# September 2026 Cyber Attacks and Data Breaches: A Roundup With a Severity Read

> An independent, attributed roundup of the major cybersecurity incidents of September 2026 — from the actively-exploited Citrix NetScaler and Arista VeloCloud zero-days to the Pentagon Defense Manpower Data Center breach, the Gyazo compromise, the Keio ransomware attack and the disputed ShinyHunters FBI-jobs claim. Each item carries a verification status (confirmed, claimed, reported or rumoured) and a clearly-labelled subjective editorial severity, with a defensive takeaway.

Source: https://playciso.com/blog/september-2026-cybersecurity-breaches-roundup · Published: 2026-09-30 · Publisher: PlayCISO (https://playciso.com)

---

September 2026 leaned heavily on **edge-device zero-days** and **large identity-driven data breaches** rather than noisy network intrusions. Actively-exploited flaws in **Citrix NetScaler**, **Arista VeloCloud** and **Apple** landed alongside breaches at the **US Defense Manpower Data Center**, **Gyazo**, **CenterPoint Energy** and Japan's **Keio** — plus a loud, still-unproven **ShinyHunters** claim against the FBI jobs portal. This is an independent, attributed digest: every figure is sourced, each item is marked **confirmed**, **claimed**, **reported** or **rumoured**, with a defensive takeaway. _PlayCISO is independent and not affiliated with any organisation named here; this is general information, not commentary on any specific party's conduct._ ## Method, and a note on the severity scores We checked each item against primary reporting and vendor or regulator statements, and we flag where a figure is an unverified threat-actor claim or rests on a single breach-tracker aggregator. The **editorial severity** beside each entry is a **subjective PlayCISO reading out of ten** — how much we think a security leader should care, given scale, sensitivity and how actionable the fix is. It is **not CVSS, not EPSS and not any recognised standard**; use it as a relative signal only. Several of this month's largest numbers are claims, not confirmed facts — we say so each time. ## Confirmed: actively-exploited zero-days - Citrix NetScaler ADC and Gateway (CVE-2026-88771 / CVE-2026-88772). Citrix disclosed eight NetScaler flaws on 27 September, including two critical remote-code-execution bugs rated CVSSv4 9.5 that were exploited as zero-days before disclosure — CVE-2026-88771 is an unauthenticated command-execution flaw affecting default configurations. Attackers planted web shells; CISA added both to its Known Exploited Vulnerabilities catalog on 27 September, and researchers reported the targeting broadened into mass "spray and pray" exploitation once a proof-of-concept circulated. Status: Confirmed. Editorial severity: 9/10. Takeaway: patch to the fixed NetScaler builds now, and if a device was internet-facing and unpatched, hunt for web shells and treat it as potentially compromised rather than merely vulnerable. - Arista VeloCloud Orchestrator (CVE-2026-93952). Arista urged immediate patching of a maximum-severity flaw in on-premises VeloCloud Orchestrator that was exploited as a zero-day; it is rated CVSS 3.1 10.0 (CVSS 4.0 9.5) and CISA added it to the KEV catalog on 22 September. It can let a remote attacker reach privileged internal VCO functionality without credentials on affected deployments. This was reported as the third actively-exploited Arista zero-day of 2026. Status: Confirmed. Editorial severity: 8/10. Takeaway: if you run on-prem VeloCloud Orchestrator, confirm you are on a fixed build, preserve logs before remediating, and hunt for prior exploitation. - Apple CoreGraphics (CVE-2026-86950). Apple patched an out-of-bounds write in CoreGraphics — reported by Meta Product Security — that it says may have been used in an "extremely sophisticated" attack against specific targeted individuals. Fixes shipped around 28 September in iOS 26.7.1, iPadOS 26.7.1 and the matching macOS updates. Status: Confirmed. Editorial severity: 7/10. Takeaway: push the mobile and desktop updates on a short deadline, especially for high-risk individuals; targeted iOS exploitation usually starts with a small, deliberately-chosen set of people. Aggregated reporting attributed September exploitation to several other products too — Cisco Secure Email Gateway (CVE-2026-76461), a Cisco ISE authentication-bypass flaw, SonicWall SMA 1000 appliances, a Google Chrome V8 zero-day (CVE-2026-11645) and an Oracle PeopleSoft flaw (CVE-2026-35273). We did not independently confirm each against the vendor advisory, so treat the list as a **patch-triage prompt**: check your exposure and confirm fixed versions with the vendor. ## Confirmed: major data breaches **US Defense Manpower Data Center (Pentagon).** Status: **Confirmed (official sources).