News
Page 7 of 31 — 923 updates. Back to latest · By industry · National audits
Instant audit
Run a free scan at audit.emailmenow.com, then unlock the Full Audit Report with Fix Kit steps and compliance evidence for $99.
Attackers abuse Google recovery-contact requests so phishing arrives from Google’s own servers (SPF/DKIM/DMARC pass). Do not click — verify at myaccount.google.com. Prefer passkeys, YubiKey, and Google Authenticator over SMS. Audits (100% ideal): accounts.google.com 58%, google.com 52%.
Read Update
Houston City College appears on Have I Been Pwned with ~832k student and alumni accounts after a June 2026 ShinyHunters pay-or-leak campaign. Audits score hccs.edu at 68% with 15% transport; MFA FAQ allows only Microsoft Authenticator or SMS — not Google Authenticator or YubiKey.
Read Update
AiLock claimed Dallas Regional Chamber; DragonForce listed Tulsa; Cuero warned of fake-CAPTCHA malware. Domain audits (ideal 100%): houston.org 70%; dallaschamber.org and tulsachamber.com 50%; okcchamber.com 32% — none at 100%. No portal advertises YubiKey or Google Authenticator.
Read Update
Have I Been Pwned added 1 breach on August 1, 2026, exposing 865,336 accounts globally. SplitVPN led the batch with 865,336 accounts.
Read Update
Living MFA directory: YubiKey/FIDO, open TOTP, and passkeys — Banks, Credit Unions, Investment Firms, Travel, Healthcare, Social, and Consumer Finance. Domain audits ideal 100%.
Read Update
Public MFA docs for Chase, Bank of America, Wells Fargo, U.S. Bank, Capital One, and Citi show phone SMS codes still dominate. None advertise Google Authenticator / Proton Pass TOTP; Bank of America is the clear FIDO security-key standout. Domain audits (ideal 100%): chase.com 79%; citi.com 50% — none at 100%.
Read Update
Public MFA docs for Frost, Comerica, Southside, Broadway, TRB, Prosperity, Texas Capital, and Independent Financial show SMS / voice codes still dominate. None advertise Google Authenticator / Proton Pass TOTP or consumer YubiKey. Domain audits (ideal 100%): texascapitalbank.com 84%; comerica.com 37% — none at 100%.
Read Update
HHS OCR listed 4 large HIPAA breach submissions dated July 31, 2026, affecting 6,166 individuals nationally. Monongalia County General Hospital Company led the batch with 2,173 individuals.
Read Update
SEC EDGAR shows 1 Form 8-K Item 1.05 material cybersecurity disclosure filed July 31, 2026. AMGEN INC is among the filers.
Read Update
Texas OAG published 6 new data security breach reports on July 31, 2026, affecting 9,787 Texans. SM Energy Company led the batch with 3,851 affected.
Read Update
NOTUS reports a February 2025 email scammer posing as DNC Chair Ken Martin stole $28,860.92; only $7,000 recovered via Wells Fargo. Domain audits (ideal 100%): fec.gov 85%, gop.com 77%, democrats.org 68%; dems.org just 32% — none at 100%.
Read Update
MNIT says a coordinated OT cyberattack hit more than 30 Minnesota community water systems July 26–27. Braham briefly took its plant offline; Plymouth, Maple Plain, and South St. Paul went to manual ops. Domain audits (ideal 100%): none reached 100% — health.state.mn.us 38%, peopleservice.com 46%.
Read Update
UC San Diego found every KARR Security System since 2017 shares one plaintext Bluetooth auth key. ~2.2M U.S. cars — many via SoCal Honda/Toyota/Mazda/Ford/Jeep dealers — can be unlocked nearby and tracked via WiGLE. Domain audits (ideal 100%): acrisure.com 78%, karrsecurity.com 53%; none reach 100%.
Read Update
7zip.com impersonates 7-zip.org and ships a trojanized installer that enrolls PCs as residential proxy nodes. Of 16 registered lookalikes we scanned, several (7zip.org, 7-zip.com, 7-zip.net) are brand-owned mirrors/forwards — the lure still scores 29% vs 36% for the project; none at the 100% ideal.
Read Update
Sam Curry and Shubham Shah showed Subaru’s STARLINK admin portal allowed account takeover and remote unlock/start plus a year of ~5 m location history. UH West Oahu summarizes the patch-in-24-hours case. Domain audits (ideal 100%): subaru.com 59%, mysubaru.com 28%; none at 100%.
Read Update
California's data breach list added 3 notices on July 27, 2026. California does not publish residents-affected counts — this roundup tracks reporting visibility.
Read Update
Multi-source breach data week of July 26, 2026: Texas OAG, HHS OCR, SEC Form 8-K, HIBP, and state AG trackers. Texas YTD reports +10 (342 → 352). 13 companies/entities from source roundups.
Read Update
ReliaQuest: hotel Wi-Fi DNS poisoning steals Microsoft 365 logins since June 2026. Full-tunnel VPN guide covers Proton VPN, Cloudflare WARP/Zero Trust, Tailscale, Zscaler, and corporate options. Top 10 U.S. hotel audits (100% ideal): marriott.com 70% leads; choicehotels.com 43%.
Read Update
August 2026 Texas bar associations cyber briefing: peer incidents, domain-audit takeaways (ideal 100%), MFA notes, one IT security tip, and free member self-check links. Published on the last Sunday of the prior month.
Read Update
August 2026 Texas chambers cyber briefing: peer incidents, domain-audit takeaways (ideal 100%), MFA notes, one IT security tip, and free member self-check links. Published on the last Sunday of the prior month.
Read Update
August 2026 Texas credit unions cyber briefing: peer incidents, domain-audit takeaways (ideal 100%), MFA notes, one IT security tip, and free member self-check links. Published on the last Sunday of the prior month.
Read Update
Ernst & Young notified clients after attackers accessed a third-party ITSM help-desk platform Mar 28–Apr 12, 2026 and downloaded tax documents. Texas AG filing July 17 lists 873 Texans. Audits (100% ideal): ey.com 84% — still −16 from ideal.
Read Update
Frontier faces two Colorado class actions after a May 12–June 3, 2026 breach affecting 11,482 people (Texas AG). Scattered Lapsus$ Hunters claimed a ransom. Audits (100% ideal): flyfrontier.com 74% with 15% transport.
Read Update
Surfside Beach lost $545,598.30 via ACH on March 13, 2026 after both lookalike domains registered March 9. As of Jul 25, neither the town nor Wildcat has neutralized the squats — both still have live MX. Audits: vendor squat 47%, town squat 43% — none at the 100% ideal.
Read Update
Pasadena, TX contractor TPIS Industrial Services notified 2,123 Texans after a ransomware incident; PLAY claimed the firm March 26. Texas AG filing July 17. Audits (100% ideal): tpis.com 47% with 0% identity and 15% transport.
Read Update
BBB and FTC warn that fake Evite, Paperless Post, and Punchbowl 'You're Invited' messages steal email passwords and one-time codes. Houston-area coverage is amplifying the alert. Audits (100% ideal): paperlesspost.com 76%, evite.com 75%, ftc.gov 72%, punchbowl.com 52%.
Read Update
Attackers stuffed third-party stolen passwords into Chick-fil-A One from June 17–19, 2026. Notices cite 2,182 Texans. Audits (100% ideal): chick-fil-a.com 42%, chickfila.com 28% — neither near ideal.
Read Update
Jamf documents CrashStealer: a C++ macOS infostealer disguised as CrashReporter that steals Keychain, browsers, ~80 crypto wallets, and 14 password managers via a notarized Werkbit dropper. Audits (100% ideal): cloudflare.com 88%, bitwarden.com 78%.
Read Update
Cybercriminals combine FaceTime social engineering with unpatched iPhones to steal banking credentials and drain accounts. Apple asks users to report fake bank FaceTime calls. Audits (100% ideal): cloudflare.com 88%, malwarebytes.com 72%, apple.com 70%.
Read Update
California's data breach list added 3 notices on July 23, 2026. California does not publish residents-affected counts — this roundup tracks reporting visibility.
Read UpdateSB 2610 may help limit exemplary damages for eligible businesses that maintain a documented cybersecurity program; not legal advice or a guarantee.