Week of June 29, 2026: AdaptHealth and Navient file 8-Ks, and a SimpleHelp bypass delivers Djinn Stealer

What mattered to security leaders in the week of June 29, 2026? Two companies filed Item 1.05 reports on Thursday, July 2 about incidents that began outside their own walls: AdaptHealth traced its breach to a socially engineered contractor session, and Navient said a ransomware attack on an outside law firm exposed borrower Social Security numbers. Attackers also went after a freshly patched SimpleHelp authentication bypass and an Oracle E-Business Suite Payments flaw.

AdaptHealth reports patient data theft after a contractor session was hijacked

AdaptHealth's 8-K, filed July 2, says an attacker got into cloud-based business applications, including internal patient management systems and document storage, and took data including a stored password file tied to insurance billing plus patient personal and health information. The company heard from the attacker on June 15 and determined materiality on June 27. It attributes the intrusion to a successful social engineering attack that compromised a user session belonging to a third-party contractor, and says it has disabled the account and reset affected credentials. Contractor identities with standing access to patient systems are the lesson. (SEC EDGAR)

Navient calls a law firm's ransomware attack material

Navient learned on June 8 that a third-party law firm providing it with legal services had suffered a ransomware attack, and that an unauthorized actor accessed Navient-related data held by the firm, including borrower names, dates of birth, addresses and Social Security numbers. Navient found no access to its own systems and no disruption, yet determined on June 29 that the incident was material given the volume and sensitivity of the data, according to its July 2 filing. Outside counsel often holds some of an organization's most sensitive records with the least security oversight. (SEC EDGAR)

SimpleHelp authentication bypass used to deliver Djinn Stealer

On June 29 BlackPoint Cyber researchers reported attackers exploiting CVE-2026-48558, an authentication bypass in the SimpleHelp remote monitoring and management tool disclosed on June 12, to get a technician session on an internet-facing server and drop a new cross-platform infostealer called Djinn Stealer. The malware hunts for cloud, source control, package registry, SSH, browser and AI coding assistant credentials as well as cryptocurrency wallets. SimpleHelp is popular with managed service providers, so organizations should ask their MSPs whether their instances are patched. (Help Net Security)

First exploitation of an Oracle Payments flaw, six weeks after the patch

Threat intelligence company Defused warned on Monday, June 29 that its Oracle E-Business Suite decoys had recorded the first in-the-wild exploitation of CVE-2026-46817 in Oracle Payments on June 27, about six weeks after Oracle's May 2026 patch and before any public proof of concept. The single-source activity used an unauthenticated file read against the ibytransmit endpoint to pull /etc/passwd, a technique that could reach configuration files holding database credentials. Oracle EBS teams that skipped the May update now have a concrete reason to apply it. (Help Net Security)

Exploited SharePoint Server deserialization flaw joins the KEV list

CISA added CVE-2026-45659, a deserialization of untrusted data vulnerability in Microsoft SharePoint Server, to its Known Exploited Vulnerabilities catalog on July 1. The alert points to Binding Operational Directive 26-04, which requires federal agencies to prioritize KEV entries on publicly exposed assets that grant total control after exploitation and to check whether systems were compromised before patching. On-premises SharePoint farms facing the internet fit that description. (CISA)

CISA launches ANCHOR-CI to widen its critical infrastructure councils

On July 1 CISA announced ANCHOR-CI, the Alliance of National Councils for Homeland Operational Resilience for critical infrastructure, a new advisory framework that builds on the Critical Infrastructure Partnership Advisory Council and widens participation from industry. It allows four kinds of councils: sector, cross-sector, industry and regional coordinating councils, with CISA managing their governance. Security leaders in regulated sectors may want a seat, since these councils shape the guidance that follows. (CISA)