Buyer Planner / Senior - Supply Chain

Ransomware attacks hit yearly high in August, says NCC Group. Wed, 7th Oct 2026 (Today) Ransomware attacks reached 1,073 in August, the highest monthly total of the year and 12% above the 960 recorded in July, according to NCC Group. The cyber security company's monthly threat intelligence findings also showed a change in the leading threat group. Qilin was responsible for 15% of all attacks, overtaking The Gentlemen. North America remained the most targeted region, accounting for 44% of attacks in August. Europe followed with 26%, continuing a pattern in which Western markets bore most of the reported incidents. Industrials remained the main target by sector, accounting for 31% of attacks in August, up from 28% in July. The increase underscores sustained pressure on businesses involved in infrastructure, manufacturing and related operations. The data points to continued disruption across large organisations. Incidents cited in the report included a customer data leak at Manchester Airports Group that affected car park, lounge, fast track bookings and in-airport WiFi systems, and an intrusion at US medical technology company Boston Scientific that disrupted manufacturing, shipping and customer order processing. Aurora case NCC Group also described a case handled by its Digital Forensics and Incident Response team involving the Aurora ransomware group and a transportation organisation. In the account, Aurora exploited a virtual private network and left a short ransom note on an encrypted hypervisor. The note said confidential files had been encrypted and instructed the victim to make contact through the Tor browser using a provided .onion link and access key. The case suggests data extortion has become a priority for the group alongside encryption and, in some cases, destruction. Aurora first emerged this year and has since targeted organisations in manufacturing, legal and research and development, the report said. The findings come as cyber security groups track how artificial intelligence is affecting both cyber attacks and defensive measures. NCC Group pointed to the recent Hugging Face incident as an example of concerns about the behaviour of advanced AI models, saying similar issues were prompting wider debate about policy and regulation. Matt Hull, vice president of cyber intelligence and response at NCC Group, said the latest figures suggested a sustained rise in ransomware activity rather than a one-off spike. "August was the second consecutive month of highest ransomware levels for the year, indicating a steady rise in global activity. A combination of factors is driving this increase, including rapid advancements in AI and ongoing geopolitical volatility, which are fuelling state-sponsored threats. "As the threat landscape evolves, organisations must ensure their resilience and response capabilities keep pace. "AI is becoming a powerful tool for defenders and attackers. As these technologies continue to advance, the most effective approach to protecting against cyber threats will be combining AI's speed and scale with human expertise and experience. Keeping people at the centre of cyber defence, while using technology responsibly, will be key to identifying and responding to cyber risk."

ShinyHunters expose 6.4M in attack on medical supplier McKesson. Source Originally from "ShinyHunters expose 6.4M in attack on medical supplier McKesson" by The Register - View original. Vendor risk governance failure: McKesson's 6.4M record breach exposes healthcare supply chain liability gaps. Why this matters at board and regulatory level. When ShinyHunters compromised McKesson - a critical medical supplier serving 3,300+ oncology providers across 29 states - the breach extended far beyond a single organization's data loss. The exposure of 6.4 million records spanning patient data, staff credentials, and healthcare provider contacts demonstrates a systemic governance failure: healthcare organizations lack binding contractual mechanisms to enforce, audit, and verify vendor security controls proportional to the sensitivity of data those vendors hold. The $55.2 million extortion demand reveals that threat actors now price attacks based on a vendor's position in the supply chain and the downstream liability exposure they create. This pricing model transforms vendor selection from a procurement decision into a board-level governance priority - yet most healthcare organizations remain unprepared to manage the cascading notification obligations, regulatory exposure, and liability allocation that follow a vendor breach of this scale. The supply chain leverage problem. McKesson's position as a critical infrastructure node in healthcare supply chains creates asymmetric risk exposure. A compromise at this level does not affect only McKesson's direct contractual relationships; it propagates through multiple layers of healthcare providers, patients, and staff. Yet the contractual frameworks governing vendor relationships typically fail to specify minimum security controls, real-time audit rights, or binding incident notification timelines. Most healthcare organizations discover - only after a breach occurs - that their vendor contracts lack clarity on who bears responsibility for notification costs, who funds regulatory remediation, and how liability is allocated if disclosure is delayed or incomplete. The concurrent breaches at Boston Scientific and Veradigm, both traced to compromised third-party vendor credentials, reveal a second structural weakness: credential hygiene and access control segregation across vendor ecosystems. When a single compromised credential grants access to multiple downstream systems, the breach becomes a supply chain cascade rather than an isolated incident. This pattern indicates that healthcare organizations have not implemented contractual requirements mandating multi-factor authentication, credential rotation, and access logging for third-party integrations. Under NIS2 and DORA frameworks, critical infrastructure operators and financial entities must assess and monitor supply chain security; healthcare organizations subject to similar regulatory expectations must translate these mandates into enforceable contractual language that specifies minimum technical controls, audit rights, and forensic disclosure obligations. Notification complexity and liability allocation. A breach affecting 6.4 million records triggers notification obligations under HIPAA, state breach notification laws, and potentially GDPR if European patients or providers are affected. However, contractual relationships between vendors and downstream customers often fail to allocate responsibility for notification timing, forensic disclosure, and regulatory reporting. Many healthcare organizations lack contractual clarity on whether their vendor must notify them within a specific timeframe, provide forensic details necessary for regulatory submissions, or assume liability for regulatory fines resulting from delayed or incomplete notification. This ambiguity creates operational chaos and legal exposure at the moment when coordinated, rapid response is most critical. The incident also exposes how vendor risk governance frameworks often overlook extortion as a distinct liability vector. A $55.2 million ransom demand creates pressure on the vendor to negotiate, potentially delaying breach disclosure to downstream customers and regulators. Contractual frameworks should explicitly prohibit vendors from negotiating ransom payments without notifying affected customers and should require vendors to maintain cyber liability insurance that covers both breach response costs and downstream customer notification obligations. Without these contractual anchors, healthcare organizations face scenarios where their vendor's negotiation decisions directly affect their own regulatory exposure and liability timeline. Cybersol's perspective: where governance frameworks break down. This incident reveals a critical distinction between technical security and governance-level risk management. The technical attack vector - credential compromise via a third-party vendor environment - is well-understood and preventable through standard access controls. The governance failure is contractual and organizational. Most healthcare vendor agreements were drafted before ransomware became a primary extortion mechanism, before supply chain attacks became the dominant attack pattern, and before regulators began holding organizations accountable for vendor security failures. Organizations typically overlook three specific risk layers: * Contractual specificity on security controls: Vendor contracts often reference "industry-standard security" or "reasonable safeguards" without defining what these terms mean operationally. Contracts should specify minimum technical controls (MFA, encryption, access logging), audit frequency, and remediation timelines for identified vulnerabilities. * Notification obligation clarity: Contracts should specify that vendors must notify the organization within 24-48 hours of discovering a breach, provide forensic details within 5 business days, and assume responsibility for notifying affected individuals if the vendor's negligence caused the breach. * Cyber liability insurance as a contractual requirement: Vendors should be required to maintain cyber liability insurance that covers breach response costs, notification expenses, and regulatory fines. This shifts financial risk to the vendor and creates an incentive for the vendor to maintain strong security controls. Most healthcare organizations have not integrated these requirements into their vendor management frameworks, leaving them exposed to the exact scenario McKesson's breach created: rapid escalation of liability, regulatory notification cascades, and contractual ambiguity about who bears the cost of remediation. Original source. The Register, "ShinyHunters expose 6.4M in attack on medical supplier McKesson" (September 10, 2026), reported by Connor Jones. Closing reflection. This incident demonstrates that vendor risk governance in healthcare remains reactive rather than preventive. Organizations should review the original article for specific technical details about the attack vector and credential compromise mechanisms. More importantly, they should use this incident as a trigger to audit their vendor contracts for explicit security requirements, notification obligations, liability allocation, and cyber insurance mandates. The governance failure here is not primarily technical - it is contractual and organizational. Healthcare boards should commission a vendor contract audit within the next 60 days, with specific focus on breach notification timelines, liability allocation, and cyber insurance requirements. The cost of updating vendor agreements is negligible compared to the regulatory exposure and notification costs that follow a breach of this scale.