TL;DR for CISOs: An extortion crew leaked data tied to 1.6 million RingCentral customers after a social engineering campaign, and the same 24 hours brought a supply chain attack that reached more than 2,500 organizations through an AI library, a cross-border takedown of a bank fraud crew, and a fresh public exploit that turns Microsoft Defender into a route to SYSTEM on fully patched Windows.
- People are the initial access. The RingCentral leak, the bank fraud scheme, and most large 2026 breaches start with someone being tricked or a trusted supplier being subverted, not a firewall being brute forced.
- Your software build pipeline is now part of your attack surface. The LiteLLM incident shows how one leaked token, three tools deep, can expose hundreds of thousands of CI/CD pipelines before anyone notices.
- A patched endpoint is not automatically a safe one. A working exploit against Microsoft Defender on fully updated Windows is a reminder to treat local privilege escalation as a live risk, not a theoretical one.
ShinyHunters leak exposes data on 1.6 million RingCentral customers
RingCentral · Cloud business communications · Social engineering to data theft and extortion
- RingCentral says the incident happened in July and resulted from a sophisticated social engineering campaign. It states that only a limited portion of customers was affected and that those individuals were notified directly.
- The extortion group ShinyHunters added RingCentral to its leak site in late July, claiming more than 623 gigabytes of data, then published a 280 gigabyte archive after the company declined to pay.
- Breach-notification service HaveIBeenPwned added the leaked data on August 13, listing roughly 1.6 million unique email addresses accompanied by names, addresses, and phone numbers.
- RingCentral says the core platform was not affected and services continued to run. It has not confirmed the attackers' claims or the number of impacted individuals.
What happened
RingCentral is a cloud provider of business phone, messaging, video, and contact-center services, so its customer records sit close to how thousands of organizations reach their own staff and clients. According to the company, attackers used social engineering rather than a software flaw to reach customer information, and RingCentral moved to stop the activity once it was detected. The number now circulating, 1.6 million, comes from the count of unique email addresses that HaveIBeenPwned catalogued from the leaked archive, alongside names, postal addresses, and phone numbers. The figure and the underlying data set trace to the ShinyHunters group's own claims and published files, which RingCentral has not independently verified.
Evidence
Verified against two independent sources:
- SecurityWeek: 1.6 Million Likely Impacted by RingCentral Data Breach
- Have I Been Pwned: RingCentral breach record
What this means for your team
A vendor that helps you talk to customers holds a directory of who those customers are. When that directory leaks, the risk is not just embarrassment for the vendor; it is a ready-made target list for the phishing and voice-fraud campaigns your users will see next. This case also fits a pattern that has defined 2026: an extortion group walked in through a human, not a zero-day. The contact details in the archive are exactly what a caller needs to sound legitimate, so the immediate exposure is downstream social engineering against your workforce and your own customers.
- Confirm whether your organization is a RingCentral customer and ask your account team directly whether any of your users were in the notified group, rather than waiting to be told.
- Warn staff and, where appropriate, customers that names, emails, addresses, and phone numbers may be in criminal hands, and to treat unexpected calls or messages referencing RingCentral with suspicion.
- Review how your own help desk and vendors verify identity over the phone, since the same social engineering playbook used here works against any organization with weak call-back procedures.
One leaked token exposed 2,500-plus organizations through an AI library
LiteLLM · Open source AI proxy · Build-pipeline supply chain compromise
- CloudSEK reports that the LiteLLM supply chain attack, which happened earlier in 2026, likely affected more than 2,500 organizations and exposed over 434,000 CI/CD pipelines.
- LiteLLM was not targeted directly. Its build pipeline automatically pulled in a compromised version of Aqua Security's Trivy scanner, which in turn poisoned two LiteLLM releases, versions 1.82.7 and 1.82.8, published to PyPI.
- The malicious code ran on every Python invocation with no explicit import. The two packages were live for roughly 40 minutes, long enough for automated systems to propagate them.
- CloudSEK cautions that the figures describe reconstructed exposure, not proof that every organization was compromised. SOCRadar has since reported that most affected organizations were likely hit earlier via the Trivy incident rather than through LiteLLM.
What happened
The threat actor CloudSEK tracks as TeamPCP has been chaining open source compromises together, and this one shows why that approach scales. A single unrevoked credential led from Trivy into the LiteLLM build system and then into a LiteLLM release, which CloudSEK summarizes as one token, three tools deep. Because automated build systems copy artifacts quickly, a malicious package that lives for less than an hour can still reach scheduled jobs, dependency resolvers, ephemeral runners, and developer laptops. CloudSEK's exposure list names large enterprises across technology, finance, pharmaceuticals, and manufacturing, while stressing that inclusion reflects potential exposure that each organization must verify for itself. The secrets within reach of the library included cloud keys, SSH keys, tokens, environment variables, and AI provider keys.
Evidence
- SecurityWeek: Over 2,500 Organizations Impacted by LiteLLM Supply Chain Attack
- CloudSEK: AI supply chain breach analysis
What this means for your team
The interesting detail is not the raw victim count, which is contested, but the mechanism. An AI component became the pivot point because it sits at a junction of data, identity, compute, and automated action, and it was reached without anyone attacking it head on. If your teams pull AI libraries and scanners straight into CI, then the trust you place in one upstream tool is inherited by everything your pipeline touches. CloudSEK's own view is that the next major supply chain attack is likely to aim at the AI layer precisely because it connects to everything else.
- Check whether LiteLLM 1.82.7 or 1.82.8, or the affected Trivy build, ever entered your pipelines or developer environments, and treat any secret reachable by them as compromised.
- Rotate exposed credentials, service accounts, and sessions, then review build and registry logs to scope the exposure window rather than assuming package removal closed it.
- Pin dependency versions, require signed artifacts, and scope build tokens narrowly so a single leaked credential cannot chain across tools.
Police arrest bank fraud crew that drained 30 million euros through a payment provider flaw
Commerzbank customers · Financial services · Third-party payment vulnerability and money laundering
- German and Brazilian authorities announced this week that four suspects were arrested in Brazil and three more were charged in Europe, to be prosecuted in Spain and Bulgaria.
- Over four days in November 2023, the group made numerous unauthorized withdrawals from German online banking accounts by exploiting a vulnerability at a payment provider, causing losses of around 30 million euros.
- Germany's BKA said the flaw was introduced by a faulty software update in a payment and transaction-processing system. Brazilian media identified the affected bank as Commerzbank, which confirmed customers were impacted but suffered no financial losses.
- Brazil's Operation Klonen executed 21 search-and-seizure warrants, and courts ordered the seizure of assets, vehicles, and real estate worth more than 20 million dollars.
What happened
The scheme is a study in how a supplier weakness becomes a bank's problem. According to the BKA, a bad software update opened a hole in a payment processor, and the attackers used it to pull money from customer accounts, then laundered the proceeds through pass-through accounts, companies, virtual-asset platforms, and payment cards issued without the account holders' consent. The largest share was cashed out in Brazil, with the rest spread across four European countries. Investigators added a memorable twist: Brazilian police said one suspect had run for elected office in 2024 and used part of the stolen funds for the campaign, and separately seized a 3D printer used to make weapons. Commerzbank said it cooperated closely with the authorities and that its customers were made whole.
Evidence
- BleepingComputer: Hackers arrested over 30M euro bank fraud exploiting service provider flaw
- The Record: Investigation of banking hack leads to arrests in Germany, Brazil
What this means for your team
The arrests are a genuine win, but the cause should hold a CISO's attention: the money moved because a third party's software update went wrong, not because the bank itself was breached. For any organization that depends on payment processors, clearing houses, or transaction platforms, this is a reminder that a supplier's change management is part of your fraud exposure. The nearly three-year gap between the 2023 theft and these 2026 arrests also underscores that recovery and attribution are slow, so prevention and rapid detection at the supplier boundary matter far more than the hope of clawing funds back later.
- Map which payment and transaction providers sit in your money-movement path and ask each how they test and stage software updates before production.
- Set alerting on abnormal transaction patterns and bulk unauthorized debits so a supplier-side flaw is caught in hours, not days.
- Confirm your contracts define breach notification and liability when a provider's own change causes customer losses.
New 'ShieldBreak' exploit turns Microsoft Defender into a path to SYSTEM
Microsoft Defender · Windows privilege escalation · Public proof-of-concept, unpatched
- A researcher known as Nightmare Eclipse published a proof-of-concept named ShieldBreak after Microsoft's August 2026 Patch Tuesday, describing it as a full bypass of the earlier RoguePlanet fix (CVE-2026-50656).
- According to the researcher, ShieldBreak grants SYSTEM privileges on fully patched Windows 10, Windows 11, and Windows Server, and requires Microsoft Defender to be enabled to work.
- The technique abuses a user-mode callback hook to change file contents during a Defender cloud-hydration scan through the Cloud Filter API, a different mechanism than RoguePlanet used.
- Vulnerability analysts Will Dormann and Kevin Beaumont confirmed the exploit works, and Beaumont published detection queries. Microsoft said it is investigating the claims.
What happened
ShieldBreak is the latest in a run of Defender and Windows privilege-escalation exploits this researcher has released since April, and it arrives amid a public dispute with Microsoft over disclosure and bug bounty practices. The important point for defenders is narrow but real: this is a working, publicly available exploit with no official patch, and it targets the security agent itself. There is no confirmed in-the-wild abuse yet, so this is a proof-of-concept risk rather than an active campaign, but privilege-escalation code that lands on a fully updated machine tends to get folded into attacker toolkits quickly. It does not grant initial access on its own; an attacker still needs a foothold before using it to climb to SYSTEM.
Evidence
- BleepingComputer: New Microsoft Defender ShieldBreak zero-day grants SYSTEM privileges
- SecurityWeek: Nightmare Eclipse Drops Windows Zero-Day Exploit ShieldBreak
What this means for your team
Privilege escalation rarely makes headlines because it is not the way in, but it is often the step that turns a minor foothold into full control of a host. A public exploit against Defender on patched systems means your endpoint detection and internal segmentation are doing more of the work than your patch level suggests. Until Microsoft ships a fix, treat local privilege escalation as a live gap and lean on behavioral detection rather than assuming an up-to-date machine is safe.
- Load the publicly shared ShieldBreak detection queries into your endpoint detection tooling and alert on the behavior while a patch is pending.
- Reduce the value of a SYSTEM escalation by tightening host segmentation, limiting local admin, and monitoring for unexpected privilege changes.
- Track Microsoft's advisory and stage the fix for rapid deployment once it is released.
Also notable
- More than 1,000 charities and nonprofits were caught in a data breach at UK CRM provider Beacon, after attackers downloaded customer database backups. SecurityWeek
- Roughly 14,000 Trezor customers had names, addresses, emails, and phone numbers stolen in a breach at fulfillment partner ShipMonk, another third-party exposure. SecurityWeek
- Attackers are exploiting an unpatched zero-day in the widely deployed GeoServer open source geospatial platform. SecurityWeek
- A max-severity SAP Commerce Cloud flaw is now being targeted in attacks, raising the stakes for enterprises running the platform. BleepingComputer
- A new macOS infostealer named AmnesiaStealer is spreading through ClickFix lures that impersonate GitHub download pages. SecurityWeek
FAQ
How many people were affected by the RingCentral breach?
Have I Been Pwned catalogued roughly 1.6 million unique email addresses from the leaked archive, along with names, addresses, and phone numbers. RingCentral says only a limited portion of customers was affected and has not confirmed the attackers' total.
Was the RingCentral core platform compromised?
RingCentral says the incident stemmed from a social engineering campaign in July, that the core platform was not impacted, and that services continued to operate. Affected individuals were notified directly.
Do I need to worry about LiteLLM 1.82.7 or 1.82.8?
If either version, or the affected Trivy build, entered your pipelines or developer machines, treat any secret reachable by them as exposed and rotate it. CloudSEK notes its 2,500-plus figure is reconstructed exposure, not confirmed compromise, and each case should be verified independently.
Is the Commerzbank fraud an active threat now?
No. The theft occurred over four days in November 2023, and the news is that police made arrests this week. The lesson is about third-party payment risk: the flaw came from a supplier's faulty software update, not from the bank itself.
Is ShieldBreak being exploited in the wild?
There is no confirmed in-the-wild abuse yet. It is a public proof-of-concept that grants SYSTEM privileges on fully patched Windows when Defender is enabled, and independent analysts confirmed it works. Treat it as a live privilege-escalation risk until Microsoft issues a fix.
Corrections and takedown requests: CISO Platform is committed to accuracy and fairness. If any detail in this briefing is inaccurate, or if you represent an affected organization and would like a correction or removal, please contact us at pritha.aash@cisoplatform.com and we will review your request promptly.
Comments