Top incidents by sector and regulatory / technology / thematic changes
July's defining thread was Russian state-sponsored activity against network infrastructure: the CISA/FBI/NSA 12-agency joint advisory on edge-device targeting (mirrored by ACSC for Australian organisations), the Russian state-sponsored Zimbra zero-day campaign (AA26-204A) and related activity made state-sponsored intrusion the month's highest-scored story set across defence, government and the macro view.
The month's second signal was enforcement rather than intrusion: the financial-cyber news cycle was dominated by settlements closing out past breaches — 23andMe's US$18 million settlement and the Connecticut AG-led 42-state agreement, Block/Cash App's US$45 million payment over lax security — while AI governance hardened from consultation into binding statute (Illinois' Frontier AI Model Law, the EU's Digital Omnibus on AI in force, Cyber Resilience Act technical guidance). Accountability and regulatory obligation, rather than new attacker capability, drove the legal and financial sectors.
Operationally, July demonstrated that OT warnings can become incidents within weeks: a coordinated cyberattack disabled operational technology at more than 30 Minnesota water facilities, federal alerts on Iran-linked OT activity broadened, and CISA's water/wastewater PLC guidance landed the same month. Human-layer social engineering also proved its ceiling — Qantas' 5.7-million-record exposure traced to a single vishing call on a contact-centre agent — reinforcing that the phone, not the firewall, remains the cheapest path into Australian organisations.
Russian state-sponsored targeting of network edge devices (routers, VPNs, firewalls) is the quarter's most credible state-threat vector; Australian organisations should treat the joint advisory's mitigation list as a compliance floor.
Confidence: HighWater and OT operators face a demonstrated, not hypothetical, attack surface after the Minnesota incidents; OT isolation guidance from CISA and ACSC should be implemented as urgent work, not planned work.
Confidence: HighThe settlement wave (23andMe, Block/Cash App) marks the accountability phase of the 2023–24 breach cycle; expect Australian regulator appetite for retrospective enforcement to strengthen along the same pattern.
Confidence: ModerateFrontier-AI obligations became binding statute in July; Australian and NZ organisations operating in or with the EU and US now carry enforceable AI-governance duties, not just principles.
Confidence: HighVishing and human-layer social engineering remain the highest-yield access vector, as Qantas' 5.7-million-record breach shows; phishing-resistant MFA and contact-centre identity verification offer the greatest marginal return of any control this period.
Confidence: HighThe bottom line up front: these themes cut across every sector-specific incident below, each listing the sectors it touches.
The month's defining thread is coordinated Russian state-sponsored activity: the CISA/FBI/NSA 12-agency joint advisory on targeting network edge devices (routers, VPNs, firewalls — mirrored by ACSC for Australian organisations), the Russian state-sponsored Zimbra zero-day campaign (AA26-204A), and Sandworm's UAC-0145 shift to ClickFix CAPTCHA lures against Ukrainian targets. July read as a sustained offensive against internet-exposed infrastructure, not opportunistic crime.
More financial-cyber stories this month concerned enforcement than new intrusions: 23andMe's $18 million settlement, Block/Cash App's $45 million payment over lax security, and the Connecticut AG-led 42-state 23andMe agreement. For Australian regulators, the signal is a hardening, cross-jurisdiction posture on consumer-data accountability — firms are now paying for breach consequences years after the fact.
A coordinated cyberattack disabled operational technology at 30+ Minnesota water facilities, federal agencies broadened alerts on Iran-linked OT activity, and CISA urged water/wastewater operators to protect PLCs — while ACSC released OT-isolation guidance. The sector's warnings are no longer hypothetical: Australian critical-infrastructure operators under SOCI should treat water and utility OT as a live, demonstrated target.
July saw AI governance harden into enforceable law: Illinois enacted the Frontier AI Model Law, the EU's Digital Omnibus on AI entered into force, and the European Commission issued technical guidance on Cyber Resilience Act compliance. Australian and NZ organisations operating into those markets now face concrete compliance obligations, not just principles.
Case & Associates (Texas AG notification), Hillwood Development (SSNs, 30 June probe close) and Sunrise Company (California AG, Akira attribution) all came to light through attorney-general filing channels rather than major press coverage. The pattern confirms that property-sector data incidents are under-reported in the news cycle and best tracked through breach-notice aggregators.
Qantas' 5.7-million-record exposure was traced to a vishing call tricking a contact-centre agent, while the Dutch police dismantled a global crypto-investment scam and AI-driven scammers showed they outperform humans at building trust. July reinforced that the human layer remains the softest initial-access vector — phishing-resistant MFA and call-back controls are the highest-leverage controls.
