Business Security
Verification Network

See who's verified. See who's vulnerable.
Report breaches confidentially.

🏢 View Business Status 📊 This Week's Threats 🚨 Confirmed Breaches Get My Badge

New here? Start with Status Board to see who's verified, or This Week's Threats for the latest intelligence.

📋 The Standard

8 Compliance Audit Checklist

How It Works

Businesses on our Status Board are measured against The Standard — 8 core security controls that prevent most cyber attacks.

Why "sexy"? Security is usually framed as a cost or checkbox. We call it "sexy" because when it's done right, it becomes a trust signal, competitive edge, and growth driver — not just protection. Businesses with strong security win deals, command premium pricing, and avoid the reputational devastation of a breach. It's not about fear; it's about aspiration.

📊

Monitor the Board

See which local businesses are currently verified and their compliance status.

✅

Verify Your Business

Complete the audit checklist to see if you qualify for the badge.

🛡️

Stay Protected

Get the weekly threat brief to stay ahead of active exploits and ransomware.

⚡

Operational Responsiveness

Security and operational readiness go hand-in-hand. Test and benchmark your inbound customer response speed on Response Radar →

View Status Board → Get My Badge →

Why This Matters

Cybersecurity isn't just IT—it's about trust, reputation, SEO, and business survival.

🔒

Data Breaches Are Rising

60% of small businesses close within 6 months of a cyber attack. Basic security can prevent most incidents.
Source: Cybersecurity Ventures

🌐

Dark Web Exposure

Over 24 billion stolen credentials are traded on the dark web. Proper controls reduce your attack surface significantly.
Source: Forbes / Digital Shadows

🤝

Consumer Trust

87% of consumers will take their business elsewhere if they don't trust a company to handle their data responsibly.
Source: McKinsey & Company

📈

SEO & Google Ranking

Google uses HTTPS/Security as a ranking signal. Verified listings build "E-E-A-T" (Trust) for local SEO.
Source: Google Search Central

💰

Insurance Savings

Proper security controls (like MFA) can lower cyber insurance premiums by up to 25-50% or make you eligible for coverage.
Source: Marsh / Global Insurance

✅

Operational Responsiveness

Established frameworks (including FTC Safeguards guidance and NIST standards) emphasize that timely remediation of substantiated security risks is central to reasonable security. Accountability requires active oversight and documented response.
Source: FTC Guidance on Business Security

💸 THE MATH OF FAILURE

Prevention vs. Catastrophe

⚠️ RESULTS ARE IN
Victim The Fatal Flaw The Prevention Tool The ROI Gap
🎓
Lincoln College
Closed (157 yr legacy)
 No offline backups. Ransomware encrypted everything instantly.
✓ Immutable Cloud Backups
~ $500 / month
~ $6,000/yr
$50M+ LOST | $6K PREVENTED
✓ Prevention cost < 0.01% of loss
🚚
Small Carriers
Liquidated fleets
 Weak passwords + No MFA enabled.
✓ MFA (Multi-Factor Auth)
$0 (Free Setting)
5 minutes to enable
BUSINESS COLLAPSE | $0
✓ Prevention cost < 0.01% of loss
🏥
Petersen Health
Chapter 11 Bankruptcy
 Unpatched remote access server (Citrix). Known bug left open.
✓ Auto-Patching Software
~ $3 - $5 / device
~ $500/mo
$40M FROZEN | $500/mo
✓ Prevention cost < 0.01% of loss
🚨 THE TAKEAWAY

Cyber defense isn't expensive. Recovery is impossible.
A verified business proves they have spent the pennies to save the millions.

✓ Prevention cost is negligible
✓ Recovery is financially impossible
✓ Verification = Accountable Baseline Defense

Why We Started This

We built this project after watching too many preventable breaches unfold the same way: known security basics were ignored, warnings were delayed, and customers, employees, and partners paid the price. The pattern was consistent across industries and company sizes.

Our goal is straightforward: make cybersecurity expectations visible, measurable, and understandable before an incident happens. When a business strengthens core controls early, everyone connected to that business is safer.

A Short History

This verification directory began as a practical response to repeated owner-negligence scenarios and avoidable incidents seen in day-to-day advisory work. Instead of waiting for another post-breach cleanup, we published a clear baseline and made status public so business owners can act sooner.

We continue to refine the methodology using current breach trends and operational lessons from remediation engagements, but the core principle has not changed: prevention is almost always less costly than recovery.

Our Position

Breach statistics consistently show that investing in foundational controls is materially more effective than relying on post-incident recovery. This site exists to make that reality harder to ignore.

How Our Business Verification Works

A transparent process to separate the security leaders from the talkers.

1

Invite

Businesses may appear here through direct outreach, routine screening, professional contact, or third-party submissions. Verification is available voluntarily, but listings are not limited to businesses that received a formal invitation.

2

Assess

We evaluate their security controls against our published baseline criteria.

3

Remediate

Businesses must remediate identified gaps or accept a failed / at-risk outcome if they ignore critical issues or refuse to engage.

4

Publish

We publish the verification status transparently for consumers and partners.

Our Business Verification Methodology

Participation in our verification program is voluntary. Passing it requires evidence. Businesses are evaluated on objective technical safeguards under The Standard, accompanied by an assessment of operational accountability and responsiveness when security concerns are identified.

Evidence-Based Review & Classification Standards

To maintain credibility and fairness, our methodology strictly distinguishes between different tiers of evidence and observations:

  • Confirmed Technical Deficiencies: Deficits verified through direct configuration review or authenticated testing (e.g., absent MFA on business email, unbacked cloud storage, missing EDR protection).
  • Self-Reported Deficiencies: Disclosures provided through the vendor security questionnaire or verification intake indicating missing baseline controls.
  • Passive External Observations: Publicly detectable DNS records (SPF, DKIM, DMARC) or web HTTP response headers. Important: Passive observations (such as DMARC in monitoring mode p=none, absent headers, or low-cost hosting) serve as screening signals, NOT standalone proof of data breach or internal compromise.
  • Operational Assurance Findings: Documented governance or escalation breakdowns, such as failing to acknowledge credible, substantiated security alerts delivered to designated contacts after proportionate follow-up.
  • Voluntary Program Choice: A decision not to participate in voluntary badge assessment is respected and remains strictly distinct from an active failure to address a confirmed security flaw.
Governance & Accountability Posture

Technical tools alone cannot protect an organization without clear human ownership. How an organization responds to documented technical concerns reflects its operational governance. When a substantiated, material security alert is communicated through proper channels and met with repeated disregard, that breakdown is documented as an Operational Assurance concern.

What this does NOT mean: Non-response to a notification does not establish that a breach has occurred. Nor is declining a sales pitch, missing a meeting, or using specific software a security failure. Our evaluations focus strictly on documented organizational security processes and verifiable controls.

The "Sexy 8" Baseline Controls (Backed by Data):

  • 1. MFA on Critical Systems: Multi-factor authentication enforced on email (M365/Google Workspace) and remote access (VPN/RDP). Third-party SaaS MFA is recommended but not required for baseline verification.
    CISA Data: MFA dramatically reduces account takeover risk on the most targeted entry points.
  • 2. Device Encryption: Full-disk encryption (BitLocker/FileVault) on all computers.
    FTC Requirement: Essential for Safe Harbor if devices are lost/stolen.
  • 3. Cloud-Integrated Backups: Email and cloud storage (M365/Google Drive) are backed up through a third-party backup platform. Local-only data not synced to cloud storage requires separate backup coverage.
    Ransomware Defense: Recoverable backups remain the most important control for operational recovery.
  • 4. Next-Gen Defense: EDR/MDR protection (not just free antivirus).
    Industry Standard: Legacy AV misses 60% of modern malware.
  • 5. Email Security - At Least for Key Users: Anti-phishing and DLP/encryption protections for business-critical mailboxes (leadership, finance, HR, and privileged admins), plus SPF/DKIM/DMARC on the primary domain.
    Verizon DBIR: Email remains one of the most common initial access vectors in real-world breaches.
  • 6. Patching: Automated updates for OS and software within 30 days.
    CISA KEV: Hackers exploit known bugs within 15 days on average.
  • 7. Incident Response Plan: A documented breach response and recovery runbook maintained by the IT provider. Client acknowledgment is recommended but not required for baseline verification.
    NIST Framework: Respond and Recover capabilities materially reduce downtime and breach impact.
  • 8. Independent Security Oversight (No DIY): Security controls must be managed or independently validated by qualified IT/security professionals. Solely self-managed ("DIY") security does not qualify.
    NIST SP 800-53 (AC-5): Separation of duties reduces risk by requiring independent roles and oversight.  |  IBM Cost of a Data Breach: Longer detection/containment lifecycles and weaker governance materially increase breach impact.
    🤖

    ChatGPT Is Not Your CTO. GoDaddy Is Not Your IT Department.

    Paying for technology does not mean someone is managing it.

    Subscribing to products is not the same as managing operational risk. Purchasing software does not automatically create ownership or active security oversight:

    • ✕ Having Microsoft 365 does not mean someone is monitoring your email security.
    • ✕ Paying for GoDaddy email security does not automatically mean you have comprehensive cybersecurity coverage.
    • ✕ Having antivirus does not mean anyone reviews alerts or responds to threats.
    • ✕ Having cloud storage does not establish that recoverable, independent backups exist.
    • ✕ Asking ChatGPT technical questions does not provide ongoing professional accountability.
    • ✕ Using Wix, Squarespace, GoDaddy Airo, or an AI-generated website does not establish who maintains its security.
    • ✕ Paying multiple technology vendors does not mean somebody is coordinating those vendors.

    These products can be useful and properly secured. The problem is assuming their existence proves that someone owns the outcome.

    Ask Yourself These Plain-English Questions:
    ❓ Who secures your business email?
    ❓ Who monitors your devices?
    ❓ Who tests your backups?
    ❓ Who responds when a warning arrives?
    ❓ Who coordinates your vendors?
    ❓ Who is accountable for it working?

    Software is a tool. Accountability is a responsibility.

    Verification Standard for Control #8: Requires identifiable, demonstrable technology and security oversight. Acceptable arrangements include qualified internal IT/security personnel, a managed IT/security provider (MSP/MSSP), a qualified independent consultant, or another documented arrangement demonstrating active competence. A business does not need to hire USTech.Ninja. An invoice alone does not prove active oversight; evidence of actual ownership and performance matters. Businesses are not penalized solely for using AI tools, website builders, or low-cost stacks—demonstrable accountability is the deciding standard.
🎯

Operational Assurance — Who Takes Responsibility When Security Matters?

