# August 2026 Cyber Attacks and Data Breaches: A Roundup With a Severity Read

> An independent, defensive roundup of August 2026’s biggest cyber incidents: the BeyondTrust Remote Support zero-day (CVE-2026-102764) exploited by a China-nexus actor from late August, the McKesson and Manchester Airports Group breaches, a record 997 ransomware claims, social-engineering hits on Apollo, RingCentral and Carhartt, OT attacks on energy and water, and the AI angle. Each item carries a status label (Confirmed / Claimed / Reported) and a subjective 1–10 severity read.

Source: https://playciso.com/blog/august-2026-cybersecurity-breaches-roundup · Published: 2026-08-31 · Publisher: PlayCISO (https://playciso.com)

---

August 2026 did not let up. A China-nexus espionage crew was quietly exploiting a **BeyondTrust Remote Support zero-day** from the last days of the month; **ShinyHunters-style social engineering** drove extortion claims against McKesson, RingCentral and Carhartt; **Manchester Airports Group** confirmed a breach touching millions; and ransomware hit a **record monthly volume**. This is our monthly roundup — independent, defensively framed, and honest about what is confirmed versus merely claimed. How to read this (method note) Every item carries a **status**: **Confirmed** (acknowledged by the organisation, a regulator, or a government body), **Claimed** (an assertion by an attacker or leak site, not yet verified), or **Reported** (described by credible outlets but not fully confirmed). The **severity N/10** is a **subjective editorial read** of blast radius, data sensitivity and systemic impact — _not_ a CVSS score, and not comparable to one. Some numbers — especially victim counts from leak sites — are **unverified**. We say so rather than repeat them as fact. PlayCISO is independent and not affiliated with any organisation named here; this is general information, not incident-specific advice. Verify against the primary source before you act. ## Nation-state and actively exploited zero-days **BeyondTrust Remote Support — CVE-2026-102764.** This is the month's most consequential item even though the public disclosure came later. BeyondTrust and Google Threat Intelligence Group / Mandiant assess that a suspected China-nexus espionage actor — **ARMORY CASTLE**, formerly tracked as **UNC5221** — began exploiting a critical flaw in Remote Support **around 29 August 2026**, against a BeyondTrust-hosted instance and a self-hosted appliance. The bug (an internal messaging component that fails to validate message origin, allowing an unauthenticated attacker to perform file operations) scores 9.3 on CVSS 4.0, and Mandiant observed privilege escalation to root, custom malware, credential harvesting and pivoting into downstream systems. The advisory (BT26-05), the patch and the CISA Known Exploited Vulnerabilities listing all landed in **mid-October 2026**. _Status: Confirmed (exploitation and attribution acknowledged by vendor and Mandiant; disclosed October, exploited from late August). Severity 9/10._ **Takeaway:** privileged remote-access tooling is a crown-jewel target — it reaches everything. Minimise its exposure, watch it closely, and assume "no patch available yet" is a live state for edge appliances. **Windows AFD for WinSock zero-day — CVE-2026-68820.** Reporting around 12 August tied active exploitation of an Ancillary Function Driver for WinSock flaw to **Lazarus** (the long-running Operation Dream Job activity), used to gain SYSTEM privileges. _Status: Reported. Severity 8/10._ **Takeaway:** local privilege-escalation zero-days turn an initial foothold into full control; endpoint detection and prompt Patch-Tuesday discipline both matter. **Edge devices under sustained fire — SonicWall, N-able N-central, Citrix NetScaler, Zimbra.** CISA flagged SonicWall SMA1000 flaws (CVE-2026-15409 / CVE-2026-15410) being used by ransomware crews; an N-central authentication bypass (CVE-2026-10867, with Storm-1175 activity reported) was actively exploited to deploy ransomware; two NetScaler flaws (CVE-2026-19489 / CVE-2026-19490) drew urgent patch calls; and Shadowserver counted **274 compromised Zimbra servers** with thousands more unpatched. _Status: Confirmed (CISA / Shadowserver). Severity 7/10._ **Takeaway:** the internet-facing perimeter is still where the breaches start. Keep an authoritative inventory of what you expose and patch it on the vendor's clock, not yours. A structured threat-modelling exercise helps you find the appliances you forgot you run. ## Big breaches and extortion **McKesson.** The healthcare and pharmaceutical-distribution giant disclosed in an SEC Form 8-K on **28 August** that it discovered an incident on 25 August involving unauthorised access to third-party applications and data exfiltration, and said it had not determined the incident to be material. **ShinyHunters** claimed roughly **284 million records** (the group itself called that a raw record count, not unique individuals) and a multi-million-dollar ransom. McKesson has not confirmed those figures. _Status: Confirmed incident / Claimed scale. Severity 8/10._ **Manchester Airports Group (MAG).** The operator of Manchester, Stansted and East Midlands airports confirmed a breach of customer sign-up data (car park, lounge, Fast Track, airport Wi-Fi). A MAG spokesperson put the figure at roughly **8.7 million customers**; the company stressed no bank or payment details were involved and airport operations ran normally. _Status: Confirmed (8.7M attributed to MAG). Severity 7/10._ **Apollo Global Management.** Social engineering gave attackers access to a cloud environment between 6–10 July 2026 (disclosed in August), exposing names, dates of birth, addresses and **Social Security numbers**; the activity is linked to a broader campaign. _Status: Confirmed. Severity 7/10._ **RingCentral.** ShinyHunters used social engineering to reach data on about **1.6 million accounts**; the core platform kept running. _Status: Reported. Severity 6/10._ **Carhartt.