INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Lazarus Group Hacked Microsoft

| 2026-10-23 10:00 CRITICAL LOW DATA BREACH SUPPLY CHAIN
JSON
Executive Summary
AI-generated
A significant data breach incident occurred in October 2026, where more than two-thirds (69%) of data breach victims were affected by a third-party breach. The majority (79%) of those individuals had their data accessed following the compromise of technology companies during June 2025 to June 2026. Finance and Professional Services sectors were most breached, with finance making up 20% of breaches observed by Kroll. Cybercriminal actors such as the Scattered Spider hacking collective target IT service providers to gain access to customers' systems. A Chinese nation-state actor gained access to an IT management software provider's cloud infrastructure in October 2026, enabling them to target downstream customers. The attack works by exploiting vulnerabilities in third-party companies, which can then lead to widespread data breaches affecting multiple organizations and individuals. Currently, the full extent of the incident is still being assessed, but it highlights the significant impact that a single company breach can have on multiple sectors.
Technical Mitigations AI-generated
• Patch ConnectWise's cloud infrastructure to prevent Chinese nation-state actors from targeting downstream customers. • Monitor for signs of Scattered Spider hacking collective activity, such as unusual login attempts or system access by unknown users. • Implement robust vendor risk management practices to identify and mitigate potential security vulnerabilities in third-party software suppliers.
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Scattered SpiderScattered Spider
Target & Sectors
CN
technologytechnology healthhealth financefinance
Incident Timeline
‎June 2026
Threat actors, including the Scattered Spider hacking collective, targeted IT service providers to gain access to their customers' systems.
organisation Professional Services
Finance and Professional Services Most Breached Sectors Despite the tech sector causing the vast majority of individual data breach victims, it was only the seventh most commonly breached sector.
threat_actor Scattered Spider
" Cybercriminal actors such as the Scattered Spider hacking collective are known to target IT service providers to gain access to their customers’ systems.
‎October 22
69% of security leaders surveyed reported experiencing a data breach in the previous 12 months.
general_metric 69 %
Among all security leaders surveyed for the Kroll report, published on October 22, 69% said their organization had suffered a breach in the previous 12 months, while 34% reported experiencing more than one.
general_metric 34 %
Among all security leaders surveyed for the Kroll report, published on October 22, 69% said their organization had suffered a breach in the previous 12 months, while 34% reported experiencing more than one.
‎the period June 2025 to June 2026
Most third-party data breach victims had their data accessed following the compromise of a technology company during the specified period.
general_metric 79 %
Of those individuals, most (79%) had their data accessed following the compromise of a technology company during the period June 2025 to June 2026.
‎October 2026
A Chinese nation-state actor gained access to ConnectWise's cloud infrastructure in October 2026, allowing the group to target downstream customers.
target_region China
In October 2026, it was reported that a Chinese nation-state actor gained access to IT management software provider ConnectWise’s cloud infrastructure, enabling the group to target downstream customers.
organisation ConnectWise
In October 2026, it was reported that a Chinese nation-state actor gained access to IT management software provider ConnectWise’s cloud infrastructure, enabling the group to target downstream customers.
Intelligence Sources
Infosecurity-Magazine 2026-10-23