Cybersecurity Newsletter September 2026

In this edition, we highlight: (i) increased investment in cybersecurity; (ii) whether through funding or information; (iii) the use of AI to help fortify cyber defenses; (iv) the need to make certain updates based on AI; and (v) the recent arrests of cybercriminals from various cyber groups.

CONSIDER THIS

• It’s Not Enough. On August 4, 2026, Sen. Mark Warner and Del. Eleanor Holmes Norton introduced the RECOVER PII Act, which aims to provide lifetime identity-protection services to the over 4 million federal employees whose sensitive records, including Social Security number and clearance files, were exposed during the 2015 Office of Personnel Management breach. The current 10-year identity theft protection services term expires in September.  

• National Cyber Director Walking Tight Rope with No Net. On August 4, 2026, during the Black Hat conference, National Cyber Director Sean Cairncross said the Trump administration’s AI executive order aims to secure AI and support defenders without creating new regulatory rules, arguing for a flexible, adaptive information‑sharing structure that can respond rapidly to breaches.

• Staying “Safe” from Agentic AI incidents. On August 5, 2026, the Linux Foundation sought comment on Shared AI Findings Exchange’s (SAFE) guidelines, which are aimed at sharing information surrounding AI security incidents and using that information to bolster threat intelligence.

• Cotton Picks Tax Incentive to Protect Infrastructure. On August 5, 2026, Senator Tom Cotton implored the Treasury to use the tax code to incentive investment in outdated operational technology used for US critical infrastructure.

• Water Facilities Awash in Cyberattacks Ignoring Certain Warnings. On August 6, 2026, a new scan of internet-connected industrial equipment found over 4,000 controllers exposed online, leaving critical water and wastewater operations vulnerable to known flaws. 

• Changing the Rules of the Game. On August 5, 2026, the Nevada Gaming Commission Operators announced new cybersecurity guidelines, including the requirement for operators to have a cybersecurity incident response plan and for casinos to give the Board a written notification of an attack within 24 hours, not 72 hours as previously required.

• AI Update to Make NIST Database A-OK. On August 11, 2026, NIST issued a request for information to help it revamp its vulnerability database in light of the AI age.

• Nonprofits to Profit from AI-Aided Cybersecurity Defense. On August 11, 2026, a North Carolina based IT services and consulting firm announced, with the help of CyberAlliance, AI-powered cyber risk intelligence, it will help under-resourced government agencies remediate cybersecurity risks.

• South Dakota Mounts Investment in Cybersecurity. On August 19, 2026, South Dakota announced a $7 million investment in cybersecurity designed to bolster defenses, improve incident response, and better protect government systems from future attacks.

• CISA Wants You to Drop Unnecessary Internet Connections. On August 21, 2026, CISA provided guidance on how organizations can reduce unnecessary connections to the Internet to help minimize vulnerabilities available for threat actors to exploit.

AS THE WORLD TURNS

• Snowflake Hacker Faces Avalanche of Prison Time. On August 5, 2026, Connor Moucka, a Canadian national, pleaded guilty to his role attacking more than 165 customer environments and personally earning $495,000 in the process. He faces up to 32 years in prison.

• Prison Sentence Halts Ransomware Developer’s Development. On August 6, 2026, Maksim Silnikau, a 20-year cybercriminal veteran, most recently known for creating and running the Ransom Cartel, was sentenced to 16 years in prison.

• Gunnin’ for Gunra. On August 10, 2026, the FBI and CISA led a joint advisory about the Gunra, a ransomware-as-a-service group. Gunra recruits penetration testers and leverages tools linked to North Korean hackers to target government and critical infrastructure globally. Gunra favors initial access via internet-facing vulnerabilities like firewalls and VPNs.

• Freeze! Medusa with Fresh Antics. On August 18, 2026, the FBI, CISA and HHS issued a new update about the Medusa ransomware group, including their penchant to target victims with unpatched software and reliance on access brokers. 

• They Come from a Land Downunder. On August 27, 2026, police arrested two men from Western Australia for their alleged roles in TeamPCP, a cybercrime group that inserted malicious code into open-source software, impacting 1,000 organizations worldwide.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.