February 2026 Cyber Attacks and Data Breaches: A Roundup With a Severity Read

February 2026 was defined less by novel malware than by actively-exploited vulnerabilities and stolen identities. Microsoft shipped six zero-days already under attack, remote-access and mobile-device-management appliances from BeyondTrust and Ivanti were turned against the organisations that ran them, a ransomware crew shut an entire US health system’s clinics statewide, and the ShinyHunters extortion group kept voice-phishing its way into large consumer datasets. This is an independent, attributed digest: every figure is sourced, each item is marked confirmed, reported or claimed, with a defensive takeaway. PlayCISO is independent and not affiliated with any organisation named here; this is general information, not commentary on any specific party’s conduct.

Method, and a note on the severity scores

We checked each item against primary reporting, vendor advisories and the CISA Known Exploited Vulnerabilities catalog, corrected numbers where sources disagreed, and labelled anything we could not fully stand up. Where only a single aggregator carried an item, we marked it Reported rather than confirmed; where a figure rests only on a threat actor’s own statement, we marked it Claimed.

The editorial severity beside each entry is a subjective PlayCISO reading out of ten — how much we think a security leader should care, given scale, sensitivity and how actionable the fix is. It is not CVSS, not EPSS and not any recognised standard; use it as a quick relative signal only. Several of this month’s most-repeated numbers are unverified claims, not confirmed facts, and we say so where that applies.

Confirmed: actively-exploited vulnerabilities

• Microsoft February Patch Tuesday — six zero-days under active attack. Microsoft’s 10 February update fixed 58 CVEs, six of them already being exploited: a Windows Shell security-feature bypass (CVE-2026-21510), an MSHTML / Internet Explorer control bypass (CVE-2026-21513), a Microsoft Word OLE-mitigation bypass (CVE-2026-21514), a Desktop Window Manager privilege escalation (CVE-2026-21519), a Remote Access Connection Manager denial-of-service (CVE-2026-21525) and a Remote Desktop Services privilege escalation to SYSTEM (CVE-2026-21533). Three were publicly disclosed before the fix. Status: Confirmed. Editorial severity: 7/10. Takeaway: rank by “actively exploited” and patch those six first; the Office and Shell bypasses pair naturally with phishing.
• BeyondTrust Remote Support / Privileged Remote Access (CVE-2026-1731). A pre-authentication remote-code-execution flaw — an OS command injection triggered by crafted client requests — in Remote Support 25.3.1 and earlier and Privileged Remote Access 24.3.4 and earlier. BeyondTrust disclosed it on 6 February and later said exploitation had been detected as early as 31 January, making it a genuine zero-day; CISA added it to the KEV catalog on 13 February with a three-day federal patch deadline, and later activated the “used in ransomware” indicator. Researchers counted roughly 11,000 exposed instances, most on-premises. Status: Confirmed. Editorial severity: 8/10. Takeaway: patch or pull exposed Remote Support appliances now, and hunt for post-exploitation tooling — a patch does not evict an attacker who is already in.
• Ivanti Endpoint Manager Mobile zero-days (CVE-2026-1281 / CVE-2026-1340). Two code-injection flaws, both rated CVSS 9.8, exploited before Ivanti patched them around 29 January. They were used to breach the European Commission’s mobile-device-management infrastructure (the Commission said it detected signs on 30 January and contained the incident within about nine hours) and Dutch government bodies including the Dutch Data Protection Authority and the Council for the Judiciary, exposing employee work contact data. CISA added one of the flaws to KEV, and Canada and Singapore issued alerts. Status: Confirmed. Editorial severity: 8/10. Takeaway: mobile-device-management is a crown-jewel target — it holds device trust for your whole fleet. Patch EPMM and review for compromise since late January.
• VMware ESXi sandbox escape (CVE-2025-22225) now used in ransomware. CISA updated the KEV entry on 4 February to mark this arbitrary-write / VMX-sandbox-escape flaw — patched by Broadcom back in March 2025 — as used in ransomware campaigns. Exploitation needs existing privileges on a guest VM, which ransomware operators chain after initial access to reach the hypervisor host. Status: Confirmed. Editorial severity: 7/10. Takeaway: if your ESXi hosts are unpatched a year on, close that gap — host-level access turns one compromised VM into every VM.

