The week in breach news Jul 22, 2026

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned organizations about several Microsoft SharePoint vulnerabilities that are actively being exploited or pose significant security risks. The advisory highlights the need for organizations using on-premises SharePoint Server to promptly assess their exposure and apply available security updates.

CISA stated that it is aware of active exploitation of the following vulnerabilities, which enable threat actors to gain unauthorized access to on-premises SharePoint Server instances.

• CVE-2026-32201: An improper input validation vulnerability that allows an attacker to perform spoofing over a network.
• CVE-2026-45659: A remote code execution vulnerability involving the deserialization of untrusted data that allows an authorized attacker to execute code over a network.
• CVE-2026-56164: A missing authentication for a critical function vulnerability in Microsoft Office SharePoint that allows an attacker to elevate privileges over a network.
• CVE-2026-58644: A remote code execution vulnerability that allows an unauthorized attacker to execute code over a network.
• CISA has also identified CVE-2026-55040, a newly disclosed vulnerability that is not yet known to have been exploited but poses a potential risk if left unpatched. The weakness involves improper authentication in Microsoft Office SharePoint, allowing an unauthorized attacker to bypass a network security feature.

The latest advisory reflects a steady stream of new SharePoint vulnerabilities, including both pre-disclosure zero-day exploitation and longer-tail n-day exploitation.

On July 16, Coca-Cola disclosed a ransomware attack on its dairy subsidiary, fairlife, that disrupted operations and temporarily halted production of fairlife products across the U.S.

In a filing with the U.S. Securities and Exchange Commission (SEC), Coca-Cola said fairlife detected unauthorized access to some of its systems, including production-related systems, in connection with the ransomware attack. The company confirmed that production at fairlife’s U.S. facilities has been temporarily suspended while it responds to the incident and restores impacted systems. However, Coca-Cola said the ransomware attack has not affected product quality or safety.

Meanwhile, the Anubis ransomware gang has listed fairlife on its dark web leak site and is threatening to publish data, adding pressure on the company as it continues its response and recovery efforts.

On July 20, U.K.-based health care technology firm Craneware disclosed that it is responding to a cyberattack that may have exposed a significant volume of customer data.

Craneware develops health care billing and revenue cycle management software used by thousands of clinics, hospitals and pharmacies across the U.S. The company’s software helps health care providers bill patients for services and processes large volumes of medical records and patient data on behalf of its customers. In a statement filed with the London Stock Exchange, Craneware said the attackers appear to have been removed from its systems, but its investigation into the incident remains ongoing.

The incident has raised concerns across the U.S. health care sector because of the potential scale of patient data that could be affected. To put that into perspective, when Craneware acquired Florida-based pharmacy software provider Sentry in 2021, the company said it gained access to Sentry’s 147 million patient records collected over two decades.

Colombian energy giant Ecopetrol disclosed that thousands of user accounts were affected by a ransomware attack.

The Latin American energy producer said a ransomware attack resulted in the theft of data from 3,300 user accounts. However, the attackers were unable to deploy ransomware or disrupt the company’s day-to-day operations due to its existing security controls. Ecopetrol also said the stolen files were pseudonymized, suggesting the information may have limited value to the attackers.

Meanwhile, reports indicate that an unidentified threat actor contacted Ecopetrol and demanded a ransom payment. However, no details have been disclosed about the amount demanded or whether any of the stolen data has been released publicly.

A cyberattack on Japan’s largest cold-chain operator, Nichirei, has had a ripple effect across the country’s food supply chain, disrupting the distribution of frozen and refrigerated products.

On July 13, Nichirei Logistics Group, which transports frozen and refrigerated food for about 5,000 customers across Japan, experienced a system outage. On July 16, the company confirmed that hackers had breached its servers. To contain the attack and protect customer data, Nichirei disconnected key systems, bringing parts of its logistics network to a standstill. The attack disrupted warehouse operations and frozen food shipments.

The disruption quickly spread across the restaurant industry, with more than 1,300 KFC restaurants and other major restaurant chains facing ingredient shortages and struggling to keep up with deliveries.