This week’s most-read stories centered on large-scale breach disclosures and active exploitation campaigns. From federal breach portals to newly cataloged vulnerabilities, here are the stories readers followed.
Data Breaches
HHS lists iRhythm breach at 8,179,772 affected individuals. HHS listed iRhythm Technologies Inc’s breach as affecting 8,179,772 individuals, with unauthorized access to third-party-hosted business applications from June 3 through June 8, 2026, per HHS Office for Civil Rights filings.
Frontline Education confirms K-12 breach exposed Social Security numbers. Frontline Education confirmed attackers exploited a flaw in outside provider software to access K-12 school district data in August 2026, with state regulator filings counting 805,382 affected people in Massachusetts, New Hampshire, Texas and Vermont.
Threat Actors
SANS ISC discloses a new ClickFix campaign targeting macOS and Windows users. SANS ISC disclosed on Oct. 28, 2026, a ClickFix campaign targeting macOS and Windows users that uses a fake Cloudflare verification page to trick people into running malicious commands, according to SANS ISC’s Bradley Duncan.
Policy & Government
EFF publishes more than 800 pages of Medicare WISeR records. EFF released more than 800 pages of Medicare WISeR records covering CMS requests to four of six vendors and applications from 66 companies across six states, EFF said.
Vulnerabilities & Patches
Huntress traces multiple intrusions to compromised camera management application. Huntress traced September and October 2026 intrusions to a compromised camera management application used as an initial-access vector, with the software appearing as CMS.exe and its vendor unidentified, Huntress said.
InfraTrust warns of exploited flaws in critical network infrastructure. InfraTrust warned of active exploitation targeting flaws in critical network infrastructure based on 133 advisories from 18 vendors covering 2,813 vulnerabilities between September 18 and October 14, InfraTrust recorded.
CISA adds exploited GitLab RCE and Cisco DoS flaws to KEV catalog. CISA added two actively exploited vulnerabilities to its Known Exploited Vulnerabilities catalog, including GitLab and Cisco flaws, and said federal civilian agencies should apply fixes by Nov. 1, 2026, CISA said.
Tech Industry
Anthropic S-1 filing discloses cyber attack and AI safeguard limits as risks. Anthropic’s S-1 filing disclosed cyber attacks and AI safeguard limits as risks, with the company saying its safeguards may not block misuse as threats evolve, Anthropic said.
Join the discussion