Russian cyber operations against Ukraine’s power grid focused on intelligence collection; and a New Zealand healthcare application (**MediMap**) taken offline after apparent unauthorized access and **patient record tampering** (e.g., records marked deceased). Additional references cover threat research and trends (airline brand impersonation domains, edge-device exploitation telemetry, MuddyWater’s *Operation Olalampo*, Google Ads cloaking via **1Campaign**, freight/logistics phishing by “Diesel Vortex,” and various governance/AI/5G/quantum commentary), which provide context on the threat environment but do not substantively report on the same specific breach event.
Jun 29, 2026
No single cybersecurity event or topic coherently links the provided items; the set mixes unrelated **malware/campaign reporting** (e.g., *Steaelite* RAT MaaS capabilities; a fake Google security-check PWA leading to browser/Android surveillance; **Velvet Tempest**-linked ClickFix activity associated with *Termite* ransomware; the **SeaFlower** backdoored Web3-wallet campaign; and **ResidentBat** Android spyware attributed to the Belarusian KGB) with **healthcare breach notifications/settlements** (multiple provider incidents and a DragonForce-related settlement) and **policy/legal/governance** coverage (US healthcare cyber reform legislation; UK Court of Appeal ruling on “personal data”; South Korea considering cyber/data law updates). Several entries are primarily **opinion, interviews, newsletters, podcasts, or generic guidance** (agentic AI “hype vs reality,” AI for incident response, board metrics/risk signals, IAM exam playbook, dark web monitoring advice, crypto safety tips, and conference/podcast promos), which do not describe a specific incident and should be treated as low-signal for incident-driven intelligence. For operational relevance, the incident-focused items provide discrete, unconnected takeaways: *Steaelite* is described as an “all-in-one” Windows 10/11 RAT with credential theft, RCE, file management, and ransomware/DDoS-style modules managed via a web panel; Malwarebytes details a social-engineering flow impersonating Google that abuses PWA behavior and browser APIs (notifications, contacts, GPS, clipboard) and can drop an Android companion implant; Deception.Pro logs a ClickFix-to-LOLBins chain (e.g., `curl.exe`, `tar.exe`, PowerShell) with observed C2 and hands-on-keyboard AD discovery leading toward ransomware activity; Confiant-reported **SeaFlower** uses trojanized clones of major crypto wallets to steal seed phrases; Censys documents **ResidentBat** infrastructure fingerprints and notes physical/ADB sideloading as the installation method. Separately, HIPAA Journal items cover multiple healthcare entities disclosing unauthorized access/exfiltration and a class-action settlement tied to a prior DragonForce ransomware incident, while government/legal pieces address sector-wide reforms and evolving interpretations of data-protection duties rather than a single breach.
Jun 29, 2026
Multiple outlets published **weekly cybersecurity roundups** summarizing a mix of vulnerability disclosures, ransomware/breach reporting, and policy developments rather than a single discrete incident. TechTarget highlighted a surge in reported vulnerabilities (citing **48,000+ new CVEs in 2025**) and called out several high-impact issues, including a **critical ServiceNow weakness** tied to weak authentication in the legacy *Virtual Agent* chatbot that became more dangerous when paired with agentic AI (*Now Assist*), potentially enabling impersonation and **admin-level access** into connected enterprise systems. Other roundup coverage aggregated unrelated security events across sectors. Sherpa Intelligence’s “Five for Friday” compiled items including ransomware claims (e.g., **Everest** targeting Nissan; **Nightspire** claiming an attack on a Hyatt Place property) and breach reporting (e.g., a **Korean Air** employee-data breach attributed to **Clop**). The Cyber Express weekly roundup similarly mixed disparate topics (platform policy changes around AI abuse, senior government appointments, and national-level connectivity disruptions), reinforcing that the common thread is **curation of multiple stories** rather than new primary reporting on one specific cyber event.
Jun 29, 2026