Cyber Victor – a leading blog on cyber security

US health tech giant CareCloud started notifying 350,000 people that their information was stolen in a data breach. Hackers accessed one of its AWS environments between March 10 and March 16, and likely exfiltrated data from it.

The initial March 27 disclosure to regulators didn’t provide much details. On June 24, the investigation determined that personal, financial, and medical information was compromised in the incident.

Stolen data included people’s names, postal addresses, Social Security numbers, as well as government-issued identification numbers, such as passports and driver’s licenses. The stolen data included financial information, such as bank account information and payment card numbers, including in some cases the CVV of credit cards, alongside a wealth of medical and health-related information.

Read more about it here.

On May 20, 2026, DentaQuest detected unauthorized access to parts of its network and launched a forensic investigation, which determined that attackers had access between May 17 and May 20, 2026. On June 5, 2026, DentaQuest publicly disclosed the cybersecurity incident, while the ShinyHunters hacking group claimed responsibility, stating it had stolen 234 GB of data after unsuccessful ransom negotiations and had begun leaking the information online.

On July 17, 2026, DentaQuest began mailing notification letters to affected individuals and offered 24 months of complimentary credit monitoring and identity theft protection. DentaQuest has confirmed that at least 15 million individuals were affected, although the total could ultimately exceed 23.4 million as the ongoing data review continues.

The compromised information includes names, addresses, Social Security numbers, member identification numbers, Medicaid numbers, Medicare numbers, and dental or vision health information, including provider names, diagnoses, treatment details, and billing information. Earlier analysis of the leaked files also found email addresses, phone numbers, dates of birth, gender, health insurance enrollment information, government-issued identification numbers, and more than 1.7 million unique Social Security numbers, with some records reportedly dating back to at least 2009.

Read more about it here.

Microsoft Patch Tuesday security updates for July 2026 broke a record: Microsoft provided fixes for 628 CVEs across Windows OS (416 CVE’s), Microsoft Office, Azure cloud services, Defender, Exchange Server, Edge, SharePoint Server and SQL Server. At least three CVEs are exploited in the wild:
CVE-2026-56155 Active Directory Federation Services Elevation of Privilege Vulnerability
CVE-2026-56164 Microsoft SharePoint Server Elevation of Privilege Vulnerability
CVE-2026-58644 Microsoft SharePoint Remote Code Execution Vulnerability

The record-breaking volume of patches signals a significant increase in vulnerability discovery rates across Microsoft’s product ecosystem.

Microsoft cited its use of AI to help uncover previously undiscovered security bugs in its software.

Read more about it here.

Cloud security firm Sysdig has released details on what it claims to be the world’s first ransomware campaign, completely driven by agentic AI, dubbed JadePuffer. The attackers exploited CVE-2025-3248 in an internet-facing Langflow (low-code AI builder tool for agentic applications) instance, allowing the AI agent to autonomously perform reconnaissance, steal credentials, move laterally, and establish persistence without human intervention.

According to Sysdig, the LLM adapted to failures in real time, even correcting unsuccessful login attempts within 31 seconds. The campaign harvested cloud, database and object-storage credentials before compromising a production Alibaba Nacos server and attempting to exploit CVE-2021-29441. Instead of focusing on extortion through recoverable encryption, JadePuffer encrypted all 1,342 Nacos configuration items and deleted the originals, making recovery effectively impossible. Sysdig found that the encryption key was randomly generated, displayed only briefly, and never stored or transmitted, meaning victims could not recover their data even if they paid a ransom. The researchers concluded that the campaign demonstrates how AI agents can autonomously execute complex, adaptive, multi-stage cyberattacks with little or no direct human involvement.

Read more about it here.

LastPass has disclosed that customer data was exposed in a cyberattack targeting Klue, a third-party platform integrated with its Salesforce environment, rather than LastPass’s own systems. The attackers reportedly exploited stolen OAuth tokens to access CRM data, exposing customer names, contact information, support case details, and sales records, but not password vaults, master passwords, or encrypted user data. LastPass said it quickly responded by revoking Klue access, rotating compromised API tokens, investigating the incident with Klue and Salesforce, and notifying law enforcement. The breach also affected several other cybersecurity companies, highlighting the growing risks of supply chain attacks and the abuse of third-party SaaS integrations. Although users’ password vaults remain secure, LastPass is advising customers to stay alert for phishing and social engineering attempts that may use the stolen contact information.

Read more about it here.

