34 Biggest Healthcare Data Breaches (Updated July 2026) | UpGuard
A list of the biggest data breaches rocking the healthcare industry in 2026, ranked by degree of impact.
Vendor news
Funding rounds, leadership changes, incidents, new capabilities and announcements across the vendors in this catalog — collected automatically from vendors' own public feeds. Product release versions are on their own page, so the landing feed here never reads as one vendor's changelog.Where this comes fromEvery item links to the vendor's own published source: a GitHub release feed, a changelog, a status page, an SEC filing or a company blog. Nothing here is written or editorially reviewed by 0-Doubt, and nothing is a recommendation — it is machine-collected public record, labelled the same way as all other baseline content on the platform. Coverage is uneven by design: a vendor that publishes no public feed will not appear, and that absence is not a judgement about the vendor.
3,481 matching stories — announcement, in GRC & Compliance Automation — showing up to 3 per vendorPer-vendor capWhile browsing, no single vendor may fill more than three slots on any one page, so a vendor with a chatty release cadence cannot buy the page you are looking at. That means a page can render fewer stories than the count above. Searching a headline or naming a vendor turns the cap off, because then you have asked to see everything that matches.
23 Biggest Data Breaches in Australia (Updated July 2026) | UpGuard
Learn about some of the biggest data breaches that have impacted Australian businesses, including recent cyberattacks in 2025.
26 Biggest Data Breaches in Finance (Updated July 2026) | UpGuard
This regularly updated list analyzes the biggest data breaches in the financial services sector. Learn the key errors that lead to each breach event.
PCI DSS finally caught up to human risk
When PCI DSS 4.0.1 took effect on March 31, 2025, Requirement 12.6 stopped being the easiest line item in the entire standard. For years it asked almost nothing of security teams: run an annual training video, log a completion percentage, move on. Now it asks for a documented program, reviewed at least every 12 months, […] The post PCI DSS finally caught up to human risk appeared first on Fable Security.
Self-modifying AI agents expose a blind spot in enterprise security
As debate over AI safety intensifies, new research is drawing attention to a more immediate risk for enterprises: AI agents that can alter the models they rely on while carrying out routine tasks. Researchers at AI security firm Irregular asked a coding agent to solve a software maintenance problem involving an application built on a local AI model that was returning incorrect answers. Instead of limiting its changes to the application, the agent fine-tuned the open-weight model it used — a mode
FedRAMP 20x Ready: Lazarus Alliance Compliance Assessments Now
FedRAMP 20x Readiness and Independent Assessments FedRAMP 20x modernizes federal cloud security certification through measurable security outcomes, persistent verification, machine-readable information, and greater reliance on automation. The FedRAMP Consolidated Rules for 2026 establish the applicable requirements. Cloud service providers should use those rules, rather than assumptions carried over from legacy FedRAMP processes, to select a […] The post FedRAMP 20x Ready: Lazarus Alliance
FedRAMP 20x Ready: Lazarus Alliance Compliance Assessments Now
In 2026, organizations pursuing cloud service offerings for federal agencies face a transformed landscape where FedRAMP 20x emphasizes automated evidence collection and continuous monitoring to slash authorization timelines. Lazarus Alliance delivers targeted compliance assessments that align precisely with these modernization mandates, enabling providers to achieve Authority to Operate (ATO) faster while maintaining rigorous risk management […] The post FedRAMP 20x Ready: Lazarus Alliance
55 HIPAA Right of Access Enforcement Actions Later: Are Healthcare Providers Getting the Message?
Part 2 of 2: Seven years after OCR’s first HIPAA Right of Access enforcement action, case #55 shows why timely access to medical records remains a compliance issue for healthcare providers. A patient waited nearly two years for her medical records. Now Azul Vision will pay $50,000 and spend two years under a corrective action […] The post 55 HIPAA Right of Access Enforcement Actions Later: Are Healthcare Providers Getting the Message? appeared first on uRISQ | Cyber Privacy and Cyber Secur
Why APAC Enterprises Need Real-Time Threat Intelligence as Singapore, Malaysia, and Thailand Tighten Cyber Compliance in 2026
Cybersecurity compliance APAC 2026 has moved from guidance to enforcement across three of Southeast Asia's largest economies, almost in step. Singapore's Cyber Security Agency issued an updated Cybersecurity Code of Practice 2026 for Critical Information Infrastructure on 29 July 2026. Malaysia's Cyber Security Act 2024 has been active since August 2024, with NACSA now well into audits and incident-reporting enforcement. Thailand's Cybersecurity Act NCSA mandate now covers new cloud and website
How to Implement Zero Trust for AI Technical Documentation Access
Modern organisations face an unprecedented challenge securing technical documentation that powers artificial intelligence systems. AI development teams require rapid access to sensitive technical specifications, model documentation, and proprietary algorithms, whilst security teams must enforce strict access controls to prevent data breaches and intellectual property theft. Traditional perimeter-based security approaches fail when AI teams collaborate across Read more...
