Week of May 11, 2026: West Pharma, CB Financial Disclose Breaches; ICO Fines Water Utility

The week of May 11, 2026 brought parallel material-incident disclosures from West Pharmaceutical Services and CB Financial Services' Community Bank, a £963,900 UK ICO fine against South Staffordshire Water's parent company, and a $12.75 million California settlement with General Motors over driver data sales. CISA added Microsoft Exchange and Cisco Catalyst SD-WAN Controller flaws to its Known Exploited Vulnerabilities Catalog, Microsoft shipped more than 120 fixes in its May Patch Tuesday, and Instructure confirmed an agreement with the ShinyHunters extortion group tied to its Canvas breach.

CB Financial Services discloses AI-related mishandling of bank customer data

CB Financial Services disclosed that its subsidiary, Community Bank, discovered on May 5, 2026 that non-public customer information had been handled through an unauthorized artificial intelligence-based software application. The company determined the event material on May 7, 2026, and said customer names, Social Security numbers and dates of birth were among the data disclosed. The incident did not disrupt operations, payment systems or core IT infrastructure, and the company said it was notifying affected customers and coordinating with banking and financial regulators. CB Financial filed the disclosure with the SEC on May 11, 2026. (SEC EDGAR)

West Pharmaceutical Services reports material cyberattack with data exfiltration and encryption

West Pharmaceutical Services disclosed a material cybersecurity attack in which an unauthorized party exfiltrated data and encrypted certain systems. The company detected the intrusion on May 4, 2026, took systems offline globally for containment, notified law enforcement and engaged external forensic experts. By its May 11, 2026 filing, core enterprise systems had been restored and shipping, receiving and manufacturing processes had restarted at some sites, though a full restoration timeline had not been finalized. West Pharmaceutical said the incident temporarily disrupted global business operations and that the financial impact had not yet been determined. (SEC EDGAR)

CISA adds Microsoft Exchange XSS flaw to Known Exploited Vulnerabilities Catalog

CISA added CVE-2026-42897, a cross-site scripting vulnerability in Microsoft Exchange Server, to its Known Exploited Vulnerabilities Catalog on May 15, 2026, citing evidence of active exploitation. The addition triggers remediation deadlines for federal civilian executive branch agencies under Binding Operational Directive 22-01, though CISA urged all organizations to prioritize patching. Exchange Server flaws remain a recurring vector for attackers targeting on-premises mail infrastructure, making the listing a prompt for enterprise security teams to check patch status against the newly added catalog entry. (CISA)

CISA adds Cisco Catalyst SD-WAN Controller bypass flaw to KEV Catalog

CISA added CVE-2026-20182, an authentication bypass vulnerability in Cisco Catalyst SD-WAN Controller, to its Known Exploited Vulnerabilities Catalog on May 14, 2026, based on evidence of active exploitation. The agency pointed federal agencies to Emergency Directive 26-03 and its supplemental hunt-and-hardening guidance for Cisco SD-WAN systems, instructing administrators to assess exposure, apply Binding Operational Directive 22-01 cloud-service guidance, or discontinue use of the product where mitigations remain unavailable. The listing added to a string of SD-WAN controller vulnerabilities security teams had to track through 2026. (CISA)

UK ICO fines South Staffordshire Water's parent £963,900 over long-undetected breach

The UK's Information Commissioner's Office fined South Staffordshire Water's parent company £963,900 over security failures that let attackers sit undetected inside its network for 20 months after a September 2020 phishing email, exposing personal data belonging to 633,887 people. The ICO found monitoring covered only 5% of the IT environment and that unsupported software, including Windows Server 2003, remained in use. More than 4.1 terabytes of stolen data, including bank details and National Insurance numbers, was later published on the dark web. The regulator reduced the penalty by 40% after the company admitted liability and agreed to settle without appeal. (Help Net Security)

Instructure reaches agreement with ShinyHunters over stolen Canvas data

Instructure, the company behind the Canvas learning management system used across more than 8,000 institutions, said it reached an agreement with the extortion group ShinyHunters to prevent publication of data stolen in a breach claimed on April 25, 2026. ShinyHunters had defaced Canvas login portals at about 330 institutions on May 7 and began extorting individual schools directly, setting a May 12, 2026 deadline for response. Instructure said the agreement included return of the stolen data, confirmation of its destruction, and assurances that affected customers would not be separately extorted. The company later tied the incident to a flaw in its Free-For-Teacher accounts. (Help Net Security)

General Motors to pay $12.75 million over driver data sales

General Motors agreed to pay $12.75 million to settle California allegations that it sold drivers' location and behavioral data to brokers without consent, marking the largest penalty in the history of the state's Consumer Privacy Act. Prosecutors said GM made approximately $20 million nationwide from the sales. The settlement requires GM to stop selling driving data to consumer reporting agencies for five years, delete retained driving data within 180 days absent affirmative consumer consent, and ask LexisNexis Risk Solutions and Verisk Analytics to delete data they received. GM must also build a privacy program covering OnStar data and report assessments to California authorities. (Help Net Security)

Microsoft's May 2026 Patch Tuesday fixes 120+ CVEs, none actively exploited

Microsoft's May 2026 Patch Tuesday delivered fixes for more than 120 CVE-numbered vulnerabilities, none actively exploited or publicly disclosed at release. Researchers flagged four critical remote code execution bugs in Microsoft Word, two of which Microsoft deemed more likely to be exploited, noting a target need not even open a malicious document if it renders in the Preview Pane. Other priority fixes included a stack-based buffer overflow in Windows Netlogon affecting domain controllers, an elevation-of-privilege flaw in Hyper-V, and a DNS Client vulnerability reachable via a crafted response that researchers said could enable unauthenticated remote code execution across an enterprise. (Help Net Security)