No-frills tech news

How Huntress Uses Managed SIEM to Detect Threats Faster

At Huntress, customer protection shapes how we build and operate. Security isn’t a separate consideration for one team or one phase of development. It runs through the entire process, from product design to threat operations. That focus continues after release. A new feature is only useful if it helps defenders investigate faster, understand incidents more clearly, or catch activity they'd have otherwise missed. That’s why close collaboration between Product and frontline teams matters so much. You can already find plenty of detailed examples in our blogs from Dray Agha, Tactical Response, and the DE&TH (Detection Engineering & Threat Hunting) team. But what really drives those stories—and the successes behind them—is how Huntress teams actually use Managed SIEM. A tight feedback loop between Product and the front lines It starts with a tight feedback loop between Product and our frontline defenders: Tactical Response, DE&TH, Security Operations Center (SOC), and Adversary Tactics. These teams are often our earliest adopters, testing new features in real environments and giving us early, honest feedback to shape the value and use cases. Once a capability goes live, it gets put to work immediately by our teams. Whether it’s a major feature like correlation rules or a small quality-of-life improvement like case-insensitive queries, every enhancement is built to reduce detection time and make investigations more efficient. We evaluate success based on real-world impact. We ask ourselves, "Does this help us detect threats faster or catch techniques we couldn’t before?" Turning log data into faster investigations One recent example is our new support for COUNT and COUNT DISTINCT in ES|QL. These functions help our analysts quickly summarize vast amounts of log data to spot anomalies, trends, or one-off behaviors. Paired with deep knowledge of attacker behavior, this capability helps our Threat Hunting, SOC, and Adversary Tactics teams dig

Industry Letter

Industry Letter Date: May 21, 2026 To: CISOs of DFS Regulated Entities Re: Heightened Cybersecurity Risks Associated with Frontier AI Models The New York State Department of Financial Services (the “Department”) is issuing this Advisory about the heightened cybersecurity risks associated with certain frontier artificial intelligence models that amplify the potency, scale, and speed of identifying vulnerabilities and exploits in information systems (“Frontier AI Models”). The Department urges individuals and entities regulated by the Department (“Regulated Entities”) to improve their security posture in preparation for the release of these Frontier AI Models. Although certain Frontier AI Models are not yet broadly available, such capabilities may become more available soon. The Advisory does not impose any new requirements for Regulated Entities; rather, it is intended to inform Regulated Entities’ risk management and compliance efforts. The best preparation for Frontier AI Models is a robust cybersecurity program that includes timely and comprehensive vulnerability identification and remediation. Regulated Entities should review and update risk assessments to reflect the evolving risks posed by this new technology. For example, entities should consider whether to strengthen operational resilience by replacing end-of-life or legacy information systems. Additionally, they should review their cybersecurity programs to ensure full compliance with the Department’s cybersecurity regulation, 23 NYCRR Part 500 (“Part 500”), and consider whether additional cybersecurity measures are warranted to address heightened risks associated with Frontier AI Models. In conjunction with this Advisory, the Department is issuing new guidance on Measures Regulated Entities Should Consider in a Heightened Cybersecurity Threat Environment (“Guidance”). This Guidance is intended to help Regulated Entities identify potential additional steps that may be appropriate when addressing cybersecurity risks that are significantly higher than normal. Whether to adopt a heightened risk posture, and which measures to adopt, depend on the unique circumstances and operations of an organization.