Network Monitoring Tools: Key Features and Top 15 in 2026
What Are Network Monitoring Tools? Network monitoring tools are software applications that continuously track network traffic, device health, and performance metrics to help IT teams prevent downtime. They collect data from routers, switches, firewalls, servers, access points, and other infrastructure. Common data sources include SNMP, flow records, packet captures, logs, and device APIs. These tools […]
NIS2 and Third-Party Risk: What Article 21 Actually Requires
What You’ll Learn The EU’s Network and Information Security Directive, NIS2, is one of the most significant expansions of cybersecurity regulation in recent years.  Most of the conversation around NIS2 and third-party risk focuses on what organizations must do to secure their own systems: risk management measures, incident reporting obligations, and governance requirements.  But there’s a dimension ... Read more The post NIS2 and Third-Party Risk: What Artic
FedRAMP 20x Buyer’s Guide
FedRAMP 20x has introduced a new era for cloud service providers seeking to do business with the federal government. This historically slow-moving, expensive certification has been overhauled to provide new opportunities for CSPs. Now, it’s a quicker, less expensive way for these organizations to signal a readiness to act and unlock a new stream of […] The post FedRAMP 20x Buyer’s Guide appeared first on A-LIGN.
How Scottish Government Implements Compliant AI for Citizen Services
Government organisations face mounting pressure to deploy artificial intelligence systems that enhance citizen services whilst maintaining strict compliance with data privacy regulations. The Scottish Government’s approach to implementing compliant AI demonstrates how public sector entities can balance innovation with regulatory obligations, creating a framework that enables advanced citizen services without compromising sensitive data security. Scotland’s Read more...
Cyber Resilience Act : les premières obligations entrent en application
Depuis le 11 septembre 2026, les fabricants de produits comportant des éléments numériques commercialisés dans l’Union européenne doivent déclarer les vulnérabilités activement exploitées et les incidents graves affectant la sécurité de leurs produits. Alors que l’essentiel du Cyber Resilience Act (règlement (UE) 2024/2847, ou CRA) ne s’appliquera qu’à partir du 11 décembre 2027, ces obligations […] The post Cyber Resilience Act : les premières obligations entrent e
Fraudulent online shops claim to be UK-based
Key Takeaway: A BBC Watchdog investigation on The One Show exposed fraudulent online shops that pose as UK-based retailers, ship counterfeit goods from China, and block customers from getting refunds. Online shopping fraud has found a new disguise. Scammers now build fraudulent online shops that claim UK roots. They pick London-sounding names and generate AI […] The post Fraudulent online shops claim to be UK-based appeared first on EBRAND.
Why Information Governance Is the Missing Piece of the Cyber-Resilience Puzzle
Not every data breach starts with a shadowy hacker and an external attack. Sometimes it’s not malicious third parties that overwhelm network defenders. It’s regular employees failing to follow established information governance guidelines that gets organisations into trouble. Or data-handling rules that break down on contact with reality. In these situations, even the most sophisticated … Continued
AI Agents Can Retrain Own Models Mid-Task, Leaking Secrets and Erasing Refusals
New research from Irregular shows AI agents can retrain and redeploy their own underlying models during routine maintenance tasks. The post AI Agents Can Retrain Own Models Mid-Task, Leaking Secrets and Erasing Refusals appeared first on SecurityWeek.
Manage SOCRadar Alerts Where Your Team Already Works with SOCRadar and Zendesk
Manage SOCRadar Alerts Where Your Team Already Works with SOCRadar and Zendesk A new high-severity alert lands in your threat intelligence platform. Someone notices it eventually, copies the details into a ticket, assign
How to Automate Security Questionnaires with AI: 2026 Best Practices
Learn how to automate security questionnaires with LLMs, why human review is the step you shouldn't automate, and where DIY automation breaks down.
Unpacking a laZzzy Donut
Six stages. Multiple encryption layers. One static analysis. In this blog, we unpack a multi-stage malware loader combining Python obfuscation, Donut shellcode, and laZzzy PE encryption, without executing the payload.
Four gaps IRM was never built to close
A buyer’s checklist for the IRM gaps a ServiceNow program leaves open. Many teams deploy IRM, watch the assessments come back clean quarter after quarter, and reasonably conclude they are covered. Months later, the greatest risk turns out to have been outside the sample. It may have changed the week after the review, or lived […] The post Four gaps IRM was never built to close first appeared on TrustCloud.
GRC Modernization in the Age of AI: What Archer Summit 2026 Revealed
AI has been a major part of the conversation at Archer® Summit 2026, but by Day 3, the conversation had moved beyond what AI can do. The bigger question was what it takes to put that capability to work in a way that organizations can actually trust, govern and defend. That shift was reflected in […] The post GRC Modernization in the Age of AI: What Archer Summit 2026 Revealed appeared first on Archer.
Outcomes Over Alert Queues: Rebuilding MDR Around Speed
Coalition was recognized in “The Managed Detection And Response Services Landscape, Q3 2026” report by Forrester Research Inc.
