Live threats
HighUnpatched Check Point Gateways Exploited via PHP2Shell, Granting Root Access and Enabling Wiper Attacks BreachUS DOJ Seizes $1.2 B Stolen from Binance Theft and Disrupts North Korean ‘FaceStealer’ Social‑Engineering Tool Rule changeFederal Register limits automated scraping of its sites, directing users to APIs DeadlineFrench court orders DNS resolver Quad9 to block sites, prompting its withdrawal from France CriticalZoom Patches Critical Windows Privilege‑Escalation Flaws (CVE‑2026‑108186 & CVE‑2026‑108187) BreachWhiteArmor Gang Claims Theft of 100 GB Data from Maersk’s Legacy Logistics Platform Rule changeNIST announces single process for NCCoE project participation via letters of interest CriticalCritical Node2Shell (CVE‑2026‑111497) Buffer Overflow Threat to Siemens Desigo & Gridscale Products
Updated 08:43 UTC All intelligence →
Digital Trust PractitionersAssociation of Digital Trust Practitioners · TrustPractitioners.org
EN
JoinJoin
BREACH WATCH BRIEF High 👤 Breach

ScreenConnect Attacks Compromise ≥ 288 Endpoints in 48 Organizations via Rogue Remote‑Access Clients

A coordinated campaign leveraged malicious ScreenConnect extensions to gain remote access to at least 288 endpoints across 48 organizations. The incident highlights gaps in third‑party risk oversight and the need for continuous monitoring of remote‑access tool integrations.

ADTP Breach Watch · November 12, 2026 · The Hacker News
SeverityHigh
Type👤 Breach
ConfidenceHigh
ReportedNov 12, 2026
Technology & SaaS Managed Service Providers Internal IT teams using remote‑access solutions Third-Party Dependency Data Exfiltration
Check if you use it. This incident came through a third party or the supply chain. If the product or supplier is in your estate or your vendors', start with the questions to ask below.

What happened

Attackers used rogue ScreenConnect client binaries delivered through compromised third‑party extensions, reaching 288 endpoints in 48 organizations; ConnectWise disabled the five affected extensions and launched a forensic investigation.

Why it matters for trust and compliance

  • The incident tests the control objective of third‑party risk management, showing that oversight of extensions is essential for audit readiness across frameworks.
  • Demonstrates need for continuous monitoring of third‑party extensions as evidence of control effectiveness.
  • Supports audit readiness by mapping extension‑oversight to vendor‑risk control objectives.

Who is affected

Managed Service Providers Internal IT teams using remote‑access solutions

Recommended actions

  1. Inventory and verify all ScreenConnect extensions; remove unverified add‑ons.
  2. Rotate partner credentials and enforce MFA for extension management.
  3. Enable detailed remote‑session logging and integrate with a SIEM.

Regulations library

Every US state privacy law, on one map

24 states have a comprehensive privacy law in the library, alongside the EU, UK, US federal and global laws: 102 in all, each explained in plain words with its sources. Select a state to see what applies there.

Explore the mapFollow Regulatory Watch
  • In force
  • Coming into force
  • Sector laws
AK ME VT NH WA ID MT ND MN IL WI MI NY RI MA OR NV WY SD IA IN OH PA NJ CT CA UT CO NE MO KY WV VA MD DE AZ NM KS AR TN NC SC DC OK LA MS AL GA HI TX FL

Get the Breach Digest

The incidents that matter for your vendors and your data, analyzed for practitioners, in one email.