Week in review: Records allegedly stolen from Azure tenants, Medusa ransomware hits 500+ orgs
Week in review: Medusa ransomware hit 500+ orgs per CISA, millions of Azure tenant records allegedly stolen, SafePal and French tax authority breaches disclosed.
Help Net Security's weekly roundup covers the FBI, CISA, and HHS joint advisory update reporting Medusa ransomware has breached more than 500 organizations since June 2021, and threat actor TheHatman's claim of millions of employee records stolen from Azure tenants of Fortune 500 firms including McDonald's, Vodafone, Kyndryl, and Tata Consultancy Services, per Hudson Rock. It also covers the SafePal breach affecting 39,798 customers, France's DGFiP breach exposing data on 678,000 individuals, and UT San delaying its fall semester after a cyberattack. Security items include critical unauthenticated GitLab flaw CVE-2026-19478, an actively exploited patched macOS Screen Sharing flaw deploying a cryptominer, US charges against 17 Mabna Institute Iranian hackers over 31TB of stolen academic data, and Google Mandiant's AI agents finding 100+ high-severity vulnerabilities.
- FBI, CISA and HHS joint advisory: Medusa ransomware has breached more than 500 organizations since June 2021
- Actor TheHatman claims millions of records from Azure tenants of Fortune 500 firms, per Hudson Rock
- GitLab patched critical unauthenticated code injection flaw CVE-2026-19478 affecting CE and EE 18.2 through 19.2
- NCSC warns attackers exploit patched macOS Screen Sharing flaw for root access and cryptomining
- US charged 17 Mabna Institute Iranian hackers over 31TB theft from universities, companies, and agencies
- CVEs
- CVE-2026-19478
- ATT&CK
- T1496 Resource Hijacking
- Products
- VidarChatGPTSiemens S7
- Threat actors
- MedusaTheHatmanMabna Institute
- Organizations
- CISAFBIHHSNCSCHudson RockGoogle Mandiant
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-19478 | Unauthenticated GraphQL Code Injection in GitLab CE/EE Enables Data Tampering | 9.1 | 6% |
From the original article
9 min read at helpnetsecurity.com
Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: Windows 11’s strongest security defenses can be bypassed without a screwdriver Researchers from the University of Birmingham and Durham University have found a way to knock down some of the toughest protections in Windows 11 without physically opening or modifying the target machine.
By @helpnetsecurity · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.