The breach isn’t the problem. The spread is. →The breach isn’t the problem. The spread is. →Measure in 5 min. Free AssessmentFree Assessment
Public Safety
Breach intelligence, attack campaigns, and threat reports targeting the Public Safety sector.
Explore Other Sectors
Public Safety Threat Reports
Flock Safety Camera Breach Exposes Critical Flaws in Smart City Surveillance Security
In 2026, security researchers successfully reverse-engineered Flock Safety's automatic license plate reader (ALPR) cameras, exposing critical security vulnerabilities in the widely-deployed surveillance infrastructure. The analysis revealed that while most sensitive data remained encrypted, poor security architecture left encryption keys stored on unencrypted partitions, allowing researchers to access extensive surveillance logs containing over one million captured images. The investigation uncovered that the cameras' computer vision software actively detects and catalogs people, vehicles, bicycles, and even specific details like bumper stickers and patches, generating dozens of images per passing vehicle. This breach of a major surveillance technology provider highlights significant privacy and security concerns in municipal and law enforcement surveillance systems. This incident demonstrates the growing vulnerability of IoT surveillance infrastructure as researchers and malicious actors increasingly target physical devices that municipalities and businesses rely on for security operations.
3 days ago
Kill Chain
Conti Ransomware Developer Gets 4-Year Prison Sentence in Landmark Prosecution
Ukrainian national Oleksii Lytvynenko was sentenced to four years in prison for his role in the Conti ransomware group, which attacked over 1,000 organizations globally before disbanding in 2022. Lytvynenko joined the prolific cybercrime operation in September 2021, developing malware and holding data from 12 victims including eight U.S.-based organizations. The group extorted approximately $634,000 in Bitcoin from victims in Tennessee, including a government entity that resulted in compromised sheriff's department, emergency medical services, and police department systems. This sentencing represents continued law enforcement efforts to prosecute ransomware operators despite their overseas operations, as Conti members have since rebranded under multiple successor groups including Black Basta, Royal, and BlackSuit, maintaining the threat landscape's evolution and persistence of ransomware-as-a-service operations.
1 week ago
Kill Chain
July 2024 Water Utility Attacks Expose Critical Infrastructure Blind Spots
In July 2024, over 100 water and wastewater treatment systems across multiple states were compromised through vulnerable industrial controllers connected directly to public cellular networks. CISA identified the widespread campaign targeting Rockwell Allen-Bradley, Schneider Electric, and Siemens equipment, with attackers gaining operational control and causing service disruptions including pump station failures and boil-water advisories. The incidents exposed critical infrastructure gaps where operational technology exists outside traditional IT security boundaries, with many systems invisible to network scans but trackable through carrier invoices. This campaign highlights the urgent need for comprehensive network visibility and microsegmentation in critical infrastructure, as traditional network perimeter defenses fail to protect cellular-connected industrial control systems that operate independently of municipal IT networks.
2 weeks ago
Kill Chain
Federal Whistleblower Exposes Critical Security Flaws in USPS Election Systems
A federal whistleblower has exposed critical security and operational flaws in the U.S. Postal Service's rushed deployment of three new IT systems designed to control mail-in ballot processing for the 2026 midterm elections. The complaint reveals that USPS bypassed standard software development practices, including pre-release testing and security validation, to implement systems that could reject entire batches of ballots based on single scanning errors. The Federal Ballot Mail Portal and associated verification systems were developed in a matter of weeks rather than months, creating significant risks to election integrity and voter disenfranchisement. This incident highlights the growing intersection of cybersecurity vulnerabilities and critical infrastructure, particularly as election systems become increasingly digitized without proper security oversight. The rushed deployment of untested systems in mission-critical environments reflects broader challenges organizations face when political pressure overrides established security protocols and development best practices.
