Partnered Health confirmed that attackers stole personal and medical information from clinics across Australia, including Medicare details, consultation notes, referral letters and pathology results [APAC]. Investigators are working with national cyber agencies, privacy regulators and law enforcement to determine which clinics and patients were affected, while preserving evidence concerning access paths, copied records and possible criminal publication of the data (Source: Partnered Health, 15-07-2026).

TriWest Healthcare Alliance notified 11,844 US military health beneficiaries after an intruder accessed and downloaded data connected to the TRICARE West programme [AMER]. The investigation identified exposed names, Department of Defense benefits numbers, authorisation request details and, for some individuals, Social Security numbers, addresses and dates of birth, creating a defined evidence set for identity-fraud monitoring and attribution work (Source: TechRadar, 16-07-2026).

New South Wales Police charged three men following an investigation into an alleged darknet drug-supply syndicate operating in the Newcastle region of Australia [APAC]. Cybercrime Squad detectives linked online activity to physical searches and arrests, illustrating how investigators correlate marketplace accounts, communications, transaction records and seized devices to identify participants and reconstruct the operational structure supporting anonymous digital trading (Source: NSW Police, 16-07-2026).

US authorities charged two alleged members of a Chinese money-laundering network with transferring $43 million derived from cyber-enabled investment scams targeting victims through fraudulent online relationships [AMER]. Investigators allege the defendants moved proceeds through bank accounts and associated financial channels, providing transaction histories, beneficiary records and communications that can connect individual victim payments to the wider infrastructure behind organised pig-butchering operations (Source: US Department of Justice, 16-07-2026).

Coca-Cola suspended production at its fairlife dairy facilities across the United States after ransomware operators gained unauthorised access to production-related systems [AMER]. External specialists are examining affected infrastructure while operations remain halted, with the company reporting that Canadian facilities and product safety were unaffected and that law enforcement, business continuity and restoration processes were activated following detection of the intrusion (Source: Reuters, 16-07-2026).

AssuranceAmerica disclosed that a cyberattack exposed records belonging to nearly seven million US insurance customers, including driving, policy, claims and identification information [AMER]. The incident reportedly began with activity targeting an employee before attackers accessed parts of the company’s environment and copied files, leaving investigators to correlate account activity, access logs and exfiltrated datasets while affected individuals face prolonged identity and social-engineering risks (Source: Fox News, 16-07-2026).

Microsoft’s July security release addressed more than 620 vulnerabilities across Windows and associated products, including flaws reported as exploited or publicly disclosed [Global]. The unusually large update requires defenders to distinguish active exploitation from lower-priority exposure, preserve indicators observed before patching and verify remediation across SharePoint, remote-access, identity and virtualisation systems where incomplete deployment could leave investigative blind spots (Source: Malwarebytes, 15-07-2026).

CISA warned that attackers were exploiting multiple Microsoft SharePoint vulnerabilities, with researchers observing chained techniques affecting exposed enterprise servers [AMER]. Organisations must examine web, authentication and process-execution logs for activity preceding remediation because applying updates alone may not remove persistence, stolen credentials or malicious artefacts, particularly where exploitation provided access to collaboration platforms containing sensitive documents and interconnected identity services (Source: Cybersecurity Dive, 15-07-2026).

Two members of the Scattered Spider cybercrime group were each sentenced to five and a half years for the 2024 attack on Transport for London [EMEA]. The National Crime Agency investigation established that social engineering and compromised credentials gave the offenders administrative access, while seized communications, cryptocurrency evidence and streamed activity helped attribute an intrusion that disrupted services, exposed customer information and caused losses exceeding £39 million (Source: National Crime Agency, 16-07-2026).

Five people were charged following a UK National Crime Agency investigation into Russian Coms, a crime-as-a-service platform associated with millions of fraudulent telephone calls [EMEA]. Investigators linked the service’s caller-ID spoofing, encrypted calling and voice-changing capabilities to campaigns impersonating banks and other trusted organisations, demonstrating how platform records, cryptocurrency payments, customer accounts and communications can expose both infrastructure operators and criminal users (Source: National Crime Agency, 15-07-2026).

CISA and partner organisations published guidance for establishing coordinated vulnerability disclosure programmes that enable security researchers to report weaknesses through defined and protected channels [AMER]. The framework emphasises documented scope, communication processes, remediation tracking and legal assurances, helping organisations retain reproducible technical evidence and build an auditable chain from initial researcher notification through validation, prioritisation, corrective action and public disclosure (Source: CISA, 15-07-2026).

Italy’s data-protection authority fined telecommunications operator WINDTRE €1.7 million following findings concerning personal-data breaches and the organisation’s handling of affected information [EMEA]. The enforcement action reinforces the need for telecommunications providers to retain reliable access records, document breach assessment decisions and demonstrate timely corrective measures, since regulators increasingly test whether technical evidence supports notification, accountability and security-control claims made after an incident (Source: Reuters, 16-07-2026).