Security controls protect your business. Accountability ensures somebody acts when those controls fail.

Operational Assurance evaluates observable organizational conduct and security-governance practices separately from technical checklists. It evaluates documented business processes, escalations, and communication channels—not individuals' personalities, motives, or sales responses.

OA-01
Security Risk Dismissal

A business explicitly rejects a credible, material, documented cybersecurity concern without a reasonable technical explanation, alternate mitigation, or documented accepted-risk decision.

OA-02
Security Notification Non-Responsiveness

A credible and specific cybersecurity concern is delivered to an appropriate organizational contact, followed up through a verified secondary channel, and receives no substantive acknowledgment within a proportionate window (typically 7–14 days).

OA-03
Security Control Circumvention

Documented, repeated bypassing of established security procedures, administrative controls, change-management protocols, or professional IT oversight.

OA-04
Materially Inaccurate Representations

An organization's security claim or attestation is materially contradicted by independently corroborated evidence. Organizations are given an opportunity to clarify or correct discrepancies before publication.

OA-05
Failure of Ownership & Escalation

Repeated, documented failure to assign responsibility, coordinate remediation, or escalate material operational incidents where an identifiable duty and business risk exist.

Review Thresholds & Due Process: An Operational Assurance review is triggered only when two independent indicators are supported by dated evidence within a rolling 90-day window, or when a substantiated critical security notification remains unacknowledged after reasonable delivery and follow-up. A decline to buy services, a missed sales meeting, or non-participation in voluntary badging is never treated as an operational failure. Non-response is an indicator of governance posture, not automatic proof of data breach.
⚪ Not Assessed — Default baseline 🟢 Reviewed — No Documented Concern 🟡 Review Pending 🔴 Documented Concern — Factual basis & path for correction
📋

Technology & Vendor Accountability — Supplier & Operational Assurance Watchlist

Documenting supplier escalation dependencies, account recovery process limitations, and technical website maintenance observations—distinct from core Sexy Eight cybersecurity ratings.

Assurance & Review Register

The Technology & Vendor Accountability Watchlist tracks upstream operational escalation dependencies, distributor support processes, and narrow technical maintenance observations. These records evaluate specific documented workflows and configuration items—they do not constitute blanket assessments of overall organization security, nor do they allege intentional misconduct or system compromise.

Organization / Ecosystem Domain / Channel Documented Observation / Specific Control Scope Operational Classification Assurance Action
Google Workspace Cloud Identity & Productivity Administrator-recovery process failed to produce a timely resolution in the documented escalation case. Established support-assisted recovery mechanisms stalled without automated resolution or clear timeline. This finding concerns account-recovery support velocity, not the general platform security of Google Workspace. ⚠️ Platform Recovery · Process SLA Limitation Record limitation in supplier risk register; maintain secondary emergency recovery protocols.
TD SYNNEX / StreamOne
Google Workspace Distribution
 IT Distribution & Cloud Aggregator During an October 2026 support case involving a Workspace tenant not yet managed by TD SYNNEX, the distributor confirmed on October 14 that it lacked a direct escalation mechanism for the administrator-recovery issue presented. TD SYNNEX acknowledged this limitation and referred the matter to management. This finding concerns the availability of a specific escalation pathway, not the security of TD SYNNEX's systems or services.
Flag: Supplier escalation dependency, not individual misconduct.
 ⚠️ Supplier Assurance · Documented Limitation Record limitation in vendor assurance; maintain independent escalation route and direct registry relationships.
Watchlist Due Process & Remediation: Supplier risk and operational review items are maintained for transparency and vendor risk governance. Upstream suppliers or reviewed organizations may submit verified resolution evidence, escalation path updates, or technical remediation logs to submit verification evidence or update their listing.
Your Security. Your Provider. Your Choice.

Found a Gap? You Have Options.

Cybersecurity Is Sexy verification is not contingent on purchasing technology or services from USTech.Ninja. Businesses may use their own IT department, an independent consultant, or any qualified service provider to meet the published security standards. Organizations can submit evidence of existing safeguards, correct identified deficiencies, and request verification without purchasing managed services from us. Our objective is better cybersecurity and stronger accountability—not exclusive service relationships.

🛠️

Handle It Internally or with Existing IT

Already have an IT provider or internal team? Review our published standards, ask them to address identified gaps, and submit evidence.

1. Review Requirements →
📑

Submit Evidence for Verification

Submit third-party attestation, questionnaires, or remediation records to verify your controls or update an existing listing.

2. Submit Verification Evidence →
🥷

Need Somebody to Own the Problem?

USTech.Ninja provides comprehensive Worry-Free IT & Cybersecurity management to assess, remediate, and maintain your technology.

3. Get Help from USTech.Ninja →
Transparency Notice: Cybersecurity Is Sexy is an independent security initiative operated by USTech.Ninja. Assessment results and badge issuance are strictly evidence-based and never contingent on purchasing services.

Website Security Headers (Informational Bonus)

We scan each business's website using SecurityHeaders.com and note the grade on their verification listing. This check evaluates HTTP response headers that protect site visitors from common attacks.

Headers we look for:

  • Strict-Transport-Security (HSTS) — Forces HTTPS connections. Recommended: max-age=63072000; includeSubDomains
  • X-Frame-Options — Prevents clickjacking. Recommended: DENY
  • X-Content-Type-Options — Prevents MIME sniffing. Recommended: nosniff
  • Content-Security-Policy (CSP) — Controls resource loading. Recommended: default-src 'self'; form-action 'self'; object-src 'none'; frame-ancestors 'none'
  • Referrer-Policy — Controls referrer information. Recommended: strict-origin-when-cross-origin
  • Permissions-Policy — Restricts browser features. Recommended: disable camera, microphone, geolocation unless needed.

Important: This is an informational bonus, not a pass/fail requirement. Many small business websites built on Wix, Squarespace, or shared hosting cannot configure these headers without developer access. A low grade is noted on the listing but does not prevent Verified status.

Grading display on listing:

  • A+ / A — 🟢 Hardened
  • B / C — 🟡 Partial
  • D / E / F — 🔴 Needs Improvement

Verification & Assurance Status Classifications

Verified - Managed: Active professional IT/security controls deployed and continuously monitored against the Sexy 8 baseline.

Verified - Validated: Meets the managed baseline and includes recent evidence checks against defined control thresholds.

Vulnerable: Baseline technical controls are unverified or documented technical deficiencies remain unresolved.

Operational Assurance (Optional Evaluation): Evaluates organizational conduct and escalation ownership separately from technical scores (Not Assessed, Reviewed — Clean, Review Pending, or Documented Concern).

Note: "MFA" is measured on critical systems (email + remote access) for baseline verification. Broader SaaS MFA and full-mailbox coverage are encouraged and may be required for higher validation tiers.

Need help meeting these standards?
These controls are standard inclusion in "Worry-Free IT" plans from our partner, USTech.Ninja.

Important Note: Our ratings reflect our own criteria and professional judgment. They are not legal compliance determinations and should be considered one factor among many when evaluating a business's security posture.

Business Verification Status Board

Real transparency about which businesses take cybersecurity seriously.

Verified? Get your badge → • Business Directory → • Partner Showcase → • Response Radar →

Verified & Armored
Vulnerable
Business Name Location Industry Status Headers Last Verified
Channel Islands Mortgage ↗ Ventura County, CA Mortgage Services Verified - Managed A+ Feb 2026
Channel Islands Law Ventura County, CA Legal Services Verified - Managed A+ Feb 2026
Reverse Mortgage Northwest Pacific Northwest Mortgage Services Verified - Managed A+ Feb 2026
OC Home Loans Orange County, CA Mortgage Services Verified - Managed A+ Feb 2026
Ellevate Insurance Arizona Insurance Verified - Managed A+ Feb 2026
Genrose Insurance ↗ Scottsdale, AZ Insurance Agency Verified - Managed A+ Sep 2026
Lisa G Travel Arizona Travel Services Verified - Managed A+ Feb 2026
AZ Baum Plumbing ↗ Arizona Home Services Verified - Managed A+ Feb 2026
Alyshaan ↗ Arizona Professional Services Verified - Managed A+ Mar 2026
Erik Kelly Group Arizona Real Estate Verified - Managed A+ Feb 2026
DustSharkz Tempe, AZ Service Business Verified - Managed A+ Feb 2026
OCA Greater Phoenix Chapter Scottsdale, AZ Non-Profit / Community Advocacy Verified - Managed A+ Sep 2026

Verification status reflects the published baseline and is updated as evidence and monitoring data are reviewed.

