Posts in category: Featured

A single cloud misconfiguration inside McGraw-Hill’s Salesforce environment handed attackers access to 45 million records this week. Combined with breaches at Booking.com and Basic-Fit, and ransomware data showing 88% of incidents target small and mid-size businesses, the message for business leaders is clear: the biggest threats are not exotic — they are ordinary oversights in the tools you already use.

The McGraw-Hill Breach: A Cloud Configuration Gone Wrong

On April 14, the ShinyHunters ransomware group claimed responsibility for breaching McGraw-Hill through an improperly configured Salesforce instance. The attackers did not need to crack encryption or exploit cutting-edge vulnerabilities. They walked through a door that was left open.

The result was 45 million Salesforce records exposed — names, contact details, and other personally identifiable information that can fuel identity theft, phishing campaigns, and follow-on attacks against the people in those records. For a company of McGraw-Hill’s size, the legal exposure alone could stretch into the tens of millions of dollars. For the millions of individuals whose data is now circulating in criminal marketplaces, the consequences may take years to fully surface.

What makes this breach instructive for small and mid-size business leaders is not the scale. It is the method. Salesforce, HubSpot, Zoho CRM, and similar platforms are standard tools across businesses of every size. Each one comes with dozens of permission settings, access controls, and integration points. A single misconfigured field — a permission set too broadly, an API endpoint left exposed, a user role that grants more access than intended — can turn a trusted business tool into an open window.

If your organization uses any cloud-based CRM, project management, or customer data platform, the question is not whether your configuration is complex. It is whether anyone has audited it recently.

More Breaches This Week: Booking.com and Basic-Fit

McGraw-Hill was not alone. On April 12, Booking.com confirmed that a cybersecurity incident compromised customer reservation details — full names, email addresses, postal addresses, phone numbers, and even the special requests customers had attached to their bookings. The company has not disclosed the total number of affected records, but the breadth of exposed data types is concerning. For businesses that rely on third-party booking or scheduling platforms, this is a reminder that your customers’ data security is only as strong as the weakest link in your vendor chain.

A day later, Dutch fitness chain Basic-Fit disclosed that attackers had accessed records for one million members, including bank account details for a portion of those customers. The breach impacted operations across multiple countries and underscored a pattern that has been building throughout 2026: customer-facing businesses that store payment information remain high-value targets, regardless of their industry.

Neither Booking.com nor Basic-Fit operate in what most people would consider the “cybersecurity industry.” They are a travel platform and a gym chain. That is precisely the point. Attackers are not limiting themselves to technology companies. They are going where the data is, and for most businesses, that means the customer records sitting inside everyday operational tools.

The Numbers Behind the Headlines

These individual breach stories fit into a broader pattern that every business leader should have on their radar. Current data from multiple cybersecurity research organizations paints a stark picture of the ransomware landscape heading deeper into 2026:

• 88% of all ransomware incidents now involve small and mid-size businesses. The overwhelming majority of ransomware attacks are hitting organizations with limited IT staff and smaller security budgets.
• The average cost of a ransomware incident for a small business ranges from $120,000 to $1.24 million. That figure includes ransom payments, recovery expenses, lost revenue during downtime, and the cost of rebuilding trust with customers and partners.
• 60% of small businesses that suffer a cyberattack shut down within six months. The financial and operational shock is often more than a smaller organization can absorb, especially when it hits during a period when margins are already thin.
• The top three attack methods remain exploited software vulnerabilities (32%), compromised credentials (23%), and phishing emails (18%). None of these are exotic. They are known problems with known solutions.

One additional trend worth watching: data exfiltration is now present in 87% of ransomware attacks. Criminals are not just locking your files and demanding payment. They are stealing your data first and threatening to publish it if you refuse to pay. This double extortion strategy raises the stakes significantly because even if you have reliable backups and can restore your systems, your sensitive business and customer data may still end up on the dark web.

What Business Leaders Should Be Doing This Week

The gap between awareness and action is where most businesses get hurt. Reading about these breaches is a start, but the real question is whether your organization has taken concrete steps to close the doors that attackers are walking through.

