August 2026 Cyber Attacks and Data Breaches: A Roundup With a Severity Read
August 2026 was a heavy month. A China-nexus espionage actor (tracked as ARMORY CASTLE / UNC5221) exploited a BeyondTrust Remote Support zero-day, CVE-2026-102764, from around 29 August — months before the vendor disclosed and patched it in mid-October and CISA added it to the Known Exploited Vulnerabilities catalogue. ShinyHunters-style social engineering drove a run of extortion claims: McKesson disclosed unauthorised access to third-party apps on 28 August with the group claiming ~284 million records (unverified), RingCentral reported ~1.6 million affected accounts, and Carhartt was hit with a 50 GB claim. Manchester Airports Group confirmed a breach affecting roughly 8.7 million customers across three UK airports. Apollo Global Management, Baylor Genetics, Latvia’s CSDD, CareCloud and Heights Finance all reported large exposures. Comparitech counted a record 997 ransomware claims for the month (only 77 confirmed by victims at the time), with Qilin and The Gentlemen the most active. Operational technology took real hits — a Russia-linked intrusion briefly stopped a Polish combined-heat-and-power plant, and US water and port operators ran manually after attacks. This roundup labels every item Confirmed / Claimed / Reported, assigns a subjective 1–10 editorial severity (not a CVSS score), and pulls out the defensive lesson. Where a claim is an attacker’s, we say so.
August 2026 did not let up. A China-nexus espionage crew was quietly exploiting a BeyondTrust Remote Support zero-day from the last days of the month; ShinyHunters-style social engineering drove extortion claims against McKesson, RingCentral and Carhartt; Manchester Airports Group confirmed a breach touching millions; and ransomware hit a record monthly volume. This is our monthly roundup — independent, defensively framed, and honest about what is confirmed versus merely claimed.
How to read this (method note)
Every item carries a status: Confirmed (acknowledged by the organisation, a regulator, or a government body), Claimed (an assertion by an attacker or leak site, not yet verified), or Reported (described by credible outlets but not fully confirmed).
The severity N/10 is a subjective editorial read of blast radius, data sensitivity and systemic impact — not a CVSS score, and not comparable to one.
Some numbers — especially victim counts from leak sites — are unverified. We say so rather than repeat them as fact. PlayCISO is independent and not affiliated with any organisation named here; this is general information, not incident-specific advice. Verify against the primary source before you act.
Nation-state and actively exploited zero-days
BeyondTrust Remote Support — CVE-2026-102764. This is the month's most consequential item even though the public disclosure came later. BeyondTrust and Google Threat Intelligence Group / Mandiant assess that a suspected China-nexus espionage actor — ARMORY CASTLE, formerly tracked as UNC5221 — began exploiting a critical flaw in Remote Support around 29 August 2026, against a BeyondTrust-hosted instance and a self-hosted appliance. The bug (an internal messaging component that fails to validate message origin, allowing an unauthenticated attacker to perform file operations) scores 9.3 on CVSS 4.0, and Mandiant observed privilege escalation to root, custom malware, credential harvesting and pivoting into downstream systems. The advisory (BT26-05), the patch and the CISA Known Exploited Vulnerabilities listing all landed in mid-October 2026. Status: Confirmed (exploitation and attribution acknowledged by vendor and Mandiant; disclosed October, exploited from late August). Severity 9/10. Takeaway: privileged remote-access tooling is a crown-jewel target — it reaches everything. Minimise its exposure, watch it closely, and assume "no patch available yet" is a live state for edge appliances.
Windows AFD for WinSock zero-day — CVE-2026-68820. Reporting around 12 August tied active exploitation of an Ancillary Function Driver for WinSock flaw to Lazarus (the long-running Operation Dream Job activity), used to gain SYSTEM privileges. Status: Reported. Severity 8/10. Takeaway: local privilege-escalation zero-days turn an initial foothold into full control; endpoint detection and prompt Patch-Tuesday discipline both matter.
Edge devices under sustained fire — SonicWall, N-able N-central, Citrix NetScaler, Zimbra. CISA flagged SonicWall SMA1000 flaws (CVE-2026-15409 / CVE-2026-15410) being used by ransomware crews; an N-central authentication bypass (CVE-2026-10867, with Storm-1175 activity reported) was actively exploited to deploy ransomware; two NetScaler flaws (CVE-2026-19489 / CVE-2026-19490) drew urgent patch calls; and Shadowserver counted 274 compromised Zimbra servers with thousands more unpatched. Status: Confirmed (CISA / Shadowserver). Severity 7/10. Takeaway: the internet-facing perimeter is still where the breaches start. Keep an authoritative inventory of what you expose and patch it on the vendor's clock, not yours. A structured threat-modelling exercise helps you find the appliances you forgot you run.
Big breaches and extortion
McKesson. The healthcare and pharmaceutical-distribution giant disclosed in an SEC Form 8-K on 28 August that it discovered an incident on 25 August involving unauthorised access to third-party applications and data exfiltration, and said it had not determined the incident to be material. ShinyHunters claimed roughly 284 million records (the group itself called that a raw record count, not unique individuals) and a multi-million-dollar ransom. McKesson has not confirmed those figures. Status: Confirmed incident / Claimed scale. Severity 8/10.
