A phone call to a McKesson employee turned into claims of 284 million records and a $55.2 million extortion demand this week. Berlin’s city government sat on ten days of undetected exfiltration before Rhysida even had to ask for payment, walking out with 5.79 terabytes including plaintext credentials and classified committee files. A Chinese espionage crew spent months living inside Cisco routers, using the routers themselves as a bridge into networks nobody thought to watch. And Manchester Airports Group learned that 8.8 million people’s data can walk out the door through nothing more sophisticated than viewing a website’s page source.

This week: four incidents showing that the weak point is rarely the front door anymore. It is the SSO session an employee approved over the phone, the router nobody imagined could be the attacker’s own infrastructure, and the admin key somebody hardcoded into a public website.

---

McKesson / ShinyHunters Healthcare Extortion

What happened: ShinyHunters vished their way into McKesson, the largest US pharmaceutical and medical supply distributor, exfiltrating data between August 21 and 25 before the company disclosed the incident on August 31. The group claims 284 million records, pulled from McKesson’s Oncology & Multispecialty and Medical-Surgical business units, which together support roughly 3,300 oncology providers across 29 states.

Technical details that matter:

• Initial access: voice phishing (vishing) calls targeting McKesson employees, tricking them into approving or handing over Okta single sign on sessions
• Lateral movement: compromised Okta accounts used to reach downstream Salesforce and Snowflake environments, no need to touch the SaaS vendors’ own perimeter
• Exfiltration: roughly 1 TB removed, including PII and PHI, names, addresses, phone numbers, Social Security numbers, dates of birth, appointment details, and specific illness information including cancer locations
• Extortion: a $55.2 million demand tied to the stolen dataset
• Pattern: ShinyHunters ran the same vishing to Okta to Salesforce/Snowflake playbook against Medtronic in April and Exact Sciences in July, this is not experimentation, it is a repeatable production line

Why critical institutions should care: This is the third healthcare vendor ShinyHunters has taken down with an identical technique in five months, which means the group has industrialized social engineering against SSO, not software. No firewall or endpoint tool stops an employee who believes they are talking to internal IT. Any institution that federates identity into Salesforce, Snowflake, or similar SaaS platforms inherits this exposure the moment a single helpdesk-style call succeeds, and oncology and specialty pharmacy data carries reputational and regulatory weight well beyond a typical breach.

Key sources:

• McKesson confirms cyber incident after ShinyHunters claims patient-data theft (Malwarebytes)
• Healthcare cyberattacks hit pacemakers and millions of patient records (The Register)

---

Berlin City Administration / Rhysida Ransomware

What happened: Rhysida exfiltrated data from Berlin’s city administration network, including the Senate Department for Mobility, Transport, Climate Protection and the Environment, between August 7 and 12, 2026. Affected systems were disconnected on August 14, but Rhysida did not publicly claim responsibility until August 28, and the city confirmed the theft roughly a week later.

Technical details that matter:

• Data claimed: 5.79 TB across approximately 1.44 million files
• Contents: government, legal, financial, HR, and infrastructure related records, thousands of names, emails, and phone numbers, 148 IBANs, plaintext credentials, payment system data, personnel and payroll files, more than 3,200 nondisclosure agreements, and classified Bundesrat committee material
• Extortion leverage: Rhysida cited GDPR exposure as pressure and gave a four day deadline before threatening publication
• Initial access vector has not been disclosed, though prior Rhysida campaigns have relied on trojanized Microsoft Teams installers, so a similar social engineering entry point is plausible but unconfirmed
• Response: Mayor Kai Wegner refused payment, state criminal police, prosecutors, and federal security agencies opened investigations, and officials confirmed no election data was touched

Why critical institutions should care: A week and a half of undetected exfiltration inside a capital city’s administrative network, followed by two more weeks before public confirmation, shows how much runway ransomware crews get against municipal IT even after detection. Plaintext credentials and payment configuration data sitting in the stolen set means the blast radius extends well past the immediate leak, into every system that trusted those credentials.

Key sources:

• Berlin confirms data theft after Rhysida ransomware attack claims (BleepingComputer)
• Berlin refuses to be blackmailed after network breach (Help Net Security)
• Berlin Ransomware Leak Exposes State Secrets (Security Affairs)

---

Fire Ant Cisco IOS XR Router Campaign

What happened: Researchers at Sygnia published findings on August 31 describing Fire Ant, a China linked espionage operation that turned compromised Cisco IOS XR routers into covert monitoring platforms. The activity was found after analysts spotted an active GRE tunnel interface on a router that had no matching entry in its running configuration or commit history, meaning the tunnel was invisible to normal administrative review.

Technical details that matter:

• Persistence: a fake system service scheduled to run only during alternating hours, plus BridgeAgent, a backdoor disguised as a legitimate Zabbix monitoring agent running as a root level systemd service with TLS reverse shell capability
• Command and control: outbound Telnet connections to Fire Ant infrastructure supporting interactive shell access with no logging
• Defense evasion: selective suppression of syslog messages to hide tunnel activity from legitimate admins, combined with timestamp tampering to obstruct forensic timelines
• Collection: PCAP captures of internal traffic uploaded to external FTP servers, exposing internal topology, administrative connections, authentication flows, and routing relationships
• Strategy: a “target behind the target” approach, compromising trusted network infrastructure to use as a covert bridge into higher value connected networks rather than attacking those networks directly
• Attribution: Sygnia assesses strong overlap with UNC3886, a Chinese espionage group Google’s Mandiant unit has previously documented, though implementation differences leave room for a distinct but related group

Why critical institutions should care: This campaign treats the router itself as the target, not just a pathway, and it is built specifically to be invisible to the tools administrators already trust: no anomalous config diff, no obvious log entries, a monitoring agent disguise for the backdoor. Any organization relying on Cisco IOS XR at a network edge or core, especially in sectors that sit downstream of managed service providers or telecom infrastructure, needs to assume its perimeter visibility itself can be the thing that is compromised.

Key sources:

• Chinese Fire Ant hackers turn Cisco routers into spying platforms (BleepingComputer)
• China-Linked Fire Ant Hijacks Cisco Routers to Steal Credentials and Blind Security Logs (The Hacker News)
• China-Linked ‘Fire Ant’ APT Compromises Cisco IOS XR Routers to Target Trusted Infrastructure (Brinztech)

---

Manchester Airports Group / FulcrumSec Data Leak

What happened: Extortion group FulcrumSec claimed responsibility on August 30 for stealing data from Manchester Airports Group, which operates Manchester, London Stansted, and East Midlands airports. MAG refused to pay, and FulcrumSec published roughly 550 GB of the stolen data by September 3, exposing information on 8.8 million people.

Technical details that matter:

• Initial access: admin keys left in plaintext inside the frontend JavaScript of each of the three airports’ websites, on every root domain, no exploit or credential theft required, the keys were simply visible to anyone who viewed page source
• Data volume: roughly 86 GB compressed, expanding to about 640 GB extracted, drawn from car park, lounge, and Fast Track booking databases
• Exposed data: names, email addresses, phone numbers, postal codes and towns, residential IP addresses used to access accounts, browser agent details, 108,077 unique UK vehicle registration plates, 2.48 million parking, lounge, and fast track bookings, and 461,433 SMS messages tied to bookings
• MAG stated airport operations were unaffected, this was a customer data system compromise, not an operational technology or airside incident

Why critical institutions should care: This was not a sophisticated intrusion, it was a basic secrets management failure sitting in public facing code for an unknown period before anyone found it. Aviation operators increasingly separate operational technology from customer facing web infrastructure for safety reasons, but this incident shows the customer side alone can still expose millions of travelers’ movement patterns, vehicle plates, and contact details, data with real value for surveillance, stalking, and follow-on fraud.

Key sources:

• Manchester Airports Group Data on 8.8 Million People Leaked After Ransom Refusal (SecurityWeek)
• FulcrumSec claims Manchester Airports hack, theft of 86 GB of data (BleepingComputer)
• No Hacking Required: The Manchester Airports Group Data Breach (Scott Helme)

---

The Pattern This Week

None of these four incidents required a zero day. ShinyHunters used a phone call. Rhysida had ten days inside Berlin’s network before anyone acted, and then another two weeks before the public knew. Fire Ant hid inside Cisco’s own operating system using a monitoring agent disguise. FulcrumSec read Manchester’s website source code.

The defender’s problem is the same one every week: your trust boundaries are wherever your organization drew them on a diagram, not wherever an attacker can actually reach. An employee’s SSO session, a router’s own control plane, and a website’s JavaScript bundle are all inside somebody’s trust boundary and outside somebody’s monitoring scope. When the compromise happens in the gap between those two lines, your detection stack was never going to see it coming.

See you next week.

---

What Your Business Can Do This Week

1. If your organization federates single sign on into Salesforce, Snowflake, or any similar SaaS platform, assume your helpdesk process is the actual attack surface, not your firewall. ShinyHunters got into McKesson, Medtronic, and Exact Sciences with the same vishing call each time, an employee approving or handing over an SSO session because the caller sounded like internal IT. Run a live social engineering test against your own reset and MFA approval workflow, not just a tabletop exercise.
2. If you hold data that would be catastrophic on a ten day delay, government records, health data, or financial information, measure your actual mean time to detect exfiltration rather than assuming it. Rhysida had free rein inside Berlin’s city network for roughly ten days before anyone acted, and the public didn’t learn about it for another two weeks after that. Confirm your logging covers data leaving the network, not just systems being accessed, and that someone is actually watching those alerts on a weekend.
3. If your network relies on Cisco IOS XR routers, or any router you consider “just infrastructure” rather than a monitored asset, audit for GRE tunnels and interfaces that don’t match your running configuration or commit history. Fire Ant’s entire campaign depended on that gap between what the config shows and what the device is actually doing. Confirm your network team checks device state directly, not just the configuration file, and that syslog gaps trigger an alert rather than getting written off as noise.
4. If your public facing websites or APIs were built by a team that has since moved on, audit them for hardcoded secrets before someone else does. Manchester Airports Group had admin keys sitting in plain text in the frontend JavaScript of all three of its airport sites, visible to anyone who viewed page source. A basic secrets scan across your public domains costs a lot less than an 8.8 million record breach notification.