Orchard named Optimizely Customer Partner of the Year for second consecutive year. March 11, 2026 Orchard has been awarded Optimizely's Customer Partner of the Year for the second consecutive year. The award, nominated and judged by clients, recognises partners that deliver exceptional platform outcomes, genuine strategic partnership, and measurable commercial impact. The back-to-back recognition places Orchard among the top Optimizely partners globally, reflecting a body of work spanning complex platform migrations, personalisation capability builds, and sustained digital transformation programs with quantifiable results. Andrew Killey, Practice Lead, Asia Pacific, Orchard, said: "Winning this once felt like a milestone. Winning it twice feels like a reflection of the standard our team holds themselves to every day. This award belongs to them, and to the clients who chose to partner with us and push us to do our best work." Optimizely recognised Orchard's consistent role as a true extension of in-house teams, combining deep platform expertise with a collaborative and agile approach to delivery. Having achieved Gold Partner status for the first time in 2024, Orchard has now defended the Customer Partner of the Year award in consecutive years extending a partnership with Optimizely that spans over 15 years, making it one of the first solution partners in Australia.

Third-Party data breach at online DIY firm manomano affects nearly 38 million people. Ad tech company Optimizely has confirmed a data breach following a vishing attack that leaked business contact information from some internal business systems. - Advertisement - Voice phishing (vishing) leverages phone calls or audio messages to lure victims into disclosing their login credentials, authorizing a rogue app, or disclosing sensitive information such as credit card numbers. New York-based Optimizely serves over 10,000 businesses across 21 global locations and employs 1,500 people. Its clients include clothing company H&M, payment giant PayPal, automaker Toyota, telecommunications giant Vodafone, and video conferencing firm Zoom. Vishing attack on ad tech company leaks customer data. According to data breach notification letters sent to affected customers, Optimizely learned of the data breach on February 11 after a threat actor contacted the ad tech company claiming to have compromised its systems. - Advertisement - Upon learning of the data breach, Optimizely initiated an investigation and determined that the leak stemmed from a vishing attack. The unauthorized access enabled the attacker to exfiltrate basic business contact information. However, they were unable to escalate privileges, install malicious software, or gain persistence by creating a backdoor for future exploitation. "The threat actor gained access to Optimizely's systems through a sophisticated voice-phishing attack, but was unable to escalate privileges, install software, or create any backdoors in the Optimizely environment," the ad tech company stated. Additionally, no sensitive client information was compromised, and the attack was limited to some business systems, CRM, and a subset of internal documents. "The incident was confined to certain internal business systems including Zendesk, records in our Salesforce CRM, and a limited set of internal documents used for back-office operations," it added. The vishing attack also did not disrupt operations at the ad tech company, and the threat actor's access was terminated successfully. Meanwhile, Optimizely has notified law enforcement and launched an investigation with third-party cybersecurity experts to determine the scope of the incident. The ad tech company also advised impacted customers to be on the lookout for potential spear phishing attacks leveraging the stolen information. "Voice phishing is effective because it turns security into a real time conversation, where an attacker can build trust and convince employees to hand over credentials," said Pete Luban, Field CISO at AttackIQ. "Vishing is becoming more popular, and potent, as attackers combine call scripts with leaked personal details and spoofed caller IDs, or pairing the phone call with a convincing login prompt or a fake support workflow. In Optimizely's case, even if the stolen data ends up being limited, it's still valuable fuel for follow-up scams, since personal information makes future phishing and vishing attempts far more convincing." ShinyHunters linked to Optimizely vishing attack. So far, the ad tech company has not attributed the vishing attack to any threat group. However, the tactics are consistent with the aggressive hacking campaign by the prolific hacking gang ShinyHunters. Since 2025, the group has conducted vishing attacks on single sign-on (SSO) platforms, Okta, Microsoft, and Google, affecting over 100 organizations. Some notable downstream victims of the ShinyHunters' vishing campaign include Canada Goose, investment platform Betterment, streaming website SoundCloud, fintech company Figure, and business intelligence platform CrunchBase. "Marketing, PR, and advertising companies like Optimizely are not typically the primary targets of major data breaches, which makes this incident unique," noted Chance Caldwell, Senior Director of the Phishing Defense Center at Cofense. "Attackers often focus on high-value enterprises, yet ad-tech platforms hold substantial sensitive data on