Every fact is provided with its publisher and date.

Global average cost of a data breach $4.99M; United States average $11.5M; one in four malicious breaches AI-enabled.

Where: Key findings; Global highlights; AI-driven attacks.

Ransomware present in 48% of breaches; third-party involvement 48%; human element 62%; exploitation of vulnerabilities the top entry point at 31%.

Where: Results and analysis.

Global median attacker dwell time 14 days.

Where: Metrics.

Average eCrime breakout time 29 minutes.

Where: eCrime.

Reported losses of $20.9B in 2025, including $3.05B from business email compromise (BEC).

Financial Fraud Kill Chain 2025: 3,900 interventions, $1.16B attempted theft, $679M frozen (58%).

Form 8-K Item 1.05 material cybersecurity incident disclosure within 4 business days of a materiality determination.

Personal data breach notification to the supervisory authority within 72 hours of becoming aware.

Breach notification without unreasonable delay and no later than 60 days from discovery.

Notice within 72 hours of determining a cybersecurity incident occurred; 24 hours after an extortion payment; a written explanation of the payment within 30 days.

Early warning within 24 hours, incident notification within 72 hours.

Initial notification of a major information and communications technology (ICT) incident within 4 hours of classification.

72-hour incident and 24-hour ransom-payment reports are still PROPOSED. CISA missed its September 2026 target and sent the final rule to the White House for review on October 1, 2026. Reporting stays voluntary until it takes effect.

Where US states set a fixed deadline it ranges from 30 to 60 days (California, Colorado, Florida and Washington at 30 days; many at 45 to 60). Roughly 30 states require notice only without unreasonable delay.

NIST Cybersecurity Framework (CSF) 2.0 — six functions and their categories.

Incident response recommendations mapped onto CSF 2.0 functions.

Test, training and exercise program guidance, including required after-action report content.

Incident response (IR) control family and enhancements as named.

Draft after-action report about 30 days after the exercise; final report and Improvement Plan typically in 60 to 90 days (agencies set their own deadlines).

Over 100 CISA Tabletop Exercise Packages (CTEP) available.

February 2024: engineering firm Arup's Hong Kong office lost HK$200M (about US$25.6M) after a finance employee joined a video call with deepfaked colleagues, including the CFO.

Marks & Spencer: customer data of an undisclosed number of its roughly 9.4 million online customers was taken; online orders paused 46 days (April 25 to June 10, 2025); about GBP 300M profit impact.

Co-op: help-desk social engineering intrusion in the same 2025 campaign, with member data accessed and stock availability disrupted.

Kettering Health: core Epic electronic health record restored June 2, 2025 (13 days after the May 20 attack); normal operations resumed June 10 (about 3 weeks); 1,695,382 individuals notified.

Brockton Hospital: chemotherapy infusions canceled April 7, 2026, later resumed.

Nevada restored services in 28 days after the August 24, 2025 attack and published its after-action report on November 5, 2025 (about 10 weeks later); no group publicly claimed responsibility.

Interlock is confirmed only for St. Paul, Minnesota (July 2025); it is not the confirmed actor for the Nevada attack.

Allianz Life: about 1.5 million individuals affected (1,497,036 per the Maine Attorney General filing).

CitrixBleed 2 (CVE-2025-5777), disclosed June 17, 2025; Huntress documented H1 2026 intrusions in which one actor went from exploitation to DragonForce ransomware in under an hour.

Poland energy sector, December 29, 2025: CERT Polska attributed the activity to the Static Tundra cluster (also tracked as Berserk Bear / Dragonfly, widely linked to FSB Center 16); ESET and Dragos attributed it to Sandworm with medium confidence. No disruption of heat or power supply occurred.

McKesson (2026): data exfiltrated August 21 to 25, discovered August 25; attackers vished employees to compromise Okta single sign-on, then reached Salesforce and Snowflake. ShinyHunters claimed about 284 million records (not unique patients) and demanded about $55 million by September 1. McKesson's Form 8-K said materiality was not yet determined.

Foxconn: Nitrogen claimed responsibility May 11, 2026; Foxconn confirmed May 12-13; roughly two weeks of disrupted production at Mount Pleasant, Wisconsin and in Texas.

Jaguar Land Rover: attack disclosed September 2, 2025; phased production restart from October 8 (about 5 weeks); GBP 196M cost in the July-September quarter; GBP 1.5B UK government loan guarantee.

CISA #StopRansomware joint advisory AA26-222A on Gunra ransomware (August 10, 2026): initial access via FortiOS/FortiProxy VPN flaws and exposed credentials, backup and log deletion before encryption.

Salesloft Drift (UNC6395), August 8-18, 2025: stolen OAuth tokens used to query 700+ customers' Salesforce orgs; Salesforce revoked all Drift tokens August 20.

Shai-Hulud npm worm: first wave September 15-16, 2025; second wave November 24, 2025 affected 25,000 to 27,000+ repositories across about 350 npm accounts.

Instructure Canvas: about 8,800 to 9,000 institutions; initial detection April 29, 2026, second wave May 7; agreement including digital confirmation of data destruction announced May 12, 2026.

Minnesota water utilities (July 26-27, 2026): exposed programmable logic controllers manipulated — Rockwell MicroLogix 1100/1400 and CompactLogix/Micro850, Schneider Modicon M340, Siemens S7-1200.

ScreenConnect client flaw letting files be transferred and run in a session without Host confirmation: advisory September 3, 2026; fixed in 26.6.5 (CVE-2026-84869, CVSS 9.9) on September 8; added to CISA's Known Exploited Vulnerabilities catalog September 11. Huntress documented rogue-client incidents from August 20, 2026.

Reporting on rogue ScreenConnect clients and the four-stage VBScript chain.