March 2026 Cyber Attacks and Data Breaches: A Roundup With a Severity Read

March 2026 was a month of supply-chain compromise and identity abuse far more than classic malware. A single threat cluster poisoned the AI toolchain and the security tools meant to defend it; a destructive, malware-free attack wiped more than 200,000 devices at a medical-device maker using nothing but a stolen admin login; and the Cl0p extortion wave against Oracle E-Business Suite kept producing confirmed victims. This is an independent, attributed digest: every figure is sourced, each item is marked confirmed, claimed or rumoured, with a defensive takeaway. PlayCISO is independent and not affiliated with any organisation named here; this is general information, not commentary on any specific party’s conduct, and we name no individuals.

Method, and a note on the severity scores

We checked each item against primary reporting, vendor statements and regulator filings, corrected numbers where sources disagreed, and flagged anything we could not stand up. The editorial severity beside each entry is a subjective PlayCISO reading out of ten — how much we think a security leader should care, given scale, sensitivity and how actionable the fix is. It is not CVSS, not EPSS and not any recognised standard; use it as a quick relative signal only. Several of this month’s highest-profile numbers are unverified threat-actor claims rather than confirmed facts, and we mark them as such.

Confirmed: the AI-toolchain supply-chain campaign

The defining story of the month also belongs in any "is AI changing attacks?" conversation — not because an AI did the hacking, but because attackers deliberately targeted the AI and security toolchain itself.

• TeamPCP / LiteLLM (CVE-free supply-chain compromise). A threat cluster tracked as TeamPCP published backdoored releases of the widely deployed LLM gateway LiteLLM — versions 1.82.7 and 1.82.8 — to PyPI on 24 March 2026. Version 1.82.8 shipped a litellm_init.pth file; because Python executes lines in .pth files at interpreter startup, the payload ran whenever any Python process started in the environment — no import of LiteLLM required. It harvested environment variables, SSH keys, cloud credentials, Kubernetes data, Docker configs, database credentials and CI/CD secrets, encrypted them and exfiltrated to an attacker-controlled host, and established persistence. Status: Confirmed. Editorial severity: 8/10. Takeaway: if any system pulled 1.82.7 or 1.82.8, assume compromise, rebuild from clean images and rotate every reachable credential. Our LiteLLM exposure check helps you tell quickly — and note this is a different incident from the October 1.107.0 compromise.
• The wider TeamPCP wave — security scanners poisoned. The same campaign, which researchers date from a Trivy compromise on 19 March, also hit the vulnerability scanner Trivy (malicious v0.69.4 and associated GitHub Actions and Docker images), Checkmarx/KICS GitHub Actions, OpenVSX extensions, and the Telnyx PyPI package (4.87.1/4.87.2 on 27 March). Reporting indicates the attackers reused publishing tokens harvested from earlier compromises. Status: Confirmed. Editorial severity: 8/10. Takeaway: the tools you trust to find problems are themselves dependencies — pin and hash-verify them, pull from a vetted registry, and put egress controls on build hosts so a stealer cannot phone home.

The honest framing: there is no evidence an AI model autonomously ran this campaign. What is unambiguous is that attackers are targeting the AI supply chain precisely because an LLM gateway aggregates every model key and cloud credential in one place — the highest-value secret concentration in a modern stack.

Confirmed: destructive attacks and exploited flaws

• Stryker — Handala wiper. On 11 March, an attack attributed to the Iran-linked Handala group compromised a Microsoft Intune administrator account, created a new global-admin account, and used the legitimate device-management platform to remotely wipe devices — more than 200,000 across 79 countries, with manufacturing and shipping disrupted. No malware or ransomware was used. Stryker confirmed the wipe in an SEC 8-K filing and said it found no evidence of data exfiltration; Handala’s claim of 50TB stolen is therefore unverified. Status: Confirmed (wipe); 50TB exfiltration claimed (unverified). Editorial severity: 8/10. Takeaway: privileged device-management and identity consoles are an administrative single point of failure — enforce phishing-resistant MFA, alert on new global-admin creation, and rehearse mass-wipe recovery.
• Cl0p / Oracle E-Business Suite — Michelin confirms. The long-running Cl0p extortion campaign exploiting an Oracle E-Business Suite flaw kept claiming victims; Michelin confirmed on around 11–12 March that an EBS zero-day was exploited, describing a small, localized volume of data with no sensitive technical information and no ransomware deployed. Cl0p published roughly 315GB it attributes to Michelin and has listed 100+ alleged targets. Status: Breach confirmed by Michelin; 315GB volume claimed by Cl0p (unverified). Editorial severity: 6/10. Takeaway: if you run Oracle EBS, confirm patching against the exploited flaw and hunt for prior access; do not confirm an extortion group’s volume figures in your own comms.
• CISA KEV additions (20 March). CISA added five actively-exploited flaws to its Known Exploited Vulnerabilities catalog: three Apple multiple-product flaws (CVE-2025-31277, CVE-2025-43510, CVE-2025-43520), a Craft CMS code-injection flaw (CVE-2025-32432) and a Laravel Livewire code-injection flaw (CVE-2025-54068). Status: Confirmed (exploited). Editorial severity: 7/10. Takeaway: KEV is your patch-priority shortlist — these have documented exploitation, so they jump the queue regardless of CVSS.
• F5 BIG-IP RCE (27 March). CISA added CVE-2025-53521, a remote-code-execution flaw in F5 BIG-IP, to the KEV catalog. Status: Confirmed (exploited). Editorial severity: 7/10. Takeaway: edge and application-delivery appliances are perennial initial-access targets; patch and restrict management-plane access.