3 weeks ago
Kill Chain
Berlin Government Falls Victim to Rhysida Ransomware: 5.79TB of Critical Data Stolen
In August 2026, the Rhysida ransomware gang successfully breached Berlin's city administration network, exfiltrating 5.79 TB of sensitive government data comprising 1.44 million files. The attack, discovered in mid-August and publicly claimed on August 28, targeted multiple Senate departments including Mobility, Transport, Climate Protection and Environment. The stolen data includes government records, personnel files, plaintext credentials, banking information, classified documents, and critical infrastructure assessments of Berlin's water supply. Berlin's Mayor Kai Wergner confirmed the city will not pay the ransom, while federal security agencies investigate the incident. This attack highlights the escalating threat of ransomware groups targeting critical government infrastructure and the increasing sophistication of data exfiltration campaigns. With Rhysida leveraging GDPR violations as additional pressure tactics, the incident demonstrates how modern ransomware operators are weaponizing regulatory frameworks to maximize extortion potential against public sector entities.
3 weeks ago
Kill Chain
Critical ZoneMinder Vulnerability Exposes Video Surveillance Infrastructure to Remote Code Execution
ZoneMinder, a widely-deployed open-source video surveillance software, disclosed a critical OS command injection vulnerability (CVE-2026-76060) affecting versions 1.37.48 and 1.38.3. The vulnerability allows authenticated users with 'View Events' permissions to execute arbitrary operating system commands through unsanitized input in the exportFile parameter during event export operations. With a CVSS score of 8.8, successful exploitation grants full remote code execution as the web server user, potentially compromising entire surveillance infrastructure installations. This incident highlights the growing trend of supply chain vulnerabilities in critical infrastructure software, particularly as organizations increasingly rely on open-source solutions for security monitoring. The vulnerability's discovery through a public proof-of-concept demonstrates the escalating risk of weaponized research and the need for proactive vulnerability management in surveillance systems that often operate with elevated privileges across enterprise networks.
4 weeks ago
Kill Chain
Operation CameraSwarm: Massive Compromise of Dahua Devices
Between June 17 and July 22, 2026, cybersecurity researchers at Hunt.io identified a campaign, dubbed Operation CameraSwarm, that compromised over 14,530 Dahua devices. Attackers employed credential attacks, exploited authentication-bypass vulnerabilities (CVE-2021-33044 and CVE-2021-33045), and utilized a peer-to-peer (P2P) relay technique to gain unauthorized access. The breaches were predominantly concentrated in Ukraine and Russia, with 1,923 cameras configured with persistent accounts and 283 accessed via the P2P method. This incident underscores the critical need for organizations to promptly apply security patches, disable unnecessary P2P features, and regularly update device firmware to mitigate potential vulnerabilities. ([labs.itresit.es](https://labs.itresit.es/2025/10/29/dahua-beyond-cve-2025-31702-p2p-relay-exposure/?utm_source=openai))
1 month ago
Kill Chain
Iranian Cyberattacks Expose Vulnerabilities in U.S. Water Utilities
In late July 2026, a coordinated series of cyberattacks targeted over 30 community water systems across Minnesota, with similar incidents reported in at least 12 other states. The attackers, suspected to be Iranian-affiliated hackers, exploited vulnerabilities in internet-exposed programmable logic controllers (PLCs) that manage critical water infrastructure. These breaches led to operational disruptions, including temporary shutdowns of water treatment plants and manual operation shifts, though no contamination of drinking water was reported. ([techradar.com](https://www.techradar.com/pro/security/hackers-are-going-after-our-water-now-over-30-minnesota-utilities-hit-in-coordinated-cyberattack-by-apparent-iranian-attackers?utm_source=openai)) This incident underscores the escalating threat to U.S. critical infrastructure from state-sponsored cyber actors. The attacks highlight systemic vulnerabilities in aging water systems, many of which lack adequate cybersecurity measures. The urgency for enhanced security protocols and infrastructure investment is paramount to prevent future disruptions and safeguard public health.
