EXTEND Resources

10/13/2026

A simple leaked password "123456" linked to a former employee opened the door to Denmark’s national population database. Over 21 days, attackers ran millions of queries through an IT vendor's account, exposing data for nearly 8.8 million people.

The breach went unnoticed until an unusually high bill for 14 million search requests flagged the suspicious account activity.

This case highlights why password security and account monitoring are critical for every organization. Allowing weak passwords or failing to remove former employee access leaves major security gaps.

A series of security failures, including a very weak password, exposed almost 9 million people’s personal information.

09/20/2026

Utility provider CenterPoint Energy is facing multiple class action lawsuits after a hacker claimed to leak customer data online. The lawsuits state that roughly 7 million records were exposed, including customer names, phone numbers, addresses, and partial Social Security numbers.

Lawsuits focus on the company's online guest payment feature as a primary vulnerability. The filings claim the system made it too easy to retrieve private customer details using only basic account numbers.

This case serves as an important lesson for business leaders: web tools designed for customer convenience must be built with strong data privacy controls.

https://hubs.ly/Q04xv2Sy0

Customers have filed proposed class actions against CenterPoint energy, alleging the company failed to protect them from a reported data breach.

09/16/2026

Financial app Revolut recently responded to a unique security incident. Cybercriminals gained control of a legitimate government email account and sent fake records requests to Revolut staff.

Because the request came from an official government domain, employees treated it as real. The exposed records included customer names, phone numbers, passport copies, and transaction histories.

This situation proves that social engineering tactics are growing more convincing. Protecting sensitive customer data requires clear approval workflows and strict identity checks—even for requests that appear to come from official authorities.

https://bit.ly/4yH8AYp

Revolut data breach: fintech gave passports, selfies and bitcoin transaction histories to a scammer using a real government email domain.

09/14/2026

Cybersecurity researchers recently uncovered a dark web marketplace attempting to sell high-resolution scans of more than 153 million driver's licenses from the U.S. and Canada. The Federal Bureau of Investigation (FBI) launched an official investigation into the incident.

Updates to the investigation confirmed that identity verification provider IDScan experienced unauthorized access to customer data stored in its cloud environment. The exposed files included detailed document scans collected across rental car counters, dispensaries, and retail locations.

For board members, CISOs, and risk managers, this outcome points out a vital business reality: relying on third-party vendors for identity checks can create silent data risks outside your firewalls.

Maintaining strong data governance means asking vendor partners tough questions about how long they store sensitive files and how they lock down customer access.

08/31/2026

Healthcare distributor McKesson is responding to a cyberattack that affected its third-party applications and caused temporary service delays. The extortion group ShinyHunters claims it accessed company systems by making phone calls to employees while pretending to be IT support staff. The criminal group claims to have stolen a 284 million patient records.

This incident highlights a growing danger for modern businesses: cybercriminals are increasingly targeting people rather than software flaws to gain entry into cloud applications.

Protecting your business requires strong identity checks, clear data privacy rules, and regular review of third-party software risks.

https://hubs.ly/Q04vZr8j0

The pharmaceutical and healthcare technology company McKesson informed regulators it is in the early stages of investigating a cybersecurity incident involving an unnamed third-party application.

08/25/2026

A federal court has officially approved a $117.5 million settlement against Comcast following a major 2023 data breach affecting 31.7 million individuals. The breach, triggered by the exploitation of the "Citrix Bleed" vulnerability, stands as one of the largest and most legally complex data breach cases to date.

Key corporate takeaways from the ruling include:

• Third-party software vulnerabilities can expose organizations to multi-million-dollar class action liabilities.
• Unpatched systems create significant exposure under both state common law and federal statutory frameworks.
• Courts are increasingly scrutinizing the duty of care owed by both enterprise software customers and vendor providers.

Protecting corporate assets requires moving beyond perimeter defenses to implement rigorous third-party risk management and rapid patch governance.

EXTEND Resources assists executive leaders in optimizing data privacy, information security, and governance strategies. Contact us to learn how.

A federal judge has approved a $117.5 million data breach settlement against Comcast Cable Communications. The agreement represents one of the largest

08/14/2026

[LINK IN COMMENTS] A report from the World Economic Forum highlights a critical disconnect in modern corporate leadership: 73% of companies view cybersecurity as a key priority, but only 59% of boards back that priority with dedicated budget allocation. Furthermore, just 50% of boards fully grasp the cybersecurity risks associated with artificial intelligence.

As cyber threats become more sophisticated and AI-driven, treating security as an isolated IT function is no longer viable. True resilience requires board-level oversight, aligned funding, continuous talent upskilling, and strict AI governance framework implementation.

08/11/2026

A major enterprise cyber incident demonstrates how quickly operational disruptions can turn into data privacy events. Coca-Cola has confirmed that a ransomware attack on its Fairlife subsidiary involved unauthorized access and the theft of company data.

Although business continuity plans helped restore facility production and protect inventory, the situation underscores why executive teams and legal counsel must prepare for complex exfiltration scenarios before an incident occurs.

Are your business continuity and incident response plans aligned to handle double-extortion ransomware? Check the first comment for the link to the complete article.

The Anubis cybercrime group has taken credit for the attack and is threatening to leak data.

08/05/2026

Corporate wind-downs and bankruptcy do not shield organizations from severe data breach liabilities. Former employees of shuttered trucking giant Yellow Corp. have filed a class action lawsuit following a cyber incident that exposed thousands of worker records, including 20 years of Social Security numbers.

The lawsuit alleges a 15-month gap between the initial network compromise and victim notification. For executives, legal directors, and risk officers, this serves as a clear lesson on the importance of maintaining data protection protocols and transparent incident response procedures across every stage of the business lifecycle.

Is your enterprise managing legacy data retention risks before they turn into costly litigation? Check the first comment to access the full report and governance insights.

07/21/2026

A $4.02 million settlement agreement offers a stark warning for healthcare leadership, risk managers, and corporate legal teams. ApolloMD Business Services has agreed to create a multi-million-dollar fund to resolve a class action lawsuit following a May 2025 ransomware intrusion that compromised the data of more than 626,000 individuals. This case proves once again that managing third-party business associates requires far more than basic contract language—it demands proactive, continuous risk governance.

Is your organization doing enough to evaluate vendor security before a breach occurs? View the first comment to access the full article.