Confirmed and reported: major data breaches

• Cegedim Sante (France). The medical-software provider confirmed on 3 March a breach of a platform used by French doctors, exposing 15.8 million patient records, with a subset of files containing free-text clinical notes. The incident was detected in October 2025 and disclosed about four months later. Status: Confirmed. Editorial severity: 8/10. Takeaway: clinical free-text is among the most sensitive data you can lose; minimise what is retained and encrypt it at rest.
• Navia Benefit Solutions. The benefits administrator disclosed a breach affecting approximately 2.7 million individuals, reportedly via an exposed interface, with Social Security numbers and account data in scope. Status: Confirmed (disclosed by the company). Editorial severity: 7/10. Takeaway: inventory and authenticate every API that touches regulated data — an exposed endpoint is a breach waiting to be disclosed.
• Aura. The identity-protection firm confirmed a voice-phishing intrusion in which an attacker impersonated a trusted contact to obtain roughly an hour of access; about 900,000 records were reachable, of which Aura says around 20,000 current and 15,000 former customers were directly affected (the remainder being older marketing contacts), with no SSNs, passwords or financial data exposed. ShinyHunters claimed it. Status: Confirmed. Editorial severity: 6/10. Takeaway: vishing defeats password-based help-desk flows — require strong, out-of-band identity proofing before any privileged action.
• Crunchyroll. The streaming service confirmed a breach limited to customer-support ticket data, reached after an attacker phished a third-party support agent with federated access; reporting describes around 100GB and millions of tickets exfiltrated, while a claimed 6.8 million affected users is the attacker’s figure. Status: Confirmed (support-data breach); user count claimed (unverified). Editorial severity: 6/10. Takeaway: outsourced support seats carry your SSO — scope their access tightly and monitor it as you would an employee’s.
• Healthcare sector. March brought a run of health-sector incidents: the University of Hawaiʻi Cancer Center reported a ransomware event affecting roughly 1.2 million individuals, Cognizant’s TriZetto was reported to have exposed data on about 3.4 million people, and the University of Mississippi Medical Center confirmed a Medusa ransomware attack that closed clinics and took its EHR offline for days. Status: Confirmed disruptions; several counts reported rather than organisation-confirmed. Editorial severity: 7/10. Takeaway: healthcare remains the highest-consequence target — patient-safety downtime plans matter as much as data protection.

Claimed and rumoured: treat as threat-actor marketing

• Telus Digital / ShinyHunters. A breach of the outsourcing provider was confirmed, but ShinyHunters’ claim of up to 1 petabyte of data is unverified. Status: Breach confirmed; volume claimed (unverified). Editorial severity: 6/10.
• European Commission (Europa.eu) / ShinyHunters. The Commission confirmed that data was taken from public-facing websites hosted in its cloud and said internal systems were unaffected; the 350GB figure is ShinyHunters’ claim. Status: Limited breach confirmed; 350GB claimed (unverified). Editorial severity: 5/10.
• Lockheed Martin "F-35" (pro-Iran hacktivist claim). A pro-Iran group alleged theft of around 375TB including F-35 blueprints, with a ransom demand reported at over $400 million. We found no corroboration from the company or independent researchers; the scale and framing fit classic hacktivist exaggeration. Status: Rumoured / unverified — no confirmed data loss. Editorial severity: 4/10. We include it only to mark it as unsubstantiated.

What to do this week

• Hunt the TeamPCP packages — LiteLLM 1.82.7/1.82.8 and the affected Trivy, Checkmarx/KICS and Telnyx releases — rebuild any host or CI runner that pulled them, and rotate every credential those environments could read.
• Patch the March KEV additions (Apple, Craft CMS, Laravel Livewire on 20 March; F5 BIG-IP on 27 March) and confirm Oracle E-Business Suite patching against the Cl0p-exploited flaw.
• Lock down privileged identity and device-management consoles — the Stryker wipe came entirely from one Intune admin account — with phishing-resistant MFA and alerting on new admin creation.
• Treat SaaS and outsourcing partners as in-scope vendor risk. Several breaches this month came through a third party; inventory what each holds and score them with our Vendor Risk Scorecard.
• Build in layers so one stolen credential is not game over — see defense in depth — and put a defensible figure on exposure with the Breach Cost calculator.

This is part of our monthly series; for comparison, see the October 2026 roundup, which traced many of the same supply-chain and identity patterns later in the year.

Frequently asked questions

Biggest attacks of March 2026? The TeamPCP supply-chain campaign (LiteLLM 1.82.7/1.82.8 plus Trivy, Checkmarx/KICS and Telnyx), the Handala wiper that erased 200,000+ Stryker devices, and the Cl0p Oracle E-Business Suite wave (Michelin confirmed); plus data breaches at Cegedim Sante, Navia, Aura and Crunchyroll.

How were the severity scores decided? A subjective PlayCISO reading out of ten — not CVSS or any standard. Use it as a relative signal only.

Was the March LiteLLM attack the same as the October one? No — March was the TeamPCP compromise of 1.82.7/1.82.8; October was a separate 1.107.0 incident using a similar .pth trick but not attributed to TeamPCP.

Were the big breach numbers real? Several were unverified claims: Handala’s 50TB from Stryker, ShinyHunters’ petabyte from Telus and 350GB from the European Commission, Cl0p’s 315GB from Michelin, and an alleged 375TB Lockheed Martin theft.

What to do first? Audit for the TeamPCP packages and rotate reachable secrets, patch the March KEV flaws and Oracle EBS, lock down privileged identity consoles, and treat SaaS and outsourcing partners as in-scope vendor risk.