Three breach stories landed this weekend, each with a different vector and a different lesson. A Fortune 100 subsidiary hit by ransomware. The largest healthcare breach of 2026. And a network-layer phishing campaign that turns every hotel Wi-Fi login page into a credential harvester. None of these required a zero-day. All of them required gaps in controls that defenders can close today.

In the News

Coca-Cola Confirms Breach After Anubis Ransomware Hits Fairlife

Coca-Cola has confirmed a data breach affecting its Fairlife dairy subsidiary following an attack by the Anubis ransomware group. Anubis — a relatively newer ransomware operation that emerged in late 2025 — is threatening to publish exfiltrated data if its demands are not met. The scope of compromised records has not been publicly disclosed, but Fairlife’s position as a billion-dollar brand within the Coca-Cola portfolio places this firmly in the Fortune 100 incident category.

The attack highlights a persistent structural problem in large enterprises: subsidiary and acquisition security posture often lags behind the parent organization. Ransomware groups have consistently targeted subsidiaries as the path of least resistance into high-value corporate environments. Fairlife operates its own IT infrastructure, and whether Coca-Cola’s security controls extended to that environment is the central question this incident raises.

For defenders, this is a segmentation and readiness story. Immutable backups, network segmentation between business units, and endpoint detection coverage that extends to every subsidiary domain — not just the parent — are the controls that determine whether a ransomware event is a business disruption or an existential crisis. A backup strategy you have never tested across your subsidiary infrastructure is an assumption, not a defense.

Source: SecurityWeek

DentaQuest Breach Exposes 23 Million Patient Records

DentaQuest has disclosed a breach potentially impacting over 23 million individuals, making it the largest healthcare data incident of 2026 by a significant margin. The compromise occurred in May 2026 and was disclosed in late July — a two-month gap that will draw regulatory scrutiny under HIPAA’s 60-day notification requirement for breaches affecting more than 500 individuals.

The exposed data reportedly includes protected health information (PHI): names, dates of birth, Social Security numbers, and dental treatment records. DentaQuest serves as a dental benefits administrator for multiple state Medicaid programs, meaning the affected population includes some of the most vulnerable patient demographics. The initial access vector has not been publicly disclosed, which limits defensive takeaways but amplifies the regulatory and legal exposure.

For healthcare organizations, this breach is the case study their compliance teams will reference for the rest of the year. The gap between compromise and disclosure is the operational metric that matters — detection and response capabilities that cannot identify unauthorized PHI access within days leave organizations exposed to both regulatory penalties and class-action litigation. Data loss prevention controls, access monitoring on PHI repositories, and SIEM coverage mapped to HIPAA audit requirements are the primary countermeasures.

Source: SecurityWeek

Hacked Public Wi-Fi Captive Portals Harvest M365 Credentials

Researchers have documented an active campaign in which compromised public Wi-Fi captive portals — the login pages presented at hotels, airports, and conference centers — are being weaponized to harvest Microsoft 365 credentials from corporate travelers. The attack injects credential-harvesting forms that mirror legitimate M365 authentication flows directly into the captive portal page. No malware deployment is required. The phishing occurs at the network layer before the victim’s device ever reaches corporate resources.

This is a meaningful attack surface for any organization with a remote or traveling workforce. The implicit trust that users place in captive portal pages — they expect to enter information to get online — makes the social engineering almost frictionless. Standard endpoint protections do not intervene because the credential theft happens in the browser during what appears to be a normal network onboarding process. Even conditional access policies that enforce device compliance checks are bypassed because the authentication attempt originates from what the attacker controls.

The primary countermeasure is an always-on secure access architecture that establishes an encrypted tunnel before the user interacts with any captive portal. DNS-layer protection that blocks known credential-harvesting domains regardless of the underlying network is the second layer. The third — and most resilient — is phishing-resistant MFA using FIDO2 security keys. Even if a user enters credentials on a fake M365 page, a FIDO2 authenticator will not complete the challenge because the domain does not match. Password-based MFA methods — including push notifications and SMS — do not provide this protection because the attacker can relay the challenge in real time.

