Cybersecurity Threat Report — October 2026

Bottom line

Threat level: Elevated. Ransomware hit a 2026 high in August, and attackers exploited edge devices that small offices run in September. Most of the fixes cost little.

If you do only three things

1. Patch the edge this week. Citrix NetScaler, Check Point gateways and Spark firewalls, SonicWall SMA 1000, Fortinet FortiOS and ConnectWise ScreenConnect all have exploited flaws.
2. Audit vendor access. List every app, plug-in and API key that can reach your data, and remove what you don't use.
3. Verify payments by phone. Confirm any bank-detail change on a number you already have on file.

Ransomware and extortion

964 victims were claimed on leak sites in August, up 19% on July and the highest month of 2026 (Breachsense, Sep 2026). Qilin led with 157 claims, followed by The Gentlemen with 127. More crews now steal data instead of encrypting it: Coveware found only 15% of victims paid when data was stolen but not encrypted (Q2 2026), and Coalition reports data-theft ransomware claims cost more than twice as much.

AI threats and wire fraud

KnowBe4 reports 86% of phishing is now AI-driven, with reverse-proxy Microsoft 365 login theft up 139% in six months. CrowdStrike says phone-based intrusions doubled. Business email compromise cost $3.04B in 2025 (FBI IC3), and 61% of these attacks now pose as a trusted vendor (Abnormal AI, 2026). IBM's 2026 study found shadow-AI incidents at 43% of breached firms, up from 20%.

Breaches to learn from

• Brevo: a leaked key let attackers plant fake "verify you're human" pop-ups on 100,000+ websites.
• BigCommerce: stolen app logins injected scripts into online stores.
• ShipMonk: a vendor said it had deleted customer data but hadn't; 67,000 more people were exposed.
• Fake IT help-desk calls tricked staff into giving up Microsoft 365 logins.

Patches that can't wait

What changed

Paid Windows 10 security updates for business PCs reach the end of year one on Oct 13. CMMC Phase 2 is paused. The CIRCIA incident-reporting rule is still pending. Delaware's privacy law now applies from 10,000 consumers. Cyber insurance rates fell for a 12th straight quarter (Marsh, Q2 2026).

Your 8-step action plan

1. Patch internet-facing gear this week.
2. Use phishing-resistant MFA everywhere.
3. Verify every payment change by phone.
4. Review third-party apps and API keys.
5. Approve one AI tool for staff.
6. Alert on large data transfers.
7. Keep offline, tested backups.
8. Settle the Windows 10 plan.