Audit your cloud configurations. If your business uses any cloud-based platform that stores customer or employee data — CRM systems, accounting software, file storage, HR tools — verify that access permissions are set correctly. Who has admin access? Are there API integrations that were set up months ago and never reviewed? Does every user have the minimum level of access they need to do their job? If you do not know the answers, that is the first problem to solve.

Patch the software CISA flagged this week. The Cybersecurity and Infrastructure Security Agency added six actively exploited vulnerabilities to its catalog this week, including critical flaws in Fortinet’s FortiClient, Microsoft Exchange Server, and Adobe Acrobat Reader. Federal agencies have until April 30 to apply fixes. Your business should not wait that long. If you use any of these products, check with your IT provider about whether patches have been applied.

Confirm your multi-factor authentication coverage. Compromised credentials account for nearly a quarter of all successful attacks. Passwords alone are not sufficient. Multi-factor authentication adds a second verification step that stops the majority of credential-based attacks. If MFA is not enabled on every business-critical account — email, financial platforms, cloud storage, CRM — enable it today.

Review your incident response plan. If a breach happened at your organization tomorrow morning, does your team know who to call, what to shut down, and how to communicate with customers? Fifty-seven percent of security incidents are first detected by someone outside the organization, not by the company itself. Having a documented, rehearsed response plan is the difference between a contained incident and a business-ending crisis.

The breaches making headlines this week did not require advanced technical knowledge to prevent. They required attention, routine maintenance, and a commitment to treating cybersecurity as an operational priority — the same way you treat payroll, legal compliance, and insurance. The businesses that take those steps consistently are the ones that stay out of the headlines.

March 2026 delivered a cross-industry attack pattern that security researchers are calling the most volatile month of the year so far: medical technology, legal data, higher education, and manufacturing each absorbed significant incidents, driven by a combination of ransomware operators seeking high-value data and geopolitically-motivated groups targeting U.S. and allied infrastructure. The breadth of this month’s incidents is itself a data point that business leaders should act on.

Stryker, LexisNexis, and the Strategic Targeting of Data-Rich Organizations

Stryker Corporation, one of the world’s largest medical technology companies, reported a significant cyberattack in March attributed to an Iran-aligned hacktivist group. The attack disrupted administrative and operational systems at multiple business units. Stryker’s products and services reach hospitals, surgical centers, and medical providers across dozens of countries — the downstream impact of any sustained operational disruption extends well beyond the company itself.

LexisNexis, the legal and professional services data platform used by law firms, financial institutions, and compliance teams worldwide, also experienced an incident in March affecting portions of its data infrastructure. The nature of the data LexisNexis manages — legal records, professional credentials, financial due diligence files, court documents — makes it a high-value target for both nation-state actors seeking intelligence and criminal operators building identity fraud capabilities. The incident is under investigation.

Both incidents share a characteristic that defines the March 2026 threat environment: attackers are targeting organizations for their data value, not their revenue size. Stryker’s medical data and LexisNexis’s legal records have intelligence value far exceeding any ransom that could be extracted. The strategic motivation behind these attacks extends beyond financial extortion to information collection — a pattern that security agencies in the U.S., U.K., and EU have all flagged as an accelerating concern in 2026.

Higher Education and Manufacturing: Sectors That Underestimate Their Exposure

The University of Hawaii and several peer institutions experienced ransomware incidents in March, continuing a pattern from 2025 that saw education sector attacks increase 70 percent year-over-year. Universities hold a specific combination of data that makes them attractive targets: personal information on hundreds of thousands of students and alumni, research data with potential commercial or strategic value, financial records, and healthcare information from campus medical services. They also typically operate with fragmented IT environments and limited security staffing relative to their attack surface.

Michelin, the global tire and automotive manufacturing company, also reported a March incident, reinforcing that manufacturing sector organizations are increasingly targeted for operational disruption and intellectual property theft simultaneously. Manufacturing facilities that have integrated operational technology — connected machinery, automated production systems, supply chain software — with traditional IT networks face a particular risk: ransomware that crosses from the IT environment into operational systems can halt physical production, not just digital operations.

