April 2026 Cyber Attacks and Data Breaches: A Roundup With a Severity Read

April 2026 was a month of identity-driven extortion far more than classic malware. A single social-engineering playbook — phone a help desk or an employee, talk them into a cloud login, then quietly export the CRM — ran through one large organisation after another. Alongside it came a damaging healthcare-software ransomware attack, a national identity-agency breach, a nine-figure crypto heist and an actively-exploited SharePoint zero-day. This is an independent, attributed digest: every figure is sourced, each item is marked confirmed, claimed or reported, with a defensive takeaway. PlayCISO is independent and not affiliated with any organisation named here; this is general information, not commentary on any specific party's conduct.

Method, and a note on the severity scores

We checked each item against primary disclosures, regulator filings and established security-outlet reporting, corrected or dropped figures where sources disagreed, and left out several widely-reposted items we could not stand up. Where only the attacker has stated a number, we say so and treat it as a claim, not a fact.

The editorial severity beside each entry is a subjective PlayCISO reading out of ten — how much we think a security leader should care, given scale, sensitivity and how actionable the fix is. It is not CVSS, not EPSS and not any recognised standard; use it as a quick relative signal only.

The story of the month: the ShinyHunters / Salesforce extortion wave

The thread running through April was a campaign attributed to the ShinyHunters extortion brand against organisations' Salesforce environments. The pattern was consistent: a voice-phishing (vishing) call tricked an employee into surrendering access to a cloud identity (Microsoft Entra or Okta single sign-on), after which the attackers exported customer-relationship data and demanded payment to avoid a leak-site listing. Takeaway: the control that would have stopped most of these is phishing-resistant MFA plus tight, well-scoped permissions on the SaaS and identity platforms that keep turning out to be the door.

• Charter Communications (Spectrum). ShinyHunters says it used a vishing call on 1 April to obtain an employee's Entra credentials and reach Charter's Salesforce data, then listed the company before a late-May deadline. Charter confirmed a breach of sales tools for current, past and prospective business customers and said no sensitive personal or telecom account data was released. Have I Been Pwned verified about 4.9 million accounts; the group's 40 to 42 million figure is an unverified claim. Status: Confirmed (intrusion); volume claimed. Editorial severity: 7/10.
• ADT. ADT confirmed it was breached and faced extortion by ShinyHunters, with access reportedly running through a compromised single-sign-on account via a vishing call into its Salesforce instance; the group published an archive after ADT declined to pay. Status: Confirmed; exact counts vary by source. Editorial severity: 6/10.
• Pitney Bowes. The mailing-and-shipping firm confirmed unauthorised access to customer data in its Salesforce environment. ShinyHunters claimed over 25 million records; Have I Been Pwned put the leaked dataset at about 8.2 million unique email addresses with names, phone numbers and physical addresses. Status: Confirmed; 25M volume claimed. Editorial severity: 6/10.
• Vimeo. Vimeo confirmed a breach reached through a third-party analytics vendor (Anodot), exposing emails, technical data and video metadata — and explicitly not login credentials or payment data. Status: Confirmed (via supplier). Editorial severity: 4/10. Takeaway: your supplier's breach is your breach — see our primer on data leakage.
• Medtronic. The medical-device maker confirmed an unauthorised party accessed certain corporate IT systems between about 13 and 19 April (products and manufacturing unaffected), and later notified 3,834,294 individuals per its Indiana attorney-general filing — data potentially including names, dates of birth, Social Security numbers and health information. ShinyHunters claimed more than 9 million records, which Medtronic has not validated. Status: Confirmed (intrusion and 3.83M notified); 9M claimed. Editorial severity: 7/10.

Confirmed: ransomware and operational disruption

• ChipSoft (Netherlands). The Dutch healthcare-IT vendor was hit by ransomware around 7 April, confirmed by the sector response team Z-CERT; ChipSoft disabled connections to core platforms (including its widely-used HiX hospital system), and roughly a dozen Dutch hospitals pulled software offline, with knock-on portal disruption reported in Belgium. Z-CERT said critical care processes had not halted. Status: Confirmed. Editorial severity: 8/10. Takeaway: a shared healthcare-software vendor is systemic concentration risk; map your dependence on it and your manual fallback before you need it.
• Jones Day (global law firm). Jones Day confirmed a phishing-led incident in which an unauthorised third party accessed a limited number of dated files relating to about 10 clients; it notified those affected. The Silent Ransom Group (also tracked as Luna Moth) claimed the attack and, per an unverified negotiation screenshot, reportedly demanded around $13 million. Status: Confirmed (breach); ransom figure claimed. Editorial severity: 6/10. Takeaway: law firms hold concentrated, high-sensitivity data on behalf of others — treat phishing resistance and data minimisation as client obligations, not just internal hygiene.
• Winona County, Minnesota. The county detected a ransomware attack on about 6-7 April — its second of the year by a different group — and took systems including vital statistics and DMV offline; Minnesota's governor issued an executive order bringing in the National Guard's Cyber Protection Team, with offices expected back near full operation by 24 April. Emergency services were not affected. Status: Confirmed. Editorial severity: 6/10. Takeaway: the repeat hit shows recovery without hardening just buys time.

Confirmed: government and national-scale breaches

France Titres / ANTS — national identity-document agency. France confirmed a breach of the agency that manages citizens' identity documents, detected around 15 April and reportedly caused by an insecure-direct-object-reference (IDOR) flaw in its API. Exposed fields could include login IDs, names, emails, dates of birth and in some cases addresses and phone numbers; uploaded identity documents were said not to be compromised. Reporting cites a government-stated figure of about 11.7 million accounts, while an actor using the alias "breach3d" advertised 19 million records for sale. Status: Confirmed (breach); count disputed (11.7M stated vs 19M claimed). Editorial severity: 8/10. Takeaway: access-control bugs like IDOR do not need malware to spill a nation's data — test authorization on every object reference, not just authentication at the front door.

Confirmed: a nine-figure crypto heist

Kelp DAO / LayerZero — about $290 million. On 18 April, roughly $290 million in rsETH was drained from the restaking protocol Kelp DAO. LayerZero described the attack as compromising the RPC nodes used by its verifier and then forcing a failover with a DDoS so a forged cross-chain message could be pushed through, and called attribution preliminary, pointing to a "highly sophisticated state actor, likely DPRK's Lazarus Group." The two firms dispute the root cause. Status: Confirmed (theft); attribution suspected. Editorial severity: 7/10. Takeaway: single points of trust — one verifier, one node provider — are where nine-figure losses originate; threat-model the failure modes, not just the happy path, with our threat-modeling tool.

Confirmed: actively-exploited flaws and patches

• Microsoft April Patch Tuesday — a SharePoint zero-day under active attack. Microsoft shipped roughly 160-plus fixes (sources cite figures from 163 to 167), including CVE-2026-32201, a SharePoint Server spoofing flaw exploited in the wild; a separate Microsoft Defender elevation-of-privilege bug (CVE-2026-33825, publicly discussed as "BlueHammer") was disclosed ahead of the patch. Status: Confirmed. Editorial severity: 7/10. Takeaway: do not try to swallow 160+ fixes at once — rank by "actively exploited / public proof-of-concept" and patch the SharePoint zero-day first.
• CISA KEV additions (20 April) — including Cisco Catalyst SD-WAN Manager. CISA added eight actively-exploited vulnerabilities to its Known Exploited Vulnerabilities catalog, three of them in Cisco Catalyst SD-WAN Manager (CVE-2026-20122, CVE-2026-20128 and CVE-2026-20133), with the Cisco flaws carrying a short federal remediation deadline. Status: Confirmed. Editorial severity: 7/10. Takeaway: the KEV catalog is a free, exploitation-backed patch queue — mirror it into your own prioritisation even if you are not a federal agency.

Supply chain and the AI-toolchain angle

axios npm package compromise (late March, carried into April). On 31 March two malicious versions of the enormously popular axios HTTP client (over 100 million weekly downloads) were briefly published to npm via a hijacked maintainer account; the only change was a dependency whose post-install hook deployed a cross-platform remote-access trojan. The window was roughly three hours before npm pulled the packages, and Google's threat-intelligence group attributed the campaign to a North Korea-nexus actor. Status: Confirmed (prior-month event, dominant in early-April response). Editorial severity: 8/10. Takeaway: audit your dependency tree for the malicious axios versions, isolate anything that pulled them and rotate reachable secrets.

On the much-repeated "AI is doing the hacking now" framing: there was no well-sourced April case of an AI system autonomously running an intrusion. What is clearly real is that attackers are increasingly targeting the developer and AI toolchain itself — the axios compromise is the sharpest example. Weight confirmed disclosures over threat-actor and second-hand AI claims.

What to do this week

• Lock down SaaS and identity. Enforce phishing-resistant MFA and least privilege on Salesforce, Entra and Okta, and brief help desks on vishing — the single credential handed over by phone was April's recurring entry point.
• Treat suppliers as in-scope. Inventory what each SaaS and software vendor holds and rehearse a third-party incident; the worst April breaches reached victims through a supplier. Score them with our Vendor Risk Scorecard.
• Audit the axios exposure and rotate anything the malicious versions could have reached.
• Patch what is being exploited — the SharePoint zero-day (CVE-2026-32201) and the Cisco Catalyst SD-WAN Manager flaws CISA flagged — ahead of the long tail.
• Build in layers so one compromised credential is not game over — see defense in depth — and put a defensible figure on exposure with the Breach Cost calculator. For the broader year's arc, see our October 2026 roundup.

Frequently asked questions

Biggest attacks of April 2026? The ShinyHunters Salesforce extortion wave (Charter/Spectrum, ADT, Pitney Bowes, Vimeo, Medtronic), the ChipSoft ransomware attack on Dutch healthcare software, the Jones Day law-firm breach, the Winona County ransomware attack, the France Titres (ANTS) identity-agency breach, the ~$290M Kelp DAO crypto theft, an actively-exploited SharePoint zero-day (CVE-2026-32201), and the axios npm supply-chain compromise.

How were the severity scores decided? A subjective PlayCISO reading out of ten — not CVSS or any standard. Use it as a relative signal only.

Were the breach numbers real? Treat attacker figures as unverified: Charter's 40 to 42 million (about 4.9 million verified by Have I Been Pwned), Medtronic's 9 million (3,834,294 per its own filing) and France Titres' 19 million (about 11.7 million government-stated) are all claims the organisations did not confirm.

Did AI carry out any attacks? No well-sourced April case shows AI running an intrusion on its own; the real theme is attackers targeting the developer and AI toolchain, as the North-Korea-linked axios compromise shows.

What to do first? Lock down SaaS and identity against vishing, treat suppliers as in-scope risk, audit the axios exposure, and patch the SharePoint and Cisco flaws being exploited.