DataBreachToday.com

Over 400 Organizations Breached via Ongoing ToolShell Attacks, Researchers Warn
The U.S. government agency that maintains and designs America's nuclear weapons was reportedly breached by attackers exploiting zero-day flaws in on-premises Microsoft SharePoint servers, with researchers now counting over 400 victims, including European and Middle Eastern governments.

Newly Appointed Advisory Group to Support NIS2 and CRA Implementation Across Europe
Beginning Aug. 1, European Union Agency for Cybersecurity, ENISA, will launch a new Advisory Group composed of 26 independent experts to help guide the EU’s cybersecurity strategy through 2027. Their work will support the rollout of the NIS2 Directive and the Cyber Resilience Act.

Huntress's Kyle Hanslovan Warns of MFA Bypass, Rogue Apps, Fake Device Enrollments
Cybercriminals are bypassing MFA using session tokens and rogue app access, with shadow workflows enabling persistent inbox theft against SMBs. Huntress offers behavioral training and managed identity response to SMBs for real protection not just more alerts, says CEO Kyle Hanslovan.

Early Hacktivists Laid the Blueprint for Chinese Hacking
There's a reason why many of the same tools appear time and time again in Chinese nation-state hacking: A first-generation of hackers who grew up together online and continue to swap techniques to this day. A report shows the influence of the so-called "Red 40".

Alpha Wellness Says 'Devastating' Incident Forced Closure of Georgia-Based Center
Another small medical care provider has shut its doors forever as the result of a recent "devastating" cyberattack. Georgia-based Alpha Wellness & Alpha Medical Centre has permanently pulled the plug on its operations following a data theft attack by cybercriminal gang RansomHub.

Experts Say Critical Infrastructure Sectors Have Made Little Cybersecurity Progress
Panelists told the House subcommittee on cybersecurity and infrastructure protection that U.S. critical infrastructure sectors have made few cyber improvements over the last 15 years despite fears of retaliation following digital and physical attacks on Iranian nuclear sites.

But Hacking Groups of All Stripes Now Have Access to Exploit Code, Researchers Warn
Microsoft said an attack campaign targeting zero-day vulnerabilities in on-premises SharePoint servers appears to have begun by July 7, tied to three Chinese hack groups. With proof-of-concept exploit code now in the wild, security experts said hackers of all stripes have joined the fray.

Labour Government Also Backs Ransomware Payment Clearance and Reporting
The British government vowed Tuesday to proceed with a proposed ransomware payment ban for critical infrastructure organizations such as the National Health Service and to press forward on a mandate for other businesses to notify authorities in advance of paying out a ransom.

Models Aren't Yet Available to Public
The math Olympiad was never meant to be a battleground for AI dominance, but this weekend changed that. Two of the world's leading AI labs announced that their systems achieved gold-medal-level scores in the International Mathematical Olympiad.

Report Urges Indo-Pacific Cyber Shield Strategy Amid Increased Nation-State Threats
A Center for a New American Security study found China and North Korea are accelerating cyberattacks, influence operations and infrastructure breaches across the Indo-Pacific, as researchers urge the U.S. to help develop a regional cyber shield, and deploy forward cyber teams.

Cierant Corp. Says Cleo MFT Zero-Day Exploit Compromised Health Plan Client Data
A Connecticut-based firm that provides print and electronic document management services to health plans has reported to regulators that an exploit of a vulnerability in file transfer software from third-party vendor Cleo has resulted in a health data compromise affecting nearly 233,000 people.

Startup Mira Security Will Offer Insights on Encrypted Network Traffic, Decryption
Darktrace purchased a network traffic visibility startup to get insights from encrypted network traffic and decryption for customers in regulated industries. Mira Security will provide organizations with deeper, more comprehensive visibility across on-premises, cloud and hybrid environments.

As Agentic AI Takes Over Workflows, Traditional Authentication Practices Fall Short
The explosion of agentic AI and autonomous bots to orchestrate cross-system tasks is turning MFA into a brittle defense. Non-human identities often bypass human-centric security controls, operating with static credentials and undefined ownership, creating exploitable identity risks.

Traditional security testing tools can’t keep pace with modern threats—or prove which vulnerabilities truly matter. Discover how Adversarial Exposure Validation (AEV) bridges the gap by continuously simulating real-world attacks to reveal exploitable exposures, prioritize risk, and empower smarter security decisions. Learn why AEV is the missing link in your CTEM strategy and how BreachLock is leading the way.

Tom Leighton of Akamai Wants to End Cloud Bloat and Secure AI From Inside Out
The cloud was meant to be cheaper, but it's not. A bold new vision is emerging: one that slashes costs, decentralizes AI and secures APIs at the edge. From inference to firewalls, a reimagined internet is challenging hyperscaler dominance.

Attackers Modify File-Transfer Server Software to Display Patched Version Number
Managed file-transfer software developer CrushFTP said a zero-day vulnerability in its tool's web interface is being actively exploited to gain admin-level access to servers. The company urged immediate updating, saying all versions of its software released since July 1 are patched.

Leaders of the Russian Military Intelligence Units of the GRU Also Targeted
The U.K. government on Friday sanctioned three Russian Military Intelligence Service units 29155, 26165 and 74455 in the United Kingdom and Ukraine. The sanctions also targeted 18 Russian officials for their role in GRU cyber operations dating back to 2013.

Microsoft Issuing Emergency Patches to Combat Authentication-Bypassing Attacks
Hackers have been exploiting two zero-day vulnerabilities in on-premises installations of Microsoft SharePoint to gain remote access, and steal cryptographic keys and data. As Microsoft rolls out patches against "ToolShell," experts warn administrators to also rotate keys, to help eject attackers.