Top 10 Cybersecurity News (Jan. 12, 2026): Global Logistics Giant Targeted by Ransomware, Coldfusion Exploitation Wave, Fortinet Firewalls Claude Chrome Extension Data Exposure Risk, and More

WEEKLY TOP TEN: January 12, 2025, 16:00 GMT

1. Global Logistics Giant Targeted by Ransomware
   
   Kuehne+Nagel faced a significant operational disruption after a sophisticated ransomware attack encrypted several of its regional servers. The incident affected the company’s real-time shipment tracking systems, forcing many operations to revert to manual processing. Security teams identified the breach early, preventing the malware from laterally moving to the core financial databases. However, the threat actors claimed to have exfiltrated sensitive data related to client shipping manifests. The company is currently working with international law enforcement to determine the full extent of the data theft and restore full digital functionality.
2. Covenant Health Patient Data Breach
   
   Covenant Health disclosed that a ransomware intrusion exposed sensitive patient data for roughly 478,000 individuals. The incident traces back to a May 2025 compromise, with investigation and revised impact counts finalized much later. Exposed data may include identifiers (name, DOB, SSN), insurance details, and treatment-related information—enough for identity fraud and targeted healthcare scams. The associated ransomware group publicly claimed responsibility for the theft and indicated that the data was leaked after the victim allegedly did not pay. For healthcare orgs, this is a reminder that breach “scope” can expand for months as forensics finishes and regulators get updated numbers.
3. Coldfusion Exploitation Wave
   
   Adobe ColdFusion servers were hit by a coordinated exploitation campaign that cycled through multiple known vulnerabilities at high speed—classic initial-access behavior. The observed traffic patterns suggest automated scanning and exploitation attempts aimed at establishing footholds during reduced holiday staffing. Even if a single CVE is patched, broad “spray-and-pray” tooling often tries several paths until something sticks. For businesses running ColdFusion (especially legacy deployments), this is a practical incident: exposed internet-facing boxes serve as beachheads for credential theft, webshells, and eventual ransomware. Treat it as “compromise likely” if you saw the indicators, not merely “attempted exploitation.”
4. Sedgwick Contractor Subsidiary Breach
   
   Sedgwick confirmed a breach at its government contractor subsidiary, Sedgwick Government Solutions, involving file-transfer activity tied to potentially sensitive data. Incidents like this often become multi-client exposure events because contractor environments aggregate regulated information across agencies and programs. The immediate risk is downstream: impacted government entities and individuals face identity theft, fraud attempts, and secondary phishing attacks that leverage authentic context. For security leaders, the takeaway is vendor reality: your risk is only as high as your contractor’s controls, monitoring, and notification discipline—especially around file transfer tools, privileged access, and segmentation between customer datasets.
5. Rondodox Botnet Exploiting React2shell
   
   RondoDox operators exploited the React2Shell flaw in Next.js to compromise large numbers of unpatched devices and servers, building a botnet from routers, smart cameras, and small-business web infrastructure. The affected “companies” here are any orgs that run vulnerable Next.js services or expose edge devices—especially those with internet-facing admin panels and weak patch hygiene. Botnet infections aren’t just DDoS fodder; they enable credential harvesting, cryptomining, and pivoting into corporate networks when infected devices sit on the same LAN. If your footprint includes Next.js and consumer-grade edge gear, assume you’re in the target set and validate patch levels plus outbound beaconing.
6. Claude Chrome Extension Data Exposure Risk
   
   Researchers warned that Anthropic’s Claude-in-Chrome agentic extension could expose sensitive data and tokens by operating with a user’s authenticated browser context. The affected org is Anthropic (product risk), and the affected businesses are the ones deploying the extension into environments where browser sessions have access to Google Drive, Slack, Jira, and admin consoles. The core security shift is that “the browser is the identity,” and an agent that can act on your behalf expands the blast radius of prompt injection, malicious web content, and approval fatigue. Treat deployment like privileged software: limit permissions, segment accounts, and test adversarial web content paths.
7. Resecurity Honeypot “Breach” Claims
   
   A threat actor claimed access to Resecurity’s systems, but the company stated it was a honeypot environment designed to monitor adversary behavior. Regardless of the truth, the incident matters because these public claims trigger reputational damage, customer concern, and opportunistic phishing (“your vendor was breached—reset your creds here”). For businesses, the key is verification discipline: don’t treat leak-site noise as ground truth, but don’t ignore it either. Confirm with the vendor, validate any exposed credentials, and watch for spoofed domains. For vendors, honeypots are useful—but the comms plan must be ready when attackers try to weaponize the narrative.
8. NordVPN Breach Claim (Denied)
   
   NordVPN publicly denied a breach after a threat actor leaked data and claimed compromise. Even when a vendor disputes the claim, the business impact can still be real: customers will face phishing, credential-stuffing attempts, and impersonation scams that leverage the news cycle. The key for security teams is to separate “data leaked” from “systems breached”—and to act on what users will experience either way. Monitor for credential reuse, enforce MFA, and warn staff against fake “account verification” emails. Treat any leaked customer-associated artifacts (emails, tokens, configs) as accelerants for follow-on attacks, regardless of the attacker’s original access path.
9. WhatsApp Metadata Fingerprinting Leak
   
   WhatsApp addressed weaknesses that allowed attackers to infer device/OS details (“fingerprinting”) using only a target’s phone number, leaking metadata useful for spyware operators. While the direct impact may be limited without a separate exploit chain, this kind of reconnaissance is exactly how higher-end campaigns pick the correct payload and reduce failure rates. The affected party here is Meta/WhatsApp and, by extension, WhatsApp users—especially high-risk roles (execs, journalists, diplomats) who are routinely profiled before targeted delivery. Security teams should treat this as a reminder: “low-severity” leaks can become high-value when paired with zero-days and social engineering.
10. Utility Customer Data Sold After Contractor Compromise
    
    Multiple utilities were impacted after a breach at an engineering/contract services firm reportedly led to stolen customer data being sold. The affected companies named include Tampa Electric, Duke Energy, and American Electric Power, with data tied to utility customers becoming a commodity. This is the vendor-risk nightmare: your customer data can leak through a smaller third party with weaker security maturity. Business impact includes fraud attempts, identity theft, and reputational damage—plus regulatory headaches if protected data categories were involved. For CISOs, the take-home is ruthless: inventory vendors with customer data, require minimum controls, and monitor for “silent” exfiltration pathways.