Business Name Location Industry Status Headers Reason
micro1 (micro1.ai) Remote / US-based AI / Talent Platform Vulnerable - Critical Risk N/A Advertises legitimate IT/tech jobs, funnels candidates into AI video interviews, and uses responses to train AI models with no real hire. Glassdoor flagged a "Dangerous scam - personal data theft warning" and public complaints note early requests for passport/government ID. Passive technical note: Google Workspace MX, SPF uses ~all, DMARC is p=none, and the web front is Cloudflare/Webflow with HSTS, XFO, and a basic CSP.
Crossing Hurdles Remote Recruiting / Talent Broker Vulnerable - Critical Risk N/A Front organization that funnels candidates into Mercor AI talent platform to collect referral fees. Public reporting cites fake high-salary listings, unpaid assessments, AI interviews, and bait-and-switch recruiting tactics. Passive technical note: Google Workspace MX, SPF includes Google/Mailgun/JobDiva, DMARC is p=none, and Netlify serves the site with HSTS, nosniff, referrer-policy, and permissions-policy.
Turing.com Palo Alto, CA AI / Talent Platform Vulnerable - High Risk N/A Farms engineers and IT talent for AI training tasks under the guise of traditional job titles, with applicants reporting the funnel shifts from IT roles into AI operations and training work. Passive technical note: Google Workspace MX, DMARC is p=quarantine, and the Imperva front has strong headers but a very broad CSP / third-party dependency surface.
Sibitalent Corp Remote / US-based recruiting IT Staffing / Recruiting Vulnerable - Critical Risk N/A Glassdoor review alleges the company asks candidates for government ID, SSN, and other sensitive documents, creating a direct identity-theft and impersonation risk for IT professionals. Passive technical note: O365 MX, DMARC is p=none, and the apex redirects to HTTP on www with only basic Apache response headers observed.
Mercor Remote / US-based AI Talent Platform Vulnerable - Critical Risk N/A Appears in a connected recruiting ecosystem with Crossing Hurdles, micro1, and Turing. Public LinkedIn posts describe it as a predatory AI-talent ecosystem with referral farming, ghosted pay, and AI interview data harvesting. Passive technical note: Google Workspace MX, DMARC is p=quarantine, and the web front is strongly hardened but very dependency-heavy with a broad CSP and many third-party services.
Lucey Accounting Arizona CPA / Accounting Services Vulnerable - High Risk F Direct self-reported cybersecurity limitations and no follow-up remediation confirmation.
Go Gilbert Gilbert, AZ Real Estate / Community Platform Vulnerable - High Risk F Contacted owner on Feb 23, 2026 regarding identified security concerns. No remediation or verification response received.
Scottsdale Living Scottsdale, AZ Real Estate / Community Platform Vulnerable - High Risk F Contacted owner on Feb 23, 2026 regarding identified security concerns. No remediation or verification response received.
Living North Phoenix North Phoenix, AZ Real Estate / Community Platform Vulnerable - Critical Risk F Contacted owner on Feb 23, 2026 regarding identified security concerns. No remediation or verification response received.
CH Winery Unknown Hospitality / Winery Vulnerable - Critical Risk F Client-reported subdomain login flow transmitting credentials in plaintext. Immediate remediation and encrypted transport enforcement required.
Rod & Panel ↗ Scottsdale, AZ Home Design / Window Treatments Vulnerable - High Risk F Primary domain is missing DMARC and DKIM records. SPF is present with hard fail (-all), but outbound email remains easier to spoof until DMARC and DKIM are configured.
Rosemary Bookkeeping (Goska Dabrowski) ↗ United Kingdom Bookkeeping Services Vulnerable - Critical Risk F Email authentication baseline failure: missing SPF and DMARC records; no common DKIM selectors were detected.
Soles For Jesus (Yenh Mikolajewski) ↗ Wisconsin Non-Profit / Humanitarian Vulnerable - Critical Risk F Email authentication baseline failure: missing SPF and DMARC records; no common DKIM selectors were detected.
Desert Land Group (Mai Luke) Arizona Real Estate Development Vulnerable - High Risk F Email authentication baseline failure: missing SPF record and no common DKIM selectors were detected.
PXG (PARSONS XTREME GOLF) (Daniel Convery) Scottsdale, AZ Sports Equipment / Manufacturing Vulnerable - High Risk F Email authentication baseline failure: missing SPF record on the primary domain.
Panasonic Solutions for Business (Jeff Russomanno) Newark, NJ Technology / Electronics Vulnerable - Critical Risk F Email authentication baseline failure on the listed subdomain: missing SPF and DMARC records; no common DKIM selectors were detected.
Accent Building Restoration, Inc (Sugey Ostergaard) Phoenix, AZ Construction / Restoration Vulnerable - High Risk F Email authentication baseline failure: missing DMARC record.
My PC Techs Phoenix, AZ Technology Services Vulnerable - High Risk F Email authentication baseline failure: missing DMARC record.
Home Fur Good Phoenix, AZ Nonprofit / Animal Rescue Vulnerable - High Risk Not Scored Primary email-authentication gap observed on 2026-05-19: no DMARC record was returned for _dmarc.homefurgood.org. SPF is present and DKIM selectors responded, but the mixed Bluehost, Constant Contact, and Microsoft 365 sender footprint should be reviewed and tightened.
The Elyte Law Firm, PLLC Phoenix, AZ Legal Services / Criminal Defense Vulnerable - High Risk F Public website lists a consumer Gmail mailbox (`[email protected]`) as a primary client contact channel alongside firm-branded email, increasing intake confidentiality, account governance, and business-email-compromise exposure for a legal practice.
Journeys & Bridges Transitional Housing Phoenix, AZ Transitional Housing / Social Services Vulnerable - High Risk F Public-facing intake and contact workflows for a health-adjacent transitional housing provider rely on a consumer Gmail mailbox rather than a domain-managed business address, increasing confidentiality, governance, and business-email-compromise exposure for sensitive communications.
The Therapy Doctor PLLC Scottsdale, AZ Healthcare / Concierge Physical Therapy Vulnerable - High Risk F Passive baseline failure for a healthcare-adjacent practice: no DMARC record was returned for the primary domain, SPF remains in soft-fail mode (~all), and no common DKIM selectors were detected. Escalated further due to lack of communication and no verification response.
linqd. Gilbert, AZ Technology Vulnerable - Critical Risk F Email authentication baseline failure: missing DMARC record and no common DKIM selectors were detected.
DS Law AZ (Ahmed) Arizona Legal Services / Law Practice Vulnerable - High Risk F Passive baseline failure: missing DMARC record, no HSTS observed, and no Content-Security-Policy observed on the public website.
LocalFi (Kim) Arizona Marketing / Local SEO Vulnerable - High Risk F Passive baseline failure: listed domain redirects to localfiseo.com, missing DMARC record on the listed domain, and multiple common web security headers were not observed.
The Honey Foundation (Jaime) Arizona Non-Profit / Foundation Vulnerable - High Risk F Passive baseline failure: DMARC is present only in monitoring mode (p=none), and no common HSTS, CSP, X-Frame-Options, X-Content-Type-Options, or Referrer-Policy headers were observed.
helpful (Kirsten) Arizona Business Services Vulnerable - High Risk F Email authentication baseline failure: no DMARC record was found for the primary domain.
ACC Insurance Agency (Caleb Kemp) Arizona Insurance Agency Vulnerable - High Risk F Passive baseline failure: missing DMARC record, and no common HSTS, CSP, X-Frame-Options, X-Content-Type-Options, or Referrer-Policy headers were observed.
Priority Roofing (Jordan Robinson) Arizona Construction / Roofing Vulnerable - High Risk F Passive baseline failure: DMARC is present only in monitoring mode (p=none), and no common HSTS, CSP, X-Frame-Options, X-Content-Type-Options, or Referrer-Policy headers were observed.
Happy Light Company (Anthony Wilson) Arizona Home Services / Lighting Vulnerable - High Risk F Email authentication baseline issue: multiple SPF policy strings were observed in DNS TXT output, and DMARC is present only in monitoring mode (p=none).
Blackstone Roofing Group (Shaun Bures) Arizona Construction / Roofing Vulnerable - High Risk F Passive baseline failure: missing DMARC record, and no common HSTS, CSP, X-Frame-Options, X-Content-Type-Options, or Referrer-Policy headers were observed.
Oppty Unlimited United States Small Business Consulting / Sales Operations Vulnerable - High Risk F Passive baseline failure: DMARC is present only in monitoring mode (p=none), SPF remains soft fail (~all), and no common CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, or Permissions-Policy headers were observed on the public website. Escalated further due to documented non-response after direct outreach and scheduled contact.
MNO Referrals United States Business Networking / Referral Organization Vulnerable - High Risk F Passive baseline failure: DMARC is present only in monitoring mode (p=none), HSTS is effectively disabled (max-age=0), and no common CSP, X-Frame-Options, Referrer-Policy, or Permissions-Policy headers were observed on the public website. Escalated further due to lack of communication and no verification response.
InsuranceProAZ (Bret Godsey) Arizona Insurance Agency Vulnerable - High Risk F Passive baseline failure: DMARC is present only in monitoring mode (p=none), DNS TXT output appears to mix authentication policy text, and no common web security headers were observed.
The Neely Group Phoenix, AZ Financial Services / Financial Planning Vulnerable - High Risk F Escalated due to documented security-culture and leadership-posture concerns after professional engagement, combined with email security posture concerns that materially increase business-email-compromise and client-trust risk.
Prestige Accounting Arizona CPA / Accounting Services Vulnerable - High Risk B Email security gaps: DMARC, DKIM missing; SPF soft-fail (~all), allowing trivial spoofing. Financial firm handling sensitive PII without basic email authentication poses a material BEC risk. Client portal (TaxDome) is segregated, but public communications remain unsecured.
Almeida Roofing Inc. Phoenix / Maricopa County, AZ Construction / Roofing Vulnerable - High Risk Not Scored Passive verification failure captured 2026-08-10: public business communications use a consumer Gmail mailbox ([email protected]), DMARC is present only in monitoring mode (p=none), and HSTS/CSP were not observed on the public HTTPS response. X-Frame-Options, X-XSS-Protection, and X-Content-Type-Options were observed. This is a public baseline finding, not evidence of compromise or unauthorized access.
Margie Mae's Holiday Decor (MM Holiday Decor) Arizona Holiday Lighting / Seasonal Decor Vulnerable - High Risk F Critical email security baseline failure: No SPF, no DMARC, and no DKIM in place — allowing trivial domain spoofing from any sender. For a business that processes vendor payments and has documented DLP leakage events involving bank routing information, the absence of basic email authentication creates a material business-email-compromise risk. Additionally, no common web security headers (CSP, XFO, HSTS) were observed on the public website. Active phishing pressure was independently confirmed during a security review window, and the Guardz baseline score of 59/100 further supports the vulnerable classification.
Precision Auto Body Tempe / Chandler, AZ Automotive / Collision Repair Vulnerable - High Risk F High local customer trust and strong collision repair standing, but critical technical baseline gap observed: missing SPF and DMARC records on primary domain, allowing trivial domain spoofing and business email impersonation.
Dirk's Electric Arizona Contracting / Electrical Services Vulnerable - High Risk F Master licensed electrical contractor with strong industry reputation; technical baseline gap observed: missing SPF and DMARC records on primary domain.
Hope for the Homeless Arizona Nonprofit / Community Outreach Vulnerable - High Risk F Grassroots community outreach nonprofit delivering essential aid; technical baseline gap observed: missing SPF and DMARC records on primary outreach domain.
RN Patient Advocates of Arizona Arizona Healthcare / Patient Advocacy Vulnerable - High Risk F Clinical patient advocacy handling sensitive health intake; missing DMARC record and SPF soft-fail (~all), exposing client medical and care coordination communications to spoofing risks.
Nicki Fit A to Z Scottsdale, AZ Health & Fitness Vulnerable - High Risk F Active local fitness and mobility brand; email authentication in monitor-only mode (p=none) with DMARC policy not actively enforcing domain protection.
Brewers AC & Heating, LLC Arizona HVAC & Mechanical Vulnerable - High Risk F Established family-owned HVAC contractor; email authentication baseline gap observed: missing DMARC record, leaving billing and quote communications exposed to spoofing.
South Mountain Auto Detail Phoenix, AZ Automotive Detailing Vulnerable - High Risk F Mobile auto detailing provider with strong local customer reputation; technical baseline gap observed: missing SPF and DMARC records on primary domain.