1 month ago
Kill Chain
Iranian Cyberattacks on Minnesota Water Systems: A 2026 Case Study
In late July 2026, over 30 community water systems across Minnesota were targeted in a coordinated cyberattack, believed to be orchestrated by Iranian-affiliated hackers. The attackers focused on operational technology controlling pumps, wells, water towers, and wastewater systems, rather than administrative networks. Affected communities included Braham, which experienced a temporary shutdown of its water treatment plant, and other towns like Plymouth, Maple Plain, and South St. Paul, which reported varying levels of disruption. The attack prompted a statewide incident response by Minnesota IT Services. ([techradar.com](https://www.techradar.com/pro/security/hackers-are-going-after-our-water-now-over-30-minnesota-utilities-hit-in-coordinated-cyberattack-by-apparent-iranian-attackers?utm_source=openai)) This incident underscores the escalating cyber threats to U.S. critical infrastructure, particularly targeting underfunded and understaffed municipal utilities. The attacks highlight the urgent need for enhanced cybersecurity measures to protect essential services from nation-state actors. ([tomshardware.com](https://www.tomshardware.com/tech-industry/cyber-security/iran-suspected-of-conducting-cyberattacks-on-us-water-suppliers-in-45-municipalities-small-towns-mostly-targeted-with-utilities-switching-to-manual-control?utm_source=openai))
1 month ago
Kill Chain
Minnesota Water Utilities Face Coordinated Cyberattacks in July 2026
In late July 2026, over 30 community water systems in Minnesota experienced a coordinated cyberattack targeting their operational technology (OT) systems. The attacks, occurring on July 26 and 27, led to temporary disruptions in water treatment and distribution processes. For instance, the City of Braham reported its water plant was taken offline due to a malicious cyberattack but managed to restore operations within hours. The Minnesota IT Services (MNIT) agency activated its cybersecurity incident response capabilities, collaborating with federal, state, local, Tribal, and private-sector partners to investigate and mitigate the incident. This incident underscores the escalating threats to critical infrastructure, particularly in the water sector. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has emphasized the importance of isolating key OT systems to ensure continuity of critical services during cyberattacks. ([cyber.gov.au](https://www.cyber.gov.au/business-government/secure-design/operational-technology-environments/ci-fortify/ci-fortify-advice-for-isolating-vital-systems?utm_source=openai))
1 month ago
Kill Chain
Coordinated Cyberattack Disrupts 30+ Minnesota Water Systems
In late July 2026, a coordinated cyberattack targeted operational technology at over 30 community water systems across Minnesota, leading to service disruptions in cities including Braham, Plymouth, South St. Paul, and Maple Plain. The attacks affected automated controls and communications, with Braham's water plant temporarily going offline. State and federal agencies, including Minnesota IT Services (MNIT), the Cybersecurity and Infrastructure Security Agency (CISA), and the Environmental Protection Agency (EPA), initiated a comprehensive response to contain the incidents and restore services. The attackers' methods and identities remain under investigation, with no confirmed attribution to date. This incident underscores the escalating threat to critical infrastructure, particularly water systems, from cyberattacks. The similarities between this attack and previous campaigns targeting industrial control systems highlight the urgent need for enhanced cybersecurity measures and vigilance in protecting essential services.
1 month ago
Kill Chain
Coordinated Cyberattack Disrupts Water Utilities in 30+ Minnesota Communities
In late July 2026, over 30 Minnesota communities experienced disruptions in their water and wastewater utilities due to a coordinated cyberattack targeting operational technology systems. Cities such as Braham and Plymouth reported incidents where water treatment plants and related infrastructure were temporarily taken offline. While the attacks did not compromise water quality, they highlighted vulnerabilities in critical infrastructure. This incident underscores the escalating threat posed by state-sponsored cyber actors targeting U.S. critical infrastructure. The Cybersecurity and Infrastructure Security Agency (CISA) had previously warned of Iranian-affiliated groups, like CyberAv3ngers, exploiting internet-connected operational technology devices, including programmable logic controllers. ([epa.gov](https://www.epa.gov/newsreleases/epa-fbi-cisa-nsa-issue-joint-cybersecurity-advisory-water-system-regarding-iranian?utm_source=openai))
1 month ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports