Cyber Radar is a weekly read on what happened in cybersecurity across the Americas, Europe, the Middle East and APAC, and what it changes for the people who have to operate through it.
The most advanced operation disclosed this week was run largely by software, and it got in through unauthenticated API endpoints and passwords built from employee ID numbers. The most novel one crossed from a wind farm into a power plant over a cellular network that neither site controlled. Nothing this week turned on a new exploit. What changed is how cheap it has become to find and work the things already left open.
DentaQuest, the second largest dental benefits administrator in the United States, disclosed a breach affecting more than 15 million people in a notice filed with federal regulators. Intruders had access to its network between May 17 and May 20. The exposed data may include Social Security numbers, Medicaid and Medicare identifiers, and diagnosis, treatment and billing information. It is the largest health data breach reported to the US government this year.
The detail that matters commercially is the position DentaQuest occupies. Beneficiaries do not select their dental benefits administrator, they are enrolled through a plan. The organization holding the records has no direct relationship with most of the people it holds them for, and those people have no way to assess its controls. That is a data governance problem before it is a security one. Under HIPAA it lands on covered entities to know what their business associates are doing with protected health information, which is a due diligence obligation that most payer and provider organizations still satisfy with a questionnaire. Reported attribution of the intrusion to a named extortion group has not been confirmed by the company or by any government source.
CERT Polska published a follow-up report on a second, previously undisclosed attack from the December 29, 2025 campaign against Poland's energy sector. A smaller combined heat and power plant serving roughly 50,000 residents had its steam turbine and process water treatment system shut down. Operators initially believed the outage was contractor error during routine maintenance. It took more than three months of analysis to establish that it was an attack.
The route is the story. Attackers compromised a Fortinet VPN appliance at a wind farm, tunneled through a cellular router into a private APN operated by the local distribution system operator, scanned that network, found a WAGO controller exposing its web administration interface with default credentials, and used it to reach the plant's operational network. From there they set Siemens controllers to stop and password protected them. CERT Polska describes this as the first observed real world use of a private APN as an access path into an OT network, and notes that surveys of Polish operators found the enabling misconfiguration to be common. Neither site owned the network that connected them. For US operators, the equivalent question under NERC CIP is which shared connectivity reaches your critical assets, and who actually administers it.
Senators Adam Schiff and Amy Klobuchar introduced the Water Cyber Shield Act following coordinated intrusions against more than 30 community water systems in Minnesota and reported activity across roughly a dozen states. The bill would amend the Safe Drinking Water Act and the Clean Water Act to give the EPA explicit authority to conduct cybersecurity assessments and require corrective action, direct the agency to work with CISA and NIST on baseline standards, extend incident reporting obligations to state and locally owned facilities, and authorize $300 million a year through the state revolving funds for cybersecurity improvements.
This matters beyond the water sector because of the model it tests. The EPA has responsibility for water without cybersecurity rulemaking authority, and an earlier attempt to fold cyber checks into sanitary surveys was abandoned after legal challenge from industry groups and states. A bill that grants assessment and enforcement powers to a sector regulator rather than routing everything through CISA is the template other sectors will look at. Separately, the Water Watch Center launched at DEF CON, pairing managed detection providers with utilities serving fewer than 10,000 people at no cost. That is an admission that the smallest operators cannot staff detection at all.
Researchers at Israeli firm Dream published analysis of a multi-agent AI framework used against government entities in Asia. The Financial Times identified Taiwan as the target. Taiwan's Ministry of Digital Affairs confirmed the following day that overseas attackers had used AI agent tooling, including OpenClaw, in a hybrid operation combining conventional techniques with agents. Taiwan did not attribute the activity to any state, and Dream declined to name the target or the attacker.
Dream recovered a 160 megabyte archive of nearly 1,400 files documenting the operation: 12 attack waves between July 1 and July 4, up to eight sub-agents running concurrently, 21 government systems mapped, 85 credentials cracked and more than 2,500 personnel records taken. The agents ranked candidate attack paths, researched new techniques when blocked, and resumed. Guardrails in the underlying tools were bypassed by framing the activity as authorized penetration testing.
The confirmed entry paths contained nothing novel: unauthenticated API endpoints, an authentication service accepting tokens with signature validation disabled, and passwords derived from employee ID numbers. Dream's own reading is that the cost of running a capable operation has collapsed while the cost of defending against one has not. Coverage describing this as a fully autonomous attack overstates it. Dream calls it near autonomous and is explicit that substantial human engineering was required to make the framework work.
Microsoft's August Patch Tuesday addressed 421 CVEs, including CVE-2026-68820, a use after free flaw in the Windows afd.sys driver that grants SYSTEM privileges and was exploited as a zero day before the fix shipped. Check Point researchers, who reported the flaw, tied exploitation to a North Korean group deploying a kernel rootkit during intrusions against defense and aerospace targets. CISA added the same CVE to its Known Exploited Vulnerabilities catalog on August 11, alongside a Cisco Secure Firewall ASA and FTD flaw and a Metabase SQL injection issue.
Those three entries are not equivalent work. The Cisco entry is an internet facing edge device. The Metabase entry should be treated as a possible credential and data exposure rather than only an application patch, because of what the platform can reach. The volume is the other half of the story. A 421 CVE release is well above a normal month, and the increase is widely attributed to AI assisted vulnerability discovery. Under BOD 26-04, federal agencies work to fixed deadlines on KEV entries. Everyone else builds that prioritization themselves, and the input volume is growing faster than triage capacity.
Five stories, and not one required an attacker to invent anything. Taiwan fell to unauthenticated endpoints and predictable password construction. Poland fell to default credentials on a controller and a network segment with no client isolation. DentaQuest sits in a class of intermediary that most affected people cannot see, let alone assess. The water systems were reached because the utilities are too small to staff monitoring.
What changed is throughput. An agent framework assembled from free downloads ran 12 attack waves in four days and researched its own next move each time it was blocked. AI assisted discovery is helping push a single vendor's monthly patch release past 400 CVEs. Both of those move attacker economics. Neither moves defender economics. The constraint on the defensive side is what it has been for years, which is sustained attention applied continuously to a surface that keeps growing. That is why a Polish plant spent three months believing an attack was a maintenance fault, and why the honest answer for a 6,000 person water utility is to have somebody else watch the network.
The capability implied by this week is unglamorous. It is knowing, continuously, which of your externally reachable endpoints actually authenticate and which do not. Which shared or third party administered network paths touch assets you class as critical, and who administers them. Whether default credentials still exist anywhere in your operational estate. Which of your data holdings sit with intermediaries whose controls you have never tested. None of that is a product. It is an inventory that starts decaying the moment it is finished, which is why point in time assessment produces a document rather than a defense.
The same logic applies to the patch queue. When 421 fixes land in one day, triage that starts from severity scores produces a backlog. Triage that starts from exposure, confirmed exploitation and what the affected asset can reach produces a decision queue. That difference requires business and asset context the scanner does not hold.
Which is the argument for a managed operating model rather than another tool. The organizations that came through this week best were the ones with somebody watching. The Polish plant recovered quickly because human operators responded. It still took three months to learn what they had responded to.
Whether the Water Cyber Shield Act draws the same industry opposition that stopped the EPA's earlier attempt, which will indicate how sector regulator cyber authority fares elsewhere. And whether any national authority publishes agent specific detection guidance, because the Taiwan operation spread its requests across sessions and addresses in a way that volume thresholds do not catch.
