Loading story…
Itron, a U.S. utility technology company, disclosed that an unauthorized third party accessed portions of its internal IT environment, with the intrusion detected on April 13. The company said it activated its incident response plan, engaged external cybersecurity experts, notified law enforcement, and began containment, remediation, and forensic investigation. Itron reported that malicious activity has been blocked, no subsequent unauthorized activity has been observed in its corporate systems, and no unauthorized activity was identified in the customer-hosted portion of its environment.
The company said business operations have remained largely unaffected because of contingency plans and backups, and it does not currently expect the incident to have a material impact, with insurance expected to cover a significant share of related costs. The full scope of the breach remains under investigation, including whether legal or regulatory notifications will be required, and no threat actor or ransomware group has publicly claimed responsibility for the intrusion.
See attribution, scope, and your downstream exposure.
7 events from the most recent confirmed update back to the earliest known activity.
Medtronic said an unauthorized party accessed data in certain corporate IT systems. The company stated its products, patient safety, manufacturing, distribution, customer connections, and financial reporting systems were not affected.
At Black Hat Asia in Singapore, RunSybil CEO Ari Herbert-Voss said frontier LLMs are accelerating offensive security work and that average time from bug discovery to exploitation had fallen from five months in 2023 to about 10 hours in 2026. He said AI can autonomously perform substantial parts of multistep attack chains in controlled settings, but still remains unreliable for fully autonomous real-world mass exploitation.
Itron publicly disclosed that an unauthorized third party had accessed portions of its internal IT environment and said its investigation into scope and impact was ongoing. The company stated it did not expect a material impact and anticipated insurance would cover a significant portion of related costs.
After detecting the intrusion, Itron activated its cybersecurity response plan, engaged external cybersecurity advisors, and notified law enforcement to investigate, contain, and remediate the breach. The company said the malicious activity was blocked and no follow-on activity had been observed.
Itron detected a cyberattack involving unauthorized access to certain internal corporate systems on April 13, 2026. The company later said it had not observed unauthorized activity in customer-hosted environments and that business operations were largely unaffected.
Operational technology and industrial control system security leaders, including representatives from Claroty and SANS, warned that pure-play OT and ICS vendors appeared to be left out of Anthropic's Project Glasswing early-access effort. They argued critical infrastructure defenders need participation because OT patching and mitigation timelines are slower and AI is sharply reducing time-to-exploit.
Anthropic said its advanced AI model Mythos had already found thousands of high-severity vulnerabilities, including flaws in major operating systems and web browsers, but did not release it publicly because of its dangerous exploit-generation capability. This decision became a focal point for debate over who should receive early access through Project Glasswing.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
8 references tracked. Mallory keeps watching after this page renders.
securityaffairs.com
Open sourcego.theregister.com
Open sourcetechcrunch.com
Open sourcethecyberthrone.in
Open sourcedarkreading.com
Open sourceteiss.co.uk
Open sourcebleepingcomputer.com
Open sourcegovinfosecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
OnTrac, a U.S. parcel delivery company, notified customers that attackers breached its corporate network and accessed certain files containing personal information. The company said the unauthorized access occurred between March 20 and March 22 and was detected on March 23, prompting an internal investigation and the engagement of a third-party incident response specialist. The exposed information included customer names, though the full scope of compromised data was not publicly detailed because notification materials were redacted. OnTrac said it re-secured the affected data, verified it had not been distributed, and had not identified fraud or public leaks linked to the incident; the company is offering affected individuals 12 months of credit monitoring and identity protection through **CyberScout**.
Jul 28, 2026
Analog Devices disclosed that an unauthorized party accessed certain internal systems and exfiltrated some company files, prompting the semiconductor company to activate incident response procedures, engage external cybersecurity experts, and notify law enforcement. The company said it detected the intrusion on June 23 and later reported the incident in an SEC Form 8-K, adding that it is still determining the scope of the breach and the type of data affected. The company said it has not observed stolen data being leaked or used fraudulently and does not currently expect the incident to materially affect operations or its financial condition. Analog Devices also said it is evaluating a separate cybersecurity matter that became public in late July, while an extortion group known as **ExfilSquad** separately claimed on its leak site to have stolen roughly **570,000 customer records**; the company has not linked that claim to the disclosed breach, and the allegation remains unverified.
Aug 2, 2026
**Intuitive Surgical** disclosed that attackers gained access to internal business administrative systems after stealing an employee's credentials in a phishing attack. The intrusion exposed customer business and contact information, employee data, and corporate files, while the company said the incident did **not** affect operations, hospital customer networks, or its core robotic surgery and digital platforms, including **da Vinci** and **Ion** systems. Intuitive said its robotic systems operate independently from the compromised internal business network and that hospital environments remain separately managed. The company said it took immediate containment steps, launched an ongoing investigation, and notified data privacy regulators. Reporting also noted that Intuitive's network segmentation separated internal IT business systems, manufacturing operations, and digital products, which the company cited as the reason the breach did not spread into production or customer-facing clinical environments. Public details remain limited, including when the phishing attack occurred and when it was detected, but both reports indicate the incident was confined to internal business applications rather than operational or medical device infrastructure.
Jun 29, 2026