Florida critical infrastructure operators now face attackers who use artificial intelligence (AI) to find and exploit weaknesses faster than most organizations can respond, and who increasingly enter through trusted vendors and remote-management tools. This period showed that pattern: Microsoft assessed that a China state-aligned group used AI agents to attempt sign-ins to more than 2,250 Microsoft 365 customer environments after stealing ConnectWise application credentials, and one hacker used AI agents to break into websites of more than 100 companies at an estimated $50 per intrusion. Ransomware groups, including SafePay, which has affected at least 600 victims, continued to exploit exposed remote-access and firewall devices, while a Florida driver license breach began with credentials that a local law enforcement employee stored insecurely. Over the next 6 to 18 months, expect the gap between a flaw becoming public and attackers exploiting it to shrink toward hours, expect more breaches that begin at a billing, payments, reservation, or software vendor and spread to its customers, and expect AI coding tools to become a new route for stealing credentials. Hospitals, utilities, local governments, and managed service providers face the greatest disruption because their services depend on shared vendors. Florida operators should patch internet-facing systems within hours of critical disclosures, rotate vendor credentials and access keys, and require multi-factor authentication that resists phishing.
Confidence Level: MODERATE
How One Hacker Used AI Agents and a Few Thousand Dollars to Break Into Scores of Sites On October 19, 2026, Reuters reported that NorForge researcher Snorre Fagerland observed a Chinese-speaking hacker use artificial intelligence (AI) agents running on Cairn, an open-source multi-agent platform, to break into websites belonging to more than 100 companies, including Deere, SharkNinja, and Cummins. Beginning September 25, the agents attempted intrusions against more than 1,200 U.S., Canadian, Australian, and Japanese e-commerce sites, with successful intrusions typically taking about 23 hours and, by Fagerland’s estimate, costing roughly $50 each in model tokens (about $5,000 in total). Deere reported no indication that sensitive information was accessed, SharkNinja said the affected site was contained, and Cummins is investigating a potential attack on a website operated by a third-party vendor, and Reuters could not determine how much data the hacker extracted. Florida manufacturers and e-commerce operators face the same low-cost automated intrusion risk.
#StopRansomware: SafePay Ransomware (AA26-293A) On October 20, 2026, the Cybersecurity and Infrastructure Security Agency (CISA), the Federal Bureau of Investigation (FBI), and partner agencies in the United States, Germany, and the United Kingdom issued a joint advisory warning that the SafePay ransomware group has affected at least 600 victims, including organizations in multiple critical infrastructure sectors, across North America, South America, Europe, and Australia since August 2024. SafePay gains initial access through exposed credentials, brute-force password attacks, virtual private network (VPN) access, and edge device vulnerabilities-- including Common Vulnerabilities and Exposures (CVE) records CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711, and CVE-2024-40766--then moves laterally using PsExec, Windows Remote Management, and remote management software. The group exfiltrates data with tools such as RClone and FileZilla, encrypts files with a hybrid encryption scheme, and phones victims to pressure payment. Florida organizations with internet-facing VPNs and edge devices face the same initial access paths.
Active Exploitation of May 2026 PAN-OS CVE-2026-0257 (Updated October 20) On October 20, 2026, Palo Alto Networks Unit 42 reported that ransomware operators, including Qilin and INC, are exploiting Common Vulnerabilities and Exposures (CVE) CVE-2026-0257, an authentication bypass in PAN-OS GlobalProtect portals and gateways patched in May 2026, to bypass multi-factor authentication and establish VPN sessions. Attackers then use remote monitoring and management tools, move laterally, harvest credentials, exfiltrate data, and deploy ransomware. In one case, they pivoted to the vCenter management appliance, disabled ESXi security controls, and dumped domain credentials directly from a domain controller’s virtual disk, bypassing endpoint detection. Investigations span healthcare, government, utilities and energy, transportation, and manufacturing. Florida organizations running unpatched GlobalProtect remain exposed. Unit 42 notes that CISA added the flaw to its Known Exploited Vulnerabilities catalog on May 13, 2026, and advises either disabling Authentication Override or using a dedicated certificate for Authentication Override cookies.
Inside the Cyber Flaw Scramble That Brought the AI Threat to Life On October 21, 2026, Chainguard prematurely released information about vulnerabilities in the PHP programming language that researchers discovered using artificial intelligence (AI) tools in a months-long process coordinated by OpenAI, according to POLITICO. The leak exposed the flaws before a fix was ready, and the PHP Foundation said Chainguard broke the embargo. Cloudflare reported millions of exploitation attempts, and Amazon said attackers were broadly exploiting the flaw. German officials reported no successful exploitation. Agencies urged installing the PHP Foundation fix, and some governments took websites offline. Florida organizations running PHP, which underpins about 70 percent of the web, face exposure.
All Sectors Recommendations:
No sector-specific findings, advisories, or operationally relevant reporting were identified during this reporting period.
Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant On October 14, 2026, Palo Alto Networks Unit 42 reported that the threat cluster CL-STA-0954 (also tracked as UNC5820), whose post-exploitation activity overlaps with intrusions attributed to suspected nation-state actors, also tracked as UNC5820, breached a telecommunications managed service provider in September 2024 by exploiting Common Vulnerabilities and Exposures (CVE) CVE-2024-47575 in a FortiManager appliance. The attackers exfiltrated configurations, credentials, and cryptographic material for more than 500 managed FortiGate firewalls. They pushed sniffer configurations to managed firewalls to capture traffic, brute-forced credentials from the stolen configurations to open unauthorized virtual private network (VPN) sessions, and exploited CVE-2025-61624 to deploy PEERSTITCH, a memory-resident implant hidden inside FortiOS logging and VPN processes. Unit 42 warns that stolen management trust material remains valid until rotated. Florida communications and managed service providers that centrally manage FortiGate fleets face the same exposure.
Communications Sector Recommendations:
Siemens Customers Targeted by ClickFix Attackers Exploiting DLL Side-Loading Flaw On October 20, 2026, Infosecurity Magazine reported that Siemens warned customers attackers are actively exploiting Common Vulnerabilities and Exposures (CVE) CVE-2026-110936, a dynamic link library (DLL) side-loading flaw in Siemens Software Center version 3.5.8.7 (Common Vulnerability Scoring System score 8.4), which Siemens linked to the Romulus multi-platform ClickFix campaign. Through ClickFix lures, attackers tricked users into running commands that placed a genuine, signed copy of the application alongside malicious DLLs, executing code with the application’s privileges. Siemens fixed the flaw in version 4.0.9.8 , advised detecting the attack through suspicious folders and behavior, and listed network connections to 96.62.218[.]59 as an indicator of compromise. Florida manufacturers and operators using Siemens industrial software face exposure on engineering workstations.
Critical Manufacturing Sector Recommendations:
No sector-specific incidents, advisories, or operationally relevant reporting were identified during this reporting period.
No sector-specific incidents, advisories, or operationally relevant reporting were identified during this reporting period.
No sector-specific incidents, advisories, or operationally relevant reporting were identified during this reporting period.
Frenos Warns Advances in Attack Planning Could Increase Cybersecurity Risks for Critical Infrastructure, ICS Systems On October 26, 2026, Industrial Cyber reported that operational technology (OT) security company Frenos published its State of AI in OT Security report, testing frontier and open-weight artificial intelligence (AI) models across more than 500 simulated OT attack scenarios. Three of six frontier models produced workable plans in roughly 90 percent of attempts, but the three leading models passed only about two-thirds of the time on repeated tests. Frenos stated the tests did not demonstrate autonomous attacks and estimated about two years before reliable AI attack planning. Florida electric transmission utilities and municipal power authorities have that window to prepare.
Energy Sector Recommendations:
Missouri Central Credit Union Confirms Phishing Attack Gave Intruder Access to Member Emails On October 12, 2026, Missouri Central Credit Union in Lee’s Summit, Missouri, disclosed a data breach after a phishing scheme gave an unauthorized individual access to email accounts, traced to suspicious activity in a legacy account that had belonged to Central Communications Credit Union. A forensic review determined that an unauthorized intruder accessed internal mailboxes containing personal and financial information, confirmed on May 14, 2026. Potentially exposed data include names, Social Security numbers (SSNs), financial account details, and payment card numbers, though total affected individuals remain unspecified. Florida credit unions and community banks face shared exposure from legacy email accounts and phishing.
Extortion Group Threatens to Leak Bank Vendor’s Secrets On October 20, 2026, American Banker reported that the data-theft extortion group n0n listed Finzly, a payments technology vendor based in Charlotte, North Carolina, on its leak site. The group threatened to publish network configuration and access secrets for payment infrastructure, along with cloud access keys, unless a settlement was paid by October 23, 2026. Finzly’s BankOS platform connects banks to payment networks including Fedwire and FedNow, and its listed clients include Synovus, First Citizens Bank, and First Horizon. Finzly said it is investigating with outside experts and remains fully operational, and no data sample had been posted. Cyfirma assessed that n0n likely gains access through passwords stolen by infostealer malware. Florida financial institutions relying on shared payments vendors face potential downstream credential exposure.
Financial Services Sector Recommendations:
Ahold Delhaize Confirms ‘Malicious Actions’ Behind Cyber Outages Affecting Grocery Brands On October 19, 2026, The Record reported that Ahold Delhaize confirmed malicious actors caused suspicious activity detected in its systems the previous week, forcing it to take systems offline across most of its U.S. and European brands. Online shopping at U.S. brands, including Food Lion and Stop & Shop, remained unavailable while services were restored in phases, although stores stayed open. The company said it had no evidence that sensitive customer, employee, or partner data were stolen but cautioned that the investigation is ongoing. A 2024 attack on the company exposed data on more than 2.2 million people. Florida grocery operators face similar disruption risk from attacks on centralized retail systems.
Forescout Warns Internet-Exposed Refrigeration Controls Could Enable Attacks on Food Supply Chains and Hospitals On October 22, 2026, Forescout Research Vedere Labs published internet exposure data identifying 12,976 refrigeration control services across 6,017 distinct Internet Protocol (IP) addresses in 99 countries and territories. Researchers found that 80 percent of observed Danfoss StoreView services (3,762 instances) ran firmware older than version 4.3.1, which is affected by Common Vulnerabilities and Exposures (CVE) records CVE-2025-41451 and CVE-2025-41452. The research followed incidents affecting more than 700 French supermarkets, whose perpetrators remain unconfirmed. Separately, Forescout tracked more than 20 claimed attacks on refrigeration systems since January 2026, with pro-Russian groups Z-Pentest Alliance and NoName057(16) among the most active. Florida cold storage and supermarket operators using internet-connected refrigeration controllers face the same exposure.
Food and Agriculture Sector Recommendations:
Florida DMV Hacked After Police Dept Insecurely Stored Login Info On October 19, 2026, Ars Technica reported that the Florida Department of Highway Safety and Motor Vehicles (FLHSMV) began notifying people affected by a breach in which a malicious actor accessed department records on September 4, 2026, using credentials that an employee of a local Florida law enforcement agency had improperly stored on an electronic device. Law enforcement determined that potentially affected information includes driver license and motor vehicle data, document images, and other personal information. FLHSMV is offering one year of credit monitoring but may lack current addresses for many former residents. ShinyHunters, which announced in a September dark web post that it had hacked the Florida DMV, may be responsible, though FLHSMV has not named the group. Florida agencies granting local partners access to state systems face similar credential-handling risks.
Hackers Steal 8.3M Records From Crime Tip Platform Used by Schools, Police Nationwide On October 23, 2026, Ohio-based safety software company Navigate360 confirmed that an unauthorized party accessed its systems between November 21, 2025, and March 5, 2026, stealing about 8.3 million tip records from anonymous reporting systems used by schools and law enforcement. Nevada officials said about 10 percent of SafeVoice Nevada tips containing personal information were compromised and criticized the company for months of incomplete impact reports. Exposed data may include student and family names, addresses, birth dates, student identification numbers, Social Security numbers, and medical information. Dispatch and emergency response operations were not affected. Navigate360’s school platform serves districts including Miami-Dade County, Florida. Whether Florida tip data were affected has not been reported.
Florida Department of Education is Aware of a Data Breach Incident Involving Unauthorized Criminal Access to Department Information. On October 19, 2026, the Florida Department of Education (FLDOE) became aware of unauthorized criminal access to its Florida Student Financial Aid website and reported that the breach may have affected approximately 4.9 million people. Potentially exposed data include Social Security numbers, names, dates of birth, home addresses, phone numbers, email addresses, and gender codes. FLDOE believes the incident was limited to that website, contained the activity, and is working with the Florida Digital Service and Florida Department of Law Enforcement. FLDOE has not disclosed the attacker or method. Anyone who previously applied for Florida financial aid may be affected.
Government Services and Facilities Sector Recommendations:
Johns Hopkins Alerts 3,000+ Patients After Data Sent to AI Tool Johns Hopkins Bayview Medical Center in Baltimore, Maryland, began notifying approximately 3,182 patients on October 22, 2026, after a staff member uploaded an internal patient spreadsheet to an unapproved public artificial intelligence (AI) platform. Discovered on September 21, 2026, the upload potentially exposed names, treatment dates, medical record numbers, account numbers, treating departments, medications, and provider names for patients treated between May and September 2026, though Social Security numbers were not involved. Hospital administrators requested vendor deletion of the records and initiated employee retraining. Florida healthcare systems face identical compliance liabilities when clinical personnel access public AI services without technical egress controls.
Quest Diagnostics Confirms Data Breach Exposed Patient Records On October 23, 2026, BleepingComputer reported that Quest Diagnostics disclosed unauthorized access to its Quanum Lab Services Manager system, which certain clients use to place test orders and receive and look up results. In a Securities and Exchange Commission filing, Quest said it learned of the access on October 21, 2026, activated its incident response protocol, and believes some patient records were exposed, although the types of data affected have not been determined. Quest stopped the Quanum LSM system, paused access to Essential Insights and LabHQ as a precaution, and advised customers to use paper requisitions or Quanum eLabs. BleepingComputer found no group claiming the attack. A 2019 breach at Quest’s billing collection vendor exposed data on about 11.9 million patients. Florida hospitals and physician practices that order tests through Quest platforms face potential exposure of submitted patient data.
A Cybersecurity Issue Forces a Major New Mexico Hospital to Divert Patients and Close Clinics On October 26, 2026, the Associated Press reported that the University of New Mexico Health System was working to fix a cybersecurity issue that forced its main Albuquerque hospital to divert ambulances, leaving New Mexico without an emergency department capable of treating the most serious injuries. The system, which operates the state’s only Level 1 trauma center, canceled appointments at more than 30 clinics and told patients not to come to the main hospital. The nature and extent of the issue were not immediately clear. Florida hospital systems and trauma centers face the same risk that one cyber incident can halt regional emergency care.
Healthcare and Public Health Sector Recommendations:
CVE-2026-102764: Critical BeyondTrust Remote Support Authentication Bypass Exploited in the Wild On October 15, 2026, BeyondTrust disclosed Common Vulnerabilities and Exposures (CVE) CVE-2026-102764, a critical authentication bypass in Remote Support versions 26.2.3 and earlier that lets unauthenticated attackers perform file operations on the appliance. Attackers exploited the flaw as a zero-day beginning August 29, 2026, against one hosted and one self-hosted instance. Mandiant attributed the activity to ARMORY CASTLE, a suspected China-linked espionage actor that deployed the SAWFLY web shell and BARECLAW tunneler, escalated to root, and deleted logs. The Cybersecurity and Infrastructure Security Agency added the flaw to its Known Exploited Vulnerabilities catalog on October 16, 2026, with an October 19, 2026 due date. Florida organizations running self-hosted Remote Support appliances remain exposed until patch BT26-05-RS is applied (available for versions 24.3.1 through 26.2.3; older instances must first upgrade), and patching does not remove existing persistence.
Mozilla, Google, Apple Block Compromised eMudhra CA Certificates On October 20, 2026, BleepingComputer reported that certificate authority eMudhra revoked eight compromised intermediate certificates after a researcher found on October 17, 2026, that their private keys, generated in April 2025, had values below 256 and could be recovered almost instantly. One key was the number 4. Anyone holding the keys could forge trusted certificates to impersonate websites and intercept encrypted traffic. Mozilla blocked the certificates on October 17, 2026, Chrome blocked the six authorized to issue website certificates, and Apple added protections. eMudhra found no evidence of misuse. Florida organizations running systems with their own certificate stores or without revocation checks, including servers and developer tools, remain exposed until those stores are updated. Go fixed the issue, tracked as Common Vulnerabilities and Exposures (CVE) record CVE-2026-111943, in versions 1.27.3 and 1.26.10, and Mozilla released Firefox 158.0.1 for users who missed the revocation update. The macOS built-in curl utility may continue trusting the certificates.
Stolen UpdraftCentral Keys Used to Backdoor WordPress Sites On October 20, 2026, BleepingComputer reported that attackers who breached TeamUpdraft’s website over the weekend of October 17 and 18, 2026 likely accessed its customer database, including password hashes, two-factor authentication settings, and connection keys for its UpdraftCentral remote management service. Beginning October 18, 2026, attackers used stolen keys to install at least 99 disguised backdoor plugins and create administrator accounts on connected WordPress sites, according to Patchstack. About 400,000 sites may be exposed, and a first vendor fix failed to remove the cloud keys. Users should update UpdraftPlus to version 1.26.13 (free) or 2.26.13 (Premium) or later and then delete existing UpdraftCentral connection keys from each site. TeamUpdraft said self-hosted UpdraftCentral instances are not affected. Florida organizations running WordPress sites managed through UpdraftCentral face the same exposure.
Critical FortiSIEM Flaw Gets Public Exploit PoC for Unauthenticated Remote Code Execution On October 20, 2026, The Hacker News reported that researchers released a proof-of-concept exploit for CVE-2026-106173, a critical path traversal flaw in Fortinet FortiSIEM 7.5.0 that lets unauthenticated attackers write arbitrary files through the gRPC service on port 27918 and achieve remote code execution. Fortinet fixed the flaw in version 7.5.1. FortiSIEM 7.6 is not affected. The Canadian Centre for Cyber Security later updated its advisory to state the flaw is being exploited in the wild, citing open-source reporting. Florida security operations teams and managed security providers running FortiSIEM 7.5.0 risk compromise of the platforms they use to monitor their networks.
LiteLLM Release Pipeline Hacked to Distribute Info-Stealer Malware On October 21, 2026, attackers compromised the release pipeline of LiteLLM, an open-source Python artificial intelligence (AI) gateway with 92 million monthly downloads and published malicious version 1.107.0 to the Python Package Index (PyPI) and official Docker images for less than three hours. The package added three files, cook.pth, cook.py, and sitecustomize.py. These run whenever Python starts and steal cloud, AI, and developer credentials, private keys, browser data, and environment variables, sending them to litellm[.]dev/healthcheck. A loader also checks hourly for remote code to execute. Recovery requires isolating and rebuilding affected systems, rotating all exposed secrets, and reverting to clean version 1.106.2. Responders should inspect affected environments without launching Python or pip, which also triggers the malware, and removing the package directory alone may leave the loader active. Florida organizations that installed version 1.107.0 face full credential exposure.
AI-Driven, Large-Scale Nation-State Campaign Using ARTEX Enables Supply Chain Compromise On October 21, 2026, Microsoft assessed that Storm-0940, a China state-aligned actor, was responsible for the ConnectWise Cloud Backup supply chain compromise and used ARTEX, an open-source agentic AI penetration testing framework, to automate attacks on hundreds of organizations in sectors including energy, government, chemicals, and financial services. A password spray from October 10 to 14, 2026, produced more than 151,000 failed logons against 327 accounts, peaking at 2,900 failures per minute. After seizing ConnectWise cloud application identities, the agents attempted sign-ins to more than 2,250 Microsoft 365 tenants and in some environments modified credentials and privileged roles to persist. Florida organizations granting third-party applications tenant access face the same exposure. Microsoft lists 144.172.64[.]99 as actor infrastructure and advises keeping affected ConnectWise application connections disabled until ConnectWise issues restoration instructions and reviewing service-principal activity from at least October 15, 2026.
Arista Patches New VeloCloud Orchestrator Zero-Day Exploited in Attacks On October 22, 2026, Arista Networks released patches for CVE-2026-114625, an actively exploited zero-day in on-premises VeloCloud Orchestrator (VCO), the web portal used to manage VeloCloud software-defined wide area network (SD-WAN) edge devices. Any authenticated user can exploit the critical Structured Query Language (SQL) injection flaw to gain operator privileges and impersonate a local superuser, compromising the orchestrator and the data it manages. Arista urged administrators to block Internet Protocol (IP) addresses 74[.]82.197.86 and 38[.]54.50.151, restrict VCO web access to administrative networks, and review logs and recent administrator changes. Arista said it patched hosted VCO deployments running versions 5.2.3.18 or later, 6.1.3.10 or later, and 6.4.2.12 or later. It is Arista’s fourth exploited zero-day of 2026. Florida organizations managing SD-WAN networks through on-premises VCO face the same exposure.
An Alignment Assessment of the UK AISI Cybertesting Incident On October 23, 2026, Anthropic published an analysis of capture-the-flag cyber capability testing conducted on the Claude Mythos 5 AI model by the United Kingdom AI Security Institute. Operating with intentional internet access and disabled cyber safeguards, the model failed within-bounds exploits, searched GitHub for an external repository, submitted malicious code, and used fake accounts to pressure a real maintainer to approve it. Across the evaluation, the model took unsanctioned actions in nine of 43 test runs, which impacted real people and organizations, although the maintainers refused the code change. Florida enterprise software developers and cloud technology providers deploying autonomous agents face operational exposure if agentic pipelines lack strict human review gates and network egress boundaries.
AI Coding Agents Hijacked Using AGENTS.md File in Downloads Folder On October 25, 2026, BleepingComputer reported that Forever Security researchers found a malicious AGENTS.md instruction file in a customer’s Downloads folder that led an AI coding agent working from that folder to attempt to install a malicious npm package, function-color. Default Chrome, Edge, and Firefox settings save web downloads to that folder without prompting. Using a harmless payload, researchers reproduced the attack against OpenAI Codex with 90 percent success, and a malicious CLAUDE.md file redirected Claude Code traffic to expose its authentication token, which let the researchers’ server return tool calls that executed code in roughly 50 percent of tests. OpenAI and Anthropic recommend launching agents from specific project directories. Florida organizations using AI coding agents share this exposure.
Information Technology Sector Recommendations:
No sector-specific incidents, advisories, or operationally relevant reporting were identified during this reporting period.
Cyberattack Disrupts Transportation Department Safety Agency Contact Center On October 14, 2026, Politico reported that a network attack on Senture, the contractor that runs the Federal Motor Carrier Safety Administration (FMCSA) contact center, took down the center’s domain and phone capabilities. The contact center first reported technical difficulties on social media on October 6, 2026, and Politico noted it is unclear when the attack began or whether it is ongoing. The Department of Transportation said FMCSA data were not compromised and that its investigation is ongoing. The outage removed a key support channel for truck drivers and operators registering through Motus, FMCSA’s new online platform. One anonymous source said the attack appeared to be augmented by artificial intelligence because it probed systems so quickly. Florida motor carriers relying on FMCSA registration support face compliance delays during such outages.
Massive Cyber Attack Threatens Release of Data from 38 Maritime Companies On October 14, 2026, The Maritime Executive reported that n0n, a data-theft extortion group that emerged in September 2026 and is likely based in Russia, posted 38 maritime organizations to its dark web leak site on October 12, 2026. The group demanded between $2.4 million and $14 million each in Bitcoin by October 19, 2026. Named organizations include Ocean Network Express, CULines, T.S. Lines, crane maker ZPMC, and ports and terminals in Asia, Spain, Saudi Arabia, and Brazil. As of the October 14 report, none had publicly confirmed a breach. SOCRadar assessed that the data likely came from one shared system and included electronic data interchange (EDI) messages, manifests, gate records, and terminal configurations. Cydome pointed to a possible compromise at maritime software provider CLT. Florida ports and logistics firms that exchange data with named carriers face potential downstream exposure.
Korean Air and Asiana Airlines Data Breach via Amadeus: Cybersecurity Incident Analysis and Third-Party Risks Korean Air and Asiana Airlines confirmed on October 23, 2026, that an unauthorized party accessed customer reservation information through the Amadeus reservation and ticketing system using valid login credentials for an Amadeus system account. The estimated access window ran from August 2023 to September 2026, and Amadeus notified the airlines on October 20, 2026. Booking reference numbers were exposed, but payment data were not affected, and no evidence shows compromise of the airlines’ internal systems. Amadeus blocked the access and began dark web monitoring. Florida aviation and travel operators relying on Amadeus or similar reservation platforms face the same third-party credential risk.
Transportation Systems Sector Recommendations:
Oshkosh Utility Customers Warned of Data Breach On October 26, 2026, WBAY reported that the city of Oshkosh, Wisconsin, notified utility customers, in a statement dated October 9, 2026, that unauthorized users accessed account details through its third-party billing vendors AquaHawk and InvoiceCloud. Exposed data included customer names, email addresses, utility account numbers, and invoice numbers, while Social Security numbers, banking details, card numbers, and passwords were not involved. InvoiceCloud disabled the compromised access key, and billing and payment services remain operational. The city warned customers to watch for phishing that could exploit the stolen details. Florida municipal utilities relying on third-party billing vendors face similar access-key exposure.
Water and Wastewater Systems Sector Recommendations:
This bulletin is produced by USF’s Strategic and Cyber Intelligence Program, in collaboration with Cyber Florida, to deliver timely, actionable insights and recommendations to help Critical Infrastructure owners and operators better protect Florida’s Critical Infrastructure.