27th July – Threat Intelligence Report
Check Point Research's latest Threat Intelligence Report highlights several major cyber incidents and vulnerabilities from the week of July 27th. Notable breaches include a ransomware attack on Japanese frozen-food supplier Nichirei, a data breach at Swiss rail manufacturer Stadler Rail, and unauthorized access to customer data at Australian energy provider Origin Energy. On the patch front, Check Point addressed an actively exploited authentication bypass flaw (CVE-2026-16232), Oracle issued updates for 1,449 vulnerabilities, and Microsoft fixed a critical SharePoint RCE issue (CVE-2026-50522). The report also covers AI-driven threats, including a generative AI-powered malware factory and new phishing trends.
For the latest discoveries in cyber research for the week of 27th July, please download our Threat Intelligence Bulletin.
TOP ATTACKS AND BREACHES
- Nichirei, a Japan-based frozen-food supplier and logistics company, has experienced a ransomware attack that disrupted shipping operations and affected approximately 5,000 customers. KFC Japan warned of possible shortages. Nichirei confirmed personal data theft, while the RansomHouse group claimed responsibility and published a subset of the stolen information.
- Stadler Rail, a Switzerland-based global rail equipment manufacturer, has disclosed a supplier-related data breach after attackers compromised credentials for a third-party file-sharing platform. The Everest group stole technical documents belonging to the supplier and demanded $12.3 million. Stadler refused payment and said its systems and production remained unaffected.
- Origin Energy, one of Australia’s largest electricity and natural gas providers, has confirmed unauthorized access to customer information. Exposed data may include names, addresses, birth dates, phone numbers, account details, and partial payment information. Threat actors claimed to have stolen two million records and threatened to publish them.
- Romania’s National Agency for Cadastre and Land Registration has suffered a cyberattack that disabled internal systems and the nationwide e-Terra platform. The disruption halted property transactions for nearly a week. Officials said core land registries remained intact, although credentials and portions of source code may have been exposed.…