May 2026 Security Incident Roundup

Hi there, Basestone subscriber! 👋

Today we're talking about the supply chain and identity incidents that shook May, and what was happening closer to home in Korea at the same time 🔒

📌 Today's post, at a glance

• ADT: a compromised Okta SSO integration affected 5.5 million people, the company's third breach since 2024
• NYC Health + Hospitals: 1.8 million medical records exposed, including fingerprints and other biometric data
• Microsoft SharePoint zero-day (CVE-2026-32201): 1,300+ servers left unpatched and under active exploitation
• In Korea, the privacy regulator fined a funeral-services company over a breach, and ransomware crews went after domestic companies and a university

The word that runs through May's incidents is supply chain. Attacks targeting developer tools, open-source packages, and vendor systems stood out this month, and the fallout landed as large-scale data exposure at major enterprises.

📅 May's major incidents, on a timeline

Beyond these, an SAP-related npm package was found running a supply chain attack via its preinstall script to steal developer and CI/CD credentials, and a remote code execution flaw in Google's Gemini CLI was confirmed to expose CI/CD environments. A WordPress plugin installed on 70,000+ sites was found carrying a backdoor that hid malware behind its own update mechanism, and Ukrainian police broke up a group that had hijacked 610,000 Roblox accounts for roughly $225,000 in illicit profit. In Europe, a €50 million cryptocurrency fraud network was uncovered, one that used fake investment platforms to defraud over 450 people.

🇰🇷 What was happening in Korea

It's easy to read overseas breaches as someone else's problem, but May in Korea followed much the same pattern. According to AhnLab ASEC's May ransomware trend report, Qilin (104 cases) was the most active group globally, with the newer Silent group (99 cases) climbing into second place; DragonForce (54 cases) and Chaos (39 cases) followed. On the domestic front, the Nova group named Daegu University's AI department and URG Co. Ltd. as targets, and the Coinbase Cartel group claimed attacks that included Korean companies. By industry, manufacturing took the biggest hit, with IT/telecom and wholesale and distribution also affected. The attack pattern that stood out was multi-stage: malware such as EtherRAT or TukTuk used for initial access before ransomware deployment, alongside reconnaissance through RDP authentication history lookups.

There was movement on the regulatory side, too. On May 14, Korea's Personal Information Protection Commission (PIPC) fined funeral-services company Boram Sangjo ₩542.5 million (plus a ₩11.4 million administrative fine) over a personal-data breach. The root cause was a SQL injection attack, but the underlying finding was that the company had failed to adequately maintain access-control management and vulnerability checks, the safeguards it was legally obligated to have in place. That same month, following a directive from President Lee Jae-myung, the PIPC also moved to overhaul how it calculates fines, shifting from "the average revenue of the prior three fiscal years" to "the higher of the prior fiscal year's revenue or the three-year average." The change hits fast-growing companies hardest, and the large, still-under-investigation breaches at Coupang and KT were cited as part of the backdrop for the reform.

🧭 Why it matters

The thread running through this month's incidents is that you do not have to be breached directly to be breached. As with Foxconn, OpenAI, and SAP, attackers skipped straight past companies' own defenses and went through the packages, installers, and SSO integrations those companies already trusted. Even ADT's third breach traced back to its Okta integration, not its own systems. Korea's ransomware incidents this month tell much the same story. Third-party trust is itself the attack surface, and it doesn't stop at any border.

✅ Five things to check on whether your organization is exposed

• Does your CI pipeline automatically audit the preinstall and postinstall scripts of newly added npm and PyPI packages (manual review alone can't keep pace with release speed)
• For SSO integrations like Okta, have you confirmed that conditional access policies (location, device posture based) and anomaly detection are actually enforced, not just simulated
• Are you scanning your entire source code and config files for hardcoded API keys and secrets on at least a weekly cycle
• Can you check patch status for internet-facing servers (SharePoint and similar) from a single real-time dashboard, or do you have to check each system separately
• If you operate in Korea, have you calculated what the PIPC's tightened fine formula (based on the prior year's revenue) would actually mean in dollar terms for your organization's revenue scale

⚠️ What this month's incidents teach us

Third-party credentials are assets too

Developer tools and CI/CD tokens deserve the same level of protection as production credentials. As the SAP npm package showed, a single preinstall script is enough to steal them.

Delayed patching on known vulnerabilities is the biggest risk

As with the SharePoint zero-day, servers left unpatched even after a fix is public become the actual entry point for attacks. If you cannot track patch status in real time, you stay exposed to threats that are already known.

"A supply chain attack is not a question of how well you defended yourself. It is a question of how well the parties you trust defended themselves." — Basestone Security Lab

🚀 How to start right now

Pick just one list of open-source packages you are currently using, and check whether any of them run preinstall or postinstall scripts. That single check alone can cut a meaningful share of your supply chain risk.

Wondering how to prioritize when the alerts won't stop coming? Read A Response Playbook for Reducing Alert Fatigue in Security Operations as well.