Major Data Breaches
Bits of Gold Vendor Breach: 200,000 Israeli Crypto Customers Exposed
Tel Aviv-based Bits of Gold, Israel’s largest regulated crypto broker, disclosed on August 16 that a hacker breached a third-party vendor, stealing personal data on approximately 200,000 customers. The stolen information includes names, national ID numbers, emails, phone numbers, IP addresses, bank account details, and public wallet addresses. The incident is part of a global supply-chain hack believed to have impacted hundreds of firms. Bits of Gold has engaged a specialist cyber incident response firm, notified Israeli regulators, and kept services running. The investigation remains open, and the attacker has not been publicly identified. This breach potentially compromises the platform’s entire user base, a significant blow to a company known for its regulatory compliance and security1.
Source: Cybercrime Magazine
French Tax Agency Cyberattack: Data Stolen from 700,000 Taxpayers
On August 13, the French Finance Ministry confirmed a cyberattack on the General Direction of Public Finances, resulting in the theft of data from close to 700,000 taxpayers. Both individual and professional taxpayer data were stolen, with the ministry stating that a “malicious actor” broke into the agency in late June. The breach was tracked by FrenchBreaches, which received information from the alleged hackers. The ministry is investigating, and the full scope of the breach is still being determined1.
Source: Reuters
DentaQuest Healthcare Breach: 15 Million Patients Impacted
DentaQuest, the second-largest dental insurance company in the U.S., revealed a cyberattack in May that impacted 15 million patients, making it the largest healthcare data breach of 2026. Stolen information includes names, addresses, Social Security numbers, member identification numbers, Medicaid and Medicare IDs, provider names, diagnoses, treatments, and billing information. The breach details were confirmed by the U.S. Department of Health and Human Services1.
Source: HealthExec
Significant Cyberattacks
Ransomware Group Hijacks Hospital System’s Facebook Page
AnMed, a nonprofit medical system with four hospitals in Georgia and South Carolina, continues to face closures and fallout from a cyberattack that knocked out its IT systems. On August 11, its Facebook page was hijacked by “The Gentlemen” ransomware group, which posted ransom demands and claimed to have exfiltrated 6 terabytes of sensitive health information. The page was removed shortly after the incident. The attack has severely disrupted operations, and the investigation is ongoing1.
Source: The Record
Ransomware Attack on Canadian Hospital Affects Facility Systems
Winnipeg’s Health Sciences Centre, Manitoba’s largest hospital, suffered a ransomware attack affecting door access, heating, ventilation, and air-conditioning systems. Shared Health, the provincial health authority, launched an investigation and increased security presence at hospital entrances. The provincial government has been notified, and expert advice is being sought to resolve the issue1.
Source: CBC/Radio-Canada
Suspected China-Nexus Actor Exploits VMware vCenter Flaw, Deploys Babuk-Derived Ransomware
A suspected China-nexus advanced persistent threat (APT) exploited CVE-2026-59310 (CVSS 9.8), a severe directory-traversal vulnerability in VMware vCenter server, to execute arbitrary code and deploy Babuk-derived ransomware. The attacks were confirmed by German incident response company QUIRSO, which assessed with moderate confidence that the campaign is operated by a Chinese-speaking threat actor. Broadcom released a fix for the flaw on July 29, 20262.
Source: The Hacker News
Critical Vulnerabilities
Forminator WordPress Plugin Flaw Enables Unauthenticated RCE
A critical vulnerability (CVE-2026-15748, CVSS 9.8) was discovered in the Forminator Forms WordPress plugin, affecting over 600,000 installations. The flaw allows unauthenticated attackers to upload arbitrary files, including executable PHP files, leading to remote code execution and complete site compromise. The vulnerability impacts all versions before and including 1.56.1 and was patched in version 1.56.2 released July 31, 20262.
Source: The Hacker News
SAP Commerce Cloud CVE-2026-58231 Targeted in Exploitation Attempts
A maximum-severity vulnerability (CVE-2026-58231, CVSS 10.0) in SAP Commerce Cloud is under active exploitation. The flaw allows unauthenticated attackers to abuse a default authentication client and submit specially crafted input to functions lacking sufficient validation, enabling arbitrary code execution and compromise of internal components2.
Source: The Hacker News
Unisoc VoLTE Video Call Exploit Chain Achieves Full Android Kernel Access
Security researchers published a two-stage exploit chain that achieves full Android kernel access on devices running Unisoc modem firmware via a VoLTE video call. The privilege-escalation vulnerability is classified as CWE-1189. The attack requires control of a private 4G cellular network and the victim to answer the incoming video call. No fix has been issued by the chipset maker2.
Source: The Hacker News
Government Responses
China Launches Review of Palo Alto Networks Products
China’s Cyberspace Administration (CAC) announced a review of Palo Alto Networks’ products to ensure the safe and stable operation of critical information infrastructure and prevent network security risks. The review is conducted under the National Security Law and Cyber Security Law of the People’s Republic of China3.
Source: The Hacker News
French Finance Ministry Investigates Tax Agency Breach
Following the theft of taxpayer data, the French Finance Ministry is actively investigating the breach and working to secure affected systems. The ministry has not yet commented on the full scope of the incident, but is coordinating with law enforcement and cybersecurity experts1.
Source: Reuters
Miscellaneous
DEF CON Attendee Suspected in Fake WiFi Attack Targeting Delta Flight Passengers
A DEF CON attendee is suspected of launching a fake WiFi attack targeting passengers on Delta Flight 591. The attack involved setting up a rogue access point to intercept communications and potentially harvest credentials. The incident highlights ongoing risks associated with public WiFi and the need for vigilance during travel4.
Source: Daily CyberSecurity
Cavern C2 Framework Uses DNS and Google Apps Script to Blend Into Legitimate Traffic
Iranian nation-state hackers have evolved the Cavern (aka Cav3rn) command-and-control framework, using DNS A-record responses and Google Apps Script relays to blend malicious traffic with legitimate communications. The framework targets entities in Israel and demonstrates advanced evasion techniques2.
Source: The Hacker News
Conclusion
This week’s cybersecurity landscape was marked by large-scale data breaches, sophisticated ransomware attacks, and critical vulnerabilities actively exploited in the wild. Government agencies responded to major incidents, and new research highlighted evolving attack techniques and supply-chain risks. Organizations are urged to review their security posture, patch critical vulnerabilities, and remain vigilant against emerging threats.
Sources: