# April 2026 Cyber Attacks and Data Breaches: A Roundup With a Severity Read

> An independent, attributed roundup of the major cybersecurity incidents of April 2026 — from the ShinyHunters Salesforce extortion wave hitting Charter/Spectrum, ADT, Pitney Bowes, Vimeo and Medtronic, to the ChipSoft ransomware attack on Dutch hospitals, the France Titres (ANTS) identity-portal breach, a Microsoft SharePoint zero-day and the ~$290M Kelp DAO crypto theft. Each item carries a verification status (confirmed, claimed or reported) and a clearly-labelled subjective editorial severity, with a defensive takeaway.

Source: https://playciso.com/blog/april-2026-cybersecurity-breaches-roundup · Published: 2026-04-30 · Publisher: PlayCISO (https://playciso.com)

---

April 2026 was a month of **identity-driven extortion** far more than classic malware. A single social-engineering playbook — phone a help desk or an employee, talk them into a cloud login, then quietly export the CRM — ran through one large organisation after another. Alongside it came a damaging **healthcare-software ransomware** attack, a **national identity-agency** breach, a nine-figure **crypto heist** and an actively-exploited **SharePoint zero-day**. This is an independent, attributed digest: every figure is sourced, each item is marked **confirmed**, **claimed** or **reported**, with a defensive takeaway. _PlayCISO is independent and not affiliated with any organisation named here; this is general information, not commentary on any specific party's conduct._ ## Method, and a note on the severity scores We checked each item against primary disclosures, regulator filings and established security-outlet reporting, corrected or dropped figures where sources disagreed, and left out several widely-reposted items we could not stand up. Where only the attacker has stated a number, we say so and treat it as a **claim**, not a fact. The **editorial severity** beside each entry is a **subjective PlayCISO reading out of ten** — how much we think a security leader should care, given scale, sensitivity and how actionable the fix is. It is **not CVSS, not EPSS and not any recognised standard**; use it as a quick relative signal only. ## The story of the month: the ShinyHunters / Salesforce extortion wave The thread running through April was a campaign attributed to the **ShinyHunters** extortion brand against organisations' **Salesforce** environments. The pattern was consistent: a **voice-phishing (vishing) call** tricked an employee into surrendering access to a cloud identity (Microsoft Entra or Okta single sign-on), after which the attackers exported customer-relationship data and demanded payment to avoid a leak-site listing. _Takeaway: the control that would have stopped most of these is phishing-resistant MFA plus tight, well-scoped permissions on the SaaS and identity platforms that keep turning out to be the door._ - Charter Communications (Spectrum). ShinyHunters says it used a vishing call on 1 April to obtain an employee's Entra credentials and reach Charter's Salesforce data, then listed the company before a late-May deadline. Charter confirmed a breach of sales tools for current, past and prospective business customers and said no sensitive personal or telecom account data was released. Have I Been Pwned verified about 4.9 million accounts; the group's 40 to 42 million figure is an unverified claim. Status: Confirmed (intrusion); volume claimed. Editorial severity: 7/10. - ADT. ADT confirmed it was breached and faced extortion by ShinyHunters, with access reportedly running through a compromised single-sign-on account via a vishing call into its Salesforce instance; the group published an archive after ADT declined to pay. Status: Confirmed; exact counts vary by source. Editorial severity: 6/10. - Pitney Bowes. The mailing-and-shipping firm confirmed unauthorised access to customer data in its Salesforce environment. ShinyHunters claimed over 25 million records; Have I Been Pwned put the leaked dataset at about 8.2 million unique email addresses with names, phone numbers and physical addresses. Status: Confirmed; 25M volume claimed. Editorial severity: 6/10. - Vimeo. Vimeo confirmed a breach reached through a third-party analytics vendor (Anodot), exposing emails, technical data and video metadata — and explicitly not login credentials or payment data. Status: Confirmed (via supplier). Editorial