The breach isn’t the problem. The spread is. →The breach isn’t the problem. The spread is. →Measure in 5 min. Free AssessmentFree Assessment
Pharmaceuticals
Breach intelligence, attack campaigns, and threat reports targeting the Pharmaceuticals sector.
Explore Other Sectors
Pharmaceuticals Threat Reports
AZ Monica Hospital Cyberattack: A Stark Reminder for Healthcare Security
In January 2026, AZ Monica Hospital in Antwerp, Belgium, experienced a significant cyberattack that disrupted its computer systems, leading to the cancellation of at least 70 surgeries and the transfer of seven critical patients to other facilities. The attack also affected patient registration processes and emergency services, compelling the hospital to advise patients to seek care elsewhere. This incident underscores the escalating threat of cyberattacks on healthcare institutions, highlighting the critical need for robust cybersecurity measures to protect patient safety and maintain operational continuity.
5 months ago
Kill Chain
TeamPCP's Supply Chain Attack: Unveiling the Telnyx SDK Compromise and Ransomware Expansion
In March 2026, the threat actor TeamPCP executed a sophisticated supply chain attack by compromising the Telnyx Python SDK on the Python Package Index (PyPI). Malicious versions 4.87.1 and 4.87.2 were published, embedding payloads within WAV audio files—a novel steganography technique. These payloads targeted Windows systems by dropping a persistent binary named 'msbuild.exe' into the Startup folder, while Linux and macOS systems faced credential harvesting similar to previous LiteLLM compromises. Forensic analyses confirmed the use of RSA-4096 encryption and specific exfiltration patterns consistent with TeamPCP's tactics. The compromised versions were promptly quarantined by PyPI. Concurrently, TeamPCP partnered with the Vect ransomware-as-a-service operation and BreachForums, distributing affiliate keys to approximately 300,000 users, potentially enabling one of the largest coordinated ransomware deployments observed. Additionally, the LAPSUS$ group claimed a 3GB data breach of AstraZeneca, allegedly using credentials obtained through TeamPCP's activities. This breach reportedly includes internal code repositories, cloud infrastructure configurations, and employee data. Organizations affected by any phase of the TeamPCP campaign are urged to rotate credentials immediately and monitor for indicators of compromise.
6 months ago
Kill Chain
CanisterWorm: A 2026 Supply Chain Attack Targeting Iranian Systems
In March 2026, the cybercrime group TeamPCP launched a supply chain attack by compromising Aqua Security's Trivy vulnerability scanner, injecting credential-stealing malware into official releases on GitHub. This malicious code targeted authentication credentials, cloud tokens, and cryptocurrency wallets. Subsequently, TeamPCP deployed 'CanisterWorm,' a self-propagating worm that exploited exposed Docker APIs, Kubernetes clusters, and Redis servers. The worm included a wiper component designed to destroy data on systems set to Iran's time zone or with Farsi as the default language, significantly impacting Iranian organizations. This incident underscores the escalating threat of supply chain attacks and the increasing use of wiper malware by financially motivated groups. Organizations must enhance their security measures, particularly in securing development pipelines and cloud infrastructures, to mitigate such sophisticated threats.
6 months ago
Kill Chain
Loblaw Data Breach 2026: Customer Information Exposed
In March 2026, Loblaw Companies Limited, Canada's largest food and pharmacy retailer, identified unauthorized access to a non-critical segment of its IT network. The breach exposed basic customer information, including names, phone numbers, and email addresses. The company promptly secured its systems, logged out all customers from their accounts, and initiated a comprehensive investigation. Notably, sensitive data such as passwords, health information, and credit card details were not compromised, and PC Financial services remained unaffected. ([globenewswire.com](https://www.globenewswire.com/de/news-release/2026/03/10/3253350/0/en/index.html?utm_source=openai)) This incident underscores the persistent threat of data breaches in the retail sector, highlighting the need for robust cybersecurity measures. As cyberattacks become more sophisticated, organizations must continually assess and enhance their security protocols to protect customer information and maintain trust.