** ShinyHunters claimed **50 GB** of data after a reported $3.3 million extortion demand; independent analysis put the credible figure near **12.9 million people**. _Status: Claimed. Severity 6/10._ **Baylor Genetics.** Around **2.8 million people** may be affected, with reported exposure of genetic test results and SSNs — among the most sensitive categories a breach can touch. _Status: Reported. Severity 7/10._ **Latvia's CSDD (road traffic safety directorate).** Historical payment records were stolen, affecting over **1.2 million people** and 200,000 entities; officials resigned, though daily services continued. _Status: Confirmed. Severity 6/10._ **CareCloud and Heights Finance.** CareCloud reported stolen patient data with a **disputed count** (a 345,000 headline figure against a 3.75 million body figure that reporting did not reconcile — a reminder to read past the headline). Heights Finance reported **734,828 people** with financial data and SSNs exposed. _Status: Reported (CareCloud) / Confirmed (Heights). Severity 6/10._ The through-line in this section is not a single vendor or a single bug — it is **identity and the help desk**. Voice phishing and support-desk social engineering, plus access through third-party SaaS and logistics partners, drove most of these. If you want to size what one of these events would cost you, our [breach-cost estimator](/tools/breach-cost) and the explainer on [how data-breach cost is actually calculated](/blog/data-breach-cost-explained) are a grounded starting point, and the [vendor-risk scorecard](/tools/vendor-risk-scorecard) helps you rank the third parties that keep showing up as the entry point. ## Ransomware at record volume **A record month by count.** Comparitech counted **997 ransomware claims** in August 2026 — the highest monthly total it has tracked, up sharply from July. Crucially, only **77 were confirmed by the affected organisations** at the time; the rest were leak-site claims. **Qilin** and **The Gentlemen** were the most prolific, and healthcare and utilities saw notable increases. _Status: Reported (aggregate stat; most underlying claims unverified). Severity 7/10 as a trend._ The gap between 997 claims and 77 confirmations is the whole point of a status label: volume on a leak site is marketing, not evidence. **Cl0p's extortion run.** Around 17 August, Cl0p claimed data from **Shell** (~89 GB), **GE** and **Philips**. Philips said an attempted compromise of an internal server was contained; Shell and GE were assessing. _Status: Claimed (Philips reports containment). Severity 5/10 pending confirmation._ **U.S. ATF.** Qilin listed the Bureau of Alcohol, Tobacco, Firearms and Explosives on its leak site; the agency confirmed a compromised standalone system and classed it as a **major incident**. _Status: Confirmed. Severity 6/10._ ## Operational technology and critical infrastructure **Polish combined-heat-and-power plant.** Around 10 August, a Russia-linked actor tracked as **Electrum** reportedly moved from a wind-farm network into a CHP plant, switched Siemens PLCs to STOP mode and caused a brief outage. _Status: Reported. Severity 7/10._ **US water and ports.** **Columbus Water Works** (Georgia) moved to manual operations after an attack, with water supply and quality unaffected; **North Carolina Ports** forced all three facilities to manual operations. _Status: Confirmed / Reported. Severity 6/10._ **Takeaway:** OT resilience is about being able to run manually and recover — segmentation between IT, OT and safety systems is the control that keeps a data-theft event from becoming a physical-process event. This is [defence in depth](/blog/defense-in-depth-explained) in its most literal form. ## The AI angle Two August items are worth naming because they are reasonably sourced, not because AI-attack hype deserves it. Reporting described a **hybrid human-plus-AI-agent intrusion into Taiwanese government agencies** (around 13 August) that allegedly compromised at least 85 accounts and extracted over 2,500 personnel records, and a suspected China-based group tracked as **SilkParasite** (around 20 August) using spearphishing and AI-assisted malware against Central Asian government bodies. _Status: Reported (both). Severity 6/10._ The defensive reading is deliberately unglamorous: AI changes the _speed and scale_ of familiar techniques — phishing, account compromise, malware iteration — far more than it invents new ones. The controls that worked last year still work; you just need them to hold up under more attempts. ## What to take away Strip away the logos and August repeats three lessons. **Edge and remote-access appliances are the front line** — BeyondTrust, SonicWall, N-central, NetScaler and Zimbra were all exploited, several before disclosure; inventory them and patch on the vendor's schedule. **The help desk is an attack surface** — voice phishing and support-desk social engineering drove the McKesson, Apollo and RingCentral events, so add call-back verification and tighten SaaS and identity-provider session controls. And **your third parties are your breach surface** — a large share of August's exposures arrived through a vendor, a logistics partner or a cloud platform rather than the named company's own core systems. Misconfigured and publicly exposed data stores (the UKGI exposure, an open Brazilian health database) round out the picture; understanding [how data leakage happens](/blog/what-is-data-leakage) is a cheaper lesson than living it. If you build or expose services programmatically, our [security APIs](/security-apis) can wire some of these checks into your own pipelines. We publish this roundup every month. As always: these are summaries of public reporting with a subjective severity read, not legal or incident-specific advice, and attacker claims are claims until the victim or an investigator confirms them. Check the primary source before you move. ## Frequently asked questions