New Jamf CEO Sees AI Advances as Apple Security Driver

Michael Novinson • May 21, 2026

Chief Technology Officer Beth Tschida takes over as CEO of Minneapolis-based Jamf with a mandate to define how the Apple management and security vendor uses AI internally while helping CISOs govern shadow AI, identity and policy controls across enterprise Apple fleets.

Artificial Intelligence & Machine Learning

Verizon Breach Report: Vulnerability Exploitation Surges

Latest

Cyberwarfare / Nation-State Attacks

China-Aligned Webworm Adds Discord, OneDrive Backdoors

Tiffany Wang • May 21, 2026

Eset says China-aligned Webworm added Discord- and Microsoft Graph-based backdoors, custom proxies and cloud-staged malware as it expanded operations against European government targets.

Governance & Risk Management

State Officials Urge Congress to Renew Cyber Grant Program

Chris Riotta • May 21, 2026

State cybersecurity officials warned Congress that Chinese-linked intrusions and rapidly advancing artificial intelligence systems are overwhelming local defenses as states push lawmakers to expand long-term federal cyber grant funding and preserve federal coordination efforts.

Healthcare

Liberty Mutual Sued Over Alleged Everest Group Data Theft

Marianne Kolbasuk McGee • May 21, 2026

Insurance carrier Liberty Mutual is facing proposed class action litigation filed by policyholders who allege their sensitive information was compromised in an April data theft claimed by cybercrime gang Everest Group. The incident is the company's latest data security related troubles.

Cybercrime

Breach Roundup: Shai-Hulud Copycat Hits npm

Pooja Tikekar • May 21, 2026

This week, more incidents than we can here list. Among them: cloned Shai-Hulud malware, a new maximum CVSS Cisco flaw. Edge to stop loading passwords in plaintext. Tycoon 2FA offers a way around Microsoft multifactor. Convenience, taquitos and data breach: The 7-Eleven story. A MENA crackdown.

Blockchain & Cryptocurrency

Cryptohack Roundup: US Extradition of Accused in $340M Scam

Rashmi Ramesh • May 21, 2026

This week, Forsage's co-founder was extradited to the U.S. over a $340M scam, hackers stole from Verus Bridge, ThorChain and Echo Protocol, ZachXBT alleged insider control behind LAB token surge, an Ohio man was sentenced in a Ponzi scheme case and crypto ATM scams cost Americans $388M in 2025.

Anti-Money Laundering (AML)

Integrity or Innovation? Mixed Signals in Trump's Exec Orders

Suparna Goswami • May 21, 2026

Both the White House's recent executive orders deal with the financial services industry and discuss the importance of integrity and innovation in combatting fraud. But read them together and another picture emerges that could confuse seasoned fraud and compliance practitioners.

HIPAA/HITECH

Why Smaller Healthcare Providers Remain Easy Targets

Marianne Kolbasuk McGee • May 20, 2026

Small and mid-sized healthcare organizations - including medical specialty practices and regional clinics - continue to fall victim disproportionately to hacking incidents, including ransomware attacks and data thefts - affecting large populations of patients. Why does this keep happening?

Cybercrime

Microsoft Cracks Down on Signing Service Used for Ransomware

Tiffany Wang • May 20, 2026

Microsoft says cybercrime service Fox Tempest sold stolen Microsoft code-signing certificates to ransomware gangs, enabling malware to masquerade as legitimate software in attacks targeting hospitals, schools and critical infrastructure worldwide.

API Security

AI Botnets Drive Surge in Financial Sector DDoS Attacks

Tiffany Wang • May 20, 2026

Akamai says AI-enabled botnets, geopolitical hacktivism and financially motivated cybercriminals drove a massive rise in DDoS, API and web attacks against global financial services firms in 2025, with banks suffering the majority of incidents.

Cybercrime

GitHub Hacked, Internal Repositories Offered for Sale

David Perera • May 20, 2026

GitHub warned late Tuesday that hackers stole roughly 3,800 internal repositories from the Microsoft-owned platform after a developer used a poisoned VS Code script, which is developed by Microsoft. TeamPCP and Lapsus$ appear to be cooperating to sell the stolen data for $95,000.

Cybercrime

Android Ad Fraud Operation Generates 659M Bid Requests

Greg Sirico • May 19, 2026

Cybercriminals used malicious Android apps to funnel unwitting users to an ad fraud scam that generated up to 659 million daily bid requests, reports Human Security. The scam has spanned 455 malicious Android apps and is linked to 183 threat actor-owned command-and-control domains.

HIPAA/HITECH

HHS Revamps HIPAA Enforcement Agency

Marianne Kolbasuk McGee • May 19, 2026

A reorganization of the federal office that enforces health privacy and security has close observers worried that it will focus less on an epidemic of breaches and more on ideologically-charged Trump administration priorities. "Investigations will take longer to open," says a former HHS official.