Loading story…
Verizon’s 2026 Data Breach Investigations Report found that vulnerability exploitation became the leading initial access vector for breaches for the first time in the report’s 19-year history, accounting for about 31% of known breach entry points and surpassing phishing and stolen credentials. Based on more than 31,000 security incidents and 22,000 confirmed breaches across 145 countries, the report said ransomware appeared in 48% of breaches, financially motivated actors drove most activity, and defenders are falling behind on remediation: surveyed organizations fully fixed only 26% of critical known exploited vulnerabilities on average, with a median remediation time of 43 days even as attackers increasingly weaponize flaws within hours. Verizon and other reporting also highlighted rising abuse of third parties, remote monitoring and management tools, infostealer-fed credential theft, and AI-assisted attacker workflows, while voice- and text-based social engineering increasingly outperformed traditional email phishing.
The findings were especially stark for healthcare, where Verizon tracked 1,492 incidents and 1,438 confirmed data disclosures, many tied to ransomware intrusions launched through exploited vulnerabilities or social engineering. Separate reporting said small and mid-sized healthcare providers remain disproportionately exposed, with eight recently disclosed breaches affecting nearly 2 million people, including incidents at Coastal Carolina Health Care and Erie Family Health Centers. Analysts cited limited security resources, slow patching, interconnected vendors, and growing use of unapproved shadow AI tools as factors increasing both compromise and data leakage risk in a sector already handling highly sensitive personal and medical information.
Get the actors, campaigns, and ATT&CK mapping behind it.
9 events from the most recent confirmed update back to the earliest known activity.
The same May 20 reporting identified Erie Family Health Centers as having reported a security incident affecting 570,000 patients.
The May 20 healthcare-sector reporting cited Coastal Carolina Health Care in North Carolina as having reported a breach impacting 110,304 individuals.
A May 20, 2026 report said eight recently disclosed breaches at small and mid-sized healthcare providers affected nearly 2 million individuals, illustrating the sector's continued exposure to ransomware and data theft.
Verizon publicly released its 2026 Data Breach Investigations Report, prompting coverage across multiple outlets on the report's findings about vulnerability exploitation, patching failures, ransomware, healthcare targeting, and AI-related risks.
The 2026 DBIR found ransomware present in 48% of breaches, a 60% year-over-year increase in third-party involvement, growing abuse of voice and text pretexting, and rising risks from attacker use of AI and employee use of unapproved 'shadow AI' tools.
In Verizon's 2026 DBIR healthcare analysis, social engineering, system intrusion, and miscellaneous errors accounted for 81% of healthcare breaches in 2025, with pretexting rising to the second most common social action after phishing. The report and cited researchers also linked the trend to more effective AI-assisted impersonation and credential-theft campaigns tailored to healthcare workflows.
Verizon's healthcare-specific findings for the 2026 DBIR showed 1,492 healthcare incidents, including 1,438 confirmed data disclosures, with most tied to ransomware-driven system intrusions often beginning through exploited vulnerabilities or social engineering.
In the completed 2026 DBIR analysis period, exploited vulnerabilities overtook phishing and stolen credentials as the leading initial access vector for the first time in the report's 19-year history, accounting for about 31% of breaches. The report also tied the shift to slower patching, with only about 26% of critical or known exploited vulnerabilities fully remediated and median remediation time rising to 43 days.
Verizon's 2026 Data Breach Investigations Report analyzed more than 31,000 security incidents and over 22,000 confirmed breaches across 145 countries during the Nov. 1, 2024 to Oct. 31, 2025 reporting period.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
17 references tracked. Mallory keeps watching after this page renders.
health-isac.org
Open sourcehelpnetsecurity.com
Open sourcethecyberexpress.com
Open sourcedarkreading.com
Open sourcetheregister.com
Open sourcehipaajournal.com
Open sourceits.ny.gov
Open sourceverizon.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Recent reporting highlights a shift in enterprise cyber risk toward **external dependencies and identity abuse**. Coverage of the EU’s **NIS2** directive emphasizes that organizations are expected to treat **supply-chain security** as a core governance and architecture issue, reflecting the reality that third parties (e.g., cloud providers, software suppliers, maintenance access, and outsourced services) are frequent intrusion paths rather than risks contained “inside the firewall.” Separately, findings cited from Eye Security’s *State of Incident Response Report 2026* indicate attackers are increasingly **exploiting existing access** rather than “hacking in,” with **identity-based attacks** dominating and **passwords** implicated in the vast majority of such incidents; common initial compromise paths still include phishing, exposed/misconfigured internet-facing systems, social engineering, and software supply-chain attacks. In healthcare, a Trellix threat intelligence report based on **54.7 million detections** from 2025 healthcare environments warns cyber incidents are escalating from IT disruption into a **patient safety** issue due to highly interconnected systems and “cascading” outages. The report identifies **email** as the leading threat vector and the **U.S.** as the primary target, and describes ransomware and extortion activity intensifying, including groups such as **Qilin** (noted for targeting EHR databases), **INC Ransom**, and newer actors like **Sinobi** focusing on biotech; it also reports a sharp rise in **extortion-only** tactics with per-patient ransom demands intended to sidestep corporate insurance dynamics. Across these sources, **phishing** remains a dominant initial access method, with lures increasingly tailored to privileged IT roles (e.g., “AI Transformation” themes).
Jul 12, 2026
Data breaches in the United States have reached alarming levels in 2025, with 835 incidents reported in the third quarter alone, affecting 23 million individuals. Despite a slight downturn in Q3, the total number of breaches for the year has already reached 2,563, impacting nearly 202 million victims, according to the Identity Theft Resource Center. The majority of these compromises—83%—were caused by cyberattacks, while physical attacks have also increased, with 53 incidents reported so far, surpassing the total for the previous year. Major organizations affected include Anne Arundel Dermatology, DaVita, Radiology Associates of Richmond, TransUnion, and Absolute Dental Group, each sending millions of breach notifications to affected individuals. The financial sector has been particularly hard hit, experiencing 188 breaches, making it the most impacted industry. A significant concern highlighted by the ITRC is that 71% of breach notifications lacked details about the attack vectors, which complicates efforts to mitigate identity theft and fraud. Microsoft’s 2025 Digital Defense Report corroborates the trend, noting a 32% surge in identity-based attacks in the first half of the year, with over 97% of these attacks leveraging stolen passwords. Hackers are increasingly using credential leaks, infostealer malware, and social engineering tactics such as help desk scams to obtain access to sensitive accounts. The Scattered Spider group has been linked to several high-profile attacks using these methods. Microsoft has also played a role in disrupting infostealer operations, notably taking down the Lumma Stealer infrastructure, though new variants continue to emerge. The prevalence of password-based attacks underscores the need for stronger authentication measures and better user education. The lack of transparency in breach notifications further exacerbates the risk, as individuals and organizations are left without critical information to protect themselves. The rise in both cyber and physical attacks demonstrates the evolving threat landscape facing US organizations. The healthcare and financial sectors remain prime targets due to the sensitive data they hold. Experts warn that unless organizations improve their security posture and reporting practices, the US is on track for another record-breaking year in data breaches. The combination of sophisticated attack techniques and inadequate breach disclosures increases the risk of widespread identity theft and financial fraud. Security professionals are urged to prioritize credential protection, implement multi-factor authentication, and ensure timely, detailed breach notifications to mitigate the growing threat.
Jun 29, 2026
IBM’s **2026 Cost of a Data Breach Study** found that the average global cost of a data breach rose **12% year over year** to nearly **$5 million**, while the **United States** recorded the highest national average at **$11.5 million**. **Healthcare** remained the most expensive sector globally at **$6.64 million per breach**, even after a 10.5% decline from the prior year, and **phishing** was identified as the most common initial access vector across industries, with an average breach cost of **$5.9 million**. The report said breach **identification and containment times increased** for the first time in five years, with **removable media** and **supply chain compromises** taking the longest to resolve. It also found that **AI-driven attacks** rose **56%** year over year, affected **one in four organizations**, and added roughly **$1 million** to average breach costs, while **shadow AI** incidents more than doubled. **Ransomware** remained a major driver of losses, with **39%** of breached organizations reporting at least one ransomware attack in the past year and attackers increasingly using **data leaks** and **public shaming** to pressure victims into paying.
Aug 4, 2026