July 2026 Cyber Attacks and Data Breaches: A Roundup With a Severity Read

July 2026 was a month where ransomware kept spilling into the physical world and enterprise software kept getting exploited faster than it could be patched. A dairy production line went dark, more than thirty water utilities had their control systems disrupted, a maximum-severity ColdFusion bug was weaponised within hours, and two very large brand names — Coca-Cola and Accenture — confirmed incidents. Below is an independent, defensive read of the month: what happened, how solid the facts are, a subjective severity score, and what to actually do about each one.

Ransomware and extortion

Fairlife / The Coca-Cola Company. Coca-Cola disclosed in an SEC 8-K filing on 16 July 2026 that a cybersecurity incident had temporarily suspended US production at its Fairlife dairy business, while stating that product quality and safety were not impacted and that Canadian operations continued. Later reporting indicated most US production resumed by late July and that an unauthorised third party had taken certain data; the Anubis group claimed responsibility and listed the data on its leak site. Status: Confirmed (incident and production suspension); Claimed (Anubis attribution and the leak volume, variously reported from ~671 GB to 1 TB). Editorial severity: 8/10 — ransomware that halts a food-production line is the manufacturing nightmare made real, even when the data impact turns out modest. Takeaway: segment IT from OT and plan for the plant to run (or safely stop) when corporate systems are pulled offline; a recovery plan that assumes the network is up is not a plan.

PTC Windchill & FlexPLM (Clop campaign). The Clop extortion crew ran a data-theft campaign against internet-exposed PTC Windchill and FlexPLM product-lifecycle-management systems, exploiting CVE-2026-12569 (an unsafe-deserialization RCE rated around CVSS 9.3). PTC shipped patches on 17 June 2026; researchers assess Clop likely exploited it as a zero-day beforehand, deploying JSP webshells to exfiltrate data, then sending extortion emails from previously compromised accounts in mid-July. Claimed victims circulating in reports include large manufacturers, but those companies did not confirm. CISA added the flaw to its KEV catalogue. Status: Reported/Confirmed (exploitation and KEV listing); Claimed (specific victim names). Editorial severity: 8/10 — classic Clop: one enterprise app, mass exploitation, pure extortion. Takeaway: inventory internet-facing enterprise apps, patch the manufacturing-adjacent ones on the same clock as your crown jewels, and treat any PLM/ERP system as a tier-1 target. A vendor-risk scorecard helps you see which third-party platforms sit in that blast radius.

Indra Group (Spain). The Spanish defence and air-traffic-management firm was reportedly hit by ransomware attributed to SafePay, with data allegedly leaked; details were thin and largely drawn from the attacker's own posts. Status: Claimed. Editorial severity: 6/10 — a defence-sector target raises the stakes, but the public facts are limited. Takeaway: defence and aerospace suppliers should assume they are persistently targeted and treat even a limited document theft as a national-security review, not a PR exercise.

Data breaches

KDDI (Japan). The telecom giant confirmed a breach affecting more than 12 million people after attackers accessed an email platform KDDI developed and ran for five ISPs. KDDI said the intruders exploited a third-party zero-day on 16 May, discovered it on 17 June, and exposed email addresses and passwords — later reported as 12.2 million-plus addresses and ~7.6 million passwords. Japan's privacy regulator subsequently flagged that roughly 7.6 million passwords were stored in plaintext and ordered improvements. Status: Confirmed. Editorial severity: 7/10 — scale plus the plaintext-password own-goal. Takeaway: hash passwords with a modern algorithm, full stop; and remember that a vendor's zero-day becomes your breach when you operate the platform. For the financial dimension of an exposure this size, see our breach-cost estimator and the explainer on how data-breach costs add up.

Accenture. The consulting giant confirmed a security incident after an actor using the handle "888" offered roughly 35 GB of claimed source code and related material (keys, tokens, config files) for sale on a cybercrime forum. Accenture called it an "isolated matter," said it had "remediated its source," and reported no impact to operations or service delivery. Independent reporters could not verify the full scope. Status: Confirmed (incident); Claimed (35 GB and contents). Editorial severity: 6/10 — reputationally loud, operationally contained so far. Takeaway: leaked source code plus embedded secrets is a double breach — rotate any credentials the exposed repositories could contain, and keep secrets out of source control in the first place.

Masimo Corporation. The medical-device maker issued a breach notification reported to affect nearly 4 million people, exposing personal information. Attribution and mechanism were not detailed in the reporting available at month-end. Status: Reported (breach notification). Editorial severity: 6/10 — large population, health-adjacent entity. Takeaway: healthcare and med-tech firms carry some of the most sensitive and regulated data there is; breach-notification obligations alone make these expensive even before litigation.

Bank of Baroda (India). The bank confirmed a cybersecurity incident on 27 July after customer and internal data allegedly linked to it surfaced on the dark web, reportedly via a compromised employee email account; core banking was said to be unaffected. An actor, reported as "TripleX," claimed roughly 1 TB of data. Status: Confirmed (incident); Claimed (1 TB volume and actor). Editorial severity: 6/10 — a single phished mailbox reaching sensitive data is a recurring, preventable pattern. Takeaway: phishing-resistant MFA on email, plus least-privilege on what a mailbox can actually reach, blunts exactly this path.

Chick-fil-A. The restaurant chain disclosed that more than 13,000 customer accounts were accessed through credential stuffing — attackers reusing username/password pairs stolen elsewhere, not a breach of Chick-fil-A's own systems. Status: Confirmed/Disclosed. Editorial severity: 4/10 — limited scope, but a clean teaching case. Takeaway: credential stuffing is a password-reuse problem you inherit from everyone else's breaches; rate-limiting, bot detection and MFA on consumer logins are the countermeasures.

Critical infrastructure and OT

Minnesota community water utilities (30+). A coordinated attack disrupted the operational technology — automated control systems — at more than thirty Minnesota community water systems on the nights of 26–27 July. Four cities were named publicly: Braham (whose treatment plant briefly went offline), Plymouth (which lost some cellular comms but ran manually), South St. Paul and Maple Plain (which declared a local emergency). Officials said there was no sign drinking-water quality was affected. Minnesota IT Services confirmed the incident on 28 July and is working with CISA, the EPA and the FBI. Researchers have tentatively linked the activity to the IRGC-affiliated CyberAv3ngers, but US officials had not issued a formal attribution by month-end. Status: Confirmed (incident and OT disruption); Reported/Suspected (CyberAv3ngers attribution). Editorial severity: 7/10 — no public-health harm this time, but a coordinated hit on dozens of small utilities at once is the scenario everyone has warned about. Takeaway: small water and utility operators are under-resourced and over-exposed; isolate essential OT, keep manual fallback procedures drilled, and follow CISA's water-sector guidance. Layered controls — the idea behind defense in depth — matter most where a single automated system can be knocked over.

Actively exploited vulnerabilities

Adobe ColdFusion — CVE-2026-48282. A maximum-severity (CVSS 10.0) path-traversal flaw leading to unauthenticated code execution was exploited in the wild within roughly two hours of disclosure, per researchers, and added to CISA's KEV catalogue (reported 7–8 July) with a federal patching deadline. Fixes shipped in ColdFusion 2025 Update 10 and 2023 Update 21. Status: Confirmed (active exploitation, KEV listing). Editorial severity: 8/10 — the time-to-exploit here is the whole story. Takeaway: for internet-facing enterprise apps, "patch within 72 hours" is already slow; have an emergency-patch path that can move in hours, and virtual-patch or take offline anything you can't fix immediately.

Langflow — CVE-2026-0770. An RCE affecting Langflow, used to build AI workflow servers, was reported as actively exploited, with CISA ordering remediation. It lands alongside a separate, earlier Langflow authentication-bypass issue that also saw exploitation this year. Status: Confirmed (active exploitation; CISA action). Editorial severity: 7/10 — AI tooling is now production infrastructure and is being attacked like it. Takeaway: inventory the AI/LLM orchestration software you run, keep it off the open internet, and patch it on the same cadence as any other exposed web app.

The AI angle — handle with care

July's reporting included a cluster of AI-assisted attack tooling: an autonomous "ransomware agent" dubbed JadePuffer said to chain attack stages automatically, and a Dolphin-X toolset reported to use AI to rank high-value targets. We flag these deliberately as Status: Reported — they come largely from security-vendor and news-aggregator write-ups we could not independently corroborate, and "AI-powered" is a label that outruns the evidence more often than not. Editorial severity: not scored — the trend is real, but individual tool claims should be treated as unconfirmed until primary research lands. Takeaway: don't re-architect your defences around a press release. The controls that stop AI-accelerated attacks are the same ones that stop the manual kind — faster patching, least privilege, egress control, phishing-resistant MFA — applied with less tolerance for lag, because the attacker's tempo is rising. Modelling where such an adversary would move first is a good use of a threat-modelling exercise.

What to take away from July 2026

Three threads run through the month. First, ransomware keeps reaching operations — Fairlife's production line and Minnesota's water controls are the headlines, but the lesson is the quiet one: assume IT will go down and make sure the physical process can stop safely or run without it. Second, the patch window is collapsing — a CVSS 10 ColdFusion bug exploited in two hours, a PLM flaw hit as a zero-day before any patch existed. Your emergency-patch process is now a front-line control. Third, attacker claims are not facts — leak sizes, victim lists and attributions dominate the coverage and are frequently inflated; label them as claims internally, and decide on confirmed data.

None of July's worst outcomes required an exotic defence. Segmentation, fast patching, hashed credentials, phishing-resistant MFA, and a tested plan for when a system is simply gone would have blunted every confirmed incident above. This is the seventh entry in our monthly series; the October 2026 edition continues the same independent read. PlayCISO is a training vendor, not a party to any of these incidents; this piece is general information, names no individuals, and should be verified against primary sources before you act.

Frequently asked questions