This week's breaches became takeovers - too many accounts could reach too much

The account that could read everything

On Tuesday, security researchers detailed a data-theft campaign that ran for more than a year, which they call “City-Forum” [1]. An unknown attacker built custom tools to probe Salesforce and ServiceNow - two systems companies use to hold customer records and support tickets. It hunted for sites with “overly permissive guest access” [1].

Guest access is what an anonymous visitor is allowed to see. On many of these sites it was set too wide. So the attacker pulled real records without stealing a single password [1]. Active since at least March 2025, the campaign hit telecom, finance, enterprise-software, security, and public-sector organizations worldwide [1].

The tooling isn’t the point. A setting meant for the public could reach data meant for staff. Nobody picked a lock. The lock was set to “open for guests.”

Attackers hunt for the widest door, not the strongest one

A separate piece of research this week, from Zscaler’s ThreatLabz team, maps who ransomware crews - gangs that lock a victim’s files and demand payment - now go after [2]. Across one month-long campaign they tracked 351 victims at 334 organizations [2]. Nearly two-thirds held a manager title or higher, and the average target was 46 years old [2][3].

Rather than emailing the CEO, the attackers research a company’s reporting lines and pick the employees whose accounts touch the most [2]. Zscaler calls the prize “business privilege” rather than technical privilege [2]. Security teams guard the admin accounts, the ones with the keys to the servers [3]. But a manager who approves payments, reviews contracts, and can open HR and customer records holds a different master key [2]. “The value of a compromised managerial account lies in the breadth of business access,” the researchers wrote [2].

Same pattern, bigger blast radius

Microsoft warned this weekend that a China-linked crew it tracks as Storm-1175 began deploying new ransomware, StormEncryptor, on August 2 [4]. The suspected way in is a flaw in N-central, a console that IT service firms use to run thousands of client machines at once [4]. Microsoft says the flaw hands attackers “god-mode” access - one console, every downstream network [4]. It has watched the group go from first entry to full encryption in under 24 hours [4].

The same word - privileged - sits at the center of this week’s biggest ransomware alert. On Monday the FBI, CISA (the US cyber-defence agency), and South Korea’s police warned about Gunra, a gang built from leaked Conti ransomware code [5][6]. Gunra exploits known flaws in Fortinet firewalls to “gain privileged access,” then steals and encrypts data, demanding over $10 million with five to seven days to pay [5][7]. It has hit healthcare, finance, and government sectors worldwide [5]. Ransomware is not slowing: one tracker this week found attacks climbing while attention drifts to AI [8].

Why narrow access is the whole defence

These stories look separate. They share a spine: a break-in’s damage is bounded by what the broken-into thing can reach. A guest role that could read staff records. A manager account that spanned the whole business. A console with god-mode over every client. When any one is compromised, its reach is the ceiling on the harm.

The defensive answer has a plain name: least privilege. Give every account, role, service, and tool only the access its job actually needs, and nothing more. The guest role reads what guests should read. The manager approves what that manager approves, not everything. The console reaches only the clients it must. Least privilege doesn’t stop the break-in - it traps the intruder in one room instead of handing over the building.

Two more this week show the cost of getting it wrong. A supply-chain attack means compromising one thing many others rely on. One this week poisoned a data feed used by WordPress plugin maker BdThemes to quietly create rogue admin accounts on affected sites [9]. And Britain’s data regulator reprimanded the ACRO criminal records office after three break-ins went undetected for nearly two years, exposing thousands of people including domestic-violence victims [13].

The patch pile, and the week’s other breaches

Microsoft’s August update was one of its largest ever: 421 flaws fixed, including one Windows flaw already being exploited before the patch existed [10][11]. CISA added three more actively-exploited flaws to its must-patch list for federal agencies [12]. Cisco patched a dozen flaws in its networking software, three near the top of the severity scale [14]. Adobe urged immediate patching of critical ColdFusion flaws [15].

Elsewhere, a cyberattack on freight giant Ceva Logistics disrupted European retailers and may have exposed data belonging to customers of the Steam gaming platform [16].