For small and mid-size businesses in manufacturing, healthcare services, professional services, or education-adjacent industries, March’s headlines carry a direct message: your sector is not off the target list. The incidents at Stryker, LexisNexis, and university systems involved attackers who had specifically researched these organizations’ data holdings and systems before executing their attacks. Opportunistic attacks are still common, but targeted attacks — where attackers invest weeks or months in reconnaissance before executing — are increasing in frequency.

Supply Chain and OAuth Abuse: The Technical Pattern Behind March’s Incidents

April will bring news of the March incidents’ downstream effects, as is typical of the months following major attacks. What the March data already shows is a technical pattern worth understanding: OAuth abuse and supply chain compromises are responsible for a disproportionate share of the month’s incidents. OAuth is the authentication framework that allows one application to access another on a user’s behalf — the mechanism behind “Sign in with Google” or “Connect your Slack account.”

When attackers compromise an OAuth token or abuse OAuth permissions in a connected application, they gain access to everything that token is authorized to reach — often across multiple systems simultaneously, without triggering traditional login-based detection. The proliferation of connected business applications has expanded the OAuth attack surface significantly: the average SMB now uses more than 80 cloud applications, many of which are interconnected through OAuth relationships that have never been audited.

The practical implication for business owners is that connected app permissions represent an unreviewed attack surface in most small business environments. Applications granted access to your Google Workspace, Microsoft 365, or financial systems years ago may still hold permissions that are no longer necessary. An attacker who gains access to one connected application inherits whatever access that application holds across your environment.

What Business Leaders Should Consider

1. Audit your connected application permissions this month. In Google Workspace, go to Security → API Controls → Third-party apps. In Microsoft 365, go to the Azure Active Directory portal → Enterprise Applications. Review what applications have been granted access, what permissions they hold, and whether those applications are still in active use. Revoke permissions for any application your organization no longer uses.
2. If you work in healthcare, legal, or professional services, treat your data as a strategic intelligence target, not just a compliance requirement. The March incidents demonstrate that data-rich organizations are targeted not just for ransom but for the intelligence value of the information they hold. Your response plan should account for both data theft and operational disruption scenarios.
3. Ask your IT provider about network segmentation if you have any connected operational equipment. Manufacturing, healthcare, and facilities management businesses that have connected physical equipment — machinery, HVAC, security systems, medical devices — to their business network need to confirm that a compromise of the IT network cannot reach operational systems. Network segmentation is the primary technical control for this risk.
4. Verify that your cyber insurance covers geopolitically-motivated attacks. Some cyber policies include exclusions for nation-state or politically-motivated attacks. The Iran-aligned group behind the Stryker attack places that incident in a potentially excluded category for some policy holders. Review your exclusions now.
5. Run a phishing simulation with your team in Q2. The reconnaissance-heavy, targeted attacks documented in March begin with social engineering — attackers gather information about your organization and craft highly personalized communications that are difficult to distinguish from legitimate business correspondence. A quarterly phishing simulation, even a simple one, trains your team to pause before clicking and report suspicious messages.

Security researchers have documented a decisive strategic shift in how ransomware operators select targets: attacks through shared vendors and software providers — what the industry calls supply chain attacks — are now the preferred method for maximizing impact from a single compromise. For small business owners who depend on third-party software, payment processors, IT providers, and cloud platforms, this changes the calculus of risk in ways that demand a direct response.

The Economics of Supply Chain Attacks

The Conduent breach, which was initially reported as affecting approximately 4 million individuals, grew to confirmed impact on over 25 million people by February as Texas and Oregon completed audits of affected residents. The final scope of the Conduent incident is not yet known. What is known is that Conduent was one vendor, one breach event, and the downstream impact reached government agencies, healthcare organizations, and businesses across multiple states — none of which had any visibility into the vulnerability that created the exposure.

