Weekly briefing › No. 14
Weekly briefing · No. 14 · 15 Apr 2026
Ransomware gangs claimed over 400 victims in the first three months of 2026, state-sponsored hackers wiped large companies using their own IT tools, and identity exposure reached 65.7 billion distinct records with a 23% increase year-over-year.
Healthcare infrastructure remains heavily targeted with multiple ransomware incidents while criminal phishing platforms rapidly reestablish operations after law enforcement takedowns.
This issue’s disclosures
CriticalMar 11
Stryker Corporation
Infrastructure · 200K devices records
Iran-linked group Handala compromised a Microsoft Intune administrator account and used Stryker's device management platform to remotely wipe over 200,000 devices across 79 countries with no malware or ransomware. The attack affected manufacturing and shipments but not patient-related services.
What it means: This demonstrates how legitimate IT management tools can be weaponized for mass destruction when admin accounts lack proper protection.
Mar 11
HighMar 03
LexisNexis Legal & Professional
Data Broker · 400K users records
Threat actor FulcrumSec exploited an unpatched React2Shell vulnerability to access AWS environment, leveraging overpermissioned IAM roles to exfiltrate 2.04GB including 3.9 million database records, with 118 exposed accounts belonging to federal judges, DOJ attorneys, and SEC staff.
What it means: Legal industry targeting creates cascading risks for ongoing cases and government operations through credential compromise.
Mar 03
HighMar 12
University of Mississippi Medical Center
Healthcare · 1TB+ claimed records
Medusa ransomware hit UMMC starting February 19, forcing closure of 35 clinics across Mississippi and reverting staff to handwritten charts for nine days, with attackers demanding $800,000 ransom.
What it means: Healthcare ransomware continues disrupting patient care with direct impacts on emergency services and medical record access.
Mar 12
Feb 09
Japan Airlines
Individual Identity · 28K customers records
JAL detected unauthorized access to the Same Day Luggage Delivery Service reservation system exposing names, email addresses, phone numbers, and travel details for reservations since July 2024.
What it means: Travel data exposure enables highly targeted phishing campaigns using legitimate booking details and personal travel patterns.
Feb 09
Mar 18
Aura (identity protection company)
Individual Identity · 900K contacts records
An attacker impersonated a trusted contact in a voice phishing call to an Aura employee, gaining system access for one hour and accessing 900,000 records including names, email addresses, and phone numbers.
What it means: Identity protection companies becoming breach victims highlights the sophistication of social engineering attacks targeting security-focused organizations.
Mar 18
HighMar 19
Criminal-targeting sources
Credential Theft · 18.1M API keys records
SpyCloud report reveals exposure of 18.1 million API keys and tokens, plus 6.2 million credentials tied to AI tools, with non-human identities often lacking MFA enforcement and operating with broad permissions.
What it means: Machine identities are becoming prime targets as they provide persistent access to production systems and cloud infrastructure.
Mar 19
This issue by category
Where this issue’s disclosures sit.
The 6 disclosures in issue No. 14, by the category we filed each one under.