Canada’s Hospital for Sick Children reported a second cyber‑incident with employee data stolen, linked to a third‑party software application. Patient and staff records may be at risk.

The Hospital for Sick Children disclosed a cybersecurity incident that exposed personal data of current and former employees and job applicants. Clinical systems and patient records remained untouched.

Ontario’s privacy commissioner continues its investigation into a data breach at Waterloo Region Hospital, where personal health information may have been exposed.

A critical remote code execution flaw in Zimbra Collaboration Suite is being actively exploited. Healthcare organizations that rely on Zimbra for email risk immediate data compromise.

A ransomware affiliate is masquerading as a recovery service called “Ransom Busters” to solicit payments from victims. The scheme pre‑empts public disclosure and can divert funds away from legitimate incident response.

CareCloud reported a breach that exposed the personal health information of more than 3.7 million patients. The incident underscores ongoing vulnerabilities in electronic health‑record (EHR) systems.

CareCloud confirmed that the breach exposed data of 3,756,469 individuals after an eight‑hour intrusion into its EHR environment. The incident reinforces the need for rapid detection and response capabilities.

CISA warns that a critical remote code execution flaw in the Windows IKE Service Extensions is being actively exploited. The vulnerability could allow attackers to take control of hospital network devices and compromise patient data. Immediate mitigation is required.

The FBI reports that the Medusa ransomware gang has breached more than 500 critical infrastructure entities, including health‑care providers. Ongoing attacks threaten patient records and operational continuity.

CISA added the Microsoft IKE Service Extensions double‑free bug to its Known Exploited Vulnerabilities list. The flaw enables remote code execution and must be patched on all clinical network appliances.

CISA flagged a weak authentication flaw in Microsoft SharePoint that bypasses security controls. Hospitals leveraging SharePoint for clinical documentation are at immediate risk of unauthorized access.

CISA updated its advisory, confirming over 200 additional Medusa ransomware victims, many in the health‑care sector. The surge underscores the need for rapid incident response and backup verification.

CISA reports that ransomware gangs are actively exploiting a high‑severity Windows Task Host vulnerability. The flaw can be leveraged to gain system control on hospital workstations, posing an immediate risk to patient data and clinical operations.

Philips and General Electric confirm investigations into alleged Clop ransomware breaches that may have exposed patient data from medical devices. Immediate incident response is required to protect clinical operations.

Polish health‑tech firm MyDr disclosed a breach that may have exposed data of up to 19 million patients. Immediate containment and notification steps are required under GDPR.

CISA listed a hard‑coded password vulnerability in Cisco Secure Firewall Management Center that could let an unauthenticated attacker gain low‑privileged access. Hospital networks using these firewalls face immediate risk of data exposure.

Fortinet FortiOS contains an exposure of sensitive information to unauthorized actors, potentially allowing attackers to bypass existing patches. Health‑care organizations that run FortiOS appliances must patch urgently.

An OS command injection flaw in Arista VeloCloud Orchestrator on‑prem could let remote attackers execute privileged commands. The vulnerability threatens cloud‑orchestrated health‑care services.

Check Point SmartConsole suffers an improper authentication issue that may allow attackers to obtain full admin tokens. Health‑care IT teams should enforce multi‑factor authentication and apply mitigations.

Microsoft SharePoint is vulnerable to deserialization of untrusted data, enabling remote code execution. Hospitals using SharePoint for intranet or document management must apply the pending patch immediately.

Evooo1Bot, a Mirai‑derived Linux botnet, is compromising internet‑facing routers and turning them into SOCKS5 relays, posing an immediate risk to hospital networks that rely on vulnerable edge devices.

The ShinyHunters group exfiltrated personal data from 1.6 million RingCentral accounts, a platform widely used by healthcare providers for secure messaging. The breach exposes patient and staff contact information, creating an immediate risk of phishing and credential theft.

An Akira ransomware affiliate disabled endpoint detection by forcing Safe Mode, then stole data from the compromised system. Although encryption failed, the technique shows a heightened threat to hospital IT environments.

An ongoing data theft campaign uses custom tools to steal data exposed to anonymous users through Salesforce Experience Cloud and ServiceNow customer portals, posing an immediate risk to patient and healthcare organization information.

Hackers have begun using a proof‑of‑concept exploit for a critical Microsoft SharePoint vulnerability, creating an immediate threat to organizations that store patient records on SharePoint.

CISA gives federal agencies two weeks to patch a Microsoft bug exploited in a North Korean campaign, posing an immediate risk to U.S. health‑agency data.

Microsoft Defender has a new zero‑day exploit called “ShieldBreak” that grants SYSTEM privileges. The vulnerability is actively exploited and could compromise hospital IT systems, putting patient data at immediate risk.

A high‑severity denial‑of‑service flaw in Cisco ASA and FTD VPN software is being actively exploited to crash devices. Healthcare facilities relying on these firewalls risk service outages that could halt patient care.

CISA confirmed active exploitation of a critical Microsoft SharePoint remote code execution flaw by ransomware groups. Healthcare entities using SharePoint for records face immediate compromise risk.

CISA’s KEV list flags a heap inspection vulnerability in Cisco ASA/FTD that can cause unexpected reloads. The issue could bring down firewall protection for hospital networks.

A ransomware gang hijacked a hospital system’s Facebook page, claiming exfiltration of 6 TB of sensitive health records including sexual‑assault and mental‑health data. The breach poses immediate privacy and operational risks.

CISA warns that the critical‑severity Progress LoadMaster command injection flaw is being actively exploited. Healthcare organizations using the appliance face immediate risk of data breach or service disruption.

The Head Mare hacktivist group is exploiting unpatched TrueConf video‑conferencing servers to replace client installers with backdoored versions. Healthcare providers using TrueConf risk unauthorized access to patient communications and data.

A zero‑day SQL injection vulnerability in Metabase is being actively exploited to steal data from customer instances, including healthcare platforms. Immediate mitigation is required to protect patient records and other sensitive health information.

Unlimited Technology Systems, a provider of healthcare software, disclosed a breach that exposed the personal data of more than 3.8 million individuals. The incident poses an urgent risk to patient privacy and may affect ongoing clinical operations.

The Ontario Privacy Commissioner has extended its investigation into a breach that exposed patient records at Waterloo Region District Hospital. The incident highlights ongoing vulnerabilities in Canadian healthcare information systems and may trigger regulatory action. (Auto-resolved: no updates in 14 days.)

CISA issued an urgent three‑day directive for federal agencies to remediate actively exploited flaws in IBM Langflow, N‑central and Apache Tomcat, which could affect health‑agency systems handling patient data. (Auto-resolved: no updates in 14 days.)

Amgen disclosed that attackers accessed patient records and proprietary data via a third‑party cloud service. The breach exposes sensitive health information of thousands of individuals and highlights supply‑chain security gaps in biotech. (Auto-resolved: no updates in 14 days.)

Amgen disclosed a breach of its cloud environment where threat actors accessed patient health records and proprietary data stored with third‑party providers. The incident exposes sensitive personal health information and could impact ongoing clinical operations. (Auto-resolved: no updates in 14 days.)

This is a test item to verify the daily intelligence agent deployment pipeline is working correctly. This item can be safely ignored. (Auto-resolved: no updates in 14 days.)