Health-ISAC flagged increasing ShinyHunters data-theft attacks, the FTC sued Hims & Hers over sharing patient data with ad platforms, and OSF Healthcare settled a US$552,250 OCR HIPAA investigation. Alongside the education sector's Canvas pause and Cedar Crest disclosure, the period shows health and educational data exposure widening through vendor, tracking and AI-upload paths — not just database theft.
Genetic testing company agreed to $18 million settlement with states over data breach affecting millions of users. Settlement addresses security failures and inadequate breach response.
Dutch authorities arrested alleged mastermind of global cryptocurrency investment scam operation. International law enforcement coordination resulted in takedown of fraudulent investment platform.
Block Inc., owner of Cash App, agreed to a $45 million settlement to resolve allegations of inadequate security practices that led to user data exposure and financial losses. The settlement underscores growing regulatory scrutiny of fintech security practices.
The July financial-sector stories are dominated by penalties and law-enforcement outcomes rather than fresh breaches: the 23andMe $18 million multi-state settlement, Cash App owner Block's $45 million payment over lax security and 23andMe's 2023 breach consequences, alongside the Dutch police dismantling a global crypto investment scam and lengthy prison terms for ransomware negotiators and BlackCat/Avaddon conspirators. For Australian financial institutions the signal is forward-looking enforcement of consumer-data obligations and harder line on facilitating cybercrime infrastructure.
Source: The Record, The Hacker News, July 2026
In a collaborative international effort, the ACSC joined CISA and other Five Eyes partners to publish updated guidance on the 2026 Minimum Elements for a Software Bill of Materials (SBOM). The joint document outlines standardised criteria for SBOM creation, instructing private and public software developers on how to document component transparency to defend against software supply chain attacks.
Illinois Governor JB Pritzker signed the Artificial Intelligence Safety Measures Act, making Illinois the third US state to enact comprehensive safety and transparency requirements for advanced AI systems.
The EU's Digital Omnibus on Artificial Intelligence has officially entered into force as of July 27, 2026. The comprehensive digital regulatory package updates EU liability regimes, cloud services rules, and safety metrics to establish alignment with the compliance tiers and risk categories of the EU AI Act.
States and blocs are moving from consultation to binding statute: Illinois enacted the Frontier AI Model Law, the EU's Digital Omnibus on AI entered into force, and the European Commission issued technical guidance on Cyber Resilience Act compliance - while CISA and the ACSC updated joint guidance on 2026 minimum elements for software bills of materials. Each carries direct obligations for Australian and NZ legal and regulated entities operating into those markets.
Source: Hunton Privacy Law Blog, ACSC, IAPP, July 2026
A joint advisory (AA26-117A) from CISA, the FBI, NSA and 12 allied agencies detailed a sustained Russian state-sponsored campaign targeting network edge devices - routers, VPNs and firewalls - exploiting default credentials, legacy vulnerabilities and weak configurations to gain covert access. The advisory urges organisations replace unsupported edge devices, patch known vulnerabilities, harden management interfaces and audit logs, and was mirrored by the Australian ACSC and Cyber.gov.au for AU organisations. Available in 12 languages reflecting the breadth of the targeting.
South Korean intelligence and cybersecurity agencies have warned that North Korea's Lazarus Group is sharing hacking tools and infrastructure with ransomware affiliates, blurring the line between state-sponsored cyber espionage and financially motivated cybercrime. This development suggests a new level of operational collaboration between nation-state actors and criminal ransomware ecosystems.
Russian GRU-affiliated Sandworm sub-cluster UAC-0145 is using fake CAPTCHA checks on compromised websites to trick Ukrainian targets into executing PowerShell commands that deploy data-stealing malware (GHETTOVIBE, SCOUTCURL). CERT-UA issued an alert detailing the campaign.
The defining July development is the 14-country joint advisory on a Russian state-sponsored campaign targeting network edge devices - routers, VPNs and firewalls - exploiting default credentials and legacy vulnerabilities, mirrored by ACSC/Cyber.gov.au for Australian organisations. Sandworm's UAC-0145 shift to ClickFix CAPTCHA lures against Ukrainian targets and continuing KEV-catalog hardening complete a picture where defence-relevant supply-chain and espionage risk is concentrated in internet-exposed infrastructure rather than tactical military systems.
Source: CISA, Cyber.gov.au/ACSC, The Hacker News, July 2026
Health sector organisations have been warned about an increase in successful attacks by the ShinyHunters threat group, which has been increasingly targeting healthcare data. The ISAC alert underscores the persistent targeting of health sector data by cybercriminal groups.
OSF Healthcare System and its Affiliated Covered Entities have agreed to pay a penalty of $552,250 to resolve an investigation by the HHS Office for Civil Rights (OCR) into potential HIPAA violations. The settlement underscores ongoing regulatory scrutiny of healthcare organisations' security practices.
