Top 10 Cybersecurity News (Mar. 30 2026): Spanish Port Of Vigo Hit By Ransomware Attack, Anthropic AI Leak Raises Cybersecurity Concerns, Microsoft Warns Of OAuth App Abuse In Enterprise Attacks, and More

WEEKLY TOP TEN: March 30, 2026, 16:00 GMT

1. EU Commission Cloud Platform Breach Exposes Data
   
   The European Commission confirmed a cyberattack targeting its Europa web platform infrastructure on March 24, 2026. Attackers exploited weaknesses in externally facing cloud services, resulting in limited data extraction from public-facing systems. Internal networks remained unaffected, suggesting segmentation controls were effective. However, the breach highlights ongoing risks in government cloud deployments, especially where public services intersect with sensitive data environments. Investigations are ongoing to determine the scope of exfiltration and attribution. The incident reinforces the need for continuous monitoring, hardened configurations, and rapid response mechanisms across hybrid cloud ecosystems used by public institutions.
2. Citrix NetScaler Critical Flaw Under Active Exploitation
   
   Citrix NetScaler ADC and Gateway devices are facing active reconnaissance and exploitation attempts tied to CVE-2026-3055, a critical memory overread vulnerability. The flaw allows attackers to extract sensitive memory contents, particularly in SAML Identity Provider configurations. Security researchers observed attackers probing authentication endpoints to identify vulnerable systems before exploitation. Organizations using affected NetScaler versions risk data leakage and session exposure if unpatched. Citrix has issued updates, but exploitation attempts are already occurring in the wild. This vulnerability continues the trend of high-impact edge device flaws becoming immediate targets for threat actors.
3. Meena Health Data Leak Published By KillSec Ransomware
   
   Meena Health, a healthcare provider in Saudi Arabia, suffered a ransomware attack attributed to the KillSec group, which subsequently published stolen patient data on the dark web. The breach exposed highly sensitive medical records, posing significant privacy and regulatory risks. Healthcare systems remain prime targets due to valuable personal data and often outdated infrastructure. The publication of stolen data indicates double-extortion tactics, where attackers leverage both encryption and data leakage. This incident emphasizes the need for stronger healthcare cybersecurity frameworks, including encryption, access controls, and continuous threat monitoring.
4. HackerOne Employees Impacted By Navia Supply Chain Breach
   
   HackerOne disclosed that employee data was compromised due to a breach involving third-party provider Navia. The incident stemmed from a Broken Object Level Authorization vulnerability that exposed sensitive personal data, including Social Security numbers and benefits information. Although the breach occurred earlier, notification delays extended risk exposure. The case highlights supply chain vulnerabilities where trusted vendors become attack vectors into otherwise secure organizations. HackerOne emphasized concerns about delayed disclosure and lack of transparency. This breach reinforces the importance of third-party risk management, continuous vendor assessment, and strict API security controls.
5. Foster City Ransomware Attack Disrupts Government Services
   
   Foster City in California experienced a ransomware attack that disabled email and phone systems for over a week, significantly disrupting municipal operations. The attack forced officials to shut down networks to prevent further spread, limiting public services and communication. Emergency services remained operational, but administrative functions were heavily impacted. The incident demonstrates ongoing threats to local governments, which often lack advanced cybersecurity defenses. Recovery efforts are ongoing, with systems gradually restored. The attack underscores the importance of incident response readiness, backup strategies, and cybersecurity investment in public sector organizations.
6. Chinese-Linked Espionage Campaign Targets Telecom Networks
   
   A Chinese-affiliated threat group has been linked to stealthy intrusions into telecommunications networks across Asia and the Middle East. Using advanced malware such as BPFDoor, attackers maintain persistent, low-detection access to critical infrastructure. The campaign focuses on monitoring government communications and sensitive data flows. Kernel-level implants allow long-term espionage without triggering conventional security alerts. This activity highlights the growing sophistication of state-sponsored cyber operations targeting telecom providers. Organizations in critical infrastructure sectors should prioritize advanced threat detection, behavioral monitoring, and zero-trust architectures to mitigate similar risks.
7. Spanish Port Of Vigo Hit By Ransomware Attack
   
   Spain’s Port of Vigo suffered a ransomware attack disrupting logistics and administrative systems. The attack forced parts of the port’s digital infrastructure offline, requiring manual processes to maintain operations. Indicators suggest a financially motivated ransomware group targeting critical infrastructure. While core port functions continued, delays and operational inefficiencies impacted supply chain activities. The incident demonstrates the vulnerability of maritime infrastructure to cyberattacks and the cascading effects on global logistics. It reinforces the importance of segmentation, OT security controls, and resilient backup strategies for critical transportation hubs.
8. BPFDoor Malware Campaign Targets Telecom Providers
   
   A sophisticated cyber-espionage campaign leveraging BPFDoor malware targeted telecommunications providers across Asia and the Middle East. The malware enables persistent, stealthy access by bypassing traditional detection mechanisms through kernel-level techniques. The campaign focuses on monitoring communications and maintaining long-term access to sensitive network traffic. Telecom providers are attractive targets due to the volume of data they handle. The activity demonstrates the evolving capabilities of advanced threat actors and the need for behavioral monitoring, endpoint detection, and zero-trust architectures in critical infrastructure sectors.
9. CISA Warns Of Actively Exploited Zimbra And Cisco Flaws
   
   CISA added vulnerabilities affecting Zimbra Collaboration Suite and Cisco network management systems to its Known Exploited Vulnerabilities catalog. These flaws are actively exploited in real-world attacks, enabling unauthorized access and potential data compromise. Organizations using affected systems are urged to apply patches immediately. Internet-facing services are particularly at risk, with attackers targeting unpatched systems for initial access. The advisory reinforces the need for vulnerability prioritization and alignment with threat intelligence to reduce exposure.
10. Anthropic AI Leak Raises Cybersecurity Concerns
    
    A leaked internal report involving Anthropic revealed concerns about the potential misuse of advanced AI models in cyberattacks. The model demonstrated capabilities that could assist in bypassing traditional security defenses. While no confirmed exploitation has been reported, the incident triggered industry-wide concern about AI-enabled threats. Organizations are increasingly aware that adversaries may leverage AI for vulnerability discovery, phishing automation, and exploit development. This case highlights the need for governance frameworks and security controls around AI deployment in enterprise environments.