State Cyber Leaders Ask Congress to Support SLCGP, CISA

Cybersecurity and technology officials from the state governments of Tennessee, New York and Florida travelled to Washington, D.C., to testify before the U.S. House Homeland Security Subcommittee on Cybersecurity Infrastructure Protection. During the livestreamed meeting, they called for the reauthorization of funds for the State and Local Cybersecurity Grant Program (SLCGP) as well as for maintaining federal cyber coordination programs that state officials described as essential to defending local governments and critical infrastructure. “Our states are on the front lines of multiple cyber conflicts,” said Colin Ahern, New York's director of security and intelligence, during the hearing. Much of the hearing centered on the future of the SLCGP, which was created in 2021 to help state, local, tribal and territorial governments strengthen cybersecurity protections and expand shared services. Multiple witnesses said the program has helped states deploy enterprise cybersecurity tools, centralized protections and workforce training to smaller and rural communities that cannot otherwise afford them. Currently, Congress has reauthorized the State and Local Cybersecurity Grant Program, but no new money has been allocated for it. A Senate bill that proposed allocating $300 million this year has not moved, despite the U.S. House of Representatives voting yes to the PILLAR Act to extend programming through 2033. That legislation now sits with this committee. Ahern called the grant program “the single most consequential investment in the cyber protection of state and local governments in this country.” The state leaders also emphasized the importance of continued support for the federal government's Cybersecurity and Infrastructure Security Agency (CISA), as well as for federal-state information sharing efforts as cyber threats become increasingly sophisticated and AI-driven. Witnesses also warned that smaller communities largely lack the staffing, procurement capacity and operational resources needed to defend against ransomware gangs, criminal organizations and nation-state actors without state and federal

Zoe Lofgren Discusses <b>Cybersecurity</b> Risks to U.S. Water Systems at Subcommittee Hearing

Lofgren's statement emphasizes the urgency of addressing cybersecurity threats to U.S. water systems amid increasing risks. Quiver AI Summary Hearing on Water Security Challenges: The House Committee on Science, Space, and Technology is convening an Environment Subcommittee hearing titled “Research-Driven Resilience: Applying Science to Secure U.S. Water Systems from Cyber Threats." Ranking Member Zoe Lofgren underscores the serious risks to water systems from increasing cyber-attacks, stating over 70% of inspected water systems fail basic security standards. Lofgren's Concerns on Water Infrastructure: Lofgren expresses concern that aging water infrastructure, particularly in rural areas, is vulnerable to cyber threats. She emphasizes the need for federal support to enhance cybersecurity measures, highlighting incidents where hackers have attempted to compromise water treatment plants in the U.S. Addressing National Security Issues: Lofgren points out that water infrastructure is a target for cyberwarfare and urges a coordinated federal response to bolster defenses. She aims to investigate how improved funding and resources for the EPA could strengthen security across the nation’s water systems. Disclaimer: This is an AI-generated summary of a press release. The model used to summarize this release may make mistakes. See the full release here. Check out the Quiver Quantitative API to build on top of data on congressional stock trading, insider transactions, hedge fund moves, and more. Zoe Lofgren Fundraising Zoe Lofgren recently disclosed $104.7K of fundraising in a Pre-Primary FEC disclosure filed on May 20th, 2026. This was the 117th most from all Pre-Primary reports we have seen this year. 76.0% came from individual donors. Lofgren disclosed $71.9K of spending. This was the 241st most from all Pre-Primary reports we have seen from politicians so far this year. Lofgren disclosed $616.4K of cash on hand at the end of the filing period. This was the 123rd most from all Pre-Primary reports we

Showboat Linux Malware Hits Middle East Telecom with SOCKS5 Proxy Backdoor

Cybersecurity researchers have disclosed details of a new Linux malware dubbed Showboat that has been put to use in a campaign targeting a telecommunications provider in the Middle East since at least mid-2022. "Showboat is a modular post-exploitation framework designed for Linux systems, capable of spawning a remote shell, transferring files, and functioning as a SOCKS5 proxy," Lumen Technologies Black Lotus Labs said in a report shared with The Hacker News. It's assessed that the malware has been employed by at least one, and possibly more, threat activity clusters affiliated with China, with correlations identified between command-and-control (C2) nodes and IP addresses geolocated to Chengdu, the capital city of the Chinese province of Sichuan. One such threat actor is Calypso (aka Bronze Medley and Red Lamassu), which is known to be active since at least September 2016, targeting state institutions in Brazil, India, Kazakhstan, Russia, Thailand, and Turkey. It was first publicly documented by Positive Technologies in October 2019. Some of the key tools in its arsenal include PlugX and backdoors like WhiteBird and BYEBY, the latter of which is part of a broader cluster tracked by ESET under the moniker Mikroceen. The use of Mikroceen has been attributed to a closer known as SixLittleMonkeys, which, in turn, shares tactical overlaps with another China-linked group referred to as Webworm. This puts Showboat along with other shared frameworks like PlugX, ShadowPad, and NosyDoor that have been used by multiple China-nexus groups. This "resource pooling" reinforces the presence of a digital quartermaster that state-sponsored threat actors from China have relied on to supply them with necessary tooling. The starting point of the investigation was an ELF binary that was uploaded to VirusTotal in May 2025, with the malware scanning platform classifying it as a sophisticated Linux backdoor with rootkit-like capabilities. Kaspersky is

Turning data into decisions: A new model for federal <b>cybersecurity</b>

Data is the driver of modern government. It enables agencies to proactively defend against increasingly sophisticated cyber threats, better anticipate accelerating mission needs and successfully deploy advanced technologies like AI. However, agencies often operate across fragmented systems and applications, which can limit visibility, actionability and resilience. Download now to learn how reducing variability and increasing commonality across systems with Splunk can help your agency address this disconnect and create a centralized operational picture for faster detection and response.

Why rail <b>cybersecurity</b> requires a different security model

Why rail cybersecurity requires a different security model Why rail cybersecurity requires a different security model Digital threats are moving at rail speed. Here is how railways keep them off the train. The departure board flickers. The train glides in, the doors open, and together with hundreds of commuters you step into a world that feels reassuringly routine. “For most people, it really is just another Monday. But for the people who build and operate railways, that ordinary moment is the finish line we chase every single day.” says Eddy Thésée, Vice President Digital & Cybersecurity at Alstom. The finish line that Eddy refers to moves every day, without the passengers noticing. Why does it move? Society evolves, technologies too, and with new systems come new digital threats. The same threats that can expose your inbox are now targeting critical infrastructure: the power grids that keep hospitals running, the water systems that make cities liveable, the fibre networks that carry a bank login across continents. And yes, the railways that underpin entire economies. A cyber incident on rail can mean a missed morning commute for thousands. Why rail cybersecurity is a discipline of its own Long before connectivity became commonplace, rail already relied on software and control logic to run safely and on time. Older fleets are now being brought online for the first time, and new standards and EU requirements have turned cybersecurity into an operational duty. But the real challenge is not regulation; it is the moving machine. In most industries, cybersecurity protects stationary IT systems, think office computers and data locked away in a server room. The focus is on building digital walls: separating networks so a breach can’t spread, watching devices for suspicious behaviour, and controlling who gets access to what. These meaures work well when