severity: 4/10. Takeaway: your supplier's breach is your breach — see our primer on data leakage. - Medtronic. The medical-device maker confirmed an unauthorised party accessed certain corporate IT systems between about 13 and 19 April (products and manufacturing unaffected), and later notified 3,834,294 individuals per its Indiana attorney-general filing — data potentially including names, dates of birth, Social Security numbers and health information. ShinyHunters claimed more than 9 million records, which Medtronic has not validated. Status: Confirmed (intrusion and 3.83M notified); 9M claimed. Editorial severity: 7/10. ## Confirmed: ransomware and operational disruption - ChipSoft (Netherlands). The Dutch healthcare-IT vendor was hit by ransomware around 7 April, confirmed by the sector response team Z-CERT; ChipSoft disabled connections to core platforms (including its widely-used HiX hospital system), and roughly a dozen Dutch hospitals pulled software offline, with knock-on portal disruption reported in Belgium. Z-CERT said critical care processes had not halted. Status: Confirmed. Editorial severity: 8/10. Takeaway: a shared healthcare-software vendor is systemic concentration risk; map your dependence on it and your manual fallback before you need it. - Jones Day (global law firm). Jones Day confirmed a phishing-led incident in which an unauthorised third party accessed a limited number of dated files relating to about 10 clients; it notified those affected. The Silent Ransom Group (also tracked as Luna Moth) claimed the attack and, per an unverified negotiation screenshot, reportedly demanded around $13 million. Status: Confirmed (breach); ransom figure claimed. Editorial severity: 6/10. Takeaway: law firms hold concentrated, high-sensitivity data on behalf of others — treat phishing resistance and data minimisation as client obligations, not just internal hygiene. - Winona County, Minnesota. The county detected a ransomware attack on about 6-7 April — its second of the year by a different group — and took systems including vital statistics and DMV offline; Minnesota's governor issued an executive order bringing in the National Guard's Cyber Protection Team, with offices expected back near full operation by 24 April. Emergency services were not affected. Status: Confirmed. Editorial severity: 6/10. Takeaway: the repeat hit shows recovery without hardening just buys time. ## Confirmed: government and national-scale breaches **France Titres / ANTS — national identity-document agency.** France confirmed a breach of the agency that manages citizens' identity documents, detected around **15 April** and reportedly caused by an insecure-direct-object-reference (IDOR) flaw in its API. Exposed fields could include login IDs, names, emails, dates of birth and in some cases addresses and phone numbers; uploaded identity documents were said not to be compromised. Reporting cites a **government-stated figure of about 11.7 million accounts**, while an actor using the alias "breach3d" advertised **19 million records** for sale. **Status: Confirmed (breach); count disputed (11.7M stated vs 19M claimed). Editorial severity: 8/10.** _Takeaway: access-control bugs like IDOR do not need malware to spill a nation's data — test authorization on every object reference, not just authentication at the front door._ ## Confirmed: a nine-figure crypto heist **Kelp DAO / LayerZero — about $290 million.** On **18 April**, roughly $290 million in rsETH was drained from the restaking protocol Kelp DAO. LayerZero described the attack as compromising the RPC nodes used by its verifier and then forcing a failover with a DDoS so a forged cross-chain message could be pushed through, and called attribution **preliminary**, pointing to a "highly sophisticated state actor, likely DPRK's Lazarus Group." The two firms dispute the root cause. **Status: Confirmed (theft); attribution suspected. Editorial severity: 7/10.