DHS confirms breach of HSIN information-sharing platform, the Department of Homeland Security said it isolated affected systems and launched a forensic investigation after a cyberattack against the Homeland Security Information Network, a sensitive but unclassified collaboration environment used by government, law enforcement and private-sector partners [US]. The case matters to digital investigators because it combines legacy platform exposure, SharePoint collaboration risk, damage assessment and uncertainty over what data may have been accessed (Source: BleepingComputer, 01-07-2026).

Kubota says hackers had month-long access to network systems, Kubota North America disclosed that an attacker accessed files containing employee and dependent personal information between 16 March and 20 April 2026 [US]. The long dwell time, exposed payroll and benefits data, and absence of a known extortion claim make the case useful for investigators assessing identity-risk notification, endpoint telemetry retention and post-compromise control improvements (Source: BleepingComputer, 01-07-2026).

Alleged Scattered Spider member extradited to the United States, the U.S. Justice Department said Peter Stokes was arrested in Finland and extradited to face conspiracy, computer intrusion and fraud charges in the Northern District of Illinois [US]. The complaint links the group to more than 100 intrusions and substantial ransom payments, giving investigators another public view of how identity-led access, extortion and cross-border coordination are being prosecuted (Source: U.S. Department of Justice, 01-07-2026).

Microsoft investigation finds overlapping ransomware activity, Microsoft incident responders reportedly found two unrelated threat clusters operating in the same environment while investigating ransomware activity involving persistence, remote access tooling and lateral movement [Global]. The finding matters because it reinforces that incident scoping cannot assume a single actor, single entry route or clean containment boundary when multiple intrusion streams coexist inside one victim network (Source: The Hacker News, 02-07-2026).

FortiBleed credential theft linked to INC and Lynx ransomware, SOCRadar reported that FortiBleed infrastructure was tied to ransomware negotiation panels and that at least 12 ransomware deployments followed the credential-harvesting campaign [Global]. The scale of scanning across FortiGate portals and the reported conversion of appliance access into encryption events show how edge-device compromise can become a direct route into enterprise-scale extortion (Source: The Hacker News, 02-07-2026).

Microsoft removes 119 malicious Edge extensions, Microsoft took down browser extensions associated with the StegoAd campaign after finding they hid malicious code in image and font files and had collectively reached about 2.6 million downloads [Global]. The case is relevant to consumer app-data risk because extensions can steal browser credentials, redirect traffic and download further code after installation, leaving both personal and enterprise browsing profiles exposed (Source: TechRadar, 30-06-2026).

CISA adds SharePoint flaw to Known Exploited Vulnerabilities catalog, CISA added a Microsoft SharePoint Server remote code execution vulnerability to its KEV catalog after evidence of active exploitation [US]. The short federal remediation window and SharePoint’s common role in collaboration environments make this a priority for patch verification, exposed-service review and retrospective hunting for authenticated exploitation paths (Source: CISA, 01-07-2026).

Cisco confirms in-the-wild exploitation of Unified CM vulnerability, Cisco confirmed exploitation of CVE-2026-20230, a Unified Communications Manager and Unified CM SME vulnerability associated with server-side request forgery and possible privilege escalation to root [Global]. The advisory is significant for telecoms and enterprise voice environments because exploitation of collaboration infrastructure can support persistence, lateral movement and disruption of operational communications (Source: SecurityWeek, 02-07-2026).

Scattered Spider suspect remains in custody after extradition, U.S. prosecutors said the alleged group member made an initial appearance in federal court in Chicago and was ordered to remain in law enforcement custody [US]. The case underlines the growing role of extradition, Interpol notices and multi-agency evidence handling in cyber extortion cases involving actors who operate across national borders (Source: U.S. Department of Justice, 01-07-2026).

U.S. seizes domains used for illegal World Cup streaming, the Justice Department announced the seizure of nearly 400 domains allegedly used to stream 2026 World Cup matches without authorisation [US]. Although framed around intellectual property enforcement, the operation also highlights cybercrime risk because illegal streaming domains can expose users to malware, insecure connections and criminal traffic infrastructure (Source: U.S. Department of Justice, 26-06-2026).

UK updates managed service provider factsheet under Cyber Security and Resilience Bill, DSIT updated guidance explaining how medium and large relevant managed service providers would be brought into scope of the NIS Regulations [UK]. The policy is important because MSPs often hold privileged access to client environments, making their regulation directly relevant to supply-chain intrusion, incident reporting and shared-responsibility evidence after compromise (Source: GOV.UK, 30-06-2026).

NIST publishes updated ransomware risk management profile, NIST NCCoE published the final NIST IR 8374 Revision 1 profile translating CSF 2.0 into practical ransomware risk management actions [US]. The profile is relevant for compliance and audit teams because it supports prioritised control evidence, ransomware readiness assessment and alignment between resilience planning and the current Cybersecurity Framework structure (Source: NIST, 11-06-2026).

ENISA tests EU cyber crisis response arrangements, ENISA reported that Cyber Europe 2026 tested EU-level coordination across technical, operational and political layers using rail and maritime disruption scenarios [EU]. The exercise matters because it connects incident response practice with policy mechanisms, including the EU Cybersecurity Blueprint and Cybersecurity Reserve, rather than treating major cyber crises as isolated technical events (Source: ENISA, 11-06-2026).