Three <b>cybersecurity</b> names Josh Brown added to his 'best stocks' list

Three cybersecurity names Josh Brown added to his 'best stocks' list Josh Brown has added three cybersecurity names, Fortinet, Palo Alto Networks, and CrowdStrike, to his closely watched “best stocks in the market” portfolio. Cybersecurity stands as the singular, non-negotiable line item in corporate IT budgets, immune to macroeconomic tightening. Interestingly, the rapid advancement of artificial intelligence (AI) has fortified the sector’s growth trajectory rather than threatening it. As AI accelerates the sophistication of global hacking capabilities, enterprise clients are materially scaling their defensive infrastructure – transforming the following three specialized cybersecurity stocks into indispensable digital utilities. Fortinet Inc (FTNT) Josh Brown was drawn to Fortinet following a dramatic, clean “technical breakout” that decisively shattered an 18-month descending channel. After compressed price action found consistent support in the $83 to $88 range, a massive first-quarter (Q1) earnings surprise exploded the stock past prior all-time highs to $124. This powerful move pushed FTNT shares above its 50-day and 200-day moving averages (MAs) for the first time in a year and a half. While its blistering relative strength index (RSI) of 85 indicates a highly overbought condition that requires near-term price digestion, the sheer velocity of the breakout confirms institutional accumulation, making it a premier addition to the elite momentum list. That said, Wall Street currently rates Fortinet stock at “hold” only. Palo Alto Networks (PANW) Palo Alto Networks stock earned its spot on the list through a decisive, come-from-behind victory that validated its aggressive “platformization” strategy. Josh Brown highlighted the chart’s powerful trend momentum after the stock carved out a long, choppy base and cleared heavy resistance in the $180 to $190 range. Backed by an absolute gusher of an earnings quarter, PANW embarked on a historic parabolic run – surging 71% in just 57 trading days to hit $245. With

Buy CRWD, ZS, PANW, or FTNT? <b>Cybersecurity</b> Stock Picks for 2026

The buy CRWD ZS PANW FTNT debate is the most common cybersecurity question on US-stock watchlists for 2026. Four companies, four very different setups heading into the back half of the year. This piece gives an explicit ranking. Where to buy, where to hold, and where to pass, with reasoning per ticker. The short answer: the best cybersecurity stocks 2026 split along three verticals, and the cheapest quality name is not the one most retail investors expect. Endpoint vs Network vs Cloud Security: Picking Your Vertical Cybersecurity is not one market. It is three overlapping ones, and each company here anchors a different vertical. Endpoint security protects laptops, servers, and workloads. CrowdStrike is the category leader, with SentinelOne as the smaller challenger. Network and cloud security protects traffic flowing between users and applications. Zscaler owns the secure access service edge category, while Palo Alto Networks and Fortinet bridge network firewalls into cloud-native architectures. The crwd vs panw framing is misleading. Their core revenue lines barely overlap. The real choice is which vertical you want owned in your portfolio. CrowdStrike (CRWD) Post-Outage Trust Rebuild The CrowdStrike story in 2026 is that the trust rebuild worked. ARR sits at $5.25B growing 24%, the company turned GAAP profitable, and FY27 revenue is guided to $5.9B. Shares trade near $429 with a consensus target around $507. That is roughly 18% upside, healthy but not screaming cheap. The July 2024 global outage is firmly in the rearview. Net retention has stayed above 115% and module attach rates kept climbing through 2025. The risk is valuation. CRWD prices in flawless execution, and any softness in net new ARR would compress the multiple quickly. Zscaler (ZS) and SASE Architecture Tailwind Zscaler is the most interesting setup in the group. Q2 FY26 revenue hit $815.8M, up 26% YoY,

Student hackers take on 'ethical battle' beyond cyber attacks and exploits

Student hackers take on 'ethical battle' beyond cyber attacks and exploits Thu 21 May 2026 at 7:01am In short: Student hackers from around the world have competed in a series of challenges for cybersecurity's "World Cup". The competition pits country against country with simulated attacks similar to real-world threats. What's next? The event is designed to prepare the next generation of "ethical hackers" for an industry full of rapidly evolving threats. When more than 100 hackers meet in a room, it might be a good idea to update your password. But these cybersecurity sleuths have gathered for a good cause. "The term used in the industry is ethical hacking, which to a lot a of people sounds like an oxymoron," software developer Rohan van Klinken said. "But it's basically the best way to secure a system, is to have someone hack it for real and point out all the holes." Mr van Klinken represents Team Oceania in the 2026 International Cybersecurity Challenge — the "World Cup of Cybersecurity". It pits the best student teams from Asia, Europe, Africa, North and South America, and Australia, against each other over two days on the Gold Coast. "It's a completely different mental state, completely locked-in on the problem in front of you, and sometimes you can spend four hours on the same challenge," Mr van Klinken said. But as cybersecurity threats become faster and more complex, these simulated challenges have real-world implications. Pay to get hacked In the "attack and defence" challenge, teams are given the same programs with intentional bugs placed in them. They must identify and fix those bugs, before exploiting them to attack other teams. "If you're working on criminal psychology, you need to know how a criminal thinks so you can help police catch criminals," Avery Armstrong from Team

Craig Applauds Passage of Legislation to Enact the Enhanced <b>Cybersecurity</b> for SNAP Act

Craig Applauds Passage of Legislation to Enact the Enhanced Cybersecurity for SNAP Act Today, state Senator Hearcel Craig (D-Columbus) celebrated the passage of Senate Bill 315 on the Senate floor – bipartisan legislation to require Ohio's SNAP program to begin using chip-enabled EBT cards. “When vulnerable Ohioans have no choice but to turn to the state for help meeting their basic needs, they deserve peace of mind knowing those benefits will still be there when they walk into a store to feed their families,” said Craig. “At a time when far too many Ohio families are already struggling to afford groceries and other necessities, it is unacceptable that criminals are stealing critical food assistance from children, seniors, and working families.” The enhanced security measures in Senate Bill 315 will help safeguard critical food assistance benefits and ensure Ohio families can continue accessing the support they depend on. Senate Bill 315 now heads to the Ohio House for consideration.

Coro and Leader Partner to Simplify <b>Cybersecurity</b> for Australian MSPs | The Manila Times

New distribution partnership brings Coros’ AI-powered cybersecurity platform to Leader’s nationwide partner ecosystem CHICAGO, May 20, 2026 (GLOBE NEWSWIRE) -- Coro, the leading cybersecurity platform purpose-built for organizations with lean IT teams, today announced a strategic distribution partnership with Leader, one of Australia’s leading information and communication technology (ICT) distributors. Through this partnership, Leader’s nationwide network of managed service providers (MSPs) and reseller partners will gain access to Coro’s modular cybersecurity platform through the Leader Cloud marketplace. The partnership comes as MSPs face increasing pressure to secure customers against a rapidly evolving threat landscape while managing growing operational complexity, staffing constraints, and tool sprawl. "Coro brings a modern platform approach to cybersecurity for our MSP and reseller community,” said Hanh Tran, Cloud Business Manager at Leader. "Our partners are looking for solutions that simplify security operations while still delivering strong protection outcomes for customers. Coro enables MSPs and resellers to consolidate multiple security tools into a single, automated platform that is easier to deploy, manage, and scale.” A Media Snippet accompanying this announcement is available by clicking on this link. Designed specifically for Lean IT teams, Coro uses AI-driven automation to detect and remediate threats across endpoint, email, cloud applications, identities, networks, users, and data through a centralized platform experience. By replacing fragmented point solutions with unified security operations, Coro helps organizations reduce alert fatigue, minimize operational overhead, and improve visibility across customer environments. The platform’s modular architecture allows MSPs to deploy cybersecurity capabilities based on customer needs, including Endpoint Detection and Response (EDR), Secure Access Service Edge (SASE), Email Security, Data Protection, Security Awareness Training, Identity and Access Management, and Network Security - all managed through a single dashboard interface. "We are excited to partner with Leader to accelerate Coro’s growth across the Australian market,” said Demetrios Georgiou, Vice

CIA, Industry Officials Warn Advanced AI Models Reshaping Federal <b>Cybersecurity</b>

