Security incidents in January 2026

Attackers exploited two flaws in Ivanti EPMM, the server organisations use to manage phones, to run code without signing in. Permanent fixes arrived in 12.8.0.0. Ask IT to update the server and investigate any compromise before it was patched.

Attackers are using an old Linux flaw to turn existing access into administrator control. It affects certain older kernels, with fixes available for years. Ask whoever maintains your Linux computers or servers to verify the vendor's kernel update is running.

Two SmarterMail mail-server flaws, CVE-2025-52691 (file upload) and CVE-2026-23760 (admin password reset), are under attack, and CISA flags ransomware use. Fixed in Build 9511. Businesses running SmarterMail should update now and check for unexpected admin accounts.

Microsoft issued emergency fixes for CVE-2026-21509, an Office flaw used in attacks, later tied to Russia-linked APT28. Install Office updates for 2016 and 2019. Office 2021 and later are protected by a change Microsoft applies itself; restart your Office apps.

Attackers have exploited CVE-2024-37079 in VMware vCenter Server, software used to manage business virtual servers. Fixes have existed since June 2024. Ask your IT provider to verify vCenter and Cloud Foundation are patched.

Attackers have exploited a Versa Concerto flaw to reach administrative services without logging in. It affects business network management systems. Ask IT to confirm the fixed release is installed; Versa identifies 12.2.1 GA as a fixed release.

Attackers exploited a Zimbra mail-server flaw that exposes files without a login. Fixes arrived in November 2025. Ask your email provider or IT team to confirm it runs a patched, supported Zimbra 10.1 release; 10.0 is out of support.

Attackers are using CVE-2025-31125 to read restricted files from network-exposed Vite development servers. Fixes have existed since March 2025. Developers should update Vite, remove public access and replace potentially exposed credentials.

An exploited flaw can give attackers full control of Cisco business calling servers without logging in. Organisations using Unified CM, Unity Connection or Webex Calling Dedicated Instance should install Cisco’s fixes; release 12.5 needs migration.

Attackers used FortiCloud single sign-on to take over other customers’ Fortinet devices and steal configurations. Fixes now cover all affected branches. Ask your IT provider to update and investigate earlier access; patching alone does not clean up a compromise.

Attackers used CVE-2026-24061 to enter vulnerable GNU Inetutils Telnet servers without a password. Disable Telnet where possible; otherwise install Inetutils 2.8 or your operating-system vendor's fixed package and investigate possible compromise.

Microsoft's January 2026 Windows updates fix CVE-2026-20805, a Desktop Window Manager memory-leak flaw already used in attacks. It needs local access. Install the latest Windows update on every PC, including older ones still covered by security updates.

Attackers exploited Gogs source-code hosting servers through CVE-2025-8110 before a fix existed. Administrators should install 0.13.4 or later and investigate possible compromise. Ordinary family devices need no update for this flaw.

Attackers exploited HPE OneView, software businesses use to manage servers and other infrastructure. IT teams should upgrade to OneView 11.00 or later, or obtain HPE's enhanced January hotfix. Ordinary household devices are not affected.

CISA listed a 2009 PowerPoint flaw (CVE-2009-0556) as exploited on 7 Jan 2026. Microsoft fixed it in 2009 for PowerPoint 2000 to 2003 and Office 2004 for Mac. Anyone still running those old, unsupported versions should retire them and not open untrusted .ppt files.

Attackers are exploiting CVE-2026-0625 in old D-Link DSL routers (DSL-526B, DSL-2640B, DSL-2740R, DSL-2780B). These models are end-of-life and get no fix. D-Link says to replace them. If you own one, swap it for a supported router.

Compromised executive devices led to about US$40 million being stolen from Step Finance's treasury. The business shut down; eligible token-holder claims were paid by April. Claims are closed. Keep payout records and beware unsolicited recovery offers.

A Texas hospital's network was breached in January 2026. Names, Social Security numbers, birth dates and medical and insurance IDs of up to 257,073 people may be exposed. If you get a letter, take it seriously: freeze your credit and watch insurance statements.

Match Group confirmed a security incident after ShinyHunters claimed 10M+ Hinge, Match.com and OkCupid records. Match says limited data; no passwords, payments or messages. Claimed total is unconfirmed.

Attackers published Panera Bread contact data containing 5.1 million unique email addresses, plus names, phone numbers and postal addresses. Watch for personalised scams and check unexpected messages through Panera's app or website.

