State of (in)security - Week 1, 2026
Take action: Make sure all MongoDB database servers are isolated from the internet and accessible from trusted networks only. Then patch ASAP! If you can't update your MongoDB instance immediately, disable zlib compression.
Learn More
In the week between Dec. 29, 2025, midnight and Jan. 5, 2026, midnight we witnessed a total of:
- 7 advisory/vulnerability events
- 19 incident/data breach events
Week over Week comparison of week 1 2026 vs week 52 2025:
- Advisories are sligthly up and incidents are slightly up. Advisories are up from 6 in week 52 2025 to 7 in week 1 2026. Incidents are down from 20 in week 52 2025 to 19 in week 1 2026.
- The number of known impacted individuals is down - from 2.8 million in week 52 2025 to 1.05 million in week 1 2026.
We also shared 1 practical knowledge items
Total impacted individuals via the events of the week
There were a total of 1,055,699 impacted individuals across 9 incidents, with the largest breach being the Illinois Department of Human Services leaks data of 700,000 people incident exposing 705,017 individuals. Since not all incidents report a number of impacted individuals, the real number is definitely higher than that.
Cause breakdown of incidents
| Cause | Number of incidents |
|---|---|
| Malware, Ransomware and Related Attacks | 1 |
| Third Party Compromise | 1 |
Industry breakdown of incidents
| Industry | Number of incidents |
|---|---|
| Healthcare | 5 |
| Finance | 3 |
| Consulting/Professional Services | 2 |
| IT/Software/Technology | 2 |
| Government | 2 |
| Utilities | 1 |
| Education | 1 |
| Insurance | 1 |
| Transport/Logistics | 1 |
| Aviation | 1 |
Read the Event Details of the Week
Knowledge
- active exploit | Massive Data Exposure as Attackers Exploit MongoBleed Vulnerability
Vulnerabilities
- critical vulnerability | Apache NuttX RTOS memory flaw exposes IoT devices to remote crashes
- critical vulnerability | Critical GNU Wget2 flaw allows attackers to overwrite sensitive files
- critical vulnerability | Critical privilege escalation flaw in Apache StreamPipes allows admin takeover
- critical vulnerability | Critical SmarterMail flaw allows unauthenticated remote code execution
- critical vulnerability | Critical zero-day flaw reported in XSpeeder devices
- critical vulnerability | IBM patches critical authentication bypass flaw in API Connect
- critical vulnerability | WHILL electric wheelchairs vulnerable to remote bluetooth hijacking
Incidents
- critical vulnerability | Hacktivist group disrupt La Poste and La Banque Postale with second DDoS attack
- data breach | People's Community Clinic reports data breach
- data breach | Hackers claim breach of Pickett and Associates, offers for sale US utility infrastructure data
- data breach | Melcher & Prescott Insurance reports data breach exposing customer data
- data breach | Abri Credit Union reports data breach that went undetected for 18 months
- data breach | Illinois Department of Human Services leaks data of 700,000 people
- data breach | Neighbourly social network offline after claims of data breach
- data breach | Austin Associates reports a data breach exposing SSNs and financial records
- data breach | Korean Air reports third party data breach exposing 30,000 employee records
- data breach | Greater St. Louis Oral & Maxillofacial Surgery Reports Email Breach and Patient Data Exposure
- data breach | European Space Agency reports breach of external engineering servers
- data breach | ManageMyHealth investigates breach of New Zealand patient portal
- data breach | First Rehabilitation Resources reports email data breach
- malware | EmEditor website compromised to distribute Infostealer malware
- ransomware | Inha University Hit by Ransomware Attack; 650GB of Data Allegedly Stolen
- ransomware | TridentLocker Ransomware claims attack on Sedgwick Government Solutions
- ransomware | Akira Ransomware Group claims breach of MetroWest Community Federal Credit Union
- ransomware | Appalachian Community Federal Credit Union hit by cyberattack claimed by Qilin ransomware gang
- ransomware | Richmond Behavioral Health Authority reports ransomware attack exposing data of 113,000 people