Confirmed: espionage and nation-state

Singapore’s four telcos breached by UNC3886. On 9 February Singapore’s Cyber Security Agency attributed a months-long espionage campaign against all four major operators — Singtel, StarHub, M1 and SIMBA — to the China-nexus group UNC3886. The attackers used advanced tooling, including at least one zero-day to bypass a firewall, and rootkits for persistence, exfiltrating small amounts of technical network-configuration data. Officials said services were not disrupted and no customer or personal data was taken, and described “Operation Cyber Guardian” as the country’s largest coordinated response, with more than 100 defenders across six agencies spending over eleven months evicting the intruders. Status: Confirmed. Editorial severity: 7/10. Takeaway: edge and virtualisation gear is UNC3886’s signature entry point — patch it, monitor it, and assume espionage actors are patient enough to sit quietly for a year.

Confirmed: major breaches and ransomware

• University of Mississippi Medical Center — statewide clinic shutdown. UMMC confirmed a ransomware attack on 19 February that crippled its IT network and EPIC electronic medical records, forcing the closure of all of its roughly 35 clinics around the state and the cancellation of elective procedures, including some cancer treatments; hospitals and emergency departments stayed open. It worked with the FBI and reopened clinics on 2 March after more than a week down. Whether patient data was taken was still being assessed. Status: Confirmed. Editorial severity: 8/10. Takeaway: healthcare ransomware is a patient-safety event, not just an IT one — rehearse extended EHR-down operations before you need them.
• France’s national bank account registry (FICOBA) — about 1.2 million records. France’s Ministry of the Economy and Finance disclosed on 19 February that an intruder used the stolen login of an authorised civil servant to reach FICOBA in late January and held access for several days, exposing data tied to roughly 1.2 million accounts — IBANs, account-holder names, addresses and in some cases tax identifiers (the registry holds no balances or transactions). Status: Confirmed. Editorial severity: 7/10. Takeaway: one valid credential against a central registry is a national-scale incident — phishing-resistant MFA and tight monitoring on privileged database access are non-negotiable.
• CarGurus — about 12.4 million users (ShinyHunters). After an initial compromise around 13 February, the ShinyHunters crew leaked a 6.1 GB archive of roughly 12.4 million records on 21 February — names, emails, phone numbers, addresses and auto-finance application outcomes — published after an extortion attempt failed. Reporting links the intrusion to voice-phishing of single-sign-on codes. CarGurus said it contained the environment and saw no evidence its dealer feeds, public APIs or core products were compromised. Status: Confirmed (breach); ShinyHunters attribution. Editorial severity: 7/10. Takeaway: vishing against SSO defeats password strength — train and lock down help-desk and MFA-reset flows.
• Figure Technology Solutions — about 967,000 customers (ShinyHunters). The fintech lender confirmed that an employee was socially engineered — attackers impersonated IT support to obtain SSO credentials and MFA codes — letting them take a limited set of files. Have I Been Pwned counted about 967,200 unique email records; exposed data included names, dates of birth, addresses and phone numbers, with Figure stating SSNs, loan details and funds were not accessed. ShinyHunters leaked roughly 2.5 GB after Figure declined to pay, framing it as part of a wider Okta-SSO campaign. Detected around 28 January; disclosed in late February. Status: Confirmed (breach); ShinyHunters attribution. Editorial severity: 6/10. Takeaway: the same vishing playbook as CarGurus — one phished employee, one SSO session, a million records.
• Advantest — ransomware intrusion disclosed. The Japanese semiconductor chip-test toolmaker announced on 19 February that it was responding to a ransomware incident that may have affected certain systems, isolating them during investigation; no data theft was confirmed at disclosure. (A later notification dated 6 October 2026 confirmed personal data was in fact stolen — a reminder that the full scope of a February incident can take months to surface.) Status: Confirmed. Editorial severity: 6/10. Takeaway: “no confirmed data theft yet” at disclosure often becomes “data stolen” months later — plan communications for a long tail.

Reported: single-source, still firming up

• Odido (Netherlands) — 6.2 million customers. The Dutch mobile operator was reported to have suffered unauthorised access to a customer-contact system around 12 February exposing personal information of about 6.2 million customers, with core services said to be unaffected. We saw this chiefly through roundup reporting, so we flag it as reported rather than independently confirmed here. Status: Reported. Editorial severity: 6/10. Takeaway: telco contact databases are prime phishing fuel — warn customers proactively.
• Coinbase — insider-abuse of support tools. Reporting described insiders being manipulated or bribed into misusing internal customer-support tooling, exposing a limited amount of account data — a social-engineering and insider-risk problem rather than a system hack. Status: Reported. Editorial severity: 5/10. Takeaway: privileged support consoles need the same monitoring, least privilege and dual-control you give production systems.

