Data Breaches Expand, Zero-Days Exploit, and Identity Attacks Rise

The AssuranceAmerica data breach, initially reported to affect over 1.1 million individuals, has been updated to impact approximately 6.9 million people. This represents a substantial increase in the scope of the incident. The number of affected U.S. states has also expanded from seven to 14. The compromised data still includes names, driver's license numbers, and for some, Social Security numbers. The company continues to offer credit monitoring services to affected individuals. This expanded scope significantly elevates the potential for identity theft and fraud for a much larger population.

The July 2026 Patch Tuesday update is further detailed, noting the record 622 CVEs are partly due to AI-driven bug discovery. The BitLocker flaw (CVE-2026-50661) is explicitly classified as a third zero-day, though not actively exploited. The article also provides more granular hunting hints, detection methods (e.g., AD FS Auditing Logs, Event ID 4624, D3FEND User Behavior Analysis), and enhanced remediation steps, including AD FS hardening best practices like HSM and MFA implementation. These additions offer a more comprehensive understanding of the vulnerabilities and their mitigation.

A Unit 42 report provides extensive new technical details on the AsyncAPI supply chain attack. It reveals the Miasma RAT payload is multi-stage, heavily obfuscated, and fetches its second stage from IPFS. Persistence is established via `systemd` services on Linux/macOS and registry Run keys on Windows. The attack exploited unprotected pre-production branches (`next`, `schema`) in AsyncAPI's GitHub, allowing attackers to bypass code reviews and steal `NPM_TOKEN` and `GITHUB_TOKEN` from the CI runner. The report also contextualizes this incident within broader npm supply chain attacks by TeamPCP, including a Red Hat compromise. Numerous new IOCs, including IPFS CIDs, file paths, and the malicious commit hash, have been identified, significantly enhancing detection capabilities.