The Rainmaker Report

Story 1: MCB Data Breach Affects 1.2 Million Individuals

A data breach at MCB (likely a financial or healthcare entity) has exposed the personal information of approximately 1.2 million individuals. The incident, reported by SecurityWeek and tracked by ransomware monitoring groups, underscores the ongoing threat to sensitive consumer data.

• https://www.securityweek.com/mcbs-data-breach-affects-1-2-million-individuals/

• https://www.ransomware.live/id/VW5pdmlldyBUZWNobm9sb2dpZXNAR2xvYmFsIFNlY3Jl...

**Story 1: Swiss rail giant Stadler rejects $12.3M ransom demand after cyberattack**

Swiss rolling stock manufacturer Stadler Rail refused to pay a $12.3 million ransom demanded by the Everest ransomware group following a cyberattack. The company confirmed the incident did not impact production or train operations, and it is working with law enforcement. Everest leaked some stolen data after Stadler declined to negotiate.

• https://www.bleepingcomputer.com/news/security/swiss-rail-giant-stadler-...

**Story 1: Malware targeting AI toolchains in development environments**

Attackers are deploying a new malware variant that targets AI development toolchains in software supply chains. CrowdStrike and other researchers observed the malware, dubbed "Sandworm Mode," exploiting integrations between AI platforms and code repositories to inject malicious models and steal credentials. The technique, called "living off the AI toolchain," allows adversaries to maintain persistence and exfiltrate sensiti...

**Story 1: Kratos Phishing Platform Dismantled**

German authorities led a coordinated international takedown of the Kratos phishing platform, arresting its developer. The platform was used to launch large-scale credential theft campaigns targeting financial institutions and government portals. The operation disrupted a key infrastructure-as-a-service offering for cybercriminals.

• https://www.theregister.com/security/2026/07/21/german-authorities-lead-takedown-of-kratos-phishing-platform/5275666...

**Story 1: Apple ex-employee exploited rare bug to steal data after moving to OpenAI**

A former Apple employee exploited a rare and previously unknown bug to download confidential files after leaving the company to join OpenAI. The breach involved sensitive internal documents, and the incident highlights risks of insider threats and data exfiltration by departing staff. Apple disclosed the bug and the employee's actions in a recent security update.

• https://techcrunch.com/2026/07/13/apple-says-...

Story 1: The Gentlemen Overtakes Qilin as Most Prolific Ransomware Threat

The Gentlemen ransomware group has surpassed Qilin to become the most active ransomware threat, according to new research from Group-IB. The group has increased its attack frequency and expanded its victim targets, while Qilin's operations have declined following law enforcement disruptions. This shift marks a significant change in the ransomware landscape.

• https://www.infosecurity-magazine.com/news/the-gentlemen-most-pr...

**Story 1: Hack Suggests AI Music Generator Suno Scraped YouTube for Training Data**

A security breach at AI music startup Suno revealed internal logs indicating the company scraped copyrighted music from YouTube, Deezer, and Genius to train its generative models. The leaked data shows Suno downloaded over 100,000 tracks without authorization, raising legal and ethical questions about training data provenance. The incident underscores ongoing tensions between AI companies and content creators ov...

Story 1: SCMBanker Malware Uses ClickFix Lures

SCMBanker, a Mexican banking trojan, is now being distributed through ClickFix social engineering lures. The malware targets financial credentials and uses advanced evasion techniques to avoid detection. Researchers at Elastic Security Labs have detailed the infection chain and its focus on Latin American banking customers.

• https://thehackernews.com/2026/07/scmbanker-malware-uses-clickfix-lures.html

• https://www.elastic.co/security-labs/mexican-b...

## 19-Year-Old Scattered Spider Suspect Extradited to Face U.S. Hacking Charges

A 19-year-old suspected member of the Scattered Spider cybercriminal group has been extradited to the United States to face federal hacking charges. The individual is allegedly linked to a series of high-profile social engineering attacks and data thefts targeting major tech companies. Law enforcement coordinated with international partners to bring the suspect into U.S. custody.

• https://thehackernews.com/2026/07...

**Story 1: Klue Breach Exposes Multiple Cybersecurity Firms**

A data breach at Klue, a threat intelligence platform, has led to the exposure of sensitive information belonging to several cybersecurity companies. The incident, which occurred in late June, compromised internal data used by security firms for threat detection and response. Affected organizations are now assessing the scope of the leak and potential downstream risks.

• https://techcrunch.com/2026/06/22/klue-hack-results-in-data-brea...