The week in breach news Feb 11, 2026

macOS users worldwide are being targeted by the highly active information-stealing malware (infostealer) known as Odyssey Stealer.

Recent telemetry data shows a sharp surge in Odyssey Stealer activity aimed at macOS systems. Earlier campaigns were largely limited to users in the United States, France and Spain, but newer samples are now spreading well beyond those regions, targeting users across North America, Latin America, Europe, Asia and Africa.

Threat actors typically deploy Odyssey Stealer through social engineering, most commonly by creating fake CAPTCHA verification pages that trick users into initiating the malware themselves.

La Sapienza University in Rome, Europe’s largest university by student enrollment, suffered a significant cyberattack that crippled its IT systems and caused widespread operational disruption.

The university disclosed the incident in a social media post last week, stating that its IT infrastructure had been targeted in a cyberattack. As a precaution and to protect data integrity and security, La Sapienza immediately shut down its network systems.

In response, the university formed a technical task force to begin remediation and restoration efforts. Its main website is back online, with recovery work continuing.

An espionage campaign targeted government agencies and critical infrastructure organizations across 37 countries, including Brazil’s Ministry of Mines and Energy.

According to a recent report, the state-backed campaign has been active for over a year and appears focused on collecting intelligence on rare-earth minerals, trade deals and economic partnerships. Victims include Brazil’s energy ministry, a key government agency in a country believed to hold the world’s second-largest supply of rare earth minerals.

The report notes that the group’s methods, choice of targets and scale of operations are alarming. Researchers warn that the campaign could carry long-term implications for national security and the stability of essential services.

In a troubling sequence of events, cybercriminals hacked Onze-Lieve-Vrouw Instituut Pulhof, a secondary school in Berchem, Belgium, and escalated extortion by demanding ransom payments from both the school and parents.

According to reports, attackers compromised the school shortly after the Christmas holidays. They initially demanded a €100,000 ransom, later reducing it to €15,000. When the school did not respond, parents began receiving emails demanding €50 per child, with threats to publicly leak and sell student data on the dark web if payment was not made.

The attackers reportedly exfiltrated 45 GB of data belonging to students and staff, including ID cards, mental health records, diplomas and the school’s financial data.

Jefferson-Blount-St. Clair (JBS) Mental Health Authority in Alabama notified more than 30,000 individuals that some of their personal and protected health information was exposed in a ransomware attack.

Threat actors gained access to the organization’s network on November 25, 2026, and may have viewed or acquired information related to patients and employees dating back to 2011 through 2025. A recently concluded investigation confirmed that the exposed data included names, Social Security numbers, health insurance details, dates of birth and medical information, such as diagnoses, physician details, medical record numbers, Medicare or Medicaid information, prescription data, treatment details and billing or claims information.

Affected individuals have been advised to remain vigilant for signs of identity theft and fraud by closely monitoring their financial accounts and explanation of benefits statements.