** _Takeaway: single points of trust — one verifier, one node provider — are where nine-figure losses originate; threat-model the failure modes, not just the happy path, with our [threat-modeling tool](/tools/threat-model)._ ## Confirmed: actively-exploited flaws and patches - Microsoft April Patch Tuesday — a SharePoint zero-day under active attack. Microsoft shipped roughly 160-plus fixes (sources cite figures from 163 to 167), including CVE-2026-32201, a SharePoint Server spoofing flaw exploited in the wild; a separate Microsoft Defender elevation-of-privilege bug (CVE-2026-33825, publicly discussed as "BlueHammer") was disclosed ahead of the patch. Status: Confirmed. Editorial severity: 7/10. Takeaway: do not try to swallow 160+ fixes at once — rank by "actively exploited / public proof-of-concept" and patch the SharePoint zero-day first. - CISA KEV additions (20 April) — including Cisco Catalyst SD-WAN Manager. CISA added eight actively-exploited vulnerabilities to its Known Exploited Vulnerabilities catalog, three of them in Cisco Catalyst SD-WAN Manager (CVE-2026-20122, CVE-2026-20128 and CVE-2026-20133), with the Cisco flaws carrying a short federal remediation deadline. Status: Confirmed. Editorial severity: 7/10. Takeaway: the KEV catalog is a free, exploitation-backed patch queue — mirror it into your own prioritisation even if you are not a federal agency. ## Supply chain and the AI-toolchain angle **axios npm package compromise (late March, carried into April).** On **31 March** two malicious versions of the enormously popular **axios** HTTP client (over **100 million weekly downloads**) were briefly published to npm via a hijacked maintainer account; the only change was a dependency whose post-install hook deployed a cross-platform remote-access trojan. The window was roughly three hours before npm pulled the packages, and Google's threat-intelligence group attributed the campaign to a **North Korea-nexus** actor. **Status: Confirmed (prior-month event, dominant in early-April response). Editorial severity: 8/10.** _Takeaway: audit your dependency tree for the malicious axios versions, isolate anything that pulled them and rotate reachable secrets._ On the much-repeated "AI is doing the hacking now" framing: there was **no well-sourced April case** of an AI system autonomously running an intrusion. What is clearly real is that attackers are increasingly **targeting the developer and AI toolchain itself** — the axios compromise is the sharpest example. Weight confirmed disclosures over threat-actor and second-hand AI claims. ## What to do this week - Lock down SaaS and identity. Enforce phishing-resistant MFA and least privilege on Salesforce, Entra and Okta, and brief help desks on vishing — the single credential handed over by phone was April's recurring entry point. - Treat suppliers as in-scope. Inventory what each SaaS and software vendor holds and rehearse a third-party incident; the worst April breaches reached victims through a supplier. Score them with our Vendor Risk Scorecard. - Audit the axios exposure and rotate anything the malicious versions could have reached. - Patch what is being exploited — the SharePoint zero-day (CVE-2026-32201) and the Cisco Catalyst SD-WAN Manager flaws CISA flagged — ahead of the long tail. - Build in layers so one compromised credential is not game over — see defense in depth — and put a defensible figure on exposure with the Breach Cost calculator. For the broader year's arc, see our October 2026 roundup. ## Frequently asked questions **Biggest attacks of April 2026?** The ShinyHunters Salesforce extortion wave (Charter/Spectrum, ADT, Pitney Bowes, Vimeo, Medtronic), the ChipSoft ransomware attack on Dutch healthcare software, the Jones Day law-firm breach, the Winona County ransomware attack, the France Titres (ANTS) identity-agency breach, the ~$290M Kelp DAO crypto theft, an actively-exploited SharePoint zero-day (CVE-2026-32201), and the axios npm supply-chain compromise. **How were the severity scores decided?** A subjective PlayCISO reading out of ten — not CVSS or any standard. Use it as a relative signal only. **Were the breach numbers real?** Treat attacker figures as unverified: Charter's 40 to 42 million (about 4.9 million verified by Have I Been Pwned), Medtronic's 9 million (3,834,294 per its own filing) and France Titres' 19 million (about 11.7 million government-stated) are all claims the organisations did not confirm. **Did AI carry out any attacks?** No well-sourced April case shows AI running an intrusion on its own; the real theme is attackers targeting the developer and AI toolchain, as the North-Korea-linked axios compromise shows. **What to do first?** Lock down SaaS and identity against vishing, treat suppliers as in-scope risk, audit the axios exposure, and patch the SharePoint and Cisco flaws being exploited.