6 months ago
Kill Chain
Dark Web Drug Kingpin Sentenced: The Fall of Incognito Market
In February 2026, Rui-Siang Lin, a 24-year-old Taiwanese national, was sentenced to 30 years in U.S. federal prison for operating 'Incognito Market,' a dark web platform that facilitated over $105 million in illegal drug transactions from October 2020 to March 2024. Lin, known online as 'Pharoah,' managed the marketplace's operations, overseeing more than 1,800 vendors and 400,000 customer accounts. The platform processed over 640,000 transactions involving substantial quantities of narcotics, including cocaine, methamphetamine, and fentanyl-laced pills, which were linked to at least one fatal overdose. ([yahoo.com](https://www.yahoo.com/news/articles/incognito-market-founder-rui-siang-150954026.html?utm_source=openai)) This case underscores the persistent threat posed by dark web marketplaces in the global drug trade. Despite law enforcement's efforts to dismantle such platforms, their sophisticated use of anonymizing technologies and cryptocurrencies continues to challenge regulatory and enforcement agencies worldwide. ([helpnetsecurity.com](https://www.helpnetsecurity.com/2026/02/04/incognito-dark-web-drug-market-operator-prison-sentence/?utm_source=openai))
7 months ago
Kill Chain
Empire Market Dark Web Takedown: Owner Pleads Guilty in $430M Cybercrime Plot
In January 2026, U.S. authorities announced that Raheim Hamilton (“Sydney”/“ZeroAngel”), a co-founder of the notorious Empire Market, pleaded guilty to federal drug conspiracy charges. From 2018 to 2020, Empire Market operated as a large-scale dark web marketplace accessible via TOR, facilitating over $430 million in illegal transactions, primarily enabling drug sales but also distributing stolen credentials, hacking tools, and counterfeit currency. Hamilton and partner Thomas Pavey laundered illicit proceeds through cryptocurrency and designed the site to evade law enforcement, directly overseeing vendor disputes and operational security. This prosecution underscores the ongoing threat and operational sophistication of dark web cybercrime marketplaces, even after earlier takedowns. As digital criminal platforms persistently adapt, law enforcement and organizations must address the evolving risks involving anonymized markets, cryptocurrency transactions, and the proliferation of illicit digital goods and services.
7 months ago
Kill Chain
Microsoft Dismantles RedVDS: Takedown of a Major Cybercrime Infrastructure in 2026
In January 2026, Microsoft, in collaboration with Europol and German authorities, disrupted RedVDS, a global cybercrime-as-a-service platform responsible for at least $40 million in fraud losses since March 2025. RedVDS provided criminals with affordable, disposable virtual Windows servers and administrator-level access, enabling mass phishing, business email compromise (BEC) scams, credential theft, and sophisticated social engineering—including attacks leveraging AI technologies. The takedown involved legal action, seizure of RedVDS infrastructure, and removal of its marketplace and customer portal, significantly impacting cybercriminal campaigns that leveraged these services to attack organizations and individuals worldwide. This incident underscores the increasing threat posed by cybercrime-as-a-service models, which drastically lower barriers for criminals to launch high-volume, geographically-targeted attacks leveraging cloud infrastructure. The rise of AI-generated phishing, deepfakes, and anonymized payment methods heightens risk, challenging both organizational defenses and global law enforcement.
8 months ago
Kill Chain
AVEVA 2026: Critical ICS Vulnerabilities Put Manufacturing at Risk
In January 2026, AVEVA disclosed seven critical vulnerabilities in its Process Optimization suite, widely used by critical manufacturing and infrastructure sectors worldwide. The flaws, reported by Veracode’s Christopher Wu, include unauthenticated remote code execution, SQL injection, privilege escalation, code injection, and cleartext transmission of sensitive data. Attackers exploiting these vulnerabilities could fully compromise servers, escalate user privileges, access sensitive process data, and potentially undermine operational continuity or safety. Affected versions include all AVEVA Process Optimization releases up to and including 2024.1. These vulnerabilities highlight increasing targeting of industrial control and process optimization platforms, exposing gaps in legacy ICS security. With global critical infrastructure at risk and exploitation methods aligned with broader trends in supply chain and lateral movement attacks, this incident underscores urgent needs for robust security controls, ongoing software updates, and regulatory compliance in the ICS/OT domain.
