Cyber Threat Pulse

Checkmarx confirms data stolen in a supply chain attack, exposing DevSecOps tools to compromise and exfiltration risks.

Healthcare breach alert: Virginia Health Services (senior living/elder care in SE Virginia) hit by reported incident, unconfirmed by company.

-...

Supply chain alert: ShinyHunters stole Vimeo customer data from Snowflake/BigQuery instances using Anodot's compromised auth tokens.

• Exposed data:...

Urgent for incident response: CISA has added actively exploited vulnerabilities in ConnectWise and Windows to its KEV catalog. Patch immediately to block exploitation targeting enterprises.

Natsec alert: Iran-linked Handala Hack claims breach of 2,300+ US service members' data—identities, locations, activities of naval personnel in...

Zero-Day AI accelerates bug discovery for defenders and attackers, compressing cycles to hours. Govern to stay ahead:

• Limit access: Control model...

Urgent federal action on zero-click NTLM flaw (CVE-2026-32202) left after incomplete Patch Tuesday fix for CVE-2026-21510.

• KEV Catalog addition:...

Healthcare Cyber Incidents

• 🔥 Medtronic IT Attack Contained: Medtronic contained a cyberattack on its corporate IT systems with no impact on...

Patch priority alerts for IR teams:

• Udemy Breach: 1.4M users' personal/financial data dumped after no ransom; change passwords, enable 2FA, monitor...

Medtronic contained a cyberattack on corporate IT systems last week, with no impact on products or patients.

Key defenses:

• Network segmentation...

Iran-backed Handala escalates cyber threats to US military:

• Leaked home addresses and identities of 2,379 Marines tied to alleged Iran Minab School...

Confirmed Breaches by ShinyHunters

• 🔥 Medtronic: Medtronic confirmed hackers accessed data in its corporate IT systems, with ShinyHunters...

ShinyHunters extortion trend escalates in healthcare/security sectors:

• Medtronic breach confirmed: 9M records and 4TB files exfiltrated from...

Critical infrastructure under fire:

• Energy and water management firm Itron hacked
• China-linked APT GopherWhisper targets governments
• Need to match AI-enabled nation-state threats architecturally
  Vital watch for OT/SCADA in utilities amid escalation.

Critical flaw in Windows SmartScreen patch chain (CVE-2026-21510 → CVE-2026-32202) allows zero-click auth coercion via auto-parsed LNK files.

-...

AI vuln discovery asymmetry strikes: Anthropic researcher inputs one simple prompt, wakes to full root exploit for CVE-2026-4747—a FreeBSD bug hidden...

Confirmed Data Breaches

• 🔥 ADT Customer Data Exposure: ADT confirmed unauthorized access on April 20, 2026, exposing names, phone numbers,...

Mythos revolutionizes vuln hunting: Anthropic's Claude Mythos Preview autonomously chains vulnerabilities, executes multi-stage attacks, and finds...

• ShinyHunters claim: Stole over 10 million ADT customer records—names, phones, addresses; some DOB and last-4 SSN—demanding ransom by April 27.
  -...

Emerging threat telemetry for proactive defense:

• >300 victims worldwide since late 2024, spanning Healthcare Services, Manufacturing,...