The week in breach news Apr 8, 2026

Reports indicate that the February 17 cyber incident involving the Federal Bureau of Investigation (FBI) — linked to a suspected China-backed intrusion — has now been classified as a “major incident” posing risks to U.S. national security.

On February 17, the agency identified abnormal log activity on an internal system containing data related to domestic surveillance orders, including pen register and trap-and-trace information. These tools collect metadata about communication patterns and unauthorized access could allow attackers to identify who is under FBI surveillance.

The FBI and the Cybersecurity and Infrastructure Security Agency (CISA) have not issued a public statement. Under federal data security laws, a breach is designated a “major incident” when it involves the compromise of sensitive information that could harm national security, foreign relations, the economy, civil liberties or public health.

American toy and entertainment giant Hasbro has been forced to take some systems offline following a cyberattack and warned it may take several weeks to fully resolve the incident.

Hasbro, which owns major brands such as Transformers, Peppa Pig, Nerf and Dungeons & Dragons, detected the intrusion on March 28 and took affected systems offline as a precaution. In a filing with the U.S. Securities and Exchange Commission on April 1, the company said it has activated business continuity plans to continue taking orders, shipping products and maintaining key operations during the disruption.

The company has not publicly disclosed the nature of the attack or confirmed whether it has received any communication from the threat actors, including potential ransom demands.

Cisco reportedly suffered a cyberattack after threat actors used stolen credentials from a recent Trivy supply chain attack to breach its internal development environment and steal source code.

The incident stems from a supply chain attack targeting Trivy, an open-source vulnerability scanner, where attackers compromised its GitHub pipeline to distribute credential-stealing malware through official releases and GitHub Actions. Reports indicate that attackers leveraged the malicious GitHub Action to access Cisco's build and development environment, affecting multiple systems, including developer and lab workstations.

As part of the breach, several AWS keys were reportedly stolen and used to carry out unauthorized activities across a limited number of Cisco AWS accounts. Cisco has since isolated affected systems, initiated reimaging processes and begun rotating credentials across impacted environments.

F5 released security updates to address a critical vulnerability in BIG-IP Access Policy Manager (APM) that is reportedly being actively exploited in the wild.

More than 14,000 F5 BIG-IP APM instances remain exposed online, with attackers exploiting the remote code execution flaw tracked as CVE-2025-53521, which carries a CVSS score of 9.8. The vulnerability allows specially crafted traffic to trigger remote code execution when an access policy is enabled on a virtual server. Initially classified as a denial-of-service issue, it was reclassified as a critical RCE flaw following new findings in March 2026.

Users and administrators of affected systems have been advised to update to the latest versions immediately to mitigate the risk of exploitation.

The ransomware group Everest revealed new details about its breach of the automobile giant Nissan, including alleged negotiation logs, escalating pressure on the company to pay a ransom.

In January 2026, the group threatened to leak 900 GB of Nissan's internal data unless a ransom was paid, giving the company five days to respond. With no payment made, the attackers have now released additional details about the breach, including information related to their negotiations with the company.

The group claims to possess daily full database dumps spanning six years, including customer data from Nissan Financial Services, repair records, dealer employee information, wholesale invoices and internal business reports.