Healthcare & Government Data Breaches, Exploited Vulnerabilities Highlighted

Critical Vulnerabilities Under Active Exploitation:

• BeyondTrust Zero-Day Exploited by China-Linked Group: CISA has added CVE-2026-102764, a critical authentication bypass in BeyondTrust Remote Support, to its KEV catalog. This mandates immediate patching for FCEB agencies due to confirmed active exploitation for initial access and lateral movement.

New Threats and Advisories:

• ConnectWise Cloud Backup Supply Chain Attack: An active supply chain attack is leveraging a compromised Microsoft 365 credential for ConnectWise Cloud Backup, allowing threat actors to access customer M365 environments and potentially create backdoors.
• Rhysida Ransomware Hits Anne Arundel County: The Rhysida ransomware gang claims responsibility for an August 2026 attack, alleging the theft of 2.6TB of sensitive data, including medical and payroll records, and is demanding a $2 million ransom.
• Florida DMV Data Breach: The Florida Department of Highway Safety and Motor Vehicles is notifying drivers of a data breach resulting from compromised credentials, with the ShinyHunters group claiming responsibility for over 500,000 files.
• Medical Data Rx Breach Under Investigation: A class action law firm is investigating a ransomware attack by 'The Gentlemen/VYPR' on Medical Data Rx, a healthcare IT service company, which disrupted data access and may have exposed personal and health information.

Industry & Sector Impacts:

• Q3 2026 Ransomware Attacks Surge in Healthcare: A new report indicates a 64% surge in ransomware attacks against the U.S. healthcare sector in Q3 2026, with over 600,000 patient records compromised, highlighting significant patient safety and financial risks.
• California Student Data Exposed in Testing Provider Breach: A breach at ETS, California's testing provider, has exposed the personal information of millions of current and former students, including names, addresses, and disability records, dating back to 2023.
• Microsoft & Partners Disrupt Phishing-as-a-Service Operation: Microsoft and international partners have disrupted a major Chinese-language Phishing-as-a-Service marketplace, taking down infrastructure for three criminal businesses that supplied phishing kits to threat actors worldwide.