53 casos · pág. 1/3
In July 2026, 77 large healthcare data breaches (500+ individuals) were reported to the HHS Office for Civil Rights (OCR), a 10% month-over-month increase and the third consecutive monthly rise. At least 33,485,970 individuals were affected, up 642% from June and 154% above the 12-month average. January-July 2026 totals 67.4 million affec…
Central Ohio Primary Care Physicians, a large physician-owned primary care group based in Westerville, Ohio, with more than 80 locations, disclosed a breach affecting about 1.4 million current and former patients. In August 2026, an unauthorized third party used a voice phishing (vishing) attack to obtain credentials that gave access to i…
Paradigm Healthcare Services, a San Francisco-based billing processor for Medi-Cal (California's Medicaid program) under a data use agreement with the California DHCS, told the US HHS that a breach affected more than 970,000 people. The company detected unauthorized access to its local network on October 13, 2025. It determined only on Au…
The NSA, CISA, FBI, DOE and EPA issued a joint advisory (AA26-231A) warning of an active threat to Siemens S7 Series PLCs in U.S. critical infrastructure. Unattributed threat actors are conducting reconnaissance and capability development against U.S.-based installations using AI-generated exploitation scripts disguised as legitimate OT m…
CISA added three vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog based on evidence of active exploitation. Two affect JFrog Artifactory: CVE-2026-42016 (incorrect authorization) and CVE-2026-42018 (improper authentication). The third is CVE-2026-84869 in ConnectWise ScreenConnect (improper privilege management and mis…
CISA added two Linux Kernel vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog based on evidence of active exploitation: CVE-2025-39964, a race condition flaw, and CVE-2026-53266, an out-of-bounds write flaw. CISA describes these vulnerability types as a frequent attack vector for malicious cyber actors and a significant…
CISA added one vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog on 2026-09-16 based on evidence of active exploitation: CVE-2026-58704, an improper authorization vulnerability in Google Pixel. CISA describes this vulnerability type as a frequent attack vector for malicious cyber actors and a significant risk to the feder…
CISA added two vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog based on evidence of active exploitation: CVE-2026-65660, a code injection flaw in Microsoft SharePoint, and CVE-2026-67279, an improper enforcement of behavioral workflow flaw in MikroTik RouterOS. CISA describes these vulnerability types as a frequent at…
CISA added two vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog based on evidence of active exploitation: CVE-2026-5430, a path traversal flaw in multiple WSO2 products, and CVE-2026-71362, an incorrect authorization flaw in Adobe Commerce and Magento. CISA describes these vulnerability types as a frequent attack vecto…
CISA added one vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog on 2026-09-18 based on evidence of active exploitation: CVE-2025-39682, an Improper Check for Unusual or Exceptional Conditions flaw in the Linux Kernel. CISA describes this vulnerability type as a frequent attack vector for malicious cyber actors and a sign…
CISA added one vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog on 2026-10-01, citing evidence of active exploitation: CVE-2026-104286, a path traversal flaw in Fortinet FortiMail. CISA describes this vulnerability type as a frequent attack vector for malicious cyber actors and a significant risk to the federal enterpris…
CISA added one vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog on 2026-09-29, citing evidence of active exploitation: CVE-2026-86950, an out-of-bounds write flaw affecting multiple Apple products. CISA describes this vulnerability type as a frequent attack vector for malicious cyber actors and a significant risk to the …
CISA added one vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog on 2026-09-30, citing evidence of active exploitation: CVE-2026-76504, a hex encoding vulnerability in Cisco Catalyst SD-WAN Manager. CISA describes this vulnerability type as a frequent attack vector for malicious cyber actors and a significant risk to the …
CISA added two vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog based on evidence of active exploitation: CVE-2026-96951, a command injection flaw in Microsoft Windows, and CVE-2026-104935, an authentication bypass by spoofing in Ivanti Connect Secure. CISA describes these vulnerability types as a frequent attack vecto…
CISA added two Zammad GmbH Zammad vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog based on evidence of active exploitation: CVE-2026-102489, a session fixation flaw, and CVE-2026-102490, an improper privilege management flaw. CISA describes these vulnerability types as frequent attack vectors for malicious cyber actor…
CISA added one vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog on 2026-10-15, citing evidence of active exploitation: CVE-2026-21589, an Atlassian Multiple Products flaw in which files or directories are accessible to external parties. CISA describes this vulnerability type as a frequent attack vector for malicious cybe…
A cybersecurity incident at defense contractor BAE Systems has stopped the production and delivery of bankruptcy notices for every US federal bankruptcy court. BAE operates the Bankruptcy Noticing Center (BNC) systems and websites on behalf of the federal judiciary. The Administrative Office of the U.S. Courts confirmed the incident on Oc…
The Administrative Office of the US Courts reported a "cybersecurity incident" affecting the Bankruptcy Noticing Center (BNC), which is operated by BAE Systems, Inc. for the Federal Judiciary. The BNC systems and websites were taken offline, halting the production and distribution of electronic and paper bankruptcy notices for federal ban…
An unauthorized party used a compromised login credential to access a file transfer (SFTP) site belonging to Educational Testing Service (ETS) and copy files containing California public school student data, according to the California Department of Education (CDE). ETS supports the state's CAASPP and ELPAC assessment programs. Access occ…
Bullhorn, a US cloud staffing and recruitment software vendor serving more than 10,000 customers, disabled access to its platform after detecting a cyber incident that caused a system-wide outage. Customers first saw job posting problems on Friday, and the company confirmed the cyberattack the following day. Bullhorn says it has isolated …