Outcomes Over Alert Queues: Rebuilding MDR Around Speed
Coalition was recognized in “The Managed Detection And Response Services Landscape, Q3 2026” report by Forrester Research Inc.
AI for detection: Rule writer agent
Unit21's AI rule builder turns a plain-English pattern into a deployable rule. It asks when your prompt is vague, and it works on existing rules too.
AI for detection: Rule recommendations
Optimization Agent brings AML rule tuning down to minutes: it finds what separates true from false positives, proposes a fix, and backtests it on your data.
BreachWatch™: The Trezor–ShipMonk Breach Shows Why Vendor Trust Must Be Verified
Third-party risk management has always depended on trust. Organizations trust vendors to follow the security requirements written into contracts, answer assessments accurately, and maintain the controls they say are in place. But the recent breach involving hardware wallet manufacturer Trezor and fulfillment provider ShipMonk is a reminder that trust alone is not a control. For…
Elevated Export Control Diversion Risks
China’s revised National Defense Mobilization Law increases diversion and transshipment risk by drawing civilian organizations more deeply into defense mobilization. Exiger helps companies validate ultimate end users and beneficial ownership, monitor third-country routes and identify transactions that may support strategic stockpiling or military production. The post Elevated Export Control Diversion Risks appeared first on Exiger.
Switching Existing Software Vendors Overwhelmingly Drives Increased Satisfaction
Discover why 80% of organizations report increased satisfaction after switching vendors. Get Info-Tech's five-step methodology to build your business case while reducing switching costs. The post Switching Existing Software Vendors Overwhelmingly Drives Increased Satisfaction appeared first on Onspring.
Digital Workforce Careers: Building Resilient Digital Teams
Digital workforce protection is a professional discipline focused on reducing personal attack surfaces across employee and executive populations before adversaries exploit exposed data. Most practitioners in this field didn’t follow a straight line to get here. They arrived through threat intelligence, privacy law, compliance consulting, or investigative work, and hiring managers treat that as a signal, not a gap. The field has no standard academic pipeline, and that gap creates real oppor
Crypto AML compliance: why Datos Insights named Unit21 the category winner
Datos Insights named Unit21 winner of the 2026 Impact Award for crypto/digital asset AML innovation. What was evaluated, what was cited, why it qualified.
AI agent authorization risks remain a gap in new NIST-CISA token security guidance
AI agents’ actions are out of scope for new guidance from US authorities on securing identity and access tokens, but there is still plenty enterprises can do to protect their systems from rogue humans and AI agents alike. “Protecting Tokens and Assertions from Forgery, Theft, and Misuse,” a new report from the National Institute of Standards and Technology (NIST) with help from the Cybersecurity and Infrastructure Security Agency (CISA), offers guidance for operators of systems that use digitall
NIST AI RMF 1.0: The AI Risk Management Framework | UpGuard
Master the NIST AI RMF 1.0 framework: Learn how to govern, map, measure, and manage AI risks to deploy trustworthy, safe, and responsible AI systems today.
GovRAMP Expansion: Lazarus Alliance State Cloud Audits
GovRAMP Cloud Security Assessments and Verification GovRAMP provides a standardized, NIST-aligned framework for evaluating cloud products used by state, local, tribal, territorial, and educational organizations. The program helps public-sector organizations make risk-based procurement decisions using independently assessed security information. It also gives cloud service providers a reusable way to demonstrate their security posture across participating […] The post GovRAMP Expansion: Laz
ISO 42001 AI Governance with Continuum GRC Compliance Services
ISO 42001 establishes the first dedicated management system standard for artificial intelligence, enabling organizations to embed governance directly into AI development and deployment lifecycles. Continuum GRC delivers targeted compliance assessments that align ISO 42001 requirements with existing frameworks such as ISO 27001, NIST SP 800-53, and CMMC 2.0, helping CISOs and compliance officers reduce risk […] The post ISO 42001 AI Governance with Continuum GRC Compliance Services appeared
How to Build a NIST-Aligned Incident Response Plan
Most organizations have an incident response plan. Most have never run it — not in a tabletop, not in a simulation, not under any condition resembling real adversarial pressure.
Enhancing cyber security in financial services: Simulated cyber attacks
CREST’s Nick Benson examines whether financial regulators are doing enough to set mandatory minimum standards for complex, unpredictable and critical intelligence-led cyber attacks
AI Isn’t Waiting for a Regulation—and Neither Are Attackers
Artificial intelligence is advancing faster than the policies formulated to govern it. The Telos Secure AI Framework™ helps organizations manage risk throughout the AI lifecycle through actionable controls, disciplined testing, and continuous monitoring. Learn how this approach supports responsible AI adoption today while preparing organizations for tomorrow’s regulatory requirements. The post AI Isn’t Waiting for a Regulation—and Neither Are Attackers appeared first on Telos.
Digital sovereignty in the age of AI: staying in control
Digital sovereignty has become a major concern for both businesses and public sector organizations. For many years, the conversation focused primarily on data protection and cybersecurity. Those priorities remain essential. But as artificial intelligence rapidly reshapes how organizations operate, the …