Senior Manager

Three major breaches in two weeks: what security teams can learn from July 2026. 10 July 2026 July 2026 is shaping up to be a rough month for data security. In the past two weeks, 0xbasinas has seen alleged breaches at Nike and Alcon, a confirmed zero-day exploitation at Japanese telecom KDDI affecting 12 million people, and an intrusion at Accenture where a hacker claims to have stolen 35GB of source code and cloud credentials. These incidents are not isolated. They share patterns that security teams should pay attention to. I will walk through each incident, look at what actually happened versus what is claimed, and pull out the practical takeaways. Nike and Alcon: unverified claims with worrying details. On July 6, a threat actor using the alias Nocturne posted on a dark web forum claiming to have stolen customer data from Nike and internal records from Alcon, an ophthalmology device and pharmaceutical company. According to DarkWebInformer, the Nike data is described as "eight figures" of records, all from 2026 customer registrations and orders. The uncompressed archive is over 40GB and contains only CSV files. For Alcon, the claimed breach is more varied. The actor says they stole user sign-up information for Alcon's MARLO platform, including full names, addresses, phone numbers. They also claim to have taken Salesforce supplier data, internal MARLO conversation logs, order numbers, and source code. The sample shared includes fields like SAP IDs, credit limits, and geographic classification data. Neither Nike nor Alcon has confirmed any breach. The actor claims Alcon initially negotiated and received data samples, then backed out, prompting the leak. The post includes a direct message calling out Alcon for not disclosing the breach to customers. Some context: this is not Nike's first alleged breach in 2026. In January, the WorldLeaks ransomware gang claimed to have stolen 1.4TB of internal data, including 190,000 files about design and manufacturing. That incident reportedly involved insider access, not customer records. Nike never confirmed that one either. What this means for defenders. Unverified claims are frustrating. You cannot act on a dark web post alone, but you also cannot ignore the possibility. The safety move is to monitor for credential stuffing attempts on your own systems. If you are a Nike customer, change your password anyway. If you work with Alcon's MARLO platform or Salesforce integration, treat the claims as credible enough to review access logs for anomalous activity. The 40GB figure and sample screenshots are not proof, but they are enough to justify proactive investigation. KDDI: a zero-day in custom email infrastructure. On June 17, Japanese telecommunications giant KDDI detected unauthorized access to a system that is part of the email infrastructure used by five ISPs: STNet, JCOM, Chubu Telecommunications, NIFTY, and BIGLOBE. KDDI confirmed this week that 12.2 million email addresses and 7.6 million passwords were compromised. The attack exploited a zero-day vulnerability in software that KDDI built as part of that email system. The company says the exploitation may have been ongoing since May. They evicted the attackers immediately after discovery and found no evidence of additional suspicious activity. They are now working with the software vendor on a patch. Mandatory password resets are being rolled out. KDDI also said that mobile and fixed-line internet services were not affected, because those operate on separate infrastructure. What this means for defenders. A zero-day in custom software is every security team's nightmare. You cannot rely on off-the-shelf patches if the vulnerability is in your own code or a bespoke integration. The attackers got in through the email system, not the core network, which suggests they were after credentials. Password resets are the obvious fix, but the more important lesson is about segmentation. KDDI's mobile and fixed-line services remained unaffected because they were on different infrastructure. That is the kind of architectural decision that pays off when an incident happens. The incident also reinforces a basic truth: if you run an email service that stores plaintext or weakly hashed passwords, you are a target. KDDI says passwords were compromised, but they did not specify whether they were hashed. Given the scale, every affected user should assume their password is in the hands of attackers. Accenture: confirmed intrusion, claimed exfiltration of secrets. On July 6, a hacker using the handle "888" posted on a cybercrime forum claiming to have 35GB of data stolen from Accenture. The list includes source code, RSA keys, SSH keys, Azure Personal Access Tokens, Azure Storage access keys, configuration files, and other data. The hacker is asking for payment in Monero. Accenture confirmed the intrusion and said they identified the source and remediated it. They said the incident had no impact on their financial position or operations. They did not confirm or deny the specifics of the data theft. This is not the first time this hacker has sold Accenture data. In 2024, "888" claimed to have stolen PII of 30,000 employees. Accenture said at the time that the real number was closer to three employees. It is possible this latest claim is similarly exaggerated. But even if the actual data volume is smaller, the nature of the claimed data is concerning. Source code is one thing; RSA keys, SSH keys, and Azure PATs are another. Those credentials, if real, could be used to access Accenture's cloud environments and potentially the environments of their clients. Accenture works with many Fortune 500 companies. A breach of their internal cloud management keys would be worse than a breach of customer data. What this means for defenders. If you run a consultancy or a managed service provider, your secrets are your crown jewels. Attackers know that stealing a cloud token from an MSP is more valuable than stealing a thousand credit card numbers. The practical takeaway is to rotate all secrets regularly, enforce minimal permissions for service accounts, and monitor for token exfiltration. The fact that Accenture says they evicted the attacker and saw no further activity is good, but it does not mean the data is gone. The attacker likely already exfiltrated everything they could before the intrusion was detected. Common threads and what to do about them. All three incidents share a few things. First, they involve third-party or custom software that attackers exploited. KDDI's zero-day was in their own email system. Alcon's MARLO platform was allegedly compromised. Accenture's intrusion, whatever the vector, gave the attacker access to cloud credentials tied to client infrastructure. Second, in two of three cases the companies took days or weeks to confirm the breach. KDDI detected on June 17 and confirmed in early July. Accenture confirmed within days of the post, but the data may have been stolen earlier. Nike and Alcon have not confirmed at all. Third, the attackers went after login credentials and secrets. At KDDI, email passwords. At Accenture, cloud tokens. At Alcon, user registration data. Credential theft is the common denominator. What security teams should do right now. Rotate any secrets that may be exposed through third-party integrations. If you use Alcon's MARLO or Salesforce connections, force password resets for users of those platforms. If you are an Accenture client, ask for an audit of any shared credentials or API keys. If you use KDDI's email services, change your password today, even if you have not been notified yet. Monitor your own logs for credential stuffing attacks. The 12 million email addresses from KDDI are now in the hands of attackers. They will use them to try logging into other services. If your users reuse passwords, you will see spikes in failed login attempts. Finally, treat dark web claims as intelligence, not as confirmation. But do not dismiss them either. The cost of investigating is lower than the cost of being caught unprepared.

