LeakTrace Threat Brief · Week of August 3, 2026

## Executive Summary

The week ending August 9, 2026 surfaced five material incidents across government, healthcare, and critical infrastructure, alongside three independently exploited framework vulnerabilities. The most material event involved ExfilSquad's targeting of the UK Police National Legal Database (PNLD), exposing contact information on approximately 114,000 law enforcement and criminal-justice professionals. In parallel, Switzerland's Federal Office for Information Technology and Communications (FOITT) disclosed a SharePoint-related intrusion affecting roughly 200 accounts, while Liechtenstein's government reported unauthorized access to its beneficial-ownership register—publicly registrable data on approximately 31,000 corporate entities. These incidents reflect both targeted collection of officer and beneficial-owner intelligence and commodity exploitation of unpatched infrastructure.

## Top Incidents

A cyberattack on the U.K.'s Police National Legal Database (PNLD) has compromised contact data of more than 100,000 police officers and other criminal justice professionals. Responsibility for the attack has been claimed by the data extortion group ExfilSquad, which says it stole around 1.9GB of information containing approximately 135,000 records, including details linked to about 114,000 PNLD subscribers and 21,000 users of the Ask the Police service. The incident highlights risk to operational personnel involved in organized crime and terrorism investigations. The exposure could make phishing messages targeting named officers appear more convincing, according to UK government guidance.

Swiss Federal IT Agency FOITT says attackers exploited SharePoint flaws to compromise about 200 accounts, both user and technical accounts. One flaw, tracked as CVE-2026-50522 (CVSS score of 9.8) could enable an attacker to execute remote code over a network. FOITT detected the anomalies on July 28 and confirmed the account compromise three days later, on July 31. The agency is rebuilding affected infrastructure entirely as a containment measure.

A cyberattack has reached the data of about 31,000 people in Liechtenstein's register of the individuals behind its companies, foundations and trusts. The register of beneficial owners exists specifically to strip away layers of corporate opacity. This represents a direct intelligence loss to financial-transparency infrastructure across the European Economic Area.

On August 2, 2026, the notorious ransomware group ShinyHunters claimed responsibility for a cyberattack against Lumenis Ltd., a prominent Israeli medical device company, compromising over 1.1 million records and 176GB of data. Two of the three listings specifically reference Salesforce records, continuing a pattern seen in several recent ShinyHunters claims involving cloud-hosted business platforms. The alleged theft of Salesforce data could potentially expose customer, employee, partner, or sales information depending on how each organization's environment was configured.

## Framework Impact

On August 2, 2026, N-able published a security advisory for CVE-2026-18577, an authentication bypass vulnerability affecting N-central that was discovered being exploited in-the-wild after an incomplete fix for an earlier authentication bypass issue was disclosed. According to N-able, exploitation of CVE-2026-18577 has been observed in the wild since August 1, 2026. On August 3, 2026, CVE-2026-18577 was added to CISA's Known Exploited Vulnerability (KEV) catalog. Observed intrusions included access to managed systems, deployment of Cloudflare Tunnel services for persistence, and activity targeting high-value assets such as domain controllers.

Tracked as CVE-2026-9198 (CVSS score of 9.8), the Langflow OSS bug allows unauthenticated attackers to chain two API endpoints for remote code execution. It was disclosed on July 17, when IBM rolled out patches for it, in Langflow OSS version 1.10.1, warning that all default deployments are affected. A missing encryption of sensitive data vulnerability in Apache Tomcat allows a bypass of EncryptInterceptor, a cluster component that adds pre-shared key encryption to messages sent between cluster nodes. All three vulnerabilities carry federal remediation deadlines through CISA's Binding Operational Directive 26-04.

## LeakTrace Intelligence Team Commentary

The week's pattern reflects two distinct threat surfaces. The PNLD and Liechtenstein breaches represent high-signal collection against known, defensible targets where attackers overcame access controls or network isolation. ExfilSquad's listing occurred within days of initial compromise, suggesting either rapid post-intrusion reconnaissance or pre-existing network familiarity. The Swiss SharePoint incident reinforces the operational risk of exposing authentication systems directly to the internet, particularly when patches lag disclosure by more than a week.

The vulnerability cluster—N-central, Langflow, and Tomcat—represents a separate vector: these flaws enable initial access at scale to RMM, AI/ML pipeline, and middleware infrastructure. The Lumenis claim, if substantiated, aligns with ShinyHunters' documented practice of chaining cloud-application compromises (Salesforce) with exfiltration of bulk corporate files. None of the four organizations involved have issued material forensic disclosures at publication.

## What This Means for Family Offices

Family office operations that rely on Liechtenstein or other Alpine financial vehicles should review beneficial-ownership registry access and monitor for downstream targeting following the disclosure. Infrastructure dependent on N-central RMM services requires urgent verification of patch status; managed service provider relationships should include contractual confirmation of applied hotfixes. Review of Salesforce security posture, multi-factor enforcement, and session logging is warranted regardless of direct ShinyHunters attribution.

## What This Means for Sports Agencies

Athletes and talent-management infrastructure relying on external IT service providers managing endpoints via N-central should request immediate verification of patch status from their vendors. Law enforcement data exposure elevates risk to high-profile clients; agencies should assume that publicly available contact and affiliation data for prominent athletes may now be targeted for social engineering or physical threat campaigns. Agencies with international roster structures should verify Liechtenstein entity registry access status with counsel.

## What This Means for Boutique Counsel

Law firms managing Liechtenstein SPVs, foundations, or trustee relationships should conduct rapid asset review and advise clients of beneficial-owner registry compromise. Firms using N-central-managed endpoints should immediately engage their IT vendors for hotfix verification and conduct log review for indicators of compromise. Ransomware insurance carriers require urgent notification of any Salesforce access patterns; claims counsel should begin preservation notices now.

## What This Means for Individual Executives

Individuals named in Liechtenstein beneficial-owner disclosures should assume their corporate control structures are now visible to financially motivated threat actors and their downstream networks. Heightened personal security, travel advisory review, and executive protection protocols are warranted. Executives with N-central-managed laptops should confirm patch status with their IT teams and reset credentials associated with any systems accessed in late July.