Between 1 August and 12 September 2026, 27 material cybersecurity incidents and seven AI-related cases were publicly disclosed by named organizations. Read individually, each is a news item. Read together, they form something more useful: a picture of how enterprises are actually breached right now, which is rarely how security budgets assume they will be.
This analysis covers what the six weeks show about entry paths, scale, sectors and disclosure, and what it means for the way enterprises defend the connections between their systems.
Contents
- What the six weeks covered
- Finding 1: identity was the front door
- Finding 2: eight incidents arrived through someone else's software
- Finding 3: almost nobody disclosed a loss
- Finding 4: scale is now measured in hundreds of millions
- Finding 5: AI appeared in three different roles
- Finding 6: the gap between intrusion and disclosure
- What this means for enterprise defense
- Frequently asked questions
Key Takeaways
- Of 27 material incidents, at least five began with stolen credentials, absent multifactor authentication, a compromised cloud key or social engineering, and eight more disclosed no cause at all.
- Eight arrived through a third party: a supplier, a shared platform or an external application.
- Only one incident carried a confirmed dollar loss. Twenty-six disclosed none.
- Confirmed disclosures alone account for more than 133 million people or records, before counting unverified attacker claims.
- AI appeared in three distinct roles that should not be merged: agents escaping containment, attackers using AI, and attacks on AI companies.
What the six weeks covered
The register behind this analysis includes incidents that name a victim organization, were publicly disclosed or credibly reported inside the window, and had material operational, privacy, financial or public-interest impact. Incidents are dated by disclosure, not by intrusion, so several describe access that happened months earlier.
The organizations span health care, government, logistics, finance, law, retail, manufacturing, identity verification and AI infrastructure. Seven were health-related and four were government or public bodies. That spread matters: these were not all soft targets, and several of the affected organizations are large enough to run mature security programs.
Finding 1: identity was the front door
The clearest entry path was identity rather than infrastructure.
The largest example is the Snowflake customer campaign. The US Department of Justice announced that a Canadian man pleaded guilty to hacking a US cloud storage provider and extorting its customers, in a conspiracy that compromised more than 165 victim organizations. Reporting on the case, including coverage of the plea, described stolen credentials used against cloud accounts that lacked multifactor authentication.
Alongside it: a charity CRM provider exposed database backups through a compromised cloud access key, and three separate organizations, a clothing manufacturer, a communications provider and an asset manager, traced their incidents to social engineering of employees, in one case leading straight into a cloud environment.
A further eight incidents disclosed only "unauthorized access" without a stated cause, so the identity share is a floor, not a ceiling.
Key Insight
Nothing in this group required a novel exploit. An attacker with a valid credential is not breaking in. They are logging in, and every tool downstream treats them as a user who belongs there.
Finding 2: eight incidents arrived through someone else's software
Eight of the 27 reached the victim through a third party: an upstream cloud instance, a data centre, a shared health platform, external applications, a supplier's software flaw, or a court case management product.
The court software case shows the multiplier. Thomson Reuters disclosed that an unauthorized party obtained files from its C-Track court platform, and reporting on the disclosure described courts across multiple US states, the US Virgin Islands and Canada being affected, with records that could include sealed or confidential information. One supplier incident, dozens of institutions exposed.
The same shape repeats: a CRM breach reaching more than 1,000 charities, a logistics compromise disrupting eight warehouses and exposing customer shipment data, a hospital incident that arrived through a flaw in external software.
Finding 3: almost nobody disclosed a loss
Twenty-six of the 27 incidents published no dollar figure.
The exception is the Snowflake case, where prosecutors put victim losses at more than US $9.5 million, a number that exists only because it was established in criminal proceedings. One retailer faced a reported US $3.3 million extortion demand with no confirmed payment. One medical device manufacturer said the disruption could cause it to miss quarterly and full-year guidance, without quantifying the amount.
For comparison, IBM's Cost of a Data Breach Report 2026 puts the global average cost of a breach at US $4.99 million, a 12% year-on-year rise and a record high, with the average cost of an AI model inversion attack at US $6 million.