The US Federal Trade Commission (FTC) filed a lawsuit against telehealth platform Hims & Hers, alleging the provider illegally shared sensitive patient healthcare selections, order lists, and demographic data with third-party social media and marketing networks. The FTC asserts Hims & Hers embedded tracking pixels across its portals and diagnostic pages, sending personal clinical choices to advertising databases without patient knowledge or consent.
Health-ISAC warned of rising ShinyHunters data-theft attacks on health organisations, continuing the year's endemic targeting, while enforcement moved against both big platforms (the FTC suing Hims & Hers over sharing patient data with ad platforms) and providers (OSF Healthcare's $552,250 HIPAA settlement). The tracking-pixel exposure class is becoming a formal regulatory battleground - a precedent Australian health organisations under the Privacy Act should watch closely.
Source: HIPAA Journal, The Record, July 2026
Allentown, Pennsylvania's Cedar Crest College confirmed on 16 July 2026 that it had identified a significant cybersecurity incident affecting portions of its technology environment and immediately activated emergency response protocols. The college said it was investigating, securing systems and restoring affected services safely, publishing updates via its dedicated cybersecurity-update page as the probe continued. Higher-ed incident grounded in the college's own first-party disclosure.
Instructure, the company behind the Canvas learning management system used by thousands of universities globally, paused data delivery functions after identifying a potential security threat. This comes two months after Instructure made a deal with hackers to salvage stolen user data. The nature and scope of the threat are still under investigation.
July offered little major incident volume for education: the standout was Canvas pausing data delivery over a potential security threat, and Cedar Crest College's first-party disclosure of a significant technology-environment incident in Pennsylvania. Both reinforce the recurring theme that edtech supply-chain and vendor-risk management - not just institutional breaches - is where education-sector cyber risk is concentrating.
Source: Inside Higher Ed, WFMZ-TV, July 2026
A Russian state-supported espionage group has been exploiting a stored XSS vulnerability in Zimbra's Classic UI (CVE-2025-66376) since at least July 2025, targeting Western government and commercial mailboxes. The "view-based exploit" activates when a user opens a crafted HTML email abusing CSS @import handling, exfiltrating 90 days of email, the full directory, saved browser passwords, and 2FA recovery codes. NSA, CISA, ACSC, Unit 42 and Proofpoint jointly published the advisory on July 23.
A coalition of 42 state attorneys general reached a settlement with 23andMe's bankruptcy trustee, resolving claims from the company's 2023 data breach that exposed genetic and personal data of millions of customers.
CISA continues working toward finalising regulations implementing the Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) of 2022, with a final rule now expected in September 2026.
CISA's plan to finalise cyber incident reporting regulations in September set a concrete milestone for CIRCIA implementation, while the 23andMe 42-state settlement led by Connecticut's AG showed state-level enforcement of breach obligations at scale. Australia's ACSC again featured: the Russian device-targeting advisory and SBOM guidance were both issued jointly with US agencies, keeping AU government aligned with Five Eyes cyber policy.
Source: Hunton Privacy Law Blog, CISA, Cyber.gov.au, July 2026
CISA issued an urgent alert urging the Water and Wastewater Systems Sector to protect operational technology (OT) environments against malicious activity specifically targeting programmable logic controllers (PLCs). The alert follows last week's coordinated cyberattack that disabled OT at 30+ Minnesota water systems (covered 30 July) and continues a wave of OT-focused guidance from CISA and the ACSC.
In a proactive technical publication, the Australian Signals Directorate’s ACSC issued comprehensive advice outlining methods for isolating vital operational technology (OT) and core enabling networks from corporate IT networks. The ASD highlights that network isolation is the single most effective defence to contain active cyberattacks, prevent lateral movement of adversaries, and ensure critical physical services remain running.
A highly coordinated, multi-pronged cyberattack targeted the operational technology (OT) of more than 30 municipal community water systems across Minnesota on July 26 and 27. The attack caused communications failures, compromised automated SCADA systems, and forced the Braham treatment plant completely offline, requiring manual operations and water preservation orders. Minnesota IT Services (MNIT) is leading the response, and local declarations of emergency have been issued.
July marked the escalation of water and OT targeting from advisories to confirmed impact: a coordinated attack disabled operational technology at 30+ Minnesota water facilities, Iran-linked OT activity drew broadened federal alerts, the Bit2Watt research showed cloud tenants could disrupt power grids, and ACSC released the OT-isolation security guidance for Australian critical infrastructure. CISA's water-sector advisory and the Australian OT isolation guide bookend a month of hardening directives for SOCI-regulated entities.
