Week 26 | The Breach Economy Is Outperforming Yours

June 19–25, 2026 · 5 stories

This Week in 30 Seconds

📌 Ransomware groups pulled in $529 million in Q1 2026, which is a 39% jump over last year, and they’re buying network access like wholesale goods instead of hacking their way in.

📌 A 24-billion-record credential dump surfaced online, giving attackers a searchable roadmap to your team’s reused passwords across banking, email, and cloud accounts.

📌 The maker of Ozempic and Wegovy is facing two separate extortion groups after hackers sat inside its network for over two months, stealing drug research, AI models, and patient data.

Ransomware Groups Just Had a Record-Breaking Quarter — And They’re Running Like Startups

What happened?

Ransomware groups pulled in an estimated $529.2 million in the first three months of 2026 — a 39% increase year-over-year, according to Rapid7. The growth isn’t from better hacking. It’s from a maturing underground marketplace where criminal groups now simply buy pre-made network access from brokers, rather than breaking in themselves.

Who’s affected?

Everyone. Small and midsized businesses are increasingly targeted because attackers recognize these organisations often lack cybersecurity resources. Healthcare, manufacturing, and finance saw the sharpest upticks.

Business impact?

The average incident costs $4.4M globally, and over $10M in the U.S. Coupang’s shares have shed about 35% since its breach became public. This isn’t an IT line item. It’s a balance sheet event.

Source: TechRadar Pro

24 Billion Stolen Logins Found in One Giant Database

What happened?

Cybernews researchers discovered a publicly accessible database containing roughly 24 billion credential records, including usernames, email addresses, plaintext passwords, and login URLs linked to a wide range of online services. The data leak was identified on June 12. Think of it as a criminal phonebook, except it lists your email, your password, and the exact website they unlock.

Who’s affected?

Security experts warn that the leak will likely fuel a massive wave of credential-stuffing attacks, where hackers automate bots to test leaked password combinations across retail, banking, and social media platforms. Any business where employees reuse passwords is exposed.

Business impact?

Credential stuffing (using leaked passwords to automatically try logging into other accounts) is the #1 method attackers use to take over business email, cloud drives, and financial accounts. One reused password from a junior employee can open your entire accounting system.

Source: Malwarebytes

Hackers Spent Two Months Inside the Ozempic Maker’s Network Before Anyone Noticed

What happened?

Novo Nordisk is investigating claims by cyber extortion group FulcrumSec, which alleges it stole more than a terabyte of data. Reuters reported that the group spent more than two months inside Novo Nordisk’s networks. The hackers claimed the stolen information includes source code, proprietary drug details, clinical trial information, and internal AI models. FulcrumSec demanded $25 million while a second group, TheUSERS007, demanded $50 million. Novo did not comply with payment to either group.

Who’s affected?

Exposed data included patient trial participation data, healthcare professional names, registration numbers, email addresses, phone numbers, and office locations. Any pharmaceutical, biotech, or healthcare company should pay close attention.

Business impact?

The breach puts Novo Nordisk under closer regulatory scrutiny. Investors will likely be watching for required notifications, potential fines, and mandated changes to IT controls. When hackers target AI models and drug pipelines, they’re stealing years of R&D — worth billions.

Source: Dark Reading

South Korea Hits Online Retailer With a $409 Million Fine — the Biggest Privacy Penalty in the Country’s History

What happened?

South Korea’s data protection regulator imposed a record $409 million fine on Coupang, the country’s largest online retailer, after a breach that compromised tens of millions of customers. The penalty is the largest ever issued by the commission, surpassing the $88.8 million fine on SK Telecom. A former employee exploited an internal signing key to scrape hundreds of millions of customer records over 10 months — names, phone numbers, addresses, apartment entry codes, and order history.

Who’s affected?

Approximately 33.7 million customer accounts were compromised, which is around 65% of South Korea’s population. Any company handling customer data at scale should study this case.

Business impact?

Coupang’s shares have shed about 35% since the start of the year. The fine, the share price collapse, and $1.17 billion in customer compensation vouchers demonstrate that a single insider threat can become a company-defining financial event.

Source: The Record (Recorded Future)

France’s Government-Only Chat App Got Hacked Through One Stolen Account

What happened?

France’s secure government messaging platform, Tchap, was breached after a hacker used social engineering (tricking someone into handing over login details) to hijack one user account. The breach was detected on June 7 by France’s national cybersecurity agency. The hacker claims to have accessed 73,467 user accounts, 643,459 messages, and 876 chat rooms across French ministries.

Who’s affected?

The breach comes as France had pushed officials to use Tchap over foreign apps like WhatsApp and Signal. This is a cautionary tale for any organisation that assumes sovereign or internal tools are automatically more secure.

Business impact?

The combination of government department identifiers, email addresses, and 640,000 plaintext messages would be a treasure trove for spear-phishing targeting not Tchap, but the ministries employing its users. The downstream risk is intelligence compromise at a national level.

Source: SecurityWeek

🌐 Weekly Trend Observation

This week’s stories, taken together, tell a single uncomfortable story: cybercrime isn’t just growing, it’s professionalising faster than most legitimate businesses are defending. Ransomware operators earned $529 million in Q1 alone, and they didn’t do it with genius-level hacking. They bought pre-made access, exploited unpatched VPN appliances, and walked through doors that had been left open for months. The Novo Nordisk breach is the most alarming pattern of the lot. It signals that dwell time (how long attackers sit inside your network before being caught) is getting worse, not better, even at billion-dollar companies.

If I had to flag one category of business that should be on highest alert right now, it’s mid-market companies in pharma, manufacturing, and financial services, organisations that are big enough to hold valuable data and IP, but not yet resourced enough to have 24/7 security monitoring. The Coupang story also screams a message that boards need to hear: insider threats are not edge cases. A single departing employee with a retained key compromised two-thirds of a nation’s population.

My prediction for the next 90 days

We will see at least one major regulator outside Asia, likely the UK’s ICO or Australia’s OAIC, issue a nine-figure fine tied to a failure of basic access controls, not sophisticated hacking. The Coupang precedent has moved the goalposts. Regulators globally will be emboldened, and “we were hacked by sophisticated attackers” will no longer work as a defence when the root cause was a forgotten password or an unrevoked login.

Cybersecurity, TRANSLATED. Written weekly for business leaders who want to understand cyber risk without needing a technical degree. If this was useful, follow for next week’s edition.