Source: SecurityWeek

Defender Action Items

  • Extend ransomware controls to subsidiaries. Verify that immutable backup policies, network segmentation, and EDR coverage apply to every subsidiary and acquired entity — not just the parent domain. Test backup restoration across subsidiary infrastructure quarterly.
  • Audit PHI access monitoring. For healthcare organizations: confirm that access to PHI repositories generates high-fidelity alerts in your SIEM. Map detection rules to HIPAA breach notification timelines — if you cannot detect unauthorized access within 48 hours, close that gap before the next OCR audit.
  • Deploy always-on secure access for travelers. Configure SSE/ZTNA clients to establish encrypted tunnels before captive portal interaction. Enforce FIDO2 phishing-resistant MFA for all M365 authentication. Block captive portal credential entry for managed devices where operationally feasible.
  • Review Telegram and messaging app egress controls. The TELESHIM campaign (below) uses Telegram as C2. Ensure DNS filtering and CASB policies cover Telegram API endpoints — legitimate use may require allowlisting, but unmanaged Telegram access from server segments is a high-fidelity indicator.
  • Enforce driver blocklisting against BYOVD. The Cruciferra crypter uses Bring Your Own Vulnerable Driver to disable EDR. Apply Microsoft’s recommended driver block rules and monitor for unsigned or revoked driver loads (Sysmon Event ID 6).

Threat Pulse

TELESHIM uses Telegram for C2 in Middle East government attacks. An East Asia-linked APT is deploying three new malware families — TELESHIM, MIXEDKEY, and BINDCLOAK — against Middle Eastern government targets. TELESHIM uses Telegram’s API as a command-and-control channel, blending C2 traffic with legitimate messaging app usage. This is a known egress-evasion technique (MITRE ATT&CK T1102.002 — Web Service: Bidirectional Communication). DNS filtering and CASB controls on messaging app APIs are the primary detection and prevention layers. Source: The Hacker News

Cruciferra crypter combines BYOVD and process ghosting to evade EDR. A China-linked threat actor is using tax-themed phishing to deliver the Cruciferra crypter against Indian taxpayers. The crypter loads a legitimately signed but vulnerable kernel driver (MITRE ATT&CK T1068 — Exploitation for Privilege Escalation) and then uses process ghosting to execute payloads without triggering EDR file-scanning hooks. This is a concrete proof point for multi-layer defense: EDR alone is insufficient when the attacker can disable it at the kernel level. Driver blocklisting and application control policies are compensating controls. Source: The Hacker News

GitHub and PyPI add 3-day Dependabot cooldown. GitHub and PyPI have introduced a configurable 3-day cooldown period before Dependabot automatically pulls new package versions into dependency trees. The measure is designed to slow supply-chain poisoning via dependency confusion and typosquatting — giving maintainers and security teams time to review new releases before automated consumption. Organizations with DevSecOps pipelines should enable the cooldown and pair it with software composition analysis scanning in CI/CD. Source: The Hacker News

Detection Spotlight

The captive portal credential-harvesting campaign targets M365 authentication. Monitor your Azure AD / Entra ID sign-in logs for successful authentications from unexpected network ranges — specifically public Wi-Fi ASNs — combined with new device registrations. The following KQL query surfaces sign-ins from non-corporate IP ranges where the user authenticated successfully and a new device was registered within 30 minutes:

let corporateIPs = dynamic(["10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16"]); // Replace with your corporate egress ranges
SigninLogs
| where TimeGenerated > ago(24h)
| where ResultType == 0 // Successful sign-in
| where not(ipv4_is_in_any_range(IPAddress, corporateIPs))
| where AppDisplayName has "Microsoft 365" or AppDisplayName has "Office 365"
| join kind=inner (
    AuditLogs
    | where TimeGenerated > ago(24h)
    | where OperationName == "Add registered owner to device"
    | extend DeviceUser = tostring(TargetResources[0].userPrincipalName)
    | project DeviceRegistrationTime = TimeGenerated, DeviceUser
) on $left.UserPrincipalName == $right.DeviceUser
| where DeviceRegistrationTime between (TimeGenerated .. (TimeGenerated + 30m))
| project TimeGenerated, UserPrincipalName, IPAddress, AppDisplayName, DeviceRegistrationTime

This query will generate false positives for legitimate travel — tune by correlating against your travel-approval system or VPN connection logs. A successful sign-in from a hotel ASN followed immediately by a device registration that does not match a known corporate asset is a high-fidelity indicator of credential compromise.

References

Subscribe to the it-learn Brief

Get the daily cybersecurity brief in your inbox every weekday morning — news, SE angles, and detection queries.