Briefing — 15 August 2026

Ransomware Activity — 48 Hours 60 victims · 17 groups — TheGentlemen surge (19 victims); ShinyHunters hits 3 US healthcare orgs; 8 healthcare entities total. By Group TheGentlemen — 19 victims ⚠️ First Coast Heart Vascular Center 🇺🇸 (Healthcare) · Vector Two Technology 🇧🇷 · Acli 🇮🇹 · Community Connections 🇺🇸 · Megalaser 🇧🇷 (Manufacturing) · EKEPIS 🇬🇷 · Avanta Maroc 🇲🇦 · Plaza Auto Mall 🇲🇽 · Tempel 🇩🇪 · TOA 🇯🇵 · Retail Business Management Systems 🇬🇧 · Cityside Homes 🇬🇧 · KFC Kosova (Hospitality) · The Coffee Bean 🇲🇾 · Ollies Place Kidswear 🇦🇺 · Gravity Coffee 🇺🇸 · Gfeller Treuhand 🇨🇭 · IPS 🇮🇹 · Safeware 🇺🇸 Qilin — 9 victims Connections 🇧🇪 · Radiant 🇸🇬 · Lercher Werkzeugbau 🇦🇹 · 3f 🇩🇰 · PenLink 🇺🇸 (Government & Defense) · Urban Worldwide 🇳🇱 · Ferrari Mangimi 🇮🇹 · Aletex Group 🇪🇸 · D & J Beverage Service 🇺🇸 Storm — 6 victims Hinman Straub 🇺🇸 · 3-point Australia 🇦🇺 · ⚠️ Rood & Riddle Equine Hospital 🇺🇸 (Healthcare) · ⚠️ Canadian Mental Health Association 🇨🇦 (Healthcare) · Tapper Cuddy LLP 🇨🇦 · Integra Castings 🇨🇦 ShinyHunters — 5 victims ⚠️ Cook Medical LLC 🇺🇸 (Healthcare) · ⚠️ Baxter International 🇺🇸 (Healthcare) · ⚠️ Sharecare Inc 🇺🇸 (Healthcare) · Carhartt Inc 🇺🇸 (Retail) · Metabase 🇺🇸 (Technology) CoinbaseCartel — 4 victims Turner and Townsend 🇬🇧 (Professional Services) · Sweet Water Holdings 🇺🇸 · Serruya Private Equity 🇺🇸 · Hitachi High-Tech 🇯🇵 (Manufacturing) Akira — 3 victims Keystops 🇺🇸 · Cozad Asset Management 🇺🇸 (Financial Services) · CF Supply (Retail) Rhysida — 2 victims Pierce Township 🇺🇸 (Government & Defense) · ⚠️ SIA Medical Centre 🇦🇺 (Healthcare) InCransom — 2 · AiLock — 2 (Japan) · Global Secret Group — ⚠️ Columbia University Dental 🇺🇸 · SafePay — granjarinya.com 🇪🇸 · Interlock — Connell Enterprises 🇺🇸 · Clop — ZEBRA.COM 🇺🇸 · m3rx — tecnoabi.com 🇧🇷 · SilentRansomGroup — Reminger 🇩🇪 · Payload — Zara Investment Holding 🇯🇴 · DragonForce — GB Group S.A 🇵🇱 Security News Vulnerability Giving Attackers Full Control of Macs Is Under Active Exploitation (Ars Technica) — Critical macOS vulnerability actively exploited; enterprises should patch immediately. 1.6M RingCentral Accounts' Data Dumped After ShinyHunters Extortion Attack (The Register) — ShinyHunters released account data after failed extortion; users should reset credentials. Hackers Arrested Over €30M Bank Fraud Exploiting Service Provider Flaw (BleepingComputer) — International operation spanning Germany and Brazil resulted in multiple arrests. Scottish Govt Suffers Potentially Widening Data Breach at Prosecutor's Office (Dark Reading) — Crown Office breach may be broader than initially disclosed. Amid AI-Driven Bug-Hunt Tsunami, NIST Looks to AI (Dark Reading) — AI-powered vulnerability discovery is overwhelming the CVE pipeline; NIST exploring AI-assisted triage. Investigation of Banking Hack Leads to Arrests in Germany, Brazil (The Record) — Cross-border enforcement action targeting financial sector intrusion group. Ukraine Finds Nvidia AI Chip in New Russian Missile (Slashdot) — Recovered hardware highlights continued sanctions evasion for advanced components. Man Injected Prompts in Court Filings to Try to Win Case (Ars Technica) — Adversarial prompt injection used in legal documents; raises questions about AI in judicial processes. Going Dark, and the Era of Law Enforcement Hacking (Cryptography Engineering) — Analysis of the accelerating shift toward government-sanctioned offensive hacking as encryption debates intensify. CISA KEV — No New Additions No new entries added 14–15 August. Most recent additions remain from 11 August: CVE-2026-68820 (Windows CLFS/Lazarus), CVE-2026-20349 (Cisco ASA/FTD), CVE-2026-72898 (Metabase). Full KEV catalog →