North America
Microsoft Teams users
Microsoft’s Detection and Response Team revealed a Microsoft Teams voice phishing (vishing) campaign that targets Microsoft users.
In this campaign, threat actors impersonate IT support and trick users into granting remote access via Microsoft’s Quick Assist, enabling initial device compromise. Once access is established, attackers shift from social engineering to hands-on keyboard compromise. They then direct users to malicious websites that prompt them to enter corporate credentials into spoofed forms, triggering the download of multiple malicious payloads.
This incident highlights a growing class of attacks that exploit user trust, collaboration platforms and legitimate built-in tools to gain access and move laterally within environments.
SourceHow it could affect your business
Attackers are increasingly exploiting trusted tools and collaboration platforms to gain unauthorized access. In these incidents, threat actors create a sense of urgency and trust that can override user caution. Organizations should restrict inbound communication from unmanaged Teams accounts, adopt an allowlist approach for trusted external domains and review the use of remote access tools to reduce the risk of such incidents. Raising user awareness is also critical so employees can recognize suspicious requests before they cause damage.
United States
Foster City
Foster City, California, declared a state of emergency after a ransomware incident disrupted city services for more than a week.
On March 20, city officials confirmed that most computer systems were taken offline after detecting suspicious activity on the network the previous day. The disruption significantly impacted city operations, with most public services, except emergency response, temporarily shut down. Officials also noted concerns that public information may have been accessed, though this has not been confirmed.
City officials said they activated response protocols and are working with independent cybersecurity experts to investigate and restore systems. While details remain limited, residents and those who do business with the city have been advised to change their passwords as a precaution.
SourceHow it could affect your business
Attacks on public services continue to grow, disrupting essential operations and impacting citizens who rely on them daily. Government and public sector organizations should strengthen defenses with proactive threat monitoring, well-tested backup and disaster recovery strategies and clear response plans to maintain continuity during incidents like this.
North America
Cisco firewall vulnerability
A vulnerability patched earlier this month by Cisco in its firewalls has been exploited as a zero-day since at least late January, according to Amazon’s threat intelligence team.
The flaw, tracked as CVE-2026-20131, is a remotely exploitable deserialization vulnerability in Cisco Secure Firewall Management Center (FMC) software and carries a maximum CVSS score of 10. While Cisco released a patch on March 4, a report indicates that the Interlock cybercrime group had been exploiting it as a zero-day since at least January 26, pointing to a critical patching gap.
Cisco updated its advisory on March 18 to inform customers about this in-the-wild exploitation.
SourceHow it could affect your business
While this incident highlights the delay at the provider level, it also reinforces the need for organizations to have automated patch management in place. Timely and automated updates help ensure vulnerabilities are addressed quickly while freeing IT teams to focus on more strategic security initiatives.
United States
Trinity Health
Trinity Health, a not-for-profit Michigan-based Catholic health system operating more than 92 hospitals across 22 U.S. states, has disclosed a data breach involving protected health information (PHI).
Trinity Health participates in automated electronic data exchanges with Health Information Exchanges (HIE) to enable seamless access to patient data across providers. On January 13, the organization was notified by its HIE partner, Health Gorilla, of potential unauthorized access to patient information. The exposed data may include clinical care details, demographic information, insurance records and, in some cases, driver’s license numbers.
SourceHow it could affect your business
Third-party breaches are becoming increasingly common in regulated sectors like health care, where interconnected systems and data exchanges expand the attack surface. To reduce risk, healthcare providers should enforce strict third-party security assessments, limit data sharing to only what is necessary and continuously monitor integrations to detect unauthorized access early.
