Loading story…
German certification body GUTcert reported that unidentified attackers accessed parts of its IT environment on 5 September 2026 and allegedly exfiltrated about 640 GB of data from 6 to 9 September. The organization detected the intrusion overnight between 9 and 10 September, cut off identified attacker access on 10 September, and notified Berlin’s data-protection authority, the LKA, and Germany’s BSI on 11 September. Employees were informed on 14 September.
The attackers launched repeated extortion attempts from 12 to 20 September and sent GUTcert clients, contacts, auditors, and employees emails containing links to purported stolen data. GUTcert also identified and closed an unauthorized email session on 15 September; it said it had no evidence at that time of concurrent file-system access. Organizations that exchanged sensitive information with GUTcert should assess exposure, monitor for credential theft and targeted phishing, and validate the authenticity of breach-related communications.
See attribution, scope, and your downstream exposure.
14 events from the most recent confirmed update back to the earliest known activity.
GUTcert publicly reported the cybersecurity incident on its official website.
The attackers made fifth and sixth extortion attempts by emailing GUTcert clients, contacts, auditors, and employees links to download purportedly stolen data.
GUTcert published a dedicated page providing information about the security incident.
The attackers made a fourth extortion attempt from an external account.
The attackers made a third extortion attempt using an external email account.
GUTcert identified and immediately closed an unauthorized email session that had remained active. It reported no indication of simultaneous file-system access at that time.
The attackers made a second extortion attempt against GUTcert.
GUTcert informed all employees about the cybersecurity incident.
The attackers made their first extortion attempt. GUTcert did not respond.
GUTcert notified the Berlin data-protection authority, the LKA, and Germany’s Federal Office for Information Security (BSI) about the incident.
GUTcert terminated the attacker access it had identified following detection of the intrusion.
Unidentified third parties gained unauthorized access to parts of German certification body GUTcert’s IT systems.
GUTcert detected the attack overnight between 9 and 10 September during routine activity.
The attackers allegedly exfiltrated about 640 GB of data from GUTcert between 6 and 9 September.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A cyberattack on **Unimed**, a third-party billing and receivables service provider for German hospitals, exposed data from tens of thousands of patients at multiple university medical centers, including facilities in Cologne, Freiburg, Heidelberg, Ulm, Tübingen, and Mannheim. The intrusion reportedly occurred in mid-April and affected administrative and billing records tied to privately insured patients, self-paying patients, and some international patients; hospitals said their own clinical systems were not breached and patient care was not disrupted. Hospitals disclosed that the stolen information included personal details and, in some cases, highly sensitive medical and financial data such as diagnoses, treatment information, correspondence, and limited bank or payment details. Several affected institutions suspended data transfers to the provider, Heidelberg University Hospital filed a criminal complaint, and officials in Freiburg called for a full investigation, while some hospitals said they were considering legal action against Unimed. The attackers have not been identified and no group has publicly claimed responsibility.
Jun 29, 2026
Accenture confirmed a cybersecurity breach after a threat actor using the name **"888"** advertised roughly **35 GB** of alleged company data for sale on a cybercrime forum. The seller claimed the cache included source code, configuration files, **RSA keys**, **SSH keys**, **Azure Personal Access Tokens**, and **Azure Storage access keys**, and reportedly shared a screenshot appearing to show an Azure DevOps repository tied to an Accenture domain being cloned. Independent verification of the full dataset and its authenticity was not available at the time of reporting. Accenture said it detected irregular activity, investigated the incident, contained the affected environment, remediated the source of the breach, and restored impacted systems. The company said operations and service delivery were not affected, but it has not disclosed how the intrusion occurred, how many systems or repositories were involved, whether the exposed credentials were valid, or whether any customer data or customer environments were impacted.
Jul 11, 2026
Multiple healthcare entities reported **unauthorized access and patient data exposure**, with incidents spanning direct provider compromises and third-party vendor breaches. **Insight Hospital and Medical Center (Chicago)** disclosed suspicious activity in its IT environment, with investigators confirming **unauthorized network access from Aug 22 to Sep 11, 2025**; the organization said the review is ongoing but potentially impacted data includes **names, DOB, SSNs, passport numbers, financial account data, treatment information, and insurance details**. Two extortion groups publicly claimed responsibility: **LockBit** alleged theft of ~`200 GB` and **Termite** claimed `360 GB`, stating it leaked data in late February 2026. In France, attackers stole about **15.8 million administrative files** after breaching health-ministry software supplier **Cegedim Santé**, impacting its *MonLogicielMedical (MLM)* product used by thousands of doctors; the stolen data reportedly included **identity and contact details**, and in a smaller subset (~**165,000** files) **free-text doctors’ notes** that in limited cases contained sensitive medical-history details. Separately, **OCAT, LLC d/b/a Evoke Wellness at Hilliard** updated a breach notification describing **unauthorized network activity** and potential access to patient information; reporting also tied the matter to an **insider misuse** investigation in which a former employee allegedly accessed and sold patient data, though public filings contained **inconsistent timelines** about when the underlying incident occurred and when it was discovered.
Jun 29, 2026