Microsoft Patch Tuesday security updates for June 2026 broke a record: Microsoft provided fixes for 208 CVEs across Windows OS, Microsoft Office, Azure cloud services, Exchange Server, Hyper-V, Secure Boot, BitLocker, and a range of AI tools. If we add Chromium and third-party components bundled in Microsoft products, the total reaches 571 CVEs for the month. At least two CVEs are exploited in the wild.

The record-breaking volume of patches signals a significant increase in vulnerability discovery rates across Microsoft’s product ecosystem.

Read more about it here.

The ShinyHunters extortion group has published a 234 GB archive of data allegedly stolen from dental benefits administrator DentaQuest. The cybergang added the company to its Tor data leak site in May 2026, and the data was released after negotiations failed. The breach could affect approximately 2.6 million individuals whose information may have been exposed.

DentaQuest acknowledged the data breach and quickly moved to contain the attack. It said its systems remain operational with minimal disruption. Technical details about the security breach haven’t been disclosed yet.

According to data breach notification service HaveIBeenPwned, the leaked data includes 2.6 million email addresses, names, phone numbers, addresses, dates of birth, and healthcare-related records, some containing Medicaid IDs.

DentaQuest is the second largest dental benefits administrators in the US and a subsidiary of Sun Life US. The company manages dental and vision benefits for over 32 million Americans, with a strong focus on Medicaid, CHIP, Medicare Advantage, and commercial plans. It operates more than 70 dental practices.

Read more about it here.

In mid-April 2026, Fashion giant Zara lost customer data on almost 197,400 people, but it seems very little private information was actually stolen.

Zara is one of the biggest fashion retailers in the world, with more than 1,500 stores worldwide, and is the flagship brand of the Inditex Group, which also owns Bershka, Zara Home, Oysho, Pull&Bear, Massimo Dutti, Stradivarius, and Uterqüe.

Extortion gang ShinyHunters has claimed responsibility for the data breach, and leaked a 140GB archive, which seems to contain email addresses, geographic locations, purchases (product SKUs, order ID), and support tickets information. In a statement made by the company, it said the attackers did not access private information such as names, phone numbers, addresses, login credentials, or payment information.

Read more about it here.

In April 2026, Anthropic made considerable noise announcing Mythos, a new artificial intelligence model described as extremely effective at identifying vulnerabilities in code. In a recent scan of the curl source code, Mythos found five vulnerabilities.

“Curl is currently 176,000 lines of C code when we exclude blank lines. The source code consists of 660,000 words, which is 12% more words than the entire English edition of the novel War and Peace.” wrote Daniel Stenberg, the creator of curl. “Five issues felt like nothing as we had expected an extensive list,” he added. “Once my curl security team fellows and I had poked on the this short list for a number of hours and dug into the details, we had trimmed the list down and were left with one confirmed vulnerability. The other four were three false positives (they highlighted shortcomings that are documented in API documentation) and the fourth we deemed just a bug.” The single confirmed vulnerability is going to end up a severity low CVE planned to get published in sync with the pending next curl release 8.21.0 in late June.

Some members of the cybersecurity industry have pointed out that curl has been heavily audited and tested, including by other AI tools, making it difficult for major vulnerabilities to remain hidden. They argue that Mythos’ limited findings reflect the maturity and robustness of curl’s codebase, rather than any shortcoming of the model itself.

Read more about it here.

Google has overhauled its Vulnerability Reward Programs (VRP) for Android and Chrome, reshaping how it incentivizes external security researchers to find and disclose security flaws in its products. The most headline-grabbing change is a dramatic increase in the top Android bounty: a zero-click full-chain exploit targeting the Pixel’s Titan M2 security chip with persistence now pays up to $1.5 million, up from $1 million, while the same exploit without persistence earns $750,000. Shailesh Saini, Alex Gough, and Tony Mendez from Google said in a joint announcement, “We know that certain particularly impactful exploits remain incredibly difficult to achieve,” explaining the rationale behind maintaining and expanding top-tier rewards.

The overhaul is driven largely by the rise of AI tools, which have accelerated vulnerability discovery to the point where Google is now being flooded with low-quality, AI-generated submissions that strain its security teams. In response, Google stated that it wants researchers to shift toward concise, verifiable reports: “we are shifting our program’s focus to prioritize concrete proof that a bug exists.” Reflecting this quality-over-quantity philosophy, Chrome bounties are actually being reduced across most standard categories, since AI has made many routine exploit demonstrations far easier to produce. Despite lower individual payouts in some areas, Google expects its total rewards paid in 2026 to exceed the record $17.1 million distributed in 2025. The changes signal a broader industry reckoning with AI’s double-edged role in cybersecurity — accelerating both the discovery of genuine vulnerabilities and the generation of noise that makes managing security programs increasingly complex.

Read more about it here.