Interstate Auto Repair Arizona Automotive Mechanical Repair Vulnerable - High Risk F Longstanding automotive repair facility (member since 2017); technical baseline gap observed: missing DMARC record on primary domain.
EMG Barbershop Arizona Men's Grooming / Personal Care Vulnerable - High Risk F Concierge luxury grooming provider; technical baseline gap observed: missing SPF and DMARC records on primary client booking domain.
Signarama Chandler Chandler, AZ Commercial Signs & Branding Vulnerable - High Risk F Commercial signage and architectural branding provider with broad commercial client base; technical baseline gap observed: missing DMARC record on primary domain.
Ahwatukee Flowers Ahwatukee, AZ Florist / Retail & Events Vulnerable - High Risk F Premier local floral boutique with high community standing; email authentication in monitor-only mode (p=none) with broad third-party marketing sender footprint.
ARC Renovations and Construction Arizona General Contracting / Remodeling Vulnerable - High Risk F Licensed general contractor managing high-value residential renovations; technical baseline gap observed: missing DMARC record on primary domain.
Hayes Insurance & Financial Services Arizona Insurance Services Vulnerable - High Risk F Independent insurance agency; technical baseline gap observed: missing DMARC record and SPF soft-fail (~all), posing business email spoofing risk for policyholders.
30fold Benefits Arizona Legal & Identity Protection Vulnerable - High Risk F Legal and identity protection employee benefits advisory; technical baseline gap observed: missing SPF and DMARC records on primary domain.
The Goodman Taylor Team Ahwatukee / Phoenix, AZ Residential Real Estate Vulnerable - High Risk F East Valley residential real estate team; email authentication in monitor-only mode (p=none) with placeholder reporting address.
Kyrene Rotary Club Ahwatukee, AZ Civic & Community Service Vulnerable - High Risk F Active local civic service organization; technical baseline gap observed: missing DMARC record on primary organizational domain.
Community Action Security Arizona Security Patrol & Guard Services Vulnerable - High Risk F Physical security patrol and guard provider; technical baseline gap observed: missing DMARC record on primary domain.
Caring Transitions of Central AZ Arizona Senior Relocation & Estate Sales Vulnerable - High Risk F Senior relocation and estate management provider; technical baseline gap observed: missing SPF and DMARC records on primary domain.
Satya Yoga Center Phoenix, AZ Health & Yoga Studio Vulnerable - High Risk F Certified Iyengar yoga center; email authentication in monitor-only mode (p=none) with DMARC policy not actively enforcing unauthorized senders.
Advocate Planning Principles, Inc. Phoenix, AZ Financial Planning / Insurance Vulnerable - High Risk Not Scored Passive email-authentication baseline failure observed in September 2026: no SPF or DMARC record was returned for the primary domain. Public Arizona business records identify Advocate Planning Principles, Inc. as an active Phoenix finance and insurance corporation. This is not evidence of compromise.
OPACS Arizona Office Products / Business Services Vulnerable - High Risk Not Scored Domain has Google MX and SPF, but DMARC is only p=none and does not enforce protection against unauthorized sending. Public company information identifies OPACS as a locally owned office-products and business-services company developed by Travis and Donna Kimmel. This is not evidence of compromise.
BIO-ELITE Training Systems, LLC Scottsdale, AZ Wellness / Fitness Services Vulnerable - High Risk Not Scored Passive email-authentication baseline issue: SPF was not returned, and DNS exposed conflicting DMARC policy strings rather than one clean, authoritative record. Public site identifies BIO-ELITE Training Systems, LLC as a Scottsdale fitness and executive-health provider; Arizona business records identify Gianni Del Franco with the entity. This is not evidence of compromise.
Gryath Glass Laveen / Phoenix, AZ Automotive / Mobile Auto Glass Vulnerable - High Risk Not Scored Passive email-authentication baseline failure: no SPF or DMARC record was returned. Public site and Arizona Hispanic Chamber listing identify Gryath Glass as a Laveen-based mobile auto-glass, repair, and calibration provider. This is not evidence of compromise.
Hana Entertainment Phoenix / Mesa, AZ Events / Entertainment Vulnerable - High Risk Not Scored Domain has active Google MX and SPF, but DMARC is only p=none. The tested apex returned HTTP 404 while public event listings and Hana pages identify an Arizona event-production and entertainment business. This is not evidence of compromise.
Gryphon Roofing & Construction Tempe / Phoenix metro, AZ Construction / Roofing Vulnerable - High Risk Not Scored Domain has Google MX and SPF, but no DMARC record was returned. Public company pages identify Gryphon Companies, Inc. as an Arizona roofing, remodeling, and restoration provider operating since 1994. This is not evidence of compromise.
Handyman Connection of Phoenix Phoenix, AZ Home Services / General Contracting Vulnerable - High Risk Not Scored Domain has Microsoft 365 MX and SPF, but DMARC is only p=none. Public location pages identify the Phoenix operation, Allen Hopkins, the Northern Avenue address, and Arizona contractor license numbers. This is not evidence of compromise.
Happy Bees Pest Control / Arcadia Pest Management Arizona Pest Control Vulnerable - High Risk Not Scored Listed domain has active mail routing and SPF, but DMARC is only p=none. The site redirects to Arcadia Pest Management, and public business results identify Arcadia as formerly Happy Bees Pest Control. This is not evidence of compromise.
Back to Motion Chiropractic / Dr. Jennifer Polk Scottsdale, AZ Healthcare / Chiropractic Vulnerable - High Risk Not Scored Listed domain has active registrar-hosted mail, but no SPF or DMARC record was returned. The domain redirects to Dr. Jen Polk’s site; public pages identify Back to Motion Chiropractic in Scottsdale and Dr. Jennifer Polk as a licensed chiropractic physician. This is not evidence of compromise.
The Causey Effect / Bare Aesthetics Scottsdale, AZ Aesthetics / Nutrition / Wellness Vulnerable - High Risk Not Scored Listed domain has active Google MX, but no SPF or DMARC record was returned. Public records identify The Causey Effect, LLC and connect Christalyne Causey with the Scottsdale practice; the domain currently redirects to Bare Aesthetics. This is not evidence of compromise.
US Cleaning Solutions Peoria / Phoenix metro, AZ Commercial Cleaning Vulnerable - High Risk Not Scored Domain has active mail routing and SPF, but no DMARC record was returned. Public site and business directories identify US Cleaning Solutions as a commercial-cleaning provider serving Scottsdale, Phoenix, Glendale, and the greater metro, with a Peoria address. This is not evidence of compromise.
Western Alliance Bank Phoenix / Nationwide Banking / Financial Services Vulnerable - High Risk Not Scored Listed domain has Proofpoint MX and SPF, but DMARC is only p=none. The listed domain redirects to Western Alliance Bancorporation’s public site, which identifies Western Alliance Bank as a national commercial bank headquartered in Phoenix. This is not evidence of compromise.
One Handsome Bastard Distillery Scottsdale, AZ Distillery / Hospitality Vulnerable - High Risk Not Scored Domain has Microsoft 365 MX and SPF, but DMARC is only p=none. Public site and local reporting identify One Handsome Bastard as a Scottsdale micro-distillery and grill at 7042 E Indian School Road, operated by the Ritchie family. This is not evidence of compromise.
Window Coverings By Julie Carefree / Scottsdale, AZ Interior Services / Window Coverings Vulnerable - High Risk Not Scored Domain has active Google MX and SPF, but DMARC is only p=none. Public site and Scottsdale Chamber information identify the Carefree/Scottsdale window-coverings business, Julie Clark, and its showroom address. This is not evidence of compromise.
Golden Development Group (goldendevelopmentgroup.com) Chicago, IL / National Real Estate Acquisition Vulnerable - High Risk Not Scored Unsolicited off-market property solicitation pointing to a domain registered 2026-07-30 (roughly two months old). The site brands itself "Golden Retreat - The Private Alternative to Listing" and describes itself as doing business as Golden Development Group, while the solicitation used the name "Golden Development" - the domain name does not match the brand it presents. No named principal, no real estate license number, no physical address, and the only published contact is a personal Gmail address. The domain name overlaps an unrelated, established firm at goldendevgroup.com. Passive technical note: no MX, no SPF, no DMARC and no DKIM - the domain cannot send or receive authenticated mail; DNS is hosted on NS1/Netlify and both A records resolve to AWS eu-central-1 (Frankfurt, DE).
Choice One Properties (choiceoneproperties.com) Mesa, AZ Real Estate / Property Management Vulnerable - High Risk F Independent residential brokerage and property manager serving Mesa, Apache Junction, Gilbert, Chandler, Tempe, Queen Creek and San Tan Valley. The published contact is a personal mailbox on the business domain. Passive technical note: email authentication is unenforced - SPF ends in a hard fail (Google Workspace plus TopProducer/SendGrid) but no DKIM selector is published on the domain's authoritative nameservers and DMARC is p=none with no rua/ruf reporting address, so forged mail is both unsigned and unobserved. No CAA record. The site is an ASP.NET IDX build on the Listing Manager platform hosted on Azure App Service, answering directly with no CDN or WAF, and serves no HSTS, CSP, X-Frame-Options, X-Content-Type-Options or Referrer-Policy. Plain HTTP does redirect to HTTPS and the TLS certificate is valid (Let's Encrypt, expires 2026-11-29). Findings are configuration observations, not evidence of compromise.
Instasold (instasold.com) Phoenix, AZ Real Estate / Lead Generation Vulnerable - High Risk C Arizona buyer/seller brokerage and lead-generation business. This is a configuration finding, not a fraud report. Passive baseline failure: DMARC is published only in monitoring mode (p=none), and its aggregate reports are addressed to a third party at lovable.dev rather than the business, so forged mail from the domain is delivered and the monitoring feed goes elsewhere. SPF includes dc-aa8e722993._spfm.instasold.com, which returns NXDOMAIN, and an unresolvable include makes the entire SPF record a permerror. DKIM is present for Google Workspace. No MTA-STS and no TLS-RPT. The public site is a Lovable-built React application behind Cloudflare that serves HSTS, X-Content-Type-Options and Referrer-Policy but no CSP, X-Frame-Options or Permissions-Policy, while it collects buyer and seller contact details. No CAA record and no DNSSEC, so any certificate authority may be asked to issue for the domain. Certificate transparency lists 23 names including twelve per-agent subdomains that publish staff first names and several live personal landing pages. The registration expiry on record is 2026-10-26. Server-side code and behind-login data were not tested.
Confluent Asset Management ↗ Scottsdale, AZ Financial Services / Asset Management Website Maintenance — Remediation Unverified F Reported unsupported server-side software (PHP 8.1.34 observed via HTTP header disclosure; PHP 8.1 reached EOL Dec 31, 2025). Nicholas Chavez was notified; underlying server configuration and current remediation status have not been independently confirmed. Narrow technical website maintenance finding, not an assessment of broader cybersecurity or client data custody.
DateNation ↗ United States Online Dating / Social Community Platform Operational Accountability Pending Not Scored Presents as a dating community connecting singles across America, but operates business communications through a consumer @gmail.com address with documented operational responsiveness concerns, including unanswered member inquiries and unmoderated submissions for extended windows. No verified operational or cybersecurity safeguards on record. Note: No specific cybersecurity breach or technical vulnerability has been established; this is an operational governance and communication infrastructure observation.
Talent Stacked Bay City, MI Staffing & Recruiting Operational Reliability — Unverified Not Scored Confirmed a scheduled 15-minute call invitation (Oct 29, 2026, 10:20–10:35 AM MST) that specified a Google Meet link, then did not join that link at the scheduled time and reported the appointment as missed on the other party's side. The invitation was accepted in writing on Oct 27, 2026, the meeting room was open at the scheduled start, and a same-day offer to realign has not been answered. This is a scheduling-commitment and communication-reliability observation, not a cybersecurity breach or a technical vulnerability finding. Passive technical note: the primary domain publishes no SPF, DKIM, or DMARC record while operating Google Workspace mail, so outbound mail is unauthenticated — a configuration gap, not evidence of compromise. Server-side code and behind-login data were not tested.

Vulnerable listings require evidence-based risk indicators. Non-response may strengthen the case for public listing, but the only public negative category is Vulnerable and each listing should carry a specific documented reason.

Remediation and Removal Policy

Businesses may request review after a listed issue has been remediated. When credible remediation evidence is provided, the listing may be updated to reflect that change. However, remediation alone does not automatically remove a business from public tracking.

If the originally observed issue is no longer present, the business will typically move out of the Vulnerable category and into Verified only after full validation against the published baseline. This is intentional: removal from the status board requires affirmative evidence that the broader security baseline is being met.

Need a listing reviewed after remediation? Submit for verification or open a support request via chat and include the business name, domain, the issue addressed, and supporting evidence.

📊 Weekly Cyber Threat Brief

Week of October 21 – 27, 2026 — "php2shell" CVSS-9.2 critical RCE in PHP core added to CISA KEV (BOD 26-04), Google Brotli zero-day memory corruption, Citrix NetScaler KEV escalation, GMO Internet Group $50M cloud extortion, and UNM Health Sciences trauma center cyberattack.

Current live brief. Older weeks are archived below.

🚨 This Week's Readout

  • "php2shell" Critical Pre-Auth RCE Zero-Day (CVE-2026-109618 & CVE-2026-109619, CVSS 9.2) — Pre-authenticated remote code execution vulnerabilities stemming from out-of-memory corruption and stale request state in the PHP engine core. Added to CISA KEV on October 26, 2026, accompanied by emergency Binding Operational Directive BOD 26-04 mandating federal mitigation by Oct 29. Actively weaponized in the wild against public web endpoints. Upstream releases issued for PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. PHP 8.1 and older are End-of-Life with no upstream patches, leaving un-upgraded environments defenseless against remote execution.
  • Google Brotli Compression Memory Corruption Zero-Day (CVE-2026-111497) — Added to CISA KEV on October 27, 2026. Unchecked return values in decompression state parsing allow arbitrary memory corruption and code execution. Threat actors weaponized the flaw against edge reverse proxies, web application runtimes, and client browsers processing compressed web assets.
  • Citrix NetScaler ADC & Gateway KEV Escalation (CVE-2026-88779 & CVE-2026-107406) — Ongoing mass automated exploitation and persistence campaigns targeting enterprise NetScaler appliances. Organizations must verify patch levels for SAML SP/IdP configurations and actively audit for memory-resident backdoors and unauthorized accounts.
  • GMO Internet Group / Onamae.com ($50M Extortion Demand) — Japanese cloud and trading conglomerate confirmed an intrusion compromising 26,739 virtual desktop cloud servers. Attackers attempted unauthorized currency transactions before service isolation; extortionists issued a $50 million ransom demand.
  • Southwestern Priority: University of New Mexico (UNM) Health Sciences Cyberattack — Southwestern academic Level-1 trauma center and hospital network forced into emergency manual downtime protocols, cancelling outpatient clinic procedures and diverting emergency ambulance traffic across Albuquerque and central New Mexico.
  • Engie Third-Party Customer Data Breach — Major multinational energy utility confirmed customer record exfiltration resulting from a third-party marketing vendor credential compromise, underscoring persistent supply-chain customer data exposure.
  • SafePay Ransomware Critical Infrastructure Surge — Joint federal advisory from CISA, the FBI, and HHS alerting operators to intense SafePay ransomware activity aggressively targeting North American healthcare systems and critical municipal providers.
🔥
9.2
Active Zero-Day: php2shell Core RCE (KEV)
🚨
$50M
Extortion Demand: GMO 26,739 Cloud Desktops
🏥
Level-1
UNM Health Sciences Trauma Diverted
🛑
4+
Emergency CISA KEV Additions This Week
🛑 Critical Zero-Days & Exploited Vulnerabilities (KEV & In-The-Wild)
Identifier Affected Product Impact Vector Exploitation Status & Directive
CVE-2026-109618 / 109619 PHP core engine OOM corruption & stale request state (CVSS 9.2) Active KEV · BOD 26-04
CVE-2026-5281 Google Chrome (Dawn) Use-after-free WebGPU memory corruption In-The-Wild Zero-Day
CVE-2026-111497 Google Brotli library Decompression stream memory corruption Active KEV (Oct 27)
Undisclosed CVE Arista VeloCloud Orchestrator SQL injection in central SD-WAN management Active Edge Targeting
CVE-2026-0257 Palo Alto Networks PAN-OS VPN authentication bypass Ransomware Ingress Vector
CVE-2026-3502 TrueConf Client Update pipeline integrity check failure Targeted Zero-Day Campaign
  • "php2shell" PHP Core RCE (CVE-2026-109618 & CVE-2026-109619, CVSS 9.2) — Pre-authenticated remote code execution zero-day in PHP core engine added to CISA KEV on October 26, 2026. Threat actors weaponize memory corruption during out-of-memory conditions to hijack execution flow. CISA issued emergency Directive BOD 26-04. Patched in 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Sites on unsupported PHP branches (such as EOL PHP 8.1, 8.0, and 7.x) cannot be patched upstream and require immediate runtime modernization.
  • Google Chrome Dawn WebGPU Zero-Day (CVE-2026-5281) — Google issued an emergency channel update resolving an actively exploited use-after-free vulnerability within Chrome's Dawn WebGPU component.
  • Google Brotli Library Memory Corruption (CVE-2026-111497) — Added to CISA KEV on October 27, 2026. Attackers crafted malicious decompression streams triggering arbitrary code execution across reverse proxies, web services, and browsers.
  • Arista VeloCloud Orchestrator SD-WAN Zero-Day — Active zero-day targeting enterprise SD-WAN management portals via unauthenticated SQL injection.
  • Citrix NetScaler ADC & Gateway SAML Flaws (CVE-2026-88779 & CVE-2026-107406) — In-the-wild exploitation continues; organizations must verify appliance patches and check for secondary web shells and credential harvesting.
  • SonicWall SMA 1000 Series (CVE-2026-102255, CVSS 10.0) — Continued aggressive scanning by initial access brokers targeting unpatched Secure Mobile Access appliances.
🔓 Major Data Breaches & Extortion Activity
  • GMO Internet Group / Onamae.com ($50M Cloud Desktop Extortion) Official Company Disclosure — Japan's premier cloud and financial group confirmed compromise of 26,739 virtual desktop cloud server instances. Extortionists attempted unauthorized trading operations before systems were isolated; syndicates demanded $50M to prevent corporate disclosure.
  • Engie Customer Data Breach via Third-Party Marketing Vendor Official Company Disclosure — Multinational energy supplier verified customer record exfiltration resulting from a third-party marketing vendor credential compromise, underscoring third-party integration exposures.
  • Warp AI Development Environment Supply Chain Incident Supply Chain Incident — Developers using Warp faced upstream exposure when an unauthorized party accessed an upstream infrastructure provider, compromising agent telemetry and developer decision logs.
  • Mass Edge Credential Exposure (70,000+ Credentials Harvested) Observed Credential Spraying — Automated scanning across exposed network firewalls and VPN gateways resulted in the exposure of more than 70,000 enterprise credentials harvested from improperly guarded edge access points.
  • McKesson Corporation Confirmed Leak Update Confirmed Impact — Fallout continues from the 6.4M account cloud breach. Active banking and credit monitoring notices are arriving for patients whose Social Security numbers were confirmed compromised.
🦠 Ransomware, Cloud Sabotage & Disruptions
  • Warlock Ransomware (Storm-2603) SharePoint Campaign — China-linked threat group penetrating networks via unpatched on-prem SharePoint servers, dwelling covertly, and systematically terminating EDR/sensor software across dozens of nodes within two hours prior to encryption.
  • Payload Extortion Gang Active Directory Sabotage — Extortion gang leveraging stolen domain credentials to push malicious Group Policy Objects named PAYLOAD, automatically disabling local administrator privileges and modifying lock screens across domain-joined machines.
  • SafePay Ransomware Healthcare Surge — Joint federal advisory from CISA, FBI, and HHS warning of intense operational tempo aggressively targeting regional hospitals and utilities with double extortion.
  • Interlock Ransomware Cisco Firepower Targeting — Active exploitation campaign weaponizing vulnerabilities in Cisco Secure Firewall Management Center software.
🌵 Southwestern US Signal & Regional Disruptions
  • University of New Mexico (UNM) Health Sciences Cyberattack Confirmed Hospital Disruption — New Mexico's sole academic Level-1 trauma center declared emergency downtime operations following a major cyberattack. Incoming ambulances diverted, over 30 outpatient clinics closed, surgeries postponed, and clinical charting transitioned to manual paper. Evidence Distinction: While hospital officials confirmed clinical downtime and emergency diversions, the newly surfaced BYOD extortion gang posted an unverified claim on dark web leak channels alleging access to 36,000 systems and Cerner EHR rosters. UNM has not confirmed data exfiltration claims as forensic containment proceeds.
  • Arizona Courts 1.3M FARE Records Phishing Impersonations — Security teams across Arizona report follow-on phishing lures impersonating court collections and citation payment notices, exploiting public awareness of the FARE database breach.
  • Fake CAPTCHA / ClickFix Tactics Spreading to Local Business Sites — Inbound email campaigns directing staff to fraudulent Cloudflare and Google verification screens that instruct users to run clipboard PowerShell scripts.

