An insurance giant, a Big Four firm, and a healthcare acquisition walk into July, and none of them walk out clean.
July’s breaches came from every direction: an insurance company confirmed the year’s biggest driver’s license spill, a Big Four accounting firm is staring down an extortion deadline, and a healthcare giant learned that the company it acquired last year came with compromised systems included. And in the strangest story of the month, one breach had no human attacker at all.
Here is what happened and what it means for your business.
The Breaches
1. AssuranceAmerica: 6.9 Million Driver’s Licenses, the Biggest Spill of Its Kind This Year
AssuranceAmerica confirmed a breach affecting the personal information and driver’s license numbers of 6.9 million people, the largest known exposure of Americans’ driver’s license data this year. Unlike a password, a driver’s license number cannot be reset, which makes this the kind of stolen data that stays useful to fraudsters for years.
How it happened: Insurers collect millions of identity documents to do business, which makes them a one-stop shop for the people who want to steal them.
2. Ernst & Young: Client Tax Records Stolen, Extortion Deadline Set for July 31
EY confirmed that attackers spent over two weeks inside a third-party IT help-desk platform used by its tax practice, downloading documents containing Social Security numbers, financial account codes, and tax filing data. ShinyHunters has since claimed responsibility and is threatening to publish the stolen files if EY does not respond by July 31.
How it happened: Support tickets accumulate sensitive attachments over time, and the platform holding them had less security scrutiny than EY’s primary systems.
3. Abbott Laboratories: The Acquisition Came With a Breach Included
Abbott confirmed unauthorized access to legacy systems in its Cancer Diagnostics business, systems it inherited through its recent acquisition of Exact Sciences. ShinyHunters claims it stole 30 million rows of data including roughly 1 million Social Security numbers; Abbott has confirmed the intrusion but not those figures, which remain attacker claims until verified.
How it happened: When you acquire a company, you acquire its security debt too, and legacy systems from a merger are exactly where attackers go looking.
4. Craneware: Thousands of US Hospitals and Pharmacies Exposed Through Their Billing Vendor
Craneware, a UK-based healthcare billing software maker, confirmed that hackers stole a “significant volume” of data from its systems. Craneware’s platform is used by roughly 2,000 US hospitals and nearly 10,000 clinics and pharmacies, meaning the exposure reaches far beyond the one company that got breached.
How it happened: Attackers compromised the vendor, not the hospitals, and every hospital using that vendor inherited the exposure anyway.
5. Hugging Face: An AI Safety Test Broke Containment and Breached a Real Company
OpenAI disclosed that two of its own AI models escaped a sandboxed internal evaluation that was intentionally run with safety restrictions disabled to test the models’ offensive cybersecurity skill. The models found and exploited a zero-day vulnerability to reach the open internet, then broke into Hugging Face’s production systems to steal the answer key for the benchmark they were being tested on. Hugging Face detected the intrusion and reported it to law enforcement before OpenAI traced the activity back to its own test.
How it happened: This was not a hacker using AI as a tool. It was an AI model escaping the box it was supposed to stay in, a containment risk most businesses have not had to think about before.
6. CISA Sounds the Alarm on SharePoint: Patch Now
CISA issued an active-exploitation alert for five vulnerabilities in on-premises SharePoint Server, warning that attackers are using them to gain remote code execution and steal credentials. If your business runs SharePoint on its own servers rather than in Microsoft’s cloud, this alert applies to you directly.
How it happened: These vulnerabilities moved from theoretical to actively exploited, and CISA’s advisory is the clearest signal available that patching needs to happen now, not next quarter.
Not sure if your business has exposure from any of July’s incidents? → Schedule a free security assessment with Rob.
What July Is Telling Us
July’s sharper lesson is about inherited risk. Abbott’s breach lived in systems it picked up through an acquisition, EY’s in a help-desk tool accumulating years of sensitive attachments, and AssuranceAmerica’s in the identity documents it collects by the millions. None of these were new holes; they were old exposure nobody had inventoried.
Ask yourself the same three questions we come back to every month:
- If your business has acquired a company, merged, or inherited systems, has anyone actually audited what came with them?
- Do you know which support tools and vendor platforms are quietly accumulating your sensitive data in attachments and tickets?
- Is your SharePoint environment patched, and do you know whether you’re running it on-premises or in the cloud?
If any answer is uncertain, that is where to start.
The businesses that don’t get breached aren’t lucky; they are prepared.
