Cyberattack

• Google ha annunciato l'11 maggio 2026 di aver interrotto un cyberattacco avanzato condotto da un gruppo criminale che sfruttava vulnerabilità guidate dall'IA in sistemi informatici globali. • Gli aggressori hanno sviluppato un exploit zero-day utilizzando l'IA per la scoperta di vulnerabilità e hanno pianificato un evento di sfruttamento di massa mirato a un popolare strumento di amministrazione di sistemi basato sul web e open-source, aggirando l'autenticazione a due fattori. • Il Google's Threat Intelligence Group (GTIG) ha identificato e contrastato proattivamente la minaccia, collaborando con il fornitore interessato per una divulgazione responsabile al fine di prevenire una compromissione diffusa.

• Il blackout di Canvas a livello nazionale ha lasciato studenti e docenti in einer situazione di stallo, costringendoli a riorganizzare rapidamente la fine dell'anno accademico. • Un sistema utilizzato da migliaia di scuole e università negli Stati Uniti è rimasto offline giovedì a causa di un cyberattacco, creando il caos mentre gli studenti cercavano di studiare per gli esami finali e sottolineando la dipendenza dell'istruzione dalla tecnologia. • Gli studenti si sono rapidamente rivolti ai social media per chiedere se altri avessero problemi di accesso a Canvas, con molti in preda al panico per l'impossibilità di visualizzare i materiali didattici contenuti nella piattaforma per studiare per i loro esami finali.

• CrowdStrike disclosed on April 25, 2026, a sophisticated cyberattack via compromised third-party software affecting 2.5 million patient records at UnitedHealth's Change Healthcare subsidiary. • Attackers, linked to North Korean Lazarus Group, exfiltrated data over 72 hours before detection, demanding $22 million ransom. • Incident highlights vulnerabilities in US healthcare IT supply chains, prompting HHS emergency directives for 500+ providers.

• IBM announced IBM Autonomous Security on April 15, 2026, deploying coordinated AI agents to detect and contain threats at machine speed without human intervention. • The service addresses a critical gap: attackers now achieve full network lateral movement in as little as 27 seconds, compared to an average of 29 minutes in 2024—a 65% speed improvement driving urgent demand for AI-powered defenses. • AI-enabled attacks surged 89% year-over-year in 2025, with a 44% increase in assaults exploiting public-facing applications, prompting major security vendors to adopt autonomous AI defense strategies.

• CrowdStrike disclosed on April 20, 2026, a sophisticated supply chain attack affecting 1,200 US clients, including Fortune 500 firms, via compromised third-party software. • Attackers deployed ransomware, encrypting critical systems and demanding $50 million in Bitcoin; no data exfiltration confirmed yet. • The incident highlights rising risks in software supply chains, echoing SolarWinds breach, with FBI joining investigation.

• NATO's Cyber Defense Centre convened an emergency session Friday evening after Russia launched a sophisticated cyberattack targeting Poland's electrical grid and water treatment facilities, temporarily affecting 2.3 million residents. • Polish authorities attribute the attack to Russian military intelligence, claiming it used previously unknown malware variants designed to evade NATO defense systems and test alliance cyber resilience. • The incident prompted NATO to raise its cyber alert status to level 3, the highest in the alliance's history, and triggered Article 5 consultations regarding collective defense implications.

• IBM launched IBM Autonomous Security on April 17, 2026, a multi-agent AI service automating detection, policy enforcement, and remediation against frontier AI-driven attacks in hybrid environments. • The solution addresses emerging 'agentic attacks' where adversaries use advanced AI models, with nearly 80% of global IT leaders citing AI as a major security risk. • IBM also released an enterprise cybersecurity assessment tool focused on threats from large language models and generative AI.

• Iranian cyberattacks target critical U.S. infrastructure as President Trump threatens strikes on Iran's bridges and power plants. • The cyber activity escalates frictions during the fraying ceasefire, with unclear U.S. peace terms. • U.S. officials report the attacks follow Trump's profanity-laden threats, prompting Democratic backlash.

• A pro-Iranian cybercrime group claimed responsibility for cyberattacks that knocked the websites of Chime and Pinterest offline in April, marking a significant coordinated breach affecting major U.S. tech platforms. • The attacks demonstrate the evolving threat landscape where state-affiliated or state-aligned cyber actors target critical infrastructure and consumer-facing platforms with increased sophistication. • The incidents underscore the vulnerability of major technology companies to coordinated cyberattacks and highlight ongoing concerns about foreign threat actors targeting U.S. digital infrastructure.

Security agencies say municipalities should watch out for unusual activity, especially in water and energy sectorsMiddle East crisis – live updatesTop government security agencies issued a warning of Iran-affiliated cyberattacks on critical infrastructure across the US on Tuesday. In a joint statement, the agencies say that municipalities, especially in the water and energy sectors, should be on the lookout for unusual activity.“Cyberattacks on drinking water and wastewater systems directly threaten public health and community resilience,” Jeffrey Hall, an assistant administrator for enforcement and compliance assurance for the Environmental Protection Agency (EPA), said in a statement. “A single breach can disrupt treatment or introduce contaminants, damage equipment, and erode public trust.” Continue reading...

• Stryker, a major US medical device manufacturer, suffered a cyberattack causing widespread business disruption, reported on March 27, 2026. • The company stated operations are steadily improving toward full capacity after the incident. • This incident highlights ongoing cybersecurity vulnerabilities in US healthcare tech supply chains.

• Iran-linked hackers conducted a cyberattack last week on Stryker, a US medical technology company, exposing modern cybersecurity threats to critical infrastructure. • The incident serves as a wake-up call for the United States regarding vulnerabilities in the healthcare sector to nation-state actors. • Stryker, a major player in med-tech, faced disruptions highlighting the escalating risks from geopolitical cyber operations.