Week of October 21 – 27, 2026. Information cutoff: October 28, 2026. Older reports archived below. Sources: CISA KEV, SecurityWeek, The Hacker News, BleepingComputer, CyberScoop, Ransomware.live.

📚 Threat Brief Archives

Previous weekly threat intelligence reports

📊 October 5 – 11, 2026

Dominated by SonicWall SMA 1000 CVSS-10 pre-auth SSRF zero-day (CVE-2026-102255), Citrix NetScaler SAML KEV escalation (CVE-2026-88779/107406), Cisco Catalyst SD-WAN auth bypass, Flax Typhoon CISA KEV blitz, MoneyGram and Deloitte extortion claims by The Gentlemen, and high-profile ShinyHunters arrest.

🛑 Zero-Days & Patches

  • SonicWall SMA 1000 (CVE-2026-102255, CVSS 10.0) — Pre-authenticated SSRF flaw actively exploited within 48 hours to dump MFA seed configs and credentials.
  • Citrix NetScaler SAML (CVE-2026-88779 & CVE-2026-107406) — Added to CISA KEV; unauthenticated memory overflow against SAML SP/IdP configurations.
  • Cisco Catalyst SD-WAN Manager Auth Bypass — CISA KEV priority; unauthorized controller interface access.
  • Flax Typhoon Legacy Exploit Blitz — Six CVEs added to CISA KEV including ProFTPD (CVE-2015-3306), ONLYOFFICE Docs (CVE-2021-3199), Apache Struts (CVE-2016-3081), and Strapi (CVE-2023-22894).

🔓 Breaches & Extortion

  • McKesson Corporation (ShinyHunters Extortion) — Cloud intrusion with 100% confirmed SSN leak and PHI across 6.4M unique emails.
  • MoneyGram (The Gentlemen) — Major extortion campaign targeting global money transfer transactions.
  • Deloitte Extortion Claim — The Gentlemen listed audit giant claiming internal document exfiltration.
  • ShinyHunters Syndicate Arrest — Canadian cybersecurity professional arrested in U.S. for syndicate involvement.

🌵 Regional Signal

  • Arizona Court System 1.3M FARE Breach Update — Confirmed entry via search-engine phishing link; 1.3M SSNs and 30,000 protective orders exfiltrated from backup servers.
📊 September 28 – October 4, 2026

Dominated by actively exploited Citrix NetScaler zero-days (CVE-2026-88771/72) and SAML DoS (CVE-2026-88779), Fortinet FortiMail path traversal added to CISA KEV (CVE-2026-104286), Apple CoreGraphics zero-day (CVE-2026-86950), Warlock SharePoint ransomware operations, and the initial Arizona courts 1.3M FARE debt records disclosure.

🛑 Zero-Days & Patches

  • Citrix NetScaler (CVE-2026-88771 & CVE-2026-88772, CVSS 9.5) — In-the-wild unauthenticated RCE zero-days deploying webshells.
  • Fortinet FortiMail (CVE-2026-104286, CVSS 9.8) — Added to CISA KEV; unauthenticated arbitrary file writes via HTTP/HTTPS.
  • Apple CoreGraphics (CVE-2026-86950) — Zero-day fixed across iOS and macOS; arbitrary code execution via crafted media files.

🔓 Breaches & Intrusions

  • Arizona Court System FARE Database (~1.3M) — 30-year court debt histories, case numbers, SSNs, and protective orders copied from backup servers.
  • Pentagon / DMDC (~3.05M) — File-sharing vulnerability exposed historical service and SSN records.
  • DTU Denmark (~200,000) — Identity system compromise exfiltrated national IDs and employee files.

🦠 Ransomware & Sabotage

  • Warlock SharePoint Campaign — Critical infrastructure intrusions leveraging stolen machine keys and BYOVD EDR killing.
  • JadePuffer Azure Sabotage — 18-hour destructive cloud attack abusing service principals to purge storage and databases.
  • KillSec Seizure — Law enforcement seized leak infrastructure and 110TB of exfiltrated data.
📊 September 14–21, 2026

The week was dominated by two actively exploited Cisco zero-days in Secure Email Gateway (CVE-2026-76461 root RCE) and Cisco ISE (CVE-2026-76460 auth bypass), three Linux kernel vulnerabilities added to CISA KEV, a record-shattering 997 ransomware attacks in August, ShinyHunters hijacking Cl0p's leak site, and a 23.6M-record Gyazo breach.

🛑 Zero-Days & Patches

  • Cisco Secure Email Gateway (CVE-2026-76461, CVSS 9.8) — Unauthenticated SQL injection yielding root command execution via inbound mail flow.
  • Cisco ISE (CVE-2026-76460, CVSS 10.0) — Pre-disclosure exploited API vulnerability granting complete appliance takeover.
  • Linux Kernel Trio — CVE-2025-39682, CVE-2026-53266, and CVE-2025-39964 added to CISA KEV.

🔓 Breaches & Intrusions

  • Gyazo (Helpfeel) — 23.62M user accounts stolen via image upload server exploit.
  • CenterPoint Energy (Houston) — 7.5M utility customer records leaked on dark web.
  • IDScan.net — Vendor confirmed breach after 153M driver's license scans listed for sale.

🦠 Ransomware & Turf Wars

  • ShinyHunters vs. Cl0p — Cl0p's Tor leak site hijacked via Grav CMS file-upload flaw.
  • August Attack Record — 997 attacks (+23%), manufacturing hit hardest with 22% of victim volume.
  • Settra Ransomware — 93 victims claimed, abusing MeshAgent RMM and BYOVD evasion.
📊 September 7–14, 2026

Microsoft's September Patch Tuesday delivered a record 964–974 CVEs including two actively exploited zero-days in the Windows Update Stack (CVE-2026-81963) and Windows ALPC (CVE-2026-85880), alongside 20 wormable unauthenticated RCEs in DNS Server (CVE-2026-69730) and Remote Desktop Services (CVE-2026-69525). Veradigm disclosed a 3.5M patient record breach, Mathspace suffered 1M student/parent records leaked via Metabase SQLi, and Specialty Textile Services in Phoenix was hit by incRansom.

🛑 Zero-Days & Patches

  • Windows Update Stack (CVE-2026-81963) — First Update Stack zero-day on record; improper link resolution before file access enabling local EoP to SYSTEM.
  • Windows ALPC (CVE-2026-85880) — Heap overflow / out-of-bounds write enabling sandbox escape from low-priv AppContainer to SYSTEM with zero user interaction.
  • Wormable RCEs — Windows DNS Server (CVE-2026-69730) and Remote Desktop Services (CVE-2026-69525), both CVSS 9.8.

🔓 Breaches & Intrusions

  • Veradigm (~3.5M) — Healthcare patient data breach via vendor credential compromise.
  • Mathspace AU/NZ (~1.08M) — Metabase CVSS 10 SQLi exploited by ShinyHunters.
  • Specialty Textile Services (Phoenix, AZ) — Local hospitality linen provider listed on incRansom leak site.
📊 August 24, 2026

Active hypervisor exploitation dominated the week with VMware vCenter (CVE-2026-59310) abused for Babuk ransomware deployment, SAP Commerce Cloud under CVSS 10.0 attacks, and WordPress Forminator (CVE-2026-15748) threatening 600k+ sites. Major regional disruption hit Texas with UT San Antonio class delays and JPS Health Network in Fort Worth operating under manual clinical downtime.

🛑 Zero-Days & Patches

  • VMware vCenter (CVE-2026-59310) — Actively exploited in the wild for remote code execution and deployment of Babuk-derived ransomware directly into virtualized server clusters.
  • SAP Commerce Cloud (CVE-2026-58231, CVSS 10.0) — Perfect 10.0 critical issue under active exploitation against enterprise commerce infrastructure.
  • WordPress Forminator Forms (CVE-2026-15748) — Affecting 600,000+ active installs allowing unauthenticated arbitrary file uploads and potential server takeover.

🔓 Breaches & Intrusions

  • The Butcher Brothers (Play Ransomware) — Corporate data exfiltrated and operational shutdown following Play ransomware listing.
  • France Finance Ministry (~700,000) — Confirmed theft of taxpayer data affecting roughly 700,000 citizens.
  • Bits of Gold (~200,000) — Third-party vendor breach affecting approximately 200,000 cryptocurrency customers.

🦠 Ransomware & Healthcare Disruption

  • AnMed (South Carolina) — Severe ransomware attack forced broad facility closures and operational delays.
  • UT San Antonio & JPS Health Network (Texas) — Fall classes delayed following breach containment; Fort Worth health system forced into multi-day manual downtime with EHR offline.
  • Fort Smith City Systems — Municipal network security incident disrupted city services.
📊 July 11-18, 2026

Microsoft's July Patch Tuesday fixed 570 flaws including 2 actively exploited zero-days in AD FS (CVE-2026-56155) and SharePoint (CVE-2026-56164). AssuranceAmerica (~7M), Medtronic (>3.8M), and Moody Bible Institute (>2.3M) disclosed major breaches, while JadePuffer demonstrated the first documented fully agentic LLM-driven ransomware flow.

📊 June 25, 2026

The defining stories were brutal small-business breach reality (43–47% targeted breach rate for orgs with ≤10 users, 60% closing within six months), relentless ransomware leak-site activity across Southwest sectors, and cascading infrastructure outages (Cloudflare, BeyondTrust).

🛑 Zero-Days & Patches

  • Microsoft addressed 128–137 vulnerabilities including one zero-day (CVE-2025-49719) in SQL Server.
  • SPNEGO NEGOEX RCE (CVE-2025-47981) — wormable CVSS 9.8 affecting Windows Server 2016–2025 and Windows 10 with PKU2U.
  • KDC Proxy Service RCE (CVE-2025-49735) — critical RCE in KPSSVC on Windows Server 2016–2025.

🔓 Breaches & Intrusions

  • Ransomware leak sites — Qilin and Akira highly active; Shipping Association of NY and NJ listed.
  • June 7–8 leaks — Plaza Lama and Hansoll Textile (Vietnam) among claims.
  • BeyondTrust — active exploitation of a critical appliance vulnerability observed.