- Federal cyber officials warn advanced AI tools could aid both defenders and hackers - CIA official says Anthropic’s Mythos model marks a major cybersecurity inflection point - Public-private cooperation seen as essential to protecting critical infrastructure Federal cyber leaders have warned that advanced artificial intelligence models pose both opportunity and risk, urging agencies to strengthen partnerships with the private sector, Nextgov/FCW reported Monday. Advancements in AI and cybersecurity are reshaping how intelligence agencies collaborate with industry to address evolving threats and mission demands. Learn more about the technologies driving the intelligence community at the Potomac Officers Club’s 2026 Intel Summit on Sept. 24. Register now. Table of Contents Why Is Mythos a Turning Point? Dan Richard, associate deputy director of the Digital Innovation Directorate at the CIA, said during the Qualys ROCon Public Sector 2026 conference that Anthropic’s Mythos model represents a “reflection point” for agencies managing sensitive data. Mythos can detect extensive software flaws, raising concerns that it could also empower hackers. Anthropic introduced Mythos in April as part of its Project Glasswing cybersecurity initiative, describing the model as capable of autonomously identifying software vulnerabilities and exploit paths. The company said the technology could strengthen cyber defense operations but warned that malicious actors could also misuse similar frontier AI systems. Richard said the CIA sees potential to automate threat response but emphasized the need for collaboration with industry, noting that most U.S. critical infrastructure is privately owned. How Could AI Change Federal Cybersecurity Operations? Richard said public-private collaboration will be critical as agencies adapt to rapidly evolving AI technologies. He noted that 80 percent of the nation’s critical infrastructure is operated by private-sector organizations, requiring closer coordination between government and industry. IonQ Chief Information Officer Katie Arrington, former Pentagon CIO and previous winner of the Wash100 Award, said

Bresnahan's <b>Cybersecurity</b> Legislation Passes House Small Business Committee

Bresnahan’s Cybersecurity Legislation Passes House Small Business Committee WASHINGTON, DC: Today, U.S. Representative Rob Bresnahan, Jr. (PA-08) announced the Small Business Competitions Assistance Evaluation Act of 2026, legislation he co-led, passed out the House Committee on Small Business. His legislation, which passed unanimously by a bipartisan vote of 23-0, will ensure small businesses are protected from cybersecurity risks by studying the effects these attacks can have on small businesses. “In the United States, small businesses are 210% more likely to experience cyber incidents compared to larger companies,” said Rep. Bresnahan. “This is a significant challenge for the businesses that make up Main Streets across the country and is something Congress can no longer afford to overlook. This legislation will help ensure that as cyber threats continue to evolve, our support systems for small businesses evolve as well.” Specifically, the legislation directs the U.S. General Accountability Office (GAO) to evaluate Federal cybersecurity assistance to small businesses. The bill would require a study to analyze cyber risks, vulnerabilities, and current initiatives and identify shortcomings of current preventative and mitigating measures. In addition to the Small Business Competitions Assistance Evaluation Act of 2026, the House Committee on Small Business passed nine bills, including legislation to strengthen transparency of the Small Business Administration’s (SBA) disaster loan program, direct the SBA to provide active outreach to small businesses on health coverage options, and require the SBA to provide recommendations to address anticompetitive conduct. ###

Exclusive—Sen. Rick Scott &amp; Rep. Andy Ogles: America's <b>Cybersecurity</b> Cannot Be a...

Exclusive—Sen. Rick Scott & Rep. Andy Ogles: America’s Cybersecurity Cannot Be an Easy Target for Communist China May 20, 2026 Breitbart Sen. Rick Scott and Rep. Andy Ogles May 20, 2026 American-led innovation has built a digitally connected world that’s created enormous benefits for American families and businesses. For most American families, access to people and products from anywhere in the world comes as easily as reaching for the phone in our pocket. Now, imagine if tomorrow that access we’ve become familiar and comfortable with became our biggest threat. Think of a world in which the Chinese Communist Party (CCP) were able to launch a cyber-attack and target your power and water, block your bank accounts, or turn off your internet. That’s the reality America faces today and why we are fighting to protect American families and pass the Strengthening Cyber Resilience Against State-Sponsored Threats Act. The CCP understands the vulnerability of weak cybersecurity infrastructure. Communist China is constantly prodding U.S. security, looking for a way to undermine the American economy and disrupt our lives with CCP-backed groups of hackers known as “Volt Typhoon” and “Salt Typhoon.” The threats posed by CCP-back cyber-attacks are more real than many folks realize. In February 2024, U.S. government agencies revealed that Volt Typhoon had been burrowed into the IT environments of key critical infrastructure sectors like energy, water and wastewater systems, transportation systems, and communications for years. If a hospital is locked out of its systems, life support could fail and patients would die. An attack on our electrical grid could deny millions of families access to heat in the winter, lights would not turn on, and they wouldn’t be able to keep food in their refrigerator. If the CCP attacked our financial institutions, hackers could empty your bank account or delete all