behalf of their clients." - Advertisement - In January, Google's cybersecurity company Mandiant warned that ShinyHunters was targeting more cloud platforms and seeking more sensitive data for extortion. Additionally, the cybercrime group started using more aggressive tactics, including harassing employees and business partners to force victim organizations to pay the ransom. ShinyHunters also deploys a sophisticated phishing toolkit to meet callers' specific needs, such as providing contextual screens matching the victim's authentication flows to harvest login credentials and MFA codes. However, Mandiant insists that ShinyHunters' breaches do not stem from product vulnerabilities but from the effectiveness of its social engineering tactics. Subsequently, the cybersecurity firm recommends deploying phishing-resistant MFA, such as FIDO2 security keys, and ditching SMS-based two-factor authentication. - Advertisement -

Cybersecurity brief - 2026-02-24. 2026-02-24 Major Incidents or Breaches * Optimizely, a New York-based ad tech company, confirmed a data breach following a voice phishing (vishing) attack that led to unauthorised access to customer data. * Vanta Diagnostics (formerly Vikor Scientific), a US healthcare diagnostics firm, reported a data breach affecting 140,000 individuals, attributed to the Everest ransomware group. * The University of Mississippi Medical Center was forced to close all clinics and cancel elective procedures following a ransomware attack. * PayPal disclosed that an application error led to a data breach, exposing customer personal information for nearly six months and resulting in fraudulent transactions. * France's Ministry of Economy disclosed a data breach, as noted in Check Point Research's latest threat intelligence bulletin. Newly Discovered Vulnerabilities * Two recently patched vulnerabilities in RoundCube Webmail are being actively exploited in the wild, including an XSS flaw via animate tags in SVG documents. * Researchers identified multiple security vulnerabilities in Android mental health apps with a combined 14.7 million installs, potentially exposing sensitive medical information. * Microsoft is investigating a bug in the classic Outlook desktop client that causes the mouse pointer to disappear for some users. * Supply chain attacks continue to be observed in the npm ecosystem, with at least 19 malicious npm packages actively harvesting cryptocurrency keys, CI secrets, and API tokens. * Researchers reported ongoing malware campaigns using malicious JPEG files with embedded payloads to deliver MSI installers. Notable Threat Actor Activity * APT28 (Russia-linked) has been attributed to a new campaign targeting Western and Central European entities using webhook-based macro malware. * The Iranian state-sponsored group MuddyWater deployed new malware strains in attacks against organizations in the Middle East and Africa. * The Everest ransomware group claimed responsibility for the Vanta Diagnostics breach. * A Russian-speaking hacker used generative AI to compromise over 600 FortiGate firewalls, targeting credentials and backups for potential ransomware operations. * Autonomous AI agents have been leveraged in a new class of supply chain attack targeting crypto wallets. * The Shai-Hulud-like npm supply chain campaign is actively spreading through malicious packages. * Spanish authorities arrested four alleged members of the Anonymous Fenix hacktivist group for DDoS attacks against government and political websites. * A Romanian hacker pleaded guilty to selling access to a US state government network. * Oleksandr Didenko, a Ukrainian national, was sentenced in the US for selling stolen identities to North Korean IT workers for use on freelance platforms. Trends, Tools, or Tactics of Interest * There is a surge in ATM jackpotting attacks, with losses exceeding $20 million in 2025; attackers continue to use longstanding tools and tactics. * Cryptojacking campaigns are deploying bespoke XMRig miners using pirated software bundles, leveraging BYOVD (Bring Your Own Vulnerable Driver) exploits and time-based logic bombs for lateral movement. * Threat actors are increasingly using AI, including generative AI, to automate and scale attacks against exposed infrastructure, such as FortiGate firewalls. * Supply chain attacks remain prevalent, with npm and Docker ecosystems being active targets for malware distribution and credential harvesting. * Exposed endpoints and internal APIs in LLM (Large Language Model) infrastructure present new attack surfaces for organizations adopting AI technologies. * Ongoing campaigns use vishing (voice phishing) and deepfake audio to compromise organisations, as highlighted by the Optimizely breach and industry analysis of AI-generated voice threats. * Attackers are exploiting the persistent reuse of trust via stolen tokens and compromised devices, bypassing traditional identity-based security controls. * Malicious actors are using typosquatting (e.g., fake Huorong security site) to distribute remote access trojans such as ValleyRAT. Regulatory or Policy Developments Affecting the Security Industry * CISA has ordered US federal agencies to patch actively exploited RoundCube Webmail vulnerabilities within three weeks. * The arrest of hacktivists and cybercriminals in Spain, the US, and Romania demonstrates ongoing law enforcement efforts targeting cybercrime and hacktivism.