This is the model that attackers have recognized as superior to direct targeting of individual organizations. A single compromise of a widely-used vendor delivers more victims, more leverage, and more monetization opportunities than any equivalent effort spent targeting small businesses one at a time. Ransomware-as-a-Service operators have adapted their targeting criteria accordingly: the highest-value targets are no longer the largest organizations — they are the organizations that serve the most other organizations.

The Conduent case illustrates a specific pattern: the breach was initially contained in the public disclosure, then expanded significantly as downstream organizations completed their own audits. This is typical of supply chain incidents. The vendor’s initial breach notification understates impact because they don’t have full visibility into what their clients held. The full scope emerges over weeks and months, long after affected organizations have already made their initial response decisions.

Three Supply Chain Incidents Business Owners Should Know

The pattern isn’t limited to large payment processors. In December 2025, SoundCloud, Freedom Mobile, and Leroy Merlin each reported breaches that originated with shared infrastructure or third-party providers rather than direct attacks on their own systems. In January 2026, both BridgePay’s ransomware event and the Match Group ShinyHunters claim followed similar pathways: attackers accessed platforms that served many organizations simultaneously.

For small business owners, the implications are practical rather than theoretical. If you use a managed payroll service, a cloud accounting platform, a point-of-sale system provided by a third-party vendor, or any business application that your provider hosts on shared infrastructure, you are embedded in a supply chain that attackers are actively analyzing for vulnerability. The question is not whether your vendor will be attacked. The question is whether you have the contractual protections, the monitoring, and the response plan to manage the event when it happens.

The FCC’s January 29th warning about a fourfold increase in attacks targeting SMB providers reinforced what incident data has been showing for months: the small and mid-size businesses that serve other small and mid-size businesses — IT providers, managed services firms, telecommunications companies, regional software vendors — have become primary targets precisely because of their role in the supply chain. An attacker who compromises a managed IT provider gains access to every client organization that provider manages.

What This Means for How You Evaluate Vendor Risk

Most small business owners evaluate vendors on price, service quality, and reliability. Security posture is rarely in the evaluation criteria, and almost never contractually enforced. This represents a measurable gap between the current threat environment and most businesses’ vendor management practices.

The businesses that are managing supply chain risk effectively are not doing so through sophisticated technical audits — they’re doing it through contractual requirements and basic due diligence questions. Does the vendor carry cyber liability insurance? Have they completed a SOC 2 Type II audit in the last 12 months? What is their notification obligation to clients if they discover a breach? How quickly can they demonstrate that they can restore your data from their backup systems?

These questions take 15 minutes to ask and cost nothing to require answers to. Vendors who cannot answer them should be evaluated as uninsured supply chain risk in your business continuity planning.

What Business Leaders Should Consider

1. Add four supply chain security questions to your vendor evaluation process. For any vendor who holds your data or serves as infrastructure for your operations, ask: (1) Do you carry cyber liability insurance? (2) Have you completed a SOC 2 Type II audit? (3) What is your breach notification timeline to clients? (4) Can you demonstrate a successful data restore from backup? Document the answers.
2. Review your contracts for vendor breach notification clauses. If your existing vendor contracts don’t require breach notification within 72 hours, add that language at next renewal. Most reputable vendors will accept this provision. Those who won’t are signaling something about how they handle incident communication.
3. Know what data each vendor holds and where it lives. Create a simple inventory: vendor name, what data they hold (customer records, financial data, employee information), and whether that data is encrypted at rest. This takes one hour and becomes foundational when you need to assess impact in a breach event.
4. Confirm your cyber insurance covers supply chain incidents. Many standard cyber policies exclude or limit coverage for breaches that originate with a vendor rather than your own systems. Review your policy specifically for supply chain and third-party breach coverage and request a coverage opinion from your broker on this specific scenario.
5. Establish an alternative vendor capability for your two most critical dependencies. For each vendor whose failure would halt your operations, identify a backup option. You don’t need to contract with the backup vendor. You need to know who they are, what their onboarding timeline is, and what data migration looks like. That knowledge is valuable before an emergency, not during one.