September 2026 Cybersecurity Newsletter

In this issue

The September issue covers Ernst & Young and RingCentral breaches, Microsoft and Zoom security updates, the LiteLLM supply chain attack, ransomware disruption, and Adobe ColdFusion patching.
The recurring priorities are vendor oversight, automated patch management, software dependency monitoring, behavioral detection, backup readiness, and incident-response planning.
The issue also examines U.S. data breach costs and how AI-driven attacks increase the need for faster detection and automated response.

This September 2026 cybersecurity newsletter covers vendor breaches affecting Ernst & Young and RingCentral, Microsoft’s August security updates, a Zoom zero-click flaw, the LiteLLM supply chain attack, ransomware disruption, Adobe ColdFusion patching, breach costs, and AI-driven threats. The issue connects those reports to vendor oversight, automated patching, behavioral monitoring, and incident-response readiness.

The practical focus is keeping pace: understand which vendors and software components touch your data, keep applications updated, and prepare to detect and contain attacks before they disrupt operations.

September 2026: Cybersecurity by the Numbers

421 security flaws were fixed by Microsoft in a single month — the largest Patch Tuesday release ever recorded — including one already being actively exploited before the fix was available
Ernst & Young — one of the world’s four largest accounting firms — had client tax documents stolen including Social Security numbers, bank account details, and credit card numbers
1.6 million RingCentral business customers had their names, addresses, email addresses, and phone numbers stolen and published after the company declined to pay a ransom
Zoom patched a zero-click vulnerability — a flaw that lets attackers take over a computer during a video call without the victim clicking or doing anything at all
A supply chain attack on a single AI software library silently reached more than 2,500 organizations in one day before anyone noticed
The average cost of a data breach in the United States reached $11.5 million in 2026 — more than double the global average of $4.99 million, according to IBM’s annual report

Ernst & Young is one of the four largest professional services and accounting firms in the world, trusted by major corporations and individuals alike to handle some of their most sensitive financial information. In late July 2026, the criminal group ShinyHunters publicly claimed responsibility for a breach that EY had disclosed weeks earlier — confirming they had stolen client documents containing names, home addresses, Social Security numbers, bank account numbers, credit and debit card numbers, and other information used to prepare tax filings. The stolen data came not from EY’s own systems, but from a third-party support platform EY used internally for tax-related work.

Why a breach at a firm like EY carries such far-reaching consequences:

EY’s clients include major corporations and high-net-worth individuals — meaning the stolen tax documents likely contain the financial details of some of the most financially valuable targets for identity theft and fraud
The attackers spent more than two weeks inside the third-party platform — from March 28 to April 12 — downloading documents during that entire window, suggesting a patient and deliberate operation rather than a smash-and-grab
ShinyHunters also simultaneously claimed breaches of RingCentral and Brinks Home during the same period, demonstrating that the group is running multiple major extortion campaigns in parallel at any given time
EY offered affected clients 24 months of credit monitoring — useful, but no substitute for preventing the theft in the first place, as stolen financial data circulates on criminal markets for years

Key Takeaway: When a trusted vendor is breached, your data goes with it — regardless of how secure your own systems are. The EY breach happened through a third-party support tool, not EY’s core systems. A managed security provider continuously assesses the security of every vendor that touches your data, not just the perimeter of your own network.

Breach Alert: 1.6 Million Business Customers’ Data Published Online After RingCentral Refused to Pay

RingCentral is a cloud-based phone, messaging, and video communication platform used by hundreds of thousands of businesses worldwide to manage their day-to-day communications. In July 2026, ShinyHunters broke in through a social engineering campaign — tricking employees into giving up access — and claimed to have stolen more than 623 gigabytes of customer data. When RingCentral declined to pay the ransom, the group followed through on its threat and published a 280-gigabyte archive of stolen data. By August 13, breach-notification service Have I Been Pwned had confirmed the leak, listing 1.6 million unique customer records including names, addresses, email addresses, and phone numbers.

What the publication of this data means in practice:

Once data is published on criminal forums, it does not disappear — it gets downloaded, shared, and recycled into future attacks indefinitely, meaning the exposure compounds over time
Business phone numbers and email addresses in criminal hands are the raw material for targeted scam calls and emails impersonating colleagues, vendors, or IT support teams
RingCentral is used for internal business communications — meaning stolen contact data may reveal organizational structures that criminals can use to design more convincing impersonation attacks
This incident illustrates a pattern playing out across 2026: criminal groups are not bluffing when they set leak deadlines, and organizations that decline to engage face having their customers’ data published publicly

Key Takeaway: When a criminal group publishes stolen data, the affected customers become targets for every other criminal who downloads it. A managed security provider monitors the dark web for your organization’s data appearing in leaks, enabling rapid response to warn employees and customers before the downstream attacks begin.

Urgent Update: Microsoft Issued the Largest Security Update in Its History — 421 Fixes in a Single Month

Microsoft’s August 2026 Patch Tuesday — the monthly release of security fixes that every organization running Windows, Office, or other Microsoft products needs to apply — set a record that no one wanted to see broken: 421 vulnerabilities patched in a single update. Among them was a flaw in a core Windows component called the afd.sys kernel driver that was already being actively exploited by criminals before the fix was available. This flaw allowed an attacker who had already gained limited access to a computer to instantly escalate their privileges to full SYSTEM-level control — the highest level of access possible on a Windows machine.

What an update of this scale means for organizations:

421 patches in one month means that on average, Microsoft is fixing more than 13 security flaws every single day — a pace that makes manual patch management practically impossible for any organization without automated tools
The exploited kernel driver flaw is particularly significant because it can be used in the second stage of almost any attack — once a criminal gets any foothold in a system, this flaw gives them full control immediately
The update also included fixes for vulnerabilities in the TPM 2.0 reference implementation — the chip found in virtually every modern computer that is supposed to verify the device has not been tampered with
This was the third consecutive month in 2026 where Microsoft issued more than 400 patches — a pace that represents a fundamental shift in how quickly the attack surface is expanding

Key Takeaway: 421 patches cannot be reviewed, tested, and deployed manually across an organization in any reasonable timeframe — especially when criminals are already exploiting some of them on day one. Automated patch management, delivered by a managed security provider, is the only practical way to keep pace with a threat landscape moving this fast.

Zero-Day: A Flaw in Zoom Can Let Criminals Take Over Your Computer During a Video Call — Without You Clicking Anything

Zoom is one of the most widely used video conferencing platforms in the world, used daily by millions of businesses for meetings, client calls, and internal communications. In August 2026, Zoom patched what security researchers classified as a zero-click remote code execution vulnerability — meaning an attacker could take complete control of a victim’s computer during a Zoom session without the victim needing to click a link, open a file, or take any action at all. The attack works by sending specially crafted data during a call, exploiting how Zoom processes that data in the background. The victim would simply be on a Zoom call, and their computer would be compromised without any visible sign.

Why zero-click vulnerabilities in video conferencing tools are especially alarming:

Zoom calls are inherently trusted interactions — employees join calls with colleagues, clients, and vendors without any suspicion, making it an ideal environment for an attack that requires no action from the victim
Executive and leadership teams use video conferencing constantly for sensitive discussions — a compromised device during a call could expose strategic plans, financial information, and confidential communications
Zero-click attacks leave no obvious trace the victim would notice — there is no suspicious email to report, no file they mistakenly opened, no moment they can identify as the point of compromise
Zoom is used on both corporate devices and personal computers — meaning personal devices used for business calls may also be at risk if they are not kept up to date

Key Takeaway: A zero-click attack on a video conferencing platform means that simply showing up to a meeting can be enough for a criminal to take over a device. Ensuring that applications like Zoom are kept updated automatically — across every device in your organization — is exactly the kind of protection a managed security provider handles quietly in the background, every day.

Supply Chain: One Leaked Token in an AI Software Library Silently Reached 2,500 Organizations in a Single Day

LiteLLM is a popular open-source software library used by developers to build applications that connect to AI models like those from OpenAI, Anthropic, and others. It is embedded in thousands of software projects across the technology industry. In August 2026, attackers discovered a leaked authentication token — essentially a digital key — three layers deep in the LiteLLM dependency chain, meaning it was not in LiteLLM itself but in a tool that LiteLLM depends on, which in turn is embedded in thousands of applications. Within a single day, that one leaked token was used to access more than 2,500 organizations’ CI/CD pipelines — the automated systems that build and deploy software.

Why this attack matters beyond the organizations directly affected:

CI/CD pipelines are the assembly lines of the software industry — they are where finished software products are built and packaged before being delivered to customers. Compromising one means an attacker can potentially inject malicious code into the products being shipped
The scale — 2,500 organizations in one day — is only possible because of the interconnected nature of modern software development, where one shared component is embedded in thousands of downstream products
This attack required no hacking in the traditional sense — the attackers simply found a key that had been accidentally left visible, and used it
AI tools and libraries are being adopted at extraordinary speed, often without the same security scrutiny applied to more established software — creating a growing blind spot in many organizations’ security postures

Key Takeaway: The software your organization uses every day is built on layers of components that most people never think about — and criminals are now targeting those hidden layers specifically. A managed security provider with software supply chain monitoring tracks the components your environment relies on and alerts you the moment a compromised dependency is identified.

Ransomware: Ransomware Shut Down Eight Warehouses at One of Europe’s Largest Freight Companies

Ceva Logistics is one of Europe’s largest freight and supply chain management companies, moving goods for major retailers and manufacturers across the continent. On approximately August 1, 2026, a ransomware attack disrupted operations at eight of Ceva’s warehouses, causing shipping delays that rippled out to retail customers waiting for their orders. The attack was significant enough to attract the attention of the Dutch Data Protection Authority, which opened an investigation into the incident. For the retailers and businesses depending on Ceva to move their products, the disruption was immediate and real — empty shelves, delayed deliveries, and frustrated customers.

Why logistics and supply chain companies are high-value ransomware targets:

A logistics company’s value to criminals lies not just in the data it holds, but in its operational role — every hour of downtime translates directly into financial losses for the company and its customers
The pressure to restore warehouse and shipping operations quickly is enormous, making logistics companies more likely to pay ransoms than organizations where a brief outage is merely inconvenient
Businesses that rely on third-party logistics providers inherit the security risk of those providers — if your freight company is hit by ransomware, your supply chain suffers regardless of how secure your own systems are
This attack follows a pattern of ransomware groups targeting operational technology — the systems that run warehouses, factories, and distribution centers — rather than just stealing data

Key Takeaway: Ransomware that shuts down warehouses is not an IT problem — it is a business operations problem with direct financial consequences for every company in the supply chain. A managed security provider builds the backup systems, network segmentation, and incident response plans that allow organizations to contain and recover from ransomware without shutting down operations.

Government Attack: Russia-Linked Hackers Deployed a New Ransomware Strain Through a Trusted Microsoft Tool

In August 2026, Microsoft disclosed that a financially motivated criminal group with links to China — tracked by Microsoft as Storm-1175 — deployed a brand-new ransomware strain called StormEncr. What made this attack particularly notable was the delivery method: the criminals used Storm-1175’s established access to enterprise environments to deploy the ransomware through legitimate Microsoft management tools, making it extremely difficult for security software to distinguish the attack from normal administrative activity. Microsoft’s disclosure came as part of its broader August security update, warning organizations to watch for this new threat.

Why the use of legitimate tools to deliver attacks is a growing and particularly dangerous trend:

Traditional security software looks for malicious programs and suspicious code — when criminals use the same tools that IT administrators use legitimately, many security tools do not raise an alarm
This technique — sometimes called “living off the land” — requires no malware to be installed, meaning there is often nothing for an antivirus program to detect
Storm-1175 had already established access to victim environments before deploying the ransomware, suggesting the group prioritizes stealth and patience over speed — gaining trust before striking
The combination of financial motivation and nation-state-level sophistication makes groups like Storm-1175 among the most dangerous in the current threat landscape

Key Takeaway: When criminals use your own tools against you, traditional antivirus protection is not enough. Detecting these attacks requires behavioral monitoring — watching for legitimate tools being used in unusual ways, at unusual times, by unusual accounts. This is exactly the kind of nuanced, continuous monitoring that a managed security provider delivers around the clock.

Critical Flaw: A Critical Flaw in Adobe’s Web Software Is Being Actively Exploited — Federal Agencies Were Given Days to Patch

Adobe ColdFusion is software used by thousands of businesses and government agencies to run the web applications that power their websites, internal portals, and customer-facing systems. In August 2026, CISA — the U.S. government’s cybersecurity agency — issued an emergency order after discovering that a critical vulnerability in Adobe ColdFusion (CVE-2026-48282) was being actively exploited in the wild. Federal agencies were given an extremely short deadline to apply the patch, reflecting the urgency of the threat. The flaw allows an attacker to remotely execute code on a vulnerable server — meaning they can run any program they want on the web server, as if they were sitting at the keyboard.

Why web application vulnerabilities like this one carry significant business risk:

Web application servers are by definition exposed to the internet — they are designed to be reachable, which means a vulnerability in them can be exploited by anyone, anywhere in the world, without needing to get past other defenses first
ColdFusion servers are frequently used to handle customer data, process transactions, and run internal business applications — a compromised server can expose everything it has access to
CISA’s emergency order and tight deadline signal that exploitation was already underway at scale — meaning organizations that delayed patching were actively under attack during that window
Government agencies running ColdFusion were required to patch within days — a timeline that is only achievable if an organization has automated patch deployment already in place

Key Takeaway: When CISA issues an emergency patching order, the clock is already ticking — and in some cases, the attacks have already started. Meeting government-mandated patching timelines, let alone best-practice timelines, requires automated systems that can deploy fixes across your entire environment in hours rather than days or weeks.

Breach Alert: The Average U.S. Data Breach Now Costs $11.5 Million — More Than Double the Global Average

IBM released its 2026 Cost of a Data Breach Report in late July 2026, and the numbers are stark. The average cost of a data breach in the United States reached $11.5 million — more than double the global average of $4.99 million — making the U.S. the most expensive country in the world to suffer a breach for the seventh consecutive year. These figures include direct costs like legal fees, regulatory fines, and breach notifications, as well as indirect costs like lost customers, reputational damage, and the long-term impact on stock price for publicly traded companies. For smaller organizations without the resources to absorb these costs, a single significant breach can be existential.

What drives the cost of a breach so high — and what reduces it:

The single biggest driver of breach cost is detection time — organizations that take longer to identify and contain a breach pay significantly more. The IBM report found that breaches taking longer than 200 days to contain cost nearly twice as much as those contained within 200 days
Regulatory fines have increased substantially in 2026, particularly in healthcare, financial services, and any sector handling consumer data — adding a legal cost layer on top of the operational and reputational damage
Organizations with mature security programs — including AI-assisted detection and incident response plans — consistently experience lower breach costs and faster containment times
The $11.5 million figure is an average — for organizations handling healthcare, financial, or government data, the costs can be significantly higher due to sector-specific regulations and the sensitivity of the data involved

Key Takeaway: At $11.5 million per breach, the question is no longer whether cybersecurity investment is worth it — it is how to invest most effectively. A managed security provider delivers the detection speed, incident response readiness, and compliance documentation that directly reduce breach costs, often for a fraction of what a single incident would cost to remediate.

AI Threat: Criminals Are Now Using AI to Find the Gaps in Your Security Faster Than Your Team Can Close Them

August 2026’s threat landscape reinforced a pattern that security researchers have been tracking all year: artificial intelligence is no longer just a tool that defenders use — it is increasingly the engine powering attacks. From automated scanning that identifies unpatched systems across thousands of organizations simultaneously, to AI-generated phishing messages that are personalized and indistinguishable from legitimate communications, to autonomous agents that carry out multi-step attacks with no human guidance, the gap between what criminals can do with AI and what most organizations can defend against is widening. SecurityWeek noted in August that more than 200 vulnerabilities have been patched so far in 2026, compared to just 16 in all of 2025.

The concrete ways AI is changing the attack landscape right now:

AI tools allow criminals to scan the entire internet for specific vulnerability signatures within minutes of a new flaw being disclosed — meaning the window between a patch being released and criminals actively exploiting unpatched systems is now measured in hours, not days
AI-generated phishing messages can be personalized using information from LinkedIn, company websites, and previous breaches — making them far more convincing than the generic scam emails employees were trained to recognize
Autonomous attack agents — like the JadePuffer ransomware documented in July — can carry out full attack sequences without a human criminal monitoring the process, enabling simultaneous attacks against hundreds of targets
The explosion in vulnerability disclosures — from 16 patched by Microsoft in all of 2025 to more than 200 in the first eight months of 2026 alone — reflects both more aggressive researcher activity and criminals using AI to find flaws faster

Key Takeaway: AI is making attacks faster, more personalized, and more scalable than anything the industry has seen before. The organizations best positioned to defend against this are those that have already invested in AI-powered detection and automated response — capabilities that a managed security provider brings to bear on your behalf, matching the pace of a threat landscape that never sleeps.

References & Sources

Breach & Incident Reports

[1] BleepingComputer. (2026, July). “Ernst & Young Data Breach Claimed by ShinyHunters Extortion Gang.” bleepingcomputer.com
[2] SecurityWeek. (2026, July). “ShinyHunters Claims Ernst & Young Hack.” securityweek.com
[3] Cybersecurity News. (2026, July). “EY Data Breach Claimed by ShinyHunters Hacker Group.” cybersecuritynews.com
[4] Security Affairs. (2026, July). “ShinyHunters Claims Ernst & Young Data Breach, Threatens to Leak Stolen Data.” securityaffairs.com
[5] Privacy Guides. (2026, August 21). “Data Breach Roundup August 14-20, 2026: RingCentral Data Breach Exposed Info of 1.6 Million Accounts.” privacyguides.org
[6] CISO Platform. (2026, August 14). “Breach Watch: ShinyHunters Leak Hits 1.6M RingCentral Customers.” cisoplatform.com
[7] DMARC Report. (2026, July). “Ernst Receives Warning, RingCentral Named Leak, GitHub Slashes Bounties.” dmarcreport.com
[8] IBM Security. (2026, July 29). “2026 Cost of a Data Breach Report: $4.99M Global Average, $11.5M in the U.S.” ibm.com/security
[9] Bright Defense. (2026, August). “List of Recent Data Breaches in 2026.” brightdefense.com/resources/recent-data-breaches/
[10] PKWARE. (2026, August). “2026 Data Breaches: Cybersecurity Incidents.” pkware.com/blog/2026-data-breaches

Vulnerability & Security Advisories

[11] SecurityWeek. (2026, August 11). “August 2026 Patch Tuesday: Microsoft Fixes 421 CVEs, One Exploited Zero-Day.” securityweek.com
[12] CrowdStrike. (2026, August). “August 2026 Patch Tuesday: Updates and Analysis.” crowdstrike.com/en-us/blog
[13] SecurityWeek. (2026, August). “Zoom Patches Zero-Click Code Execution Vulnerability.” securityweek.com
[14] BleepingComputer. (2026, August). “CISA Orders Feds to Patch Max-Severity ColdFusion Flaw by Friday.” bleepingcomputer.com
[15] SecurityWeek. (2026, August). “Adobe Urges Immediate Patching of Critical ColdFusion, Campaign Classic Flaws.” securityweek.com
[16] SecurityWeek. (2026, August 24). “More Than 200 Vulnerabilities Have Been Patched to Date This Year.” securityweek.com

Threat Intelligence & Industry Research

[17] Senthorus Blog. (2026, August 11). “Cybersecurity Week in Review: August 4-10, 2026.” blog.senthorus.ch
[18] CISO Platform. (2026, August 14). “Supply Chain Attack on LiteLLM Reached 2,500 Organizations.” cisoplatform.com
[19] Picus Security. (2026). “The ShinyHunters Domino Effect: One Breach, Hundreds of Victims.” picussecurity.com
[20] BlackFog. (2026). “The State of Ransomware 2026.” blackfog.com
[21] ACI Learning. (2026). “The Biggest Cyber Breaches of 2026 So Far.” acilearning.com/blog
[22] Experian / BusinessWire. (2026). “AI Takes Center Stage as the Major Threat to Cybersecurity in 2026.” businesswire.com
[23] World Economic Forum. (2026, January). “Global Cybersecurity Outlook 2026.” weforum.org
[24] Breachsense. (2026, August). “Data Breaches in August 2026.” breachsense.com/breaches/2026/august/

Questions or concerns? Contact the Security Team at [email protected].

Stay vigilant, stay secure!

This issue covers vendor breaches, Microsoft security updates, a Zoom zero-click vulnerability, a software supply chain attack, ransomware disruption, Adobe ColdFusion patching, breach costs, and AI-driven attacks. The recurring control themes are vendor oversight, automated patch management, behavioral monitoring, backup readiness, and incident-response planning.

Why does a vendor breach matter if our own systems are secure?

A vendor can hold sensitive information or provide a path into your environment. The newsletter describes how EY’s stolen client documents came from a third-party support platform. Its takeaway is to assess the security of every vendor that touches your data, alongside protecting your own network.

The issue highlights Microsoft’s August security update, a Zoom zero-click flaw, and an actively exploited Adobe ColdFusion vulnerability. It emphasizes automated deployment across the environment, keeping applications updated on every device, and acting quickly when fixes address flaws that criminals are already exploiting.

What does the LiteLLM incident illustrate about software supply chain risk?

The newsletter describes a leaked authentication token in LiteLLM’s dependency chain reaching organizations’ software build and deployment pipelines. Its takeaway is that everyday software relies on hidden layers of components. Monitoring those dependencies helps teams identify compromised components in the environment rather than reviewing only the applications they directly use.

How can organizations prepare for ransomware that disrupts operations?

The Ceva Logistics article connects warehouse downtime to shipping delays and disruption for customers. The newsletter calls for backup systems, network segmentation, and incident-response plans that help contain attacks and support recovery. It also highlights the operational risk businesses inherit from logistics providers and other third parties.

Datapath can help teams apply the newsletter’s priorities through vendor security assessment, automated patch management, software supply chain monitoring, behavioral detection, backup systems, and incident-response planning. Those capabilities connect individual breach reports to ongoing security work across the vendors, applications, devices, and systems an organization relies on.

Disclaimer: This newsletter is intended for informational and marketing purposes only, and nothing presented here is contractually binding or necessarily the final opinion of the authors.

Healthcare

K-12 Districts

Financial Services & PE

Government

Managed IT Services

Co-Managed IT

Local Managed IT

Cybersecurity

Managed IT in Modesto

Managed IT in Fresno

Managed Cybersecurity

Continuous Protection

Operational Stability

Strategic Accountability

About Us

Team

Resources

Blog

Newsletters

Industry News

Locations

Contact Us

September 2026 Cybersecurity Newsletter

Want the next briefing tied to your environment?

Healthcare

K-12 Districts

Financial Services & PE

Government

Solutions Overview

Managed IT Services

Co-Managed IT

Local Managed IT

Cybersecurity

Managed IT in Modesto

Managed IT in Fresno

Managed Cybersecurity

Continuous Protection

Operational Stability

Strategic Accountability

September 2026 Cybersecurity Newsletter

Turn September 2026 cybersecurity news into a readiness review

September 2026: Cybersecurity by the Numbers

Breach Alert: Ernst & Young Hacked: Your Tax Documents — Social Security Numbers and All — Were Stolen

Further Reading

Breach Alert: 1.6 Million Business Customers’ Data Published Online After RingCentral Refused to Pay

Further Reading

Urgent Update: Microsoft Issued the Largest Security Update in Its History — 421 Fixes in a Single Month

Further Reading

Zero-Day: A Flaw in Zoom Can Let Criminals Take Over Your Computer During a Video Call — Without You Clicking Anything

Further Reading

Supply Chain: One Leaked Token in an AI Software Library Silently Reached 2,500 Organizations in a Single Day

Further Reading

Ransomware: Ransomware Shut Down Eight Warehouses at One of Europe’s Largest Freight Companies

Further Reading

Government Attack: Russia-Linked Hackers Deployed a New Ransomware Strain Through a Trusted Microsoft Tool

Further Reading

Critical Flaw: A Critical Flaw in Adobe’s Web Software Is Being Actively Exploited — Federal Agencies Were Given Days to Patch

Further Reading

Breach Alert: The Average U.S. Data Breach Now Costs $11.5 Million — More Than Double the Global Average

Further Reading

AI Threat: Criminals Are Now Using AI to Find the Gaps in Your Security Faster Than Your Team Can Close Them

Further Reading

References & Sources

Breach & Incident Reports

Vulnerability & Security Advisories

Threat Intelligence & Industry Research