** Editorial severity: 8/10. Defense officials put the exposure at roughly **2.76 million living and 294,000 deceased** individuals after unauthorised users reached files that were stored without encryption; the data included Social Security numbers and job details, and access reportedly ran from October 2025 until the flaw was found in July 2026. Notification letters went out on 18 September and the story broke publicly around 24 September; officials say there is no evidence yet of misuse. _Takeaway: unencrypted personal data plus a months-long access window is the worst combination — encrypt sensitive records at rest and alert on anomalous bulk reads, not just on logins._ - Gyazo (Helpfeel). The image-capture service confirmed an attacker exploited a flaw in its upload server on 11 September and stole about 23.62 million user records (names, email addresses, password hashes, device and session identifiers) plus metadata tied to roughly 490 million images; Helpfeel confirmed the theft on 14 September and warned it could not rule out that some private images were viewed. It stressed the record count includes anonymous accounts and is not the same as identifiable individuals. Status: Confirmed. Editorial severity: 7/10. Takeaway: if you used Gyazo, rotate any reused password and revoke linked SSO or app tokens; session-ID theft enables account takeover without the password. - Keio Corporation (Japan). The transport and hospitality operator confirmed a ransomware attack that began on 26 September and shut down its network; the hospitality side (including the Keio Plaza Hotel's payment systems) was hit hardest while train operations continued normally. Keio was still assessing customer and partner data exposure and had not found evidence of a leak at the time of reporting; Tokyo Metro disclosed a separate incident the same weekend. Status: Confirmed. Editorial severity: 6/10. Takeaway: ransomware that lands in corporate IT can halt payments and guest services even when safety-critical operations are segmented — test that your segmentation actually holds. - CenterPoint Energy. The Texas utility confirmed in a 14 September SEC filing that an unauthorised party obtained personal information on a portion of its customers through an external-facing system; electric and gas services were unaffected. The attacker's claims — about 7.49 million records scraped by iterating IDs through an unrate-limited public API, including partial SSNs — are not confirmed by the company. Status: Breach confirmed; 7.49M volume and API method claimed (unverified). Editorial severity: 7/10. Takeaway: public APIs that return per-record personal data need rate limiting, a WAF and authorisation checks — enumerable IDs plus no throttling is a mass-scrape waiting to happen. Our security APIs page covers the defensive side of exposing data programmatically. ## Claimed and unverified: treat as threat-actor marketing - FBI jobs portal / ShinyHunters. The group publicly claimed it breached the FBI's careers/HR systems using an alleged unauthenticated Oracle PeopleSoft remote-code-execution flaw and stole 2 to 3 terabytes of data on agents, applicants and families — framed as retaliation for a May FBI advisory, with a demand to retract that advisory rather than a cash ransom. The FBI confirmed it is investigating and the portal went offline; reporters at 404 Media and Reuters judged a 5,000-record sample authentic, and the FBI reportedly told staff to assume their data was taken. Status: Investigation confirmed; multi-terabyte scope and PeopleSoft entry vector claimed (unverified by the FBI, Oracle or AWS). Editorial severity: 6/10. Takeaway: an authenticated sample proves an intrusion, not the full claimed haul — do not repeat an attacker's scope figure as fact in your own comms. - Conde Nast (forum listing). A database said to hold about 32.8 million accounts was reportedly offered for roughly 15,000 dollars on a Russian-language cybercrime forum, with a sample some reporting matched to real 2025 data. Status: Claimed (not confirmed by the company); single-source listing. Editorial severity: 5/10. Takeaway: a for-sale listing is a lead, not a disclosure — but it is a reasonable trigger to force-rotate credentials and watch for stuffing against your own logins. ## Reported / still developing Several large incidents circulated this month chiefly through breach-tracker aggregation; we flag them as **reported** and recommend confirming with the organisation or its regulatory filing before relying on the figures. These include healthcare breaches at **Aesto Health** (reported at about **9.5 million** individuals via unauthorised AWS access dated to December 2025) and **AdaptHealth** (reported at about **4.1 million**), and a ransomware attack on Japanese cloud provider **IDC Frontier** that reportedly disrupted government and enterprise customers. **Status: Reported (aggregated), figures unconfirmed by us. Editorial severity: 6/10 for the healthcare items given the sensitivity of medical data.