[EMEA] Crowood Press disclosed that an attacker viewed and exfiltrated a significant volume of filenames during a cyber security incident affecting the British specialist publisher. Investigators currently believe the exposed material does not include file contents, but the distinction will depend on log preservation, access-history analysis and validation of the attacker’s activity across the compromised environment (Source: London Stock Exchange, 19-07-2026).

[AMER] Abbott Laboratories said it was investigating two cyber security incidents involving unauthorised access to parts of its internal systems in the United States. The parallel investigations will require correlation of identity, endpoint and network evidence to establish whether the incidents share infrastructure or credentials, determine the information accessed and distinguish opportunistic intrusion from a coordinated extortion campaign (Source: Reuters, 17-07-2026).

[EMEA] The Nigerian Bar Association indefinitely delayed its presidential election after external actors allegedly launched a coordinated cyberattack against the electronic voting platform shortly before polling began. Investigators must preserve application, hosting and authentication records to determine whether the activity was intended to disrupt availability, manipulate ballots or undermine confidence, while independently validating the integrity of voter records and election data (Source: Vanguard, 18-07-2026).

[EMEA] Dutch police dismantled an international cryptocurrency investment fraud operation and detained a suspected organiser following his extradition from Poland to the Netherlands. The investigation centres on tracing digital communications, payment flows and infrastructure associated with fraudulent trading services, with seized account records and blockchain transactions potentially enabling investigators to identify additional operators, money-mule networks and victims across several jurisdictions (Source: The Record, 15-07-2026).

[AMER] Coca-Cola-owned dairy producer Fairlife temporarily paused production in the United States after ransomware operators gained unauthorised access to production-related systems. The company isolated affected infrastructure and said product quality was not compromised, while specialists and law enforcement examine the intrusion path, possible data theft and whether manufacturing technology was directly accessed or interrupted as a precautionary containment measure (Source: Associated Press, 18-07-2026).

[AMER] Colombia’s state-controlled energy company Ecopetrol reported that a cyberattack stole information associated with approximately 3,300 user accounts, although critical operations and production remained available. The continuing investigation must determine what account attributes were taken, whether privileged identities or operational systems were reached and whether the stolen material could support credential attacks, extortion or later attempts to penetrate suppliers and energy-sector partners (Source: Reuters, 18-07-2026).

[EMEA] Kenya temporarily disabled the presidency’s website after attackers defaced the portal and displayed a demand for five bitcoins alongside threats to release unspecified information. Investigators will need to identify the exploited administrative or application access, preserve altered pages and server records, and establish whether the incident was limited to public-facing content or involved access to internal data and connected government infrastructure (Source: People Daily, 19-07-2026).

[GLOBAL] Attackers began exploiting two newly disclosed WordPress vulnerabilities, CVE-2026-60137 and CVE-2026-63030, shortly after patches became available for affected releases. The WP2Shell flaws include a high-severity SQL injection condition and can support unauthorised access or code execution, requiring administrators to patch rapidly and search web, database and authentication logs for exploitation attempts and unexpected administrative changes (Source: SecurityWeek, 20-07-2026).

[APAC] Malaysia’s Cyber Security Incident Response Centre issued a hardening advisory covering exploitation associated with CVE-2026-32201 and malicious post-exploitation activity. The warning indicates that patching alone may not be sufficient where compromise preceded remediation, making retrospective examination of authentication events, new processes, persistence mechanisms, outbound connections and configuration changes necessary to establish whether attackers retained access after the vulnerable component was secured (Source: MyCERT, 20-07-2026).

[GLOBAL] Proof-of-concept code was released for the LegacyHive Windows vulnerability, which remained effective against systems carrying Microsoft’s July 2026 security updates. The technique can mount another user’s registry hive and facilitate privilege escalation under particular credential conditions, giving defenders a basis for reviewing registry access, token use and anomalous hive-loading activity while Microsoft and enterprise teams assess mitigation options (Source: SecurityWeek, 16-07-2026).

[APAC] Singapore Police arrested 11 men and two women suspected of supplying fraudulently registered postpaid SIM cards in return for payment, with charges scheduled between 20 and 24 July. Investigators can use subscriber records, device evidence, payment histories and communications to connect the cards with scam operations, identify intermediaries and reconstruct how criminal groups acquired and activated telecommunications accounts under false identities (Source: Singapore Police Force, 19-07-2026).

[EMEA] Dutch authorities continued proceedings against a suspected organiser of an international online investment scam after the dual Israeli-Polish national was extradited from Poland and remanded in custody. The cross-border case combines conventional financial investigation with analysis of cryptocurrency transfers, platform infrastructure and victim communications, which may reveal common operators and evidential links between apparently separate fraudulent investment sites and payment accounts (Source: The Record, 15-07-2026).

[EMEA] ENISA published information about the EU Cyber Resilience Act’s Single Reporting Platform for manufacturers reporting actively exploited vulnerabilities and severe product security incidents from 11 September 2026. The centralised mechanism will require organisations to align technical detection, evidence retention and disclosure workflows so submitted reports remain accurate, timely and capable of supporting regulatory coordination without compromising continuing technical investigations (Source: ENISA, 17-07-2026).

[GLOBAL] Governments, insurers and security specialists are intensifying debate over whether organisations should be prohibited from paying ransomware demands as attacks and confirmed victim numbers continue to rise. Payment restrictions may reduce criminal revenue but can also alter reporting incentives and recovery decisions, making reliable incident disclosure, asset inventories, tested backups and preserved evidence increasingly important for organisations expected to justify actions taken during extortion events (Source: Financial Times, 20-07-2026).