🦠 Ransomware

  • 88% of SMB breaches involve ransomware (vs. 39% for larger enterprises).
  • Southwest targets: Nunez Dental, Mount Rogers Community Services, Jericho FD, Sandhills Medical, M&H Electric, Triumph Construction.
  • Median demands $25K–$120K (sub-10 employees), up to $254K (sub-50 users), downtime up to 72 hours.
📊 May 19, 2026

The defining story of the week was the Instructure/Canvas SaaS breach and extortion pressure affecting schools nationwide, including Southwest institutions, alongside an exploited LNK coercion chain and new KEV additions.

🛑 Zero-Days & Patches

  • Microsoft Windows LNK chain — Zero-click authentication coercion via malformed shortcut files patched.
  • CISA KEV additions — Actively exploited flaws in SimpleHelp, Samsung MagicINFO 9, and D-Link routers.
  • Chrome zero-day — Actively exploited Chrome zero-day patched.

🔓 Breaches & Intrusions

  • Instructure / Canvas — Names, email addresses, student IDs, and messages exposed.
  • Southwest US — Anthony, NM municipal incident (missing records/systems) and Nevada school system fallout.
  • Jones Day — Silent ransomware posted stolen data from the law firm.
📊 April 16–23, 2026

Patch-heavy week dominated by Microsoft April Patch Tuesday follow-through, Adobe Acrobat Reader emergency patching, Fortinet EMS exposure, SAP NetWeaver exploitation, and third-party access claims.

🛑 Zero-Days & Patches

  • Microsoft fixed two exploited zero-days: CVE-2026-32201 and CVE-2026-33825.
  • Adobe Acrobat Reader CVE-2026-34621 and Fortinet FortiClient EMS CVE-2026-21643 remained urgent patch items.
  • SAP NetWeaver CVE-2025-31324 was tied to web-shell uploads on exposed systems.

🔓 Breaches & Intrusions

  • OneDigital, CareCloud, Erie Family Health, and Rockstar/Anodot/Snowflake-related claims were tracked as notable disclosure items.
  • ShinyHunters, The Gentlemen, Medusa/Storm-1175, Interlock, and Qilin remained notable ransomware or intrusion-trend names.
📊 April 10–17, 2026

🚨 Patch These NOW

  • Chrome/Edge — CVE-2026-5281 (zero-day, actively exploited). Update to 146.0.7680.177+.
  • F5 BIG-IP — CVE-2025-53521 (CVSS 9.8 RCE), 14,000+ exposed.
  • Fortinet EMS — CVE-2026-35616 and CVE-2026-21643 (pre-auth RCE).

🛑 Zero-Days & Patches

  • CVE-2026-32201 — SharePoint spoofing zero-day, actively exploited.
  • CVE-2026-5281 — Chrome Dawn/WebGPU use-after-free zero-day.
  • Eight critical Office/Word RCE bugs (up to CVSS 8.4).
  • Firefox 149.0.2 and Thunderbird 149.0.2 also required patching.

🦠 Ransomware

  • 21-35 new victims were appearing daily in early April reporting.
  • LockBit and SafePay were among the most active groups tracked that week.
  • Qilin, Akira, and DragonForce accounted for a large share of observed activity.
  • LeakBase seized — 142,000+ user cybercrime forum shut down.
📊 April 7–14, 2026

🏪 Small Business Breaches

59 breaches exposing 97.7 million records in 2026 alone. Average ransom demand: $84,000

  • Hennessy Advisors — 12,643 individuals (SSNs, financial accounts, driver's licenses)
  • North Central Behavioral Health Systems — Patient PHI exposed
  • Evergreen Healthcare Group — SSNs, medical info, DOBs exposed

🔓 Major Breaches

  • TriZetto Provider Solutions (Cognizant) — 3.4M individuals
  • LexisNexis Risk Solutions — ~2GB internal data leaked
  • FBI Surveillance/Wiretap Systems — Confirmed investigation

🛑 Critical Zero-Days

  • Chrome CVE-2026-5281 — 4th zero-day of 2026, Use-After-Free in Dawn (WebGPU), actively exploited. Update to 146.0.7680.177+
  • F5 BIG-IP CVE-2025-53521 — 14,000+ exposed, CVSS 9.8 RCE
  • Fortinet FortiClient EMS — CVE-2026-35616, CVE-2026-21643 (pre-auth RCE)
  • Axios npm — Supply chain attack, versions 1.14.1 and 0.30.4 backdoored

🦠 Ransomware

  • Anubis — Claimed 170GB theft
  • DragonForce — Hit Neurological Associates of Washington (1.4TB)
  • Rhysida — Hit Cheyenne & Arapaho Tribes, $680K demand
  • LeakBase seized — 142,000+ user cybercrime forum shut down
📜 Historical Advisory: Secure Boot Certificate Transition

Historical Note: The Microsoft Secure Boot certificate revocation deadline took effect June 26, 2026. Required UEFI dbx firmware updates were rolled out during the April–May 2026 Patch Tuesday maintenance cycles.

More archives coming as weeks accumulate. Historical data helps track threat trends over time.

📊 April 2–9, 2026
  • F5 BIG-IP CVE-2025-53521 — 14,000+ exposed, CVSS 9.8 RCE actively exploited
  • Fortinet FortiClient EMS — CVE-2026-24858, CVE-2026-35616 under urgent patching
  • Akira, Timc, Anubis — 20+ new victims on leak sites, targeting healthcare, manufacturing, IT
  • Axios npm supply chain — Malicious packages 1.14.1/0.30.4 deployed backdoors
  • Cisco AWS keys — Stolen in breach, unauthorized cloud access
📊 March 26 – April 2, 2026
  • Langflow RCE CVE-2026-33017 — CISA KEV, exploited within 20 minutes of disclosure
  • Ransomware — 780 attacks in March (up 13%), Qilin (140) and Akira (80) most active
  • Supply chain — LiteLLM PyPI, Axios npm, TeamPCP targeting CI/CD
  • Breaches — Navia Benefit Solutions (2.7M PII), North Texas Behavioral Health (284K), OSI Systems (4.9K)
  • Outages — 325 global network outages (up 17%)
📊 March 19–26, 2026
  • March Patch Tuesday — 79-82 CVEs, critical RCE in Devices Pricing Program (CVE-2026-21536, CVSS 9.8)
  • Fortinet FortiWeb — CVE-2026-24017 auth bypass enables brute-force
  • Medusa ransomware — UMMC (1TB+ patient data, $800K), Passaic County NJ
  • Stryker attack — Iranian Handala group, 200K+ devices wiped, 50TB stolen
  • Ongoing exploits — SharePoint RCE, Cisco FMC zero-day, ConnectWise ScreenConnect
📊 March 5–12, 2026
  • Microsoft Patch Tuesday — 82 flaws, Excel zero-click info disclosure (CVE-2026-26144)
  • Android zero-day CVE-2026-21385 — Confirmed exploited, CISA added to KEV
  • LexisNexis breach — 3.9M records, AWS secrets, Salesforce creds exposed
  • ServiceNow outage — March 6, 63 mins, global customers impacted
📊 February 19–26, 2026
  • SolarWinds Serv-U — 4 critical RCE flaws (CVE-2025-40538-41, CVSS 9.1), update to 15.5.4
  • Dell RecoverPoint CVE-2026-22769 — CVSS 10.0, China-nexus exploitation since mid-2024
  • APT28 zero-day CVE-2026-21509 — Russian state actor, MS Office exploit
  • Conduent breach — 25M+ Americans, one of largest in US history
  • Qilin ransomware — 100+ victims/month, 56% surge after RansomHub collapse
  • Cloudflare outage — Feb 20, ~5 hours, BGP misconfiguration (not cyber attack)
📊 Arizona & Southwest Breaches
  • University of Phoenix — 3.5M records, Clop ransomware (CVE-2025-61882), largest AZ breach
  • Academic Urology & Urogynecology of Arizona — 73K patients, PHI exposed
  • Arizona Lighting Sales — Play ransomware, Feb 2026
  • Conduent — State payment processor, AZ residents impacted

🚨 Confirmed Breaches

Based on public records, government filings, and verified client notifications.

🔴 GMO Internet Group / Onamae.com — $50 Million Cloud Desktop Extortion (26,739 Cloud Servers Compromised) Active Alert
⚠️ Confirmed Impact: 26,739 Virtual Desktop Cloud Servers Compromised Extortionists compromised virtual desktop cloud infrastructure across GMO Internet Group and Onamae.com, attempting unauthorized foreign-exchange trading before systems were isolated. The attackers issued a $50 million extortion demand.

The Incident: During the week of October 21, 2026, Japanese internet and financial conglomerate GMO Internet Group confirmed that unauthorized actors breached internal cloud management planes, affecting 26,739 virtual desktop infrastructure (VDI) servers. Threat actors gained access to trading terminals and attempted unauthorized trading operations before defense teams severed connections. The syndicate demanded a $50 million ransom under threat of leaking corporate and customer datasets.

Exposed Assets & Threat Vector:
  • Cloud Virtual Desktops: 26,739 server instances accessed across enterprise hosting and customer accounts.
  • Trading Systems: Direct access attempts against financial trading and FX transaction pipelines.
  • Cloud Infrastructure Credentials: Administrative session tokens and API keys leveraged for lateral traversal across tenant boundaries.

💡 Lessons & Defenses for Cloud Operators

  • Tenant Isolation & Microsegmentation: Virtual desktop hosting infrastructure must be completely segregated from financial execution and administrative consoles via zero-trust network architectures.
  • Hardware-Backed FIDO2 Authentication: Enforce phishing-resistant MFA across all cloud orchestration planes to prevent session hijacking.
  • Out-of-Band Financial Verification: High-value transactions and automated trading APIs require cryptographic multi-party authorization independent of the operating system session.

Disclosed: Week of October 21–27, 2026 | Impact: 26,739 VDI cloud servers | Demand: $50,000,000 | Sources: GMO Group Incident Advisory, SecurityWeek, CyberScoop

🔴 University of New Mexico (UNM) Health Sciences — Level-1 Trauma Center Cyberattack Confirmed Disruption

The Incident: On October 23, 2026, UNM Health Sciences—the primary academic hospital system and only Level-1 trauma center in New Mexico—declared emergency downtime operations following a major cyberattack. Emergency departments diverted ambulances to regional facilities, outpatient clinical appointments were canceled, and clinical care transitioned to manual paper charting to contain lateral propagation.

