January 2026

4 pieces, newest first.

• A hospital knew in August and could say what happened in January

  January 27, 2026 · 3 sources

  159 days between detecting an intrusion and being able to say what was taken. Notification cannot start until that second clock stops.

• A 9.4 in the single sign-on, and the patch did not help

  January 21, 2026 · 4 sources

  An authentication bypass in FortiCloud SSO, exploited from 21 January against devices that were already fully patched.

• The automation platform was the credential store nobody inventoried

  January 7, 2026 · 4 sources

  A CVSS 10.0 chain in n8n reached a forged administrator session. What it opened was every credential the platform had been given.

• 716,000 people, 120 brands, and a company none of them chose

  January 7, 2026 · 4 sources

  A telehealth platform behind 120 consumer brands was accessed across two days. Two irreconcilable totals are still in circulation.