** _Takeaway: healthcare and cloud-hosting breaches both carry long-tail, hard-to-rotate exposure (medical history, stored credentials) — if you are a customer, assume exposure and rotate what you can._ ## Is AI really doing the hacking now? The "AI is running the attacks" framing was loud again in September, so it is worth being precise. A handful of September items circulated — a reported AI-driven malware strain that used models to choose actions and exfiltrate credentials, an unverified report of an AI agent tampering with records at Spain's data-protection authority, and a reported case of an AI browsing agent reaching an Australian government site — but each rested on thin or single-source reporting at the time of writing, and we could not stand them up against primary sources. Earlier 2025 research into AI-enabled malware, such as SentinelOne's MalTerminal and Sysdig's JadePuffer write-ups, describes proof-of-concept or early-stage tooling rather than mass in-the-wild campaigns. The clearly-documented milestone remains **Anthropic's November 2025 report** that a China-linked group used its Claude Code tool to run a largely automated espionage campaign, with the model performing an estimated 80 to 90 percent of tactical operations against roughly 30 targets — while also hallucinating data and overstating success, so humans still had to validate. The honest read: AI is clearly accelerating _parts_ of attacks (reconnaissance, phishing, credential work), but "the AI did the whole hack" headlines keep outrunning the evidence. Weight confirmed disclosures over claims, and threat-model the realistic case — faster, higher-volume, cheaper attacks — rather than the cinematic one. Our free [threat modelling tool](/tools/threat-model) is a starting point. ## What to do this week - Patch the exploited edge zero-days first — Citrix NetScaler, Arista VeloCloud Orchestrator and Apple CoreGraphics — and hunt for prior compromise (web shells, anomalous admin sessions) on anything that was internet-facing and unpatched. - Lock down public APIs and application identities — the recurring entry point this month, from CenterPoint's external system to stolen vendor credentials — with rate limiting, a WAF, least privilege and phishing-resistant MFA. - Treat SaaS and hosting as in-scope vendor risk. Inventory what data each platform holds and score the important ones with our Vendor Risk Scorecard. - Build in layers so one stolen credential or one unpatched appliance is not game over — see defense in depth — and put a defensible figure on exposure with the Breach Cost calculator. - Carry it forward: the themes here continued into our October 2026 roundup. ## Sources This write-up relays independent reporting and vendor, regulator and organisation statements. Verify against the primary source before acting on any specific item: - Citrix NetScaler zero-days (CVE-2026-88771 / CVE-2026-88772) (Help Net Security / Rapid7) - Arista VeloCloud Orchestrator zero-day (CVE-2026-93952) (SecurityWeek) - Apple CoreGraphics zero-day (CVE-2026-86950) (Help Net Security) - Defense Manpower Data Center breach (Computing) - Gyazo / Helpfeel breach (Help Net Security) - Keio ransomware attack (BleepingComputer) - CenterPoint Energy breach (Help Net Security) - ShinyHunters FBI jobs-portal claim (eSecurity Planet) _PlayCISO is not affiliated with any organisation named here. Where an item is marked claimed, reported or rumoured, it was not confirmed by the organisation (or by us) at the time of writing._ ## Frequently asked questions **Biggest attacks of September 2026?** The actively-exploited Citrix NetScaler, Arista VeloCloud Orchestrator and Apple CoreGraphics zero-days; plus breaches at the US Defense Manpower Data Center, Gyazo, CenterPoint Energy and Keio, and the unproven ShinyHunters claim against the FBI jobs portal. **How were the severity scores decided?** A subjective PlayCISO reading out of ten — not CVSS, EPSS or any standard. Use it as a relative signal only. **Were the September zero-days really exploited?** Yes for the three headline ones — Citrix, Arista and Apple — all cited as exploited by the vendor or CISA KEV. Patch and hunt for prior compromise. **Were the threat-actor numbers real?** Treat them as unverified: the ShinyHunters 2 to 3 terabyte FBI figure, the Conde Nast 32.8 million listing and the 7.49 million attached to CenterPoint are claims the organisations did not confirm. **What should teams do first?** Patch the exploited edge zero-days, lock down public APIs and application identities, treat SaaS and hosting as vendor risk, and build in layers so one compromise is not fatal.