Operational Impact: Southwestern regional healthcare disruption, emergency ambulance diverts, clinical scheduling outages, and medical record EHR disconnection. Law enforcement and federal cybersecurity agencies were notified as forensic containment continues.

⚠️ Evidence Source Clarification: UNM Health Sciences leadership officially confirmed clinical downtime, emergency diversions, and paper charting. Separately, the newly surfaced BYOD extortion gang claimed responsibility on dark web leak channels, alleging compromise of 36,000 endpoints, Active Directory forests, and Cerner EHR rosters. UNM has not verified these criminal claims, and uncorroborated dark web listings should not be confused with confirmed data loss.

Disclosed: October 23, 2026 | Entity: UNM Health Sciences (Albuquerque, NM) | Classification: Hospital / Level-1 Trauma Center Downtime | Sources: UNM Health Incident Notice, Albuquerque Journal, HealthITSecurity, BleepingComputer

🔴 McKesson Corporation — Massive Healthcare Supply Chain Breach (ShinyHunters Extortion) Critical Alert
⚠️ Confirmed Impact: Social Security Numbers 100% Confirmed Leaked Social Security numbers are verified as actively compromised and floating on dark web aggregators alongside comprehensive patient medical histories. Affected individuals nationwide are receiving high-priority banking and credit monitoring breach alerts.

The Incident: Between August 20 and 25, 2026, threat actors infiltrated third-party software applications connecting to McKesson's environment—specifically targeting cloud-hosted data platforms including Salesforce and Snowflake. The intrusion impacted major divisions including Oncology & Multispecialty and Medical-Surgical operations. Extortion group ShinyHunters claimed responsibility, issuing a ~$55 million extortion demand and claiming 284 million rows of stolen corporate and patient records. Troy Hunt's Have I Been Pwned independently confirmed 6.4 million unique email addresses across patients, medical staff, and healthcare provider contacts.

Exposed Data Categories:
  • Social Security Numbers: Confirmed leaked; identity monitoring and banking alerts actively firing for affected individuals.
  • Protected Health Information (PHI): Detailed medical diagnoses, medication logs, laboratory and diagnostic test results, treating physician records, and clinical therapy regimens.
  • Health Insurance & Government Program IDs: Commercial policy numbers, group numbers, Medicare beneficiary IDs, and Medicaid numbers.
  • Full Identity Records (PII): Patient full legal names, physical home addresses, phone numbers, email addresses, dates of birth, and unique patient identifiers.
  • Financial & Billing Data: Payment card records, bank account routing details, and healthcare invoice transactions.

💡 How This Disaster Could Have Been Avoided

This catastrophe was not an unstoppable alien zero-day. Like most devastating corporate breaches, it exploited basic operational hygiene gaps:

  • Anti-Vishing / Help Desk Verification Protocols: ShinyHunters explicitly claims entry via voice-phishing (vishing) corporate help desks and personnel. Organizations must enforce strict out-of-band identity verification (e.g., manager callback, cryptographic token validation, or in-person check) before fulfilling password or MFA resets.
  • Phishing-Resistant MFA (FIDO2 / Hardware Security Keys): Legacy MFA (SMS codes, email OTPs, or push notifications susceptible to MFA fatigue) can be hijacked via vishing or reverse-proxy adversary-in-the-middle (AitM) phishing kits. Enforcing FIDO2 hardware keys (e.g., YubiKeys) cryptographically binds authentication to the destination domain, rendering voice phishing and fake portals completely ineffective.
  • SaaS & Data Warehouse Least-Privilege Scoping: Massive central repositories like Snowflake and Salesforce must never be accessible with broad, unsegmented administrative credentials. Mandatory network IP allowlisting, column-level data masking, just-in-time access, and continuous SaaS Security Posture Management (SSPM) prevent mass exfiltration even if single credentials leak.
  • Anomalous Exfiltration Alerting: Pulling gigabytes or hundreds of millions of patient rows from SaaS connections should trigger immediate automated token revocation and egress blocking—not a discovery 5 days after the attacker has already exfiltrated everything.
Why Companies Must Stop Slacking on Cybersecurity: McKesson is a Fortune 10 healthcare juggernaut distributing one-third of all medications in North America. If an enterprise of that scale leaks Social Security numbers and cancer patient files through basic social engineering and third-party SaaS connections, no business owner or individual can afford to assume their vendors or partners have security figured out. You cannot rely on "hope" as a security strategy. Business owners and high-value individuals need proactive, vigilant defenders who actively audit configurations, enforce real controls, and watch their back 24/7.

Disclosed: August 28 / September 8, 2026 | Attack Window: Aug 20–25, 2026 | Attacker: ShinyHunters | Confirmed Breach Scope: 6.4M unique emails (HIBP), 100% confirmed SSNs, patient PHI, oncology/med-surg data | Sources: McKesson SEC Filings & Breach Notices, HIPAA Journal, Have I Been Pwned, SecurityWeek

🔴 Veradigm — Patient Records (The Gentlemen Ransomware)

Healthcare-tech company disclosed a patient-data breach after a third-party vendor's credentials exposed a customer-services API. The Gentlemen gang claims 3.5M patient records (names, addresses, SSNs) and threatens a leak unless paid.

Disclosed: Week of Sept 8, 2026 | Source: BleepingComputer

🟠 Mathspace — 1.08M Student Records (ShinyHunters)

Online math platform (AU/NZ) disclosed a breach affecting 1,079,819 students, teachers, staff and parents after a self-hosted Metabase instance was hit via the CVSS-10 SQLi CVE-2026-72898. ShinyHunters claimed responsibility; the critical advisory was not escalated in time.

Disclosed: Sept 8, 2026 | Source: SecurityWeek

🟠 Specialty Textile Services (Phoenix, AZ) — incRansom

Phoenix-based linen/hospitality provider (~200–500 staff) hit by incRansom. Double-extortion attack discovered Sept 2, 2026; listed on the group's leak site. Local Phoenix signal for hospitality and supply-chain operators.

Discovered: Sept 2, 2026 | Source: Leak-site record (HookPhish / breach aggregators)

🟠 HYBE Weverse — 422K Accounts (Payment/Refund Data)

HYBE's superfan platform confirmed 422,584 accounts leaked, including payment and refund details. Reported to KISA after an external vulnerability disclosure. Second Weverse data incident this year.

Confirmed: Sept 6, 2026 | Source: Music Business Worldwide

🟡 Gangnam Unni (Healing Paper) — 219K Users

South Korea's leading cosmetic-procedure platform exposed 219,665 users' consultation records — including procedure/hospital names, appointment times, reasons for consultation and photos — through an API access breach.

Disclosed: Sept 8, 2026 | Source: Korea Herald

🔴 University of Phoenix — 3.5M Records (Clop Ransomware)

Clop exploited CVE-2025-61882 in Oracle E-Business Suite. Names, SSNs, birth dates, bank account/routing numbers for 3.49 million students/staff. Undetected for 3 months.

Disclosed: November 2025 | Largest AZ breach on record.

🔴 Conduent — 25M+ Americans (State Payment Processor)

Safepay ransomware. 8TB exfiltrated over 5 months (Oct 2024–Jan 2025). SSNs, health data, Medicaid/benefit info for 25M+ Americans. Notifications sent 9 months later.

Impact: Multiple states' government payment services.

🔴 Academic Urology & Urogynecology of Arizona — 73K Patients

Unauthorized intrusion May 18-22, 2025. Exposed: names, SSNs, tax IDs, driver's licenses, DOBs, financial details, health insurance, medical records.

Disclosed: January 30, 2026 | HIPAA-reportable.

🟠 Double D Taxes — IRS Data Exfiltration

Social engineering leading to credential leak. IRS and tax data exfiltrated via dark web leak.

Date: November 2025 | Source: Dark Web Leak

🟠 Arizona Lighting Sales — Play Ransomware

Play ransomware claimed Phoenix-area commercial lighting distributor. Double-extortion playbook. Data scope undisclosed.

Date: February 19, 2026

🟠 TriZetto Provider Solutions — 3.4M Health Records

Cognizant subsidiary. Health insurance and patient payment data compromised for 3.4 million individuals.

Type: Healthcare payment platform breach.

🟠 Phoenix Art Museum — Breach Disclosed April 15

Cybersecurity incident confirmed. Number of records exposed undisclosed.

🟠 Primary Health / U.S. HealthWorks (AZ) — 78K Records

Cyberattack / data theft. Names, DOB, SSNs exposed.

Date: January 2025 | Source: HHS OCR Breach Portal

🟡 Glendale Obstetrics & Gynecology — 500+ Patients

Network hacking incident. Patient records exposed.

Date: December 2025 | Source: HHS OCR Breach Portal

🟡 PayPal Working Capital — Configuration Error

Software coding error (not a hack). 5.5 months of exposed data: names, emails, phones, SSNs, DOBs. No network intrusion.

Date: Jul 1 – Dec 13, 2025 | Source: Public Disclosure

🟠 Stryker — Iranian Device-Wipe Attack (Tens of Thousands of Endpoints)

Iranian government hackers broke into medical tech giant Stryker in March 2026 and remotely wiped tens of thousands of employee devices. The attack caused widespread operational disruption and had a material impact on Stryker's first-quarter earnings. U.S. government attributed the hacking group to an arm of Iranian intelligence, marking a shift from espionage to destructive attacks.

Date: March 2026 | Source: TechCrunch / U.S. Government Attribution

🔴 Klue / Icarus — 200 Companies Exposed (Jamf, HackerOne, LastPass)

Market research provider Klue breached by Icarus extortion gang using a credential issued in 2022 that was never decommissioned — roughly 4 years of neglect. Hackers stole cloud service keys allowing access to Klue's customers' data stores, affecting close to 200 companies including cybersecurity giants Jamf, HackerOne, and LastPass. Klue reportedly paid ransom to prevent publication.

Date: 2026 | Source: TechCrunch / Verified Customer Notifications

🔴 Instructure / Canvas — 30M+ Students (ShinyHunters Double Breach)

ShinyHunters breached education tech giant Instructure's Canvas LMS, stealing private data of over 30 million students and staff. When Instructure didn't pay, hackers broke in again during finals week and defaced login screens across U.S. schools, disrupting exams nationwide. Instructure eventually paid ransom despite FBI discouragement. ShinyHunters also hit Charter (40M records via voice phishing) and Carnival Cruise (6M customer records).

Date: 2026 | Source: TechCrunch / FBI

📋 Banner Health — Historical Reference (3.7M Patients)

Largest healthcare breach in AZ history. Settlement and public records.

Source: HHS Public Settlement Records

Have information about a local breach? Report it confidentially