Broadening toric options for astigmatic patients. June 19, 2026 At the American Optometric Association 2026 in Phoenix, Alcon introduced expansion of its astigmatism contact lens offerings for PRECISION1(R), PRECISION7(R) and TOTAL30(R), delivering broad parameter availability across 1-day, 1-week and 1-month replacement lenses, reinforcing its commitment to helping eyecare professionals (ECPs) fit more astigmatic patients in their desired lenses. Astigmatism remains one of the most common vision conditions, yet many patients remain under-corrected or difficult to fit due to historical parameter limitations.[1-3] Expanded parameter availability can help improve first-fit success, reduce the need for refits and provide ECPs with greater flexibility across a broader range of prescriptions and patient needs, [2,3] Alcon said in its announcement. Uncorrected astigmatism can impact patients' vision-related quality of life, reduce productivity among working-age adults, and create economic burden for patients and their families.[1] With these expanded parameters, including TOTAL30 for Astigmatism, lenses will cover 99% of astigmatic eyes[*], supporting real-world clinical needs.[4-6] TOTAL30 for Astigmatism contact lenses are now the most readily accessible parameters of the leading monthly replacement toric brands, giving ECPs more options for patients.[5-8,**] "In practice, a lack of parameter options can be a barrier to fitting some astigmatic patients in contact lenses," said Torrey J. Carlson, OD,[+] multi-practice owner and founder of Dr. Torrey J. Carlson & Associates. "The expanded toric parameters will be instrumental in making it easier to find the right fit, streamline appointments and ultimately help more patients fit in lenses." The announcement reflects Alcon's broader focus on advancing a comprehensive contact lens portfolio designed to support a wider range of patient needs across daily, weekly and monthly modalities. "The future of eyecare depends on innovations that help practitioners care for more patients across a wider range of vision and ocular surface needs," said Carla Mack, OD, Head of Global and US Professional Education and Development at Alcon. "From expanded toric parameters to emerging approaches in dry eye, continued innovation is creating new opportunities to improve patient care and fitting success." + Paid Alcon Consultant * All eyes with a spectacle cylinder range of -0.75DC to -3.50DC. ** Based on SKU range comparison between TOTAL30(R) for Astigmatism, BIOFINITY Toric^, and ULTRA for Astigmatism^, as of December 2025 ^Trademarks are property of their respective owners References: * Epidemiology and Burden of Astigmatism: A Systematic Literature Review. Optom Vis Sci. 2023 Mar 1;100(3):218-231. doi: 10.1097/OPX.0000000000001998. Epub 2023 Feb 7. PMID: 36749017; PMCID: PMC10045990. * Gustafson B, Whaley S, Giedd B, Montaquila S, Edwards B, Subbaraman LN. Short-Term fit assessment of a novel daily disposable, toric, silicone hydrogel contact lens. Clin Ophthalmol. 2022 Nov 14;16:3721-3730. doi: 10.2147/OPTH.S370151. PMID: 36407500; PMCID: PMC9673940 * Nathan Efron, Philip B. Morgan, Craig A. Woods, Deborah Jones, Lyndon Jones, Jason J. Nichols, International trends in prescribing toric soft contact lenses to correct astigmatism (2000-2023): An update, Contact Lens and Anterior Eye,Volume 47, Issue 5, 2024,102276, ISSN 1367-0484,https://doi.org/10.1016/j.clae.2024.102276 (https://www.sciencedirect.com/science/article/pii/S1367048424001681) * Alcon data on file, 2017. REF-15290 * TOTAL30 family contact lenses Directions for Use - 2025 * Alcon data on file, 2026. REF-29086 * BAUSCH + LOMB ULTRA MONTHLY Contact Lens Parameters. Bausch + Lomb eye care professional website. Published 2023. Accessed February 3, 2026. https://ecp.bauschcontactlenses.com/siteassets/pdf/ultra-contact-lens-parameters.pdf/ * Product Reference Guide. CooperVision eye care professional website. Published 2025. Accessed February 3, 2026. https://coopervision.com/practitioner/its-products/product-reference-guide