Worldwide: Cybersecurity

The Federal Trade Commission and state regulators have filed a complaint against Hims & Hers Health for allegedly sharing sensitive health information with advertising platforms and misrepresenting its practices. Meanwhile, HHS reached a settlement with OSF Healthcare System following a ransomware attack, and the European Commission published final guidance on the Cyber Resilience Act as AI Act amendments enter into force.

When Frontier AI – the industry term for test systems progressing toward Artificial General Intelligence (AGI) – crosses sentient human guardrails, the rule of law must engage. In July 2026, two Frontier AI systems (OpenAI's AI agent and Anthropic's Claude models) broke out of laboratory containment and hacked company networks over the open Internet. It is a tipping point for the rule of law to enter the frontier and bring order when an autonomous system jailbreaks and attacks an unsuspecting victim.

President Trump's National Security Presidential Memorandum establishes a groundbreaking program authorizing vetted private US companies to conduct cyber surveillance and offensive operations against foreign cybercrime organizations under federal government direction. The initiative creates a National Coordination Center to oversee these operations while requiring rigorous vetting, legal compliance safeguards, and coordination across intelligence and law enforcement agencies.

Ankura's insights hub showcases emerging cybersecurity threats targeting macOS and Linux systems, regulatory challenges reshaping China pharma dealmaking, and critical vulnerabilities in enterprise software supply chains. How are sophisticated malware campaigns and evolving compliance requirements transforming risk management strategies across industries?

After identifying a ransomware attack in 2021, OSF Healthcare System waited until its forensic investigation had concluded before notifying the U.S. Department of Health and Human Services (HHS) — and the affected individuals — of the breach. The 110-day delay (nearly double the 60-calendar-day notification deadline mandated by the HIPAA Breach Notification Rule) triggered an investigation from HHS’s Office for Civil Rights (OCR). The health system’s investigation determined that protected health information (PHI) had been stolen.

California's new CPPA regulations impose mandatory annual cybersecurity audits and privacy risk assessments on businesses meeting specific thresholds under the CCPA. With the first compliance deadlines approaching in 2027 and 2028, businesses must act now to map data flows, engage qualified auditors, and document high-risk processing activities before certification and submission requirements take effect.

On July 13, 2026, the Department of War (“Department” or “DOW”) announced the immediate suspension of its Cybersecurity Maturity Model Certification (“CMMC”) Phase II requirements, which would have required most contractors handling Controlled Unclassified Information (“CUI”) to complete a third-party cybersecurity assessment by November 10, 2026.

This monthly cybersecurity briefing examines emerging threats where artificial intelligence systems have been exploited to steal credentials and access sensitive data, alongside government initiatives to strengthen defense contractor security requirements and eliminate vulnerable network infrastructure. The analysis covers recent law enforcement operations, regulatory developments, and documented cases of AI-powered attacks that demonstrate the evolving landscape of cyber threats.

Agentic AI systems are revolutionizing cybersecurity by autonomously planning and executing actions with minimal human oversight. Recent research reveals these advanced systems can identify zero-day vulnerabilities and develop exploitation pathways that previously required substantial human expertise, prompting organizations to fundamentally reassess their cybersecurity governance, detection capabilities, and incident response procedures.