A SwapNet contract flaw drained US$13.43 million from 18 Matcha Meta users who bypassed One-Time Approval. Revoke direct SwapNet approvals on every chain, including unused exact approvals. Users who kept the default protection were unaffected.

An exposed database held 149 million login records collected by password-stealing malware, including email, social and financial accounts. It was taken offline. Check devices for malware, replace exposed or reused passwords and enable two-factor authentication.

Attackers abused a flaw in SagaEVM's inherited Ethermint code to mint Saga Dollars without backing and took about US$7M on 21 Jan 2026. No recovery reported. SagaEVM is reportedly shutting down 23 Nov 2026: if you hold assets on it, withdraw them.

A phishing attack stole files from healthcare vendor Xsolis containing patients’ identity and medical details. Published totals differ: 1.40 million versus 2.52 million. Check your notice, ask about free monitoring and review credit and health-insurance statements.

An attacker stole student names, school details, email addresses and encrypted passwords across Victoria's government schools. Passwords were reset, but stolen information remains a risk. Contact your school or 1800 338 663 for advice.

Belgium's AZ Monica hospital shut its servers on 13 Jan 2026 after a cyberattack, cancelling surgery and moving seven critical patients. Systems were largely back by mid-February; no ransom paid, no confirmed data theft. Nothing for families to do.

Bondu’s admin console exposed children’s private conversations and family details to ordinary Google accounts. Bondu says it fixed the service and found no other unauthorised access. Parents can review and delete conversations in its app.

Ransomware disrupted South Korea's Kyowon Group on 10 January. Most website functions returned by 14 January, but customer-data exposure remained unresolved in the latest follow-up found. Customers should check official notices and verify unexpected messages.

A Eurail breach exposed some travellers’ identity, contact and passport details, including DiscoverEU participants. Stolen data was offered for sale. Check your notification, change your Rail Planner password and watch for impersonation scams.

An intruder stole Betterment contact data and sent customers a fake crypto offer. Betterment says customer accounts and passwords were not compromised. Ignore the offer and report suspicious contact through Betterment’s official channels.

An attacker used an arithmetic overflow in Truebit's roughly five-year-old contract to buy TRU for nothing and take 8,535 ETH (US$26.6M). TRU fell 99.9%. No recovery or compensation found. If you hold TRU or use Truebit, don't interact with its contracts.

A breach at checkout partner Global-e exposed names, contact details and order data for some Ledger buyers. Ledger said wallets and payment details were unaffected. Watch for impersonation scams and never share your 24-word recovery phrase.

Endesa notified over 16 million Endesa Energía and Energía XXI customers after unauthorised access to identity, contract and potentially IBAN details. Passwords were unaffected. Watch for impersonation scams and unfamiliar bank debits.

Prosura and Hiccup rental-car insurance customers may have had contact, travel, policy and claims data exposed, including licence images. Some received attacker emails. Ignore unexpected policy messages and contact Prosura through its official website.

Sixteen "ChatGPT Mods" browser extensions (15 Chrome, 1 Edge, ~900 installs) copied ChatGPT login tokens and sent them to the operator. If you installed any ChatGPT add-on from this publisher, remove it and sign out of ChatGPT everywhere.

A stolen maintainer token let attackers publish poisoned eslint-config-prettier releases in July 2025. CISA confirmed exploitation in January 2026. Developers should install clean replacements and investigate Windows machines that installed affected versions.

Attackers used an eScan update server to deliver malware on 20 January. eScan says affected customers were remediated, but disputes researchers' wider-impact claims. If you used eScan then, ask support to confirm your computer was checked and recovered.

Fake LastPass emails demanded a vault backup within 24 hours and linked to pages targeting master passwords. Further waves followed takedowns, including on 20 February. Ignore the request, open LastPass directly and report suspicious emails to [email protected].

ZachXBT reported that one holder lost over US$282 million in Bitcoin and Litecoin through a hardware-wallet scam. About US$700,000 was reportedly frozen, with no confirmed return. Keep recovery words private and verify support through the maker’s official site.

A WhatsApp worm, 'Boto Cor-de-Rosa', spreads the Astaroth banking trojan on Windows. It sends a ZIP file to every contact of an infected user. It mainly hits Brazil. Don't open unexpected ZIPs, even from people you know.