Manchester Airports Group (MAG). The operator of Manchester, Stansted and East Midlands airports confirmed a breach of customer sign-up data (car park, lounge, Fast Track, airport Wi-Fi). A MAG spokesperson put the figure at roughly 8.7 million customers; the company stressed no bank or payment details were involved and airport operations ran normally. Status: Confirmed (8.7M attributed to MAG). Severity 7/10.
Apollo Global Management. Social engineering gave attackers access to a cloud environment between 6–10 July 2026 (disclosed in August), exposing names, dates of birth, addresses and Social Security numbers; the activity is linked to a broader campaign. Status: Confirmed. Severity 7/10.
RingCentral. ShinyHunters used social engineering to reach data on about 1.6 million accounts; the core platform kept running. Status: Reported. Severity 6/10.
Carhartt. ShinyHunters claimed 50 GB of data after a reported $3.3 million extortion demand; independent analysis put the credible figure near 12.9 million people. Status: Claimed. Severity 6/10.
Baylor Genetics. Around 2.8 million people may be affected, with reported exposure of genetic test results and SSNs — among the most sensitive categories a breach can touch. Status: Reported. Severity 7/10.
Latvia's CSDD (road traffic safety directorate). Historical payment records were stolen, affecting over 1.2 million people and 200,000 entities; officials resigned, though daily services continued. Status: Confirmed. Severity 6/10.
CareCloud and Heights Finance. CareCloud reported stolen patient data with a disputed count (a 345,000 headline figure against a 3.75 million body figure that reporting did not reconcile — a reminder to read past the headline). Heights Finance reported 734,828 people with financial data and SSNs exposed. Status: Reported (CareCloud) / Confirmed (Heights). Severity 6/10.
The through-line in this section is not a single vendor or a single bug — it is identity and the help desk. Voice phishing and support-desk social engineering, plus access through third-party SaaS and logistics partners, drove most of these. If you want to size what one of these events would cost you, our breach-cost estimator and the explainer on how data-breach cost is actually calculated are a grounded starting point, and the vendor-risk scorecard helps you rank the third parties that keep showing up as the entry point.
Ransomware at record volume
A record month by count. Comparitech counted 997 ransomware claims in August 2026 — the highest monthly total it has tracked, up sharply from July. Crucially, only 77 were confirmed by the affected organisations at the time; the rest were leak-site claims. Qilin and The Gentlemen were the most prolific, and healthcare and utilities saw notable increases. Status: Reported (aggregate stat; most underlying claims unverified). Severity 7/10 as a trend. The gap between 997 claims and 77 confirmations is the whole point of a status label: volume on a leak site is marketing, not evidence.
Cl0p's extortion run. Around 17 August, Cl0p claimed data from Shell (~89 GB), GE and Philips. Philips said an attempted compromise of an internal server was contained; Shell and GE were assessing. Status: Claimed (Philips reports containment). Severity 5/10 pending confirmation.
U.S. ATF. Qilin listed the Bureau of Alcohol, Tobacco, Firearms and Explosives on its leak site; the agency confirmed a compromised standalone system and classed it as a major incident. Status: Confirmed. Severity 6/10.
Operational technology and critical infrastructure
Polish combined-heat-and-power plant. Around 10 August, a Russia-linked actor tracked as Electrum reportedly moved from a wind-farm network into a CHP plant, switched Siemens PLCs to STOP mode and caused a brief outage. Status: Reported. Severity 7/10.
US water and ports. Columbus Water Works (Georgia) moved to manual operations after an attack, with water supply and quality unaffected; North Carolina Ports forced all three facilities to manual operations. Status: Confirmed / Reported. Severity 6/10. Takeaway: OT resilience is about being able to run manually and recover — segmentation between IT, OT and safety systems is the control that keeps a data-theft event from becoming a physical-process event. This is defence in depth in its most literal form.
The AI angle
Two August items are worth naming because they are reasonably sourced, not because AI-attack hype deserves it. Reporting described a hybrid human-plus-AI-agent intrusion into Taiwanese government agencies (around 13 August) that allegedly compromised at least 85 accounts and extracted over 2,500 personnel records, and a suspected China-based group tracked as SilkParasite (around 20 August) using spearphishing and AI-assisted malware against Central Asian government bodies. Status: Reported (both). Severity 6/10. The defensive reading is deliberately unglamorous: AI changes the speed and scale of familiar techniques — phishing, account compromise, malware iteration — far more than it invents new ones. The controls that worked last year still work; you just need them to hold up under more attempts.
What to take away
Strip away the logos and August repeats three lessons. Edge and remote-access appliances are the front line — BeyondTrust, SonicWall, N-central, NetScaler and Zimbra were all exploited, several before disclosure; inventory them and patch on the vendor's schedule. The help desk is an attack surface — voice phishing and support-desk social engineering drove the McKesson, Apollo and RingCentral events, so add call-back verification and tighten SaaS and identity-provider session controls. And your third parties are your breach surface — a large share of August's exposures arrived through a vendor, a logistics partner or a cloud platform rather than the named company's own core systems. Misconfigured and publicly exposed data stores (the UKGI exposure, an open Brazilian health database) round out the picture; understanding how data leakage happens is a cheaper lesson than living it. If you build or expose services programmatically, our security APIs can wire some of these checks into your own pipelines.
We publish this roundup every month. As always: these are summaries of public reporting with a subjective severity read, not legal or incident-specific advice, and attacker claims are claims until the victim or an investigator confirms them. Check the primary source before you move.
Frequently asked questions
Ready to practise the decisions these articles describe?
Run a free War Room →