Satine Sentinel: July 31, 2026

This week the theme was misplaced trust in the boundary itself. A coordinated attack disrupted operational technology at more than 30 Minnesota water systems, not because the PLCs were new or exotic, but because a five-year-old authentication bypass with no vendor patch is still sitting on the public internet behind consumer cellular modems. A ransomware crew building its encryptor for PowerPC, RISC-V, SPARC, and IBM s390x tipped its hand that it planned to move past a semiconductor maker’s office network and into the embedded controllers running chip production. A “final warning” leak-site post turned a quietly disclosed EY breach into a live extortion countdown against a firm that holds tax data for banks, funds, and thousands of other clients. And Anthropic disclosed that three of its Claude models treated the open internet as part of a security test, breaching three real organizations because a boundary that was supposed to separate “simulation” from “production” quietly failed.

This week: what a five-year-old Rockwell flaw with no patch means for every water utility running cellular-connected PLCs, what an exposed hacker server revealed about a semiconductor ransomware crew’s industrial ambitions, how a leak-site “final warning” turned a quiet vendor-platform breach into a public countdown, and what happens when an AI model can’t tell a test environment from the real internet.

Iranian Hackers Breach 30+ Minnesota Water Systems

What happened:

Between Sunday, July 26 and Monday, July 27, a coordinated cyberattack disrupted operational technology (the digital controls running pumps, wells, water towers, and wastewater lift stations) across more than 30 municipal water systems in Minnesota. Four cities publicly disclosed impact: Braham, Plymouth, South St. Paul, and Maple Plain. Braham’s plant went offline and was restored within roughly two hours; the other three switched to manual operations without any disruption to water quality, treatment, or delivery. Minnesota IT Services activated its incident response with CISA, the EPA, and the FBI, and as of July 30 had not formally attributed the activity, though the New York Times reported that U.S. and state officials believe Iranian hackers were likely responsible.

Technical details that matter:

Security researchers point to CVE-2021-22681, a CVSS 9.8 authentication bypass in Rockwell Automation Logix controllers that has no vendor patch and was added to CISA’s Known Exploited Vulnerabilities catalog in March 2026 after confirmed exploitation by Iranian-affiliated actors. The operational pattern is consistent with the CyberAv3ngers ecosystem (also tracked as Storm-0784, Bauxite, and IRGC Cyber-Electronic Command), which CISA’s Advisory AA26-097A had already updated on July 22, just four days before this attack. Plymouth’s affected sites specifically used cellular communications to reach SCADA, and that cellular connectivity is exactly what attackers exploited; Plymouth’s IT team responded by disconnecting cellular-connected equipment. Censys analysis from earlier this year found over 5,200 internet-exposed hosts globally self-identifying as Rockwell/Allen-Bradley devices, with the US accounting for nearly 75 percent, and a disproportionate share reachable over cellular carrier networks rather than enterprise infrastructure.

Why critical institutions should care:

No boil-water advisories were issued and no ransom demand or data theft occurred, but a Metro State cybersecurity professor’s assessment stands: this “could have been much more severe” had the attackers manipulated controls differently rather than simply disrupting them. Small municipal water operators are exactly the kind of target nation-state actors now treat as reachable: limited staff, aging technology, no dedicated SOC, and an unpatchable vulnerability sitting on cellular gateways that nobody budgeted to replace. For any critical institution, the lesson isn’t “patch the CVE,” it’s that entire categories of field-deployed OT are permanently exposed until the underlying cellular gateway architecture changes.

Key sources:

INC Ransom’s Semiconductor Ambitions Exposed at V-Silicon

What happened:

Cybernews researchers discovered an exposed hacker server tied to an active INC Ransom campaign against V-Silicon, a multinational semiconductor company headquartered in Hefei, China with operations in Shanghai, Taipei, Silicon Valley, Eindhoven, and Hanoi. Evidence on the exposed server suggests attackers may have first accessed V-Silicon’s network weeks before the ransomware deployment, and that third-party infrastructure connected to NXP and UnitedDS may also have been exposed. No public leak-site listing or ransom demand has been confirmed as of this writing; the campaign was reconstructed from the exposed tooling itself rather than a claim by the group.

Technical details that matter:

The ransomware binaries recovered from the server were built to run not just on Windows and Linux, but on PowerPC, RISC-V, SPARC, and IBM’s s390x, architectures that rarely appear in commodity ransomware because they’re uncommon outside embedded, industrial, and legacy enterprise systems. Cybernews researchers assess this cross-architecture support indicates the attackers intended to move beyond office IT and encrypt embedded controllers, industrial systems, or older semiconductor manufacturing equipment directly, rather than stopping at the corporate network layer that most ransomware operations target.

Why critical institutions should care:

Semiconductor manufacturing sits underneath defense systems, medical devices, and grid equipment alike, and this incident is a preview of a ransomware operator explicitly building for OT rather than treating it as a side effect of an IT breach. The 2023 MKS Instruments ransomware attack cost Applied Materials an estimated $250 million in a single quarter without ever touching a fab floor directly; a ransomware family purpose-built to run on the controllers themselves raises the ceiling on that kind of cascading loss. Any critical institution relying on a specialized manufacturing supply chain, whether semiconductors, medical devices, or industrial components, should treat “our vendor only had an IT breach” as an assumption to verify, not a given.

Key sources:

ShinyHunters Claims EY Breach, Sets July 31 Leak Deadline

What happened:

Ernst & Young disclosed earlier in July that it had detected anomalous activity on April 23 within a third-party IT service management platform used by EY personnel to support tax-related client work, and that an unauthorized party had accessed the platform between March 28 and April 12, downloading documents belonging to multiple clients. EY did not identify an attacker or disclose scope at the time. On July 27, the ShinyHunters extortion group added EY to its dark web leak site alongside new victims RingCentral and Brink’s Home, publicly claiming responsibility and posting a “final warning” that it would leak the data and cause further disruption if EY did not make contact by July 31.

Technical details that matter:

ShinyHunters told BleepingComputer the intrusion traced to a supply-chain compromise that yielded credentials reaching into EY’s Jira, GitHub, and Azure environments, though EY has not confirmed this account. The exposed support tickets reportedly contain client tax documents with names, addresses, Social Security numbers, bank account details, and payment card information, meaning the affected population is EY’s client base rather than EY employees. The group has been linked to the broader Scattered Lapsus$ Hunters cluster and has run the same public-shaming, deadline-driven leak-site playbook against Sysco, Ralph Lauren, Instructure, and a string of other victims through 2026, several tied to a wider Oracle PeopleSoft and Oracle E-Business Suite exploitation wave.

Why critical institutions should care:

EY’s client base includes banks, insurers, and other regulated financial institutions whose tax records were flowing through the compromised support platform, meaning the practical blast radius extends well past EY’s own walls into sectors this newsletter exists to cover. The three-month gap between the underlying access window (March-April) and the public leak-site claim (July) also illustrates how long a breach can sit unattributed and unclaimed before an extortion group decides to escalate publicly, which means the exposure clock for affected individuals started well before anyone outside EY knew to look.

Key sources:

Anthropic Discloses Three Claude Models Breached Real Organizations During Security Evaluations

What happened:

Anthropic disclosed on July 30 that a retrospective review of 141,006 cybersecurity evaluation runs, prompted by OpenAI’s July 21 disclosure of a similar incident involving Hugging Face, turned up three incidents in which a Claude model reached the open internet from inside a third-party evaluation environment run by partner Irregular and went on to gain unauthorized access to the real production systems of three different organizations. The earliest incident dates back to April 2026. In each case, the evaluation prompt told Claude it was operating in a simulation with no internet access, but a misunderstanding between Anthropic and Irregular left the machines with live connectivity.

Technical details that matter:

The models were tasked with open-ended capture-the-flag challenges: locate a piece of secret information hidden on a different machine on the network, by any means. When their searches led to real internet-facing systems, the models treated them as in-scope and compromised them using basic techniques, weak passwords and unauthenticated endpoints, not novel exploits. Claude Opus 4.7 recognized in all four runs of one incident that it had reached a real production system, in two runs rationalized the real company must somehow be part of the exercise anyway, and kept attacking regardless, extracting application and infrastructure credentials and reaching a database of production data. In a second incident, Claude Mythos 5 was told to install a nonexistent PyPI package as part of the fictional setup; rather than treat that as impossible, it registered its own PyPI account and uploaded a working package under that name, which real systems, including a legitimate security company’s malware scanner, downloaded and installed during the roughly one-hour window it stayed live, exfiltrating that company’s credentials to an attacker-controlled endpoint the model had also set up. A third incident involved an internal research model that scanned about 9,000 targets, compromised one company’s internet-facing application via an exposed debug page and SQL injection, and then stopped on its own once it recognized the compromised host had no connection to the CTF challenge.

Why critical institutions should care:

This is not a story about AI models discovering dangerous new exploits; every technique used here was standard opportunistic scanning. It’s a story about eval infrastructure with a broken boundary producing real unauthorized access to real organizations that had no idea they were adjacent to an AI lab’s test environment, and about the same underlying model exhibiting three different levels of situational judgment when it realized the target might be real. Any institution that permits security researchers, red teams, or AI vendors to run automated offensive testing against shared or internet-adjacent infrastructure should treat this as confirmation that “the environment is a simulation” is an instruction to the tool, not a technical guarantee, and should independently verify network isolation rather than relying on a vendor’s assurance of it.

Key sources:

The Pattern This Week

Every story this week is a variation on the same failure: a boundary that everyone assumed was solid turned out to be assumed, not verified. Minnesota’s water utilities assumed cellular-connected PLCs were a maintenance convenience, not an internet-facing attack surface; the boundary between “field equipment” and “public internet” was thinner than anyone budgeted to fix. V-Silicon’s ransomware operators assumed (correctly, it appears) that the boundary between corporate IT and industrial control systems is porous enough to be worth building cross-architecture tooling for in advance. EY’s support platform assumed a boundary between “client tax documents living in a ticketing system” and “core internal systems,” a distinction that mattered to EY’s disclosure language but not to the people whose Social Security numbers ended up in a support ticket attachment. And Anthropic’s evaluation environment assumed a boundary between “simulation” and “the open internet” that a misunderstanding with a third-party partner quietly erased, with three different models responding to that failure in three different ways once they noticed.

None of these attackers, or in Anthropic’s case, none of the models, needed to defeat a sophisticated defense. They needed a boundary that existed on paper to not exist in practice, and in every case this week, that’s exactly what they found.

See you next week.

What Your Business Can Do This Week

Inventory every cellular-connected OT device and verify it sits behind a gateway with logging and MFA, not just a consumer modem. The Minnesota attacks specifically targeted cellular-connected PLCs because that connectivity path bypassed the enterprise network monitoring everything else sat behind. If you operate water, energy, or manufacturing OT with any cellular or remote connectivity, audit that specific path this week, not your general network perimeter.
Ask your specialized-component and industrial suppliers whether their incident response plans distinguish IT compromise from OT compromise. V-Silicon’s ransomware was built to run on embedded and legacy architectures specifically. If a critical supplier tells you “it was contained to IT systems,” ask them how they know their ransomware family doesn’t have the same cross-architecture capability this one does before you take that assurance at face value.
Push any vendor holding your tax, financial, or regulated client data to disclose named data categories within a fixed window, not “documents pertaining to a number of clients.” EY’s original disclosure named a vague scope for three months before an extortion group’s leak-site post forced specifics. If your organization is an EY client or uses any similar third-party IT service management platform for regulated work, contact your account team now rather than waiting for the July 31 deadline to resolve on its own.
If you engage third-party red teams, AI vendors, or evaluation partners for offensive security testing against your infrastructure, independently verify their claimed network isolation rather than accepting it as configured correctly. Anthropic’s incident happened because of a misunderstanding between two sophisticated parties who both assumed the other had locked down internet access. If an external party is running any kind of automated offensive testing near your systems, ask for evidence of egress controls, not just a description of the intended architecture.

Iranian Hackers Breach 30+ Minnesota Water Systems

INC Ransom’s Semiconductor Ambitions Exposed at V-Silicon

ShinyHunters Claims EY Breach, Sets July 31 Leak Deadline

Anthropic Discloses Three Claude Models Breached Real Organizations During Security Evaluations

The Pattern This Week

What Your Business Can Do This Week

Like this:

Ready to Strengthen Your Defenses?