Cyber Watch
The story behind the alert—and what to do next.
Cyber Watch follows hacking, confirmed breaches, ransomware, security threats and scams, and AI security. Stories are organized by topic and preserved in a browsable archive.
How to read Cyber Watch
Facts first. Impact second. Action always.
01
What happened
Confirmed facts from advisories, affected organizations, regulators, researchers, and reputable reporting.
02
Why it matters
Who is actually exposed, what remains unknown, and what the event changes for individuals or organizations.
03
What to do
Concrete protection, verification, patching, monitoring, or recovery steps matched to the evidence.
Newsroom
Ransomware
Every story links to original reporting or advisories and separates confirmed facts from analysis.
Ransomware Watch — August 2026
Comparitech recorded 997 ransomware incidents and claims in August, but only 77 were confirmed. The distinction matters—and so do tested recovery plans.
Read the storyArchive
Story list
- Ransomware Watch — August 2026Ransomware
Panther Notes
Analysis from the field
Panther Notes holds practical observations, lessons learned, and evidence-based security thinking. The tone stays direct: no fear marketing and no pretending certainty where it does not exist.
Start at the source
Critical claims should lead back to the original advisory, disclosure, filing, or regulator notice.
CISA Alerts & AdvisoriesBreach source desk
Where Cyber Watch checks the claim
A social post or criminal claim can be a lead, but it is not confirmation. These sources help establish what happened, who may be affected, and what action is actually supported by the evidence.
First source
The affected organization
Look for a dated incident notice, customer letter, regulator filing, or status update from the organization itself. Treat missing details as unknown—not as proof that nothing happened.
Government record
HHS breach reports
The U.S. Department of Health and Human Services publishes reported breaches of unsecured health information affecting 500 or more people.
Search the HHS portalCompany filing
SEC EDGAR
Public companies may disclose material cybersecurity incidents in Form 8-K filings. Read the filing before relying on a headline.
Search SEC filingsConsumer notices
State breach notices
State attorney general sites often preserve the notice letter sent to affected people, including dates, exposed data types, and offered protection.
Search California noticesExposure check
Have I Been Pwned
Check whether an email address appears in a known breach. A listing is a warning to change reused passwords—not proof of identity theft.
Check an email addressIndependent reporting
Reuters cybersecurity
Use reputable reporting to add context, then follow its links and named sources back to the original evidence whenever possible.
Read Reuters coverageResearch desk
Comparitech
Use Comparitech for breach research, practical security reporting, and its continually updated ransomware datasets. Verify important claims against the affected organization or official record.
Read Comparitech newsEditorial standard
Review first. Publish second.
New briefings are saved as drafts for human review. Nothing is automatically published. Material corrections are identified when the evidence changes.