8 months ago
Kill Chain
Former Insiders Launch ALPHV/BlackCat Ransomware Attacks in 2023
In 2023, two former cybersecurity professionals, Ryan Clifford Goldberg and Kevin Tyler Martin, exploited their trusted positions at incident response firms Sygnia and DigitalMint to perpetrate a series of targeted ransomware attacks. Acting in collusion with a third party and leveraging the ALPHV (BlackCat) ransomware variant, they compromised the networks of organizations across several critical sectors, including healthcare, engineering, and manufacturing. The group successfully extorted nearly $1.3 million from a Florida-based medical company and caused total damages exceeding $9.5 million across multiple states, before being apprehended and pleading guilty in federal court within months of indictment. This breach stands out for the attackers’ abuse of insider knowledge and privileged access, highlighting a new threat vector where trusted security personnel become adversaries. The case draws industry-wide attention to potential insider threats, the rising sophistication of ransomware groups, and the urgent need for enhanced monitoring and zero trust practices.
8 months ago
Kill Chain
Inotiv 2025 Ransomware Breach: Pharma Data at Risk
In August 2025, Inotiv, a leading American pharmaceutical firm, suffered a significant ransomware attack resulting in the theft of sensitive personal data belonging to thousands of individuals. Threat actors infiltrated the company’s network, deployed ransomware, and exfiltrated confidential information before encrypting internal systems. The breach led to data exposure and operational disruption, prompting Inotiv to notify impacted parties and regulatory authorities. Forensic investigation indicated unauthorized access over an extended period prior to the ransomware detonation, increasing the scope of compromised information. This incident highlights the escalating risks faced by the pharmaceutical industry, where highly regulated data attracts sophisticated ransomware groups. The resurgence of data-exfiltration ransomware tactics underlines the urgent need for advanced segmentation, egress controls, and integrated detection to defend against evolving threats and meet compliance expectations.
8 months ago
Kill Chain
Mirion Medical 2025: Critical Vulnerabilities in NMIS BioDose Software Threaten Healthcare Security
In December 2025, Mirion Medical disclosed multiple high-severity vulnerabilities affecting its EC2 Software NMIS BioDose product, versions prior to 23.0. These flaws—incorrect permission assignments, use of hard-coded credentials, and client-side authentication weaknesses—could be exploited by attackers to gain unauthorized access, elevate privileges, manipulate executables, steal sensitive medical data, or execute arbitrary code. Impacting the healthcare and public health sectors globally, these vulnerabilities pose critical operational and patient-data risks, especially in environments with networked installations and exposed Microsoft SQL Server databases. No active exploitation has yet been reported, but CISA urges urgent mitigation measures due to the vulnerabilities’ remote exploitability and low attack complexity. This incident highlights intensifying regulatory scrutiny on medical device security as threat actors increasingly target healthcare systems for sensitive patient data and intellectual property. The vulnerabilities in Mirion’s product underscore persistent gaps in authentication and privilege controls—a growing concern amid adoption of connected medical technologies and regulatory frameworks such as HIPAA and NIST.
8 months ago
Kill Chain
Festo ICS Hidden Function Flaw Raises Global Manufacturing Security Stakes
In November 2025, Festo SE & Co. KG disclosed a critical security vulnerability (CVE-2023-3634) in its MSE6-C2M/D2M/E2M industrial control modules. The flaw, caused by hidden functionality accessible to remote, low-privileged authenticated users, could enable attackers to trigger undocumented test modes leading to a complete loss of confidentiality, integrity, and availability across affected devices. Operations worldwide in the critical manufacturing sector were potentially exposed due to this vulnerability, rated CVSS 8.8, though no evidence of active exploitation was reported. The issue prompted coordinated advisories from CERT@VDE and CISA, highlighting the systemic risk to industrial automation environments. This incident highlights ongoing threats to operational technology (OT) and industrial control systems, as the trend of exploiting hidden or undocumented features grows. With manufacturing and critical infrastructure increasingly interconnected, such vulnerabilities pose a greater risk of targeted disruptions and underscore the urgent need for proactive cybersecurity and compliance safeguards in OT environments.
8 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports