Recent breaches and what they mean for your business
Most attacks on small businesses aren’t new tricks. They’re the same few mistakes showing up in the news week after week: reused passwords, unpatched firewalls, fake calls from “IT” or “the bank,” and data left open to the internet. This page collects recently disclosed incidents, explains each one in plain English, and links to the guide and Short that show you how to close the same gap.
Last updated · 12 incidents disclosed between Sep 7, 2026 and Oct 19, 2026 · Every entry links to its original source.
Palo Alto Networks' Unit 42 says ransomware operators, including the Qilin and Inc groups, are exploiting an authentication bypass in GlobalProtect VPN gateways to open VPN sessions without valid logins. After getting in, they move across the network and steal data before deploying ransomware.
What it means for a small business
Your firewall or VPN box is the front door, and a known flaw in it lets attackers skip your passwords and MFA. Unit 42's list of affected sectors includes professional and legal services, hospitality, manufacturing and retail, not only large enterprises.
Ransomware takes down a cloud provider's region and its customers' servers
IDC Frontier (IDCF Cloud), Japan·Disclosed
What happened
IDC Frontier confirmed a ransomware attack on its IDCF Cloud service that caused an outage affecting 495 companies and local governments. The attackers claimed they encrypted databases and wiped more than 550,000 snapshots, and the provider shut off customer console access in every region while it checked its systems.
What it means for a small business
If your only copy lives with the same provider that runs your servers, one attack on that provider can take both. Keep at least one backup with a different company or offline, and test a restore.
A Virginia business lost $856,000 after a fake bank caller collected its 2FA codes
Local business in Hanover County, Virginia·Disclosed
What happened
The sheriff's office says the business's computer had been infected with malware and the criminals already had its online banking login. A caller posing as the bank then talked an employee into reading out several two-factor codes, which were used to approve wire transfers. The bank clawed back part of the money, cutting the loss to $330,000, and a Florida woman who received some of the funds now faces charges.
What it means for a small business
Your bank will never call and ask you to read back a security code. Codes sent by text or read over the phone can be talked out of anyone, so hang up and call the number on your card or statement.
Hackers use Ninja Forms and WooCommerce plugin flaws to plant hidden WordPress admins
Ninja Forms and WPC Product Bundles for WooCommerce (WordPress plugins)·Disclosed
What happened
Attackers are planting malicious code in form submissions and WooCommerce order data. When a logged-in admin views it, the code installs a fake plugin and creates administrator accounts, including one hidden from the WordPress user list. Ninja Forms runs on more than 500,000 sites.
What it means for a small business
A contact form or shop plugin you installed years ago can hand over your whole website. Turn on plugin auto-updates, and remember that updating doesn't remove an attacker who is already in, so check your admin accounts.
Domino's customer accounts taken over with passwords leaked from other sites
Domino's Pizza (UK customer accounts)·Disclosed
What happened
Domino's emailed affected customers to say a small number of accounts were accessed using email and password pairs leaked in unrelated breaches elsewhere. The company says its own systems weren't breached. It reset the affected accounts and reported the incident to the UK Information Commissioner's Office.
What it means for a small business
When staff reuse a password, a breach at some unrelated site becomes a login to your business accounts. A password manager with a unique password per account stops this attack.
Payroll provider breached through a flaw in one of its software vendors
Poppins Payroll Company·Disclosed
What happened
Poppins Payroll told customers that an attacker used a security vulnerability in Metabase, a software vendor it uses, to get into a Poppins system on September 3, 2026. It filed notices with state attorneys general, including California, and offered two years of credit monitoring.
What it means for a small business
Your payroll data is only as safe as your payroll provider and the tools it uses. If you get a breach letter, freeze your credit (it's free) and ask your providers how they vet their own vendors.
Fake Zoom and PDF installers quietly install remote-access tools
Phishing campaigns abusing MSP360 RMM and ConnectWise ScreenConnect·Disclosed
What happened
Microsoft reports phishing emails dressed up as meeting invites, PDF documents and software updates that install a legitimate remote-management tool under a fake file name. The attackers then add a second remote-access tool and use it to steal saved passwords and collect data.
What it means for a small business
Because the software is real and signed, it can look like normal IT activity. Decide which remote-access tool your business uses, block the rest, and don't let staff approve admin prompts for software they didn't ask for.
Two men sentenced for business email scams that redirected million-dollar wires
Business email compromise ring (U.S. federal case)·Disclosed
What happened
Two former U.S. Air Force members were sentenced to a combined 189 months for phishing employee email logins and then using look-alike email addresses of business partners to redirect payments. Diverted wires included more than $1.68 million from a victim in Iowa City and more than $720,000 from a victim in Ohio.
What it means for a small business
A "new bank details" email from a real vendor's address, or one that's one letter off, is how most of this money goes missing. Confirm any change to payment details by calling a number you already have.
UpGuard researchers found more than 16,000 Supabase databases with tables anyone could read, exposing personal details and in some cases passwords and login tokens. One U.S. valet service exposed more than 100,000 customer records. Researchers blamed missing security settings and said many of the apps appear to have been built with AI coding tools.
What it means for a small business
If someone built your booking app, customer portal or website backend for you, ask them to prove the data isn't public. "It has a login page" is not the same as "the data is protected."
CISA updated its Known Exploited Vulnerabilities catalog to say ransomware gangs are using a critical WatchGuard Firebox flaw that lets attackers run code without logging in. The fix came out in December, but Shadowserver still counted nearly 9,000 unpatched firewalls online nine months later.
What it means for a small business
WatchGuard says it serves more than 250,000 small and mid-sized companies, mostly through local resellers. If you have a Firebox, ask whoever manages it for the firmware version today, and make firewall updates part of your monthly check.
Fake "IT help desk" calls steal Microsoft 365 sessions, even with MFA
Microsoft 365 users (campaigns tracked by Microsoft and Arctic Wolf)·Disclosed
What happened
Microsoft and Arctic Wolf describe callers posing as internal IT who walk employees through a "passkey" or MFA update on a fake company login page. The page passes the password and MFA approval to the attacker, who then downloads mail and files from Outlook, SharePoint and OneDrive. Arctic Wolf says targets are mainly U.S. firms in construction, healthcare, real estate, finance and professional services.
What it means for a small business
Codes and push approvals can be relayed through a fake page. Use phishing-resistant sign-in (passkeys or security keys) where you can, and have one rule: IT never calls to set up MFA, so hang up and call back.
Emergency fix for the remote-management tool many MSPs use to run client PCs
N-able N-central (CVE-2026-86218)·Disclosed
What happened
N-able released an emergency hotfix for a maximum-severity flaw in N-central, the console many managed service providers use to control their clients' computers. Huntress flagged it as a possible zero-day after a compromise at one customer, and Shadowserver counted nearly 1,500 N-central servers exposed online.
What it means for a small business
If an IT provider manages your computers, their tools can reach every one of them. Ask your MSP which remote-management platform they use, whether it's patched, and whether their console requires MFA.
Close these gaps with a ready-made security program
The Small Business Security Essentials Toolkit gives you a 32-question self-assessment that ranks what to fix first, ten editable policies (including Password & MFA, Backup & Recovery, and Contractor & Vendor Access), five incident playbooks with the messages already written, and a 90-day rollout plan. $79 one-time, instant download.
The security basics to put in place first, in one free PDF. Leave your email to get it in your inbox, plus a short note when a new guide is published. Check your inbox to confirm your subscription if Kit asks you to.