45
45
45
Veradigm Confirms Patient Data Exposed in Third-Party Data Breach
Veradigm disclosed a third-party vendor breach exposing patient data including Social Security numbers via stolen vendor API credentials.
Veradigm filed an 8-K with the SEC on September 8, 2026, disclosing that attackers used credentials stolen from a third-party vendor to access a specific vendor-facing API and download patient personal data, including Social Security numbers for some individuals. No clinical or medical information was compromised, and Veradigm's internal infrastructure was not breached directly. The company activated incident response, notified law enforcement, and is offering credit monitoring to affected individuals.
55
45
CenterPoint Energy Confirms Data Breach Exposing Customers’ Personal Information
CenterPoint Energy confirmed an unauthorized third party accessed customer personal data via an external system, disclosed in an SEC Form 8-K filing.
CenterPoint Energy disclosed in a September 14, 2026 Form 8-K that an unauthorized third party obtained personal information of some customers through one of the company's external systems. The company learned of the incident after an online post claimed possession of a customer dataset, then activated incident-response protocols and engaged external forensic specialists. Electric and gas delivery operations were unaffected and the company does not expect a material financial impact, though response, notification, and compliance costs are being incurred. The number of affected customers, data types, and threat actor remain undisclosed as the investigation continues.
70
Week in review: Records allegedly stolen from Azure tenants, Medusa ransomware hits 500+ orgs
Week in review: Medusa ransomware hit 500+ orgs per CISA, millions of Azure tenant records allegedly stolen, SafePal and French tax authority breaches disclosed.
Help Net Security's weekly roundup covers the FBI, CISA, and HHS joint advisory update reporting Medusa ransomware has breached more than 500 organizations since June 2021, and threat actor TheHatman's claim of millions of employee records stolen from Azure tenants of Fortune 500 firms including McDonald's, Vodafone, Kyndryl, and Tata Consultancy Services, per Hudson Rock. It also covers the SafePal breach affecting 39,798 customers, France's DGFiP breach exposing data on 678,000 individuals, and UT San delaying its fall semester after a cyberattack. Security items include critical unauthenticated GitLab flaw CVE-2026-19478, an actively exploited patched macOS Screen Sharing flaw deploying a cryptominer, US charges against 17 Mabna Institute Iranian hackers over 31TB of stolen academic data, and Google Mandiant's AI agents finding 100+ high-severity vulnerabilities.
42
45
45
45
45