Source: CISA, ACSC, The Hacker News, The Record, July 2026
Commercial and residential property manager Case & Associates, operating across Arkansas, Kansas, Mississippi, Missouri, Oklahoma and Texas, disclosed a data breach in which an unauthorised actor accessed its network between September 2025 and March 2026. A filing with the Texas Attorney General's Office indicated names and Social Security numbers were exposed, with notifications sent to affected individuals and attorneys investigating a potential class action.
California-based real estate developer Sunrise Company, whose portfolio spans more than 20 resort communities, reported a data breach after detecting unauthorised acquisition of files on its network on 23 April 2026. A notification submitted to the California Attorney General's Office on 28 July 2026 confirms names were exposed, while dark-web monitoring platform Ransomware.live attributes the attack to the Akira ransomware group, which claims exfiltration of 13 GB of data.
Texas-based multinational real estate developer Hillwood disclosed a cybersecurity incident between 13 and 15 March 2026 that compromised sensitive data including names, addresses, Social Security numbers, driver's licence and government identification numbers, and financial and payment card account numbers. An investigation with cybersecurity experts concluded on 30 June 2026, and the scope of exposed data varied per individual.
July continued the pattern of construction and property incidents surfacing mainly through breach-notice and legal channels rather than major press coverage. (Sector supplemented by web collection; see incidents.)
Source: Web collection (breach-notice aggregators), July 2026
The US Department of Justice announced the seizure of over 1,000 domains used to illegally stream World Cup matches, in one of the largest anti-piracy operations coordinated with international law enforcement.
A Japanese teenager was arrested in connection with a cyberattack that disrupted a major anime streaming service, highlighting the ongoing issue of young actors engaging in DDoS and other cyber offenses.
An investigation by Wired revealed that Madison Square Garden maintained a private list tracking the sexual orientation of celebrities and high-profile attendees. The revelation raises significant privacy concerns and has prompted scrutiny of MSG's data collection practices.
The DOJ seized more than 1,000 domains illegally streaming World Cup games while Ukrainian media outlets were named priority targets for Russian hackers and a Japanese teenager was arrested over attacks disrupting anime streaming. Madison Square Garden's data exposure added a privacy dimension for the events industry. The picture is one of contested digital distribution channels and nationality-linked targeting across the entertainment economy.
Source: The Record, Wired, July 2026
Blackpoint Cyber detailed HollowFrame (Go-based loader framework) and Matryoshka (Rust-based malware). Attack chain: spear-phishing → encrypted archive with LNK → privilege escalation → Defender weakening → DLL side-loading (python.exe / python311.dll). Matryoshka has two variants: HTTP-based C2 and GitHub C2.
Research found that AI chatbots are more effective at creating "exploitable trust" than human scammers, demonstrating superior ability to manipulate victims into compliance. The findings have implications for social engineering defences and AI-generated phishing detection.
The Dysphoria IoT botnet lineage, tracked by China's CNCERT and Qi'anxin's XLab, has evolved to use blockchain-based name services and infected-device relays for command-and-control following the March law enforcement operation against JackSkid infrastructure. Researchers estimate the botnet population exceeds 200,000 devices, with 4,401 confirmed active in China (Jul 14–20) and a single-day peak of 239,000 abroad — though no independent counting methodology has been published. Defenders should patch exposed IoT devices and eliminate default credentials.
The macro picture for July was service-ification of attacks: HollowFrame loader deploying the Matryoshka backdoor in spear-phishing campaigns, the Dysphoria IoT botnet adopting blockchain C2 after the JackSkid module, DevMan RaaS centralising payload builds for affiliates, and research showing AI scammers outperforming humans at building trust. Together they signal that tooling, not talent, is now the binding constraint in cybercrime - an argument for defenders to automate detection and response in kind.
Source: The Hacker News, Ars Technica, July 2026
A tech-support vishing scam caused a massive data breach at Australian airline Qantas, with reports of 5.7 million customers' personal information leaked after a fake 'Qantas IT help' caller tricked a contact-centre agent into connecting the CRM to a data-extraction tool. The Office of the Australian Information Commissioner found Qantas did not breach the Australian Privacy Principles and declined to open a formal probe, though class actions remain in train. The incident demonstrates telephone-based social engineering of the human layer, not a technical intrusion.
Swiss train maker Stadler refused to pay a 10 million Swiss franc ransom after hackers stole technical data via a supplier platform. The incident ran through a supplier compromise rather than a direct network intrusion, highlighting the supply-chain vector in rail manufacturing and the pressure on transport OEMs to secure third-party access to engineering data.
The daily rotation produced no July transport incidents in the database; this sector was supplemented via web collection for the July review. See the incidents listed for the confirmed subset.
Source: Web collection, July 2026