Running to a Future in Computer Science and <b>Cybersecurity</b>

Running to a Future in Computer Science and Cybersecurity Nicholas Scarangelli (’26) grew up surrounded by family members who worked in computer science. His father is a computer scientist for the FAA; his sister, Gianna Scarangelli (’24), is a computer engineer. Originally interested in engineering, he took an advanced programming class during his senior year and fell in love. “To me, coding is like a puzzle — once you figure out where the pieces go, they all fit together,” Nicholas shared. “There are infinite possibilities of what you can make through code.” Embry-Riddle Met the Criteria Nicholas and his parents took a 3,000-mile road trip to visit dozens of colleges from Maine to Florida. That trip helped him realize that he wanted to attend a smaller school in a warm state. He also wanted to run at the collegiate level. “Once I figured out my criteria, Embry-Riddle kept coming back to mind,” Nicholas said. “I had been here on several visits to see my sister and was in awe of the campus. It was modern and in a great, lively area with beautiful beaches nearby.” When he took an official tour of Embry-Riddle, he realized the facilities, class size and expert professors met his criteria. “The cross-country track and field team sealed the deal. I met the coach and team, and I loved the vibe — everyone was so friendly.” Nicholas has found that smaller class sizes allow for better relationships with his professors. They’re available for questions and want to help their students succeed. Teaching assistants have also been a valuable resource to Nicholas. “Along with the professors and teaching assistants, I have utilized the Academic Advancement Center, which is an amazing resource on campus,” he said. “I really enjoy going, and the tutors are great at explaining topics

Staff mistakes plague healthcare <b>cybersecurity</b>: Verizon report

Healthcare has been among the industries most affected by data breaches related to staff mistakes, according to Verizon. “Breaches take many forms, but in the healthcare sector, one pattern stands out: miscellaneous errors,” the telecom giant stated in its annual data breach investigations report. “The ranking may vary from year to year, but it remains a chronic problem that needs a cure.” Here are seven more things to know about healthcare data breaches, according to the study that analyzed security incidents between Nov 1, 2024, and Oct 31, 2025: 1. Healthcare had 1,438 data breaches, the fourth-most of any sector. 2. System intrusion (largely ransomware), miscellaneous errors and social engineering represented represented 81% of the breaches. 3. The most common errors were misdelivery (data being sent to the wrong recipient), loss (such as unencrypted user devices and portable media) and misconfiguration (like exposing a data repository to the internet without appropriate controls). 4. Eighty-one percent of the threat actors were external, while 19% were internal. 5. The No. 1 motive by far (99%) was financial, with 2% espionage-related. 6. The most common initial access points for threat actors were vulnerability exploitation (20%), phishing (14%), and credential abuse (11%). 7. Fifty-four percent of the breaches involved a human element, while 32% originated with third parties (the Oracle E-Business Suite vulnerability was a big driver across industries). At the Becker's 11th Annual IT + Revenue Cycle Conference: The Future of AI & Digital Health, taking place September 14–17 in Chicago, healthcare executives and digital leaders from across the country will come together to explore how AI, interoperability, cybersecurity, and revenue cycle innovation are transforming care delivery, strengthening financial performance, and driving the next era of digital health. Apply for complimentary registration now.