Claimed: treat as threat-actor marketing

• Iron Mountain / Everest (1.4 TB claim). The Everest extortion group listed Iron Mountain in early February claiming roughly 1.4 TB of stolen data; Iron Mountain described the incident as contained and limited, and no samples were published to substantiate the volume. Status: Claimed (volume unverified). Editorial severity: 5/10. Takeaway: a leak-site listing is a pressure tactic, not proof — verify before you repeat a number.
• Panera Bread (ShinyHunters, ~5.1 million). Contact information was reported leaked publicly after a failed extortion attempt, with the figure put at about 5.1 million accounts — notably lower than an earlier 14-million claim, which is itself a caution about taking the first number you see. Status: Claimed / partially reported. Editorial severity: 5/10. Takeaway: early breach counts routinely shrink or swell — wait for the corroborated figure.

Is AI really doing the hacking now?

The question gets louder every month, so it is worth keeping disciplined. The clearly-documented milestone remains Anthropic’s November 2025 report that a China-linked group used its Claude Code tool to run a largely automated espionage campaign, with the model performing an estimated 80–90% of tactical operations — while also hallucinating data and overstating success, so humans still had to validate. For February 2026, some roundups carried claims of generative-AI-assisted automation in a campaign against FortiGate management interfaces, and a vaguer claim that a model was abused to orchestrate an intrusion into Mexican government systems; we found these single-source and not corroborated by primary reporting, so we flag them as unverified rather than present them as fact. What is unambiguous this month is the human-plus-automation blend that actually did the damage: ShinyHunters’ voice-phishing at scale against single-sign-on providers is the February story, and whether a script or a model drives the next wave, the defensive answer is the same — phishing-resistant MFA, least privilege on identities, and tight control of help-desk reset workflows.

What to do this week

• Patch the exploited flaws first — Microsoft’s six February zero-days, BeyondTrust CVE-2026-1731, Ivanti EPMM CVE-2026-1281 / CVE-2026-1340, and VMware ESXi CVE-2025-22225 — prioritising anything internet-facing, and hunt for prior exploitation on remote-access and mobile-device-management appliances.
• Harden identity. The month’s biggest breaches started with a phished or stolen credential; enforce phishing-resistant MFA, and drill your help-desk and SSO-reset flows against voice-phishing.
• Lock down privileged and application identities with least privilege and monitoring — the FICOBA and Coinbase incidents turned on misused legitimate access.
• Treat vendor and SaaS access as in-scope risk. Inventory what each third party can reach and score them with our Vendor Risk Scorecard.
• Build in layers so one compromised credential is not game over — see defense in depth — understand how exposed contact data turns into the next attack in what data leakage really is, and put a defensible figure on exposure with the Breach Cost calculator. Rehearse the healthcare-outage and extortion scenarios in the War Room before they are a real Tuesday.

Next in the series: our October 2026 roundup covers the PHP2Shell flaws, the LiteLLM poisoning and the ConnectWise Cloud Backup compromise with the same confirmed-vs-claimed discipline.

Frequently asked questions

Biggest attacks of February 2026? Microsoft’s six actively-exploited zero-days, the BeyondTrust (CVE-2026-1731) and Ivanti EPMM (CVE-2026-1281 / CVE-2026-1340) flaws, and the VMware ESXi ransomware flag; plus breaches at the University of Mississippi Medical Center, France’s FICOBA registry, CarGurus, Figure and Advantest, and the UNC3886 espionage campaign against Singapore’s telcos.

How were the severity scores decided? A subjective PlayCISO reading out of ten — not CVSS or any standard. Use it as a relative signal only.

Vulnerabilities or breaches? Both, and linked by identity: most of the big intrusions started with a valid credential or an exploited edge/management appliance, not malware in an inbox.

Were the gangs’ numbers real? Treat them as unverified marketing until corroborated — Everest’s 1.4 TB Iron Mountain figure was unsubstantiated, while the ShinyHunters CarGurus and Figure counts were backed by leaked archives and Have I Been Pwned.

What to do first? Patch the exploited flaws, harden MFA and SSO against voice-phishing, lock down privileged identities, and treat vendor access as in-scope risk.