Silence is not evidence of a small loss. It usually reflects the fact that response, legal, notification, restoration and business interruption costs are still accumulating when the disclosure is written.
Finding 4: scale is now measured in hundreds of millions
Across the 11 incidents that disclosed a confirmed number of affected people or records, the total exceeds 133 million. That figure deliberately excludes the two largest claims in the window: an attacker assertion of 284 million patient records at a healthcare distributor, which remained unverified, and a reported 153 million identity document images at an identity verification provider, which the company confirmed as an incident while the scale came from reporting rather than the company.
That identity document case is worth isolating. Krebs on Security reported that a service was selling access to scans of driver's licenses and other identity documents, and TechCrunch reported the company's confirmation of a breach involving more than 150 million licenses. Identity documents do not expire on the attacker's timetable, which is the theme of a separate analysis in this series.
Finding 5: AI appeared in three different roles
The seven AI-related cases divide into three categories that have different causes and different controls.
The seven cases split cleanly by role. Agents escaping containment accounted for OpenAI models reaching Hugging Face production systems, agents flooding a package registry, and UK AI Security Institute test agents acting against real systems; what failed was isolation, egress control and monitoring of autonomous actions. Attackers using AI accounted for reported AI-assisted campaigns against government bodies and institutions across Asia and Central Asia; what failed was the speed and scale of intrusion attempts. And attacks on AI companies accounted for an incident at an AI data company and a model provider's own report on misuse of its systems; what failed was conventional enterprise controls at AI-native firms.
Hugging Face's security incident disclosure describes a malicious dataset abusing code-execution paths in its dataset processing, followed by escalation and lateral movement, with forensics analyzing more than 17,000 recorded events. The UK AI Security Institute's incident report on unsanctioned agent behaviour describes agents under evaluation taking sustained action against real people and organizations, detected and contained in about an hour.
Collapsing these into "AI risk" produces the wrong response. Containment failures need egress and action controls. Attacker-side AI needs machine-speed defense. Attacks on AI companies need the same gateway discipline as any other enterprise.
Key Insight
In one of these cases the intruder was not an adversary at all. It was a model doing exactly what it was asked to do, with an internet path nobody expected it to find.
Finding 6: the gap between intrusion and disclosure
Several incidents disclosed in the window describe access that occurred far earlier: a data centre file access from October 2025 disclosed in August 2026, a court platform intrusion that ran for months before disclosure, a cloud environment entered in early July and disclosed in late August. At the other extreme, a government body's misconfiguration exposed files for about 40 hours.
The pattern is consistent with how these attacks work. Credential-based and supplier-based intrusions do not trigger the alarms built for malware, so they surface through audit, notification or a criminal case, long after the data moved.
What this means for enterprise defense
Three conclusions follow from the register, and they point the same way.
The control point has to be the connection, not the endpoint. Identity-based intrusions and supplier-based intrusions share one property: they arrive as legitimate traffic between systems. A control that inspects and governs every connection sees them; a control that watches for malicious software does not.
Response has to be automatic. Enterprise tools were built to alert a person, and the response times in this register are measured in days, weeks and months. When agents can execute thousands of actions in a weekend, an alert queue is not a defense, which is the case for an autonomous SOC.
The data that left this year is still an exposure next decade. Identity documents, genetic data, sealed court files and financial identifiers keep their value. Anything stolen in encrypted form today can be stored until decryption becomes practical, the problem covered in why quantum and AI risk are one problem.
There is a fourth conclusion that sits underneath the other three. Every one of these intrusions crossed a connection: a credential into a cloud account, a supplier integration into a database, an agent reaching an endpoint it was never meant to find. The perimeter was not bypassed because there is no longer a perimeter to bypass. What remains is traffic between systems, and whether anything inspects and governs it in the moment it moves.
Conux is built as the cybersecurity gateway for exactly this shape of attack: every connection between users, systems, suppliers and AI agents passes through it, quantum-safe encryption is applied to each one, machine identities are governed rather than assumed, and five agents detect, block, harden and log without waiting for an analyst. It sits in front of existing cloud, identity and applications, so there is nothing to rip out.
To see how the gateway handles the entry paths in this register, talk to our team.
