Check Point Research Details Global Cyber Threats, Including Major Breaches and AI-Driven Attacks

Check Point Research has released its latest threat intelligence report, detailing a wide array of cyber incidents and emerging threats observed during the week of October 12th, 2026. The report underscores a global increase in cyberattacks, with a notable 48% year-over-year rise in September 2026, averaging 2,803 weekly attacks per organization. The education sector continues to be the most targeted, while ransomware attacks saw a significant 53% increase.

Several high-profile data breaches are detailed, including a significant incident at Denmark's Central Register of Persons. Unauthorized access, facilitated through a private supplier, exposed personal information such as names, addresses, and identification numbers for approximately 8.8 million individuals. In Ukraine, ATB, the country's largest grocery retailer, suffered a cyberattack claimed by the DataSuckers group, which reportedly stole records belonging to 7.9 million customers, including sensitive personal and order details. Additionally, Japan's Osaka Metropolitan University experienced a suspected ransomware attack that disrupted operations and potentially exposed the data of at least 130,000 individuals.

The report also sheds light on the evolving landscape of AI-driven threats. Researchers have identified an intrusion campaign, dubbed ARTEX, targeting South Korean financial institutions, which allegedly uses AI-assisted workflows for data theft. A sophisticated phishing campaign has been observed employing prompt injection techniques within HTML comments and invisible text to trick both human users and AI-powered email assistants into performing fraudulent actions or disclosing sensitive information. Furthermore, CyberXero, an AI-augmented initial access broker, has been profiled for its automated attacks against WordPress and e-commerce platforms, and its success in obtaining data on over 628,000 Ukrainian individuals.

Critical vulnerabilities affecting widely used enterprise software are also a key focus. Veeam Backup & Replication version 12 is impacted by CVE-2025-64393, a critical remote code execution flaw. Citrix NetScaler ADC and Gateway appliances face CVE-2026-88779, a memory overflow vulnerability that has seen targeted exploitation. Cisco has addressed multiple critical vulnerabilities in its NX-OS software, including CVE-2026-76455, an improper access control flaw. Atlassian products, including Jira, Confluence, and Bitbucket, are affected by CVE-2026-21589, a critical arbitrary file access vulnerability.

The report highlights the increasing sophistication of threat actors, including the Russia-aligned UAC-0099 group targeting Ukrainian organizations with the MATCHBOIL downloader and MATCHWOK backdoor. The FBI and Secret Service have issued warnings about the continued exploitation of the FortiBleed campaign, which has affected over 86,000 Fortinet FortiGate devices globally, with compromised access reportedly sold to ransomware affiliates. Cyberespionage campaigns targeting Taiwanese research organizations through deceptive phishing emails and AI-assisted event invitations are also noted.

In terms of broader threat intelligence, the report indicates that one in every 39 enterprise Generative AI prompts posed a high risk of sensitive data exposure in September 2026. This, coupled with the rise in ransomware attacks and the increasing use of AI by threat actors, paints a picture of a rapidly escalating and complex threat environment.

Check Point IPS offers protection against some of these threats, including the arbitrary file read vulnerability in Atlassian products (CVE-2026-21589). The comprehensive nature of the report underscores the need for organizations to stay vigilant, update their systems promptly, and enhance their security postures against both traditional and AI-augmented cyber threats.