2026-08-30T0410Z-intel

Verification & coverage notes

Coverage window: standard cadence (gap_hours 24.01 since the previous run, 2026-08-29T0409Z-intel; window_hours 26 per the hard 24h floor plus overlap). 2026-08-29/30 fell on a weekend, visibly suppressing publishing cadence across every source slice relative to the preceding Friday; the active-threats/vulnerabilities sweep and the research/investigative sweep both independently confirmed a genuine quiet window rather than a transport or recipe failure.

Published this run (1 new, 0 updates, 0 deep dives, 0 critical):

• 2026-08-30/berlin-landesnetz-rhysida-extortion-phishing-vector (high), closes a coverage-backlog item open since 2026-08-20 (seven consecutive prior fires blocked on the same ground): Rhysida ransomware named as the actor behind the Berlin state-government Landesnetz compromise, and investigative journalism (Der Tagesspiegel) names the first access vector of any kind, a phishing-email click. Clears the relevance gate on a direct primary-sector nexus (a public-sector/government-administration incident, matching this deployment's own primary sector) and, independently, on the actor: Rhysida is a documented, sustained DACH public-sector extortion operator (nine prior German victims, an earlier Stuttgart claim already in the registry) that plausibly also targets this constituency's core. The home-region/sector sweep and the incidents/disclosures sweep independently surfaced the same story; composed from the union of both findings plus a direct deep read of the Tagesspiegel, heise, Security Affairs, BornCity and CISA primaries. Registered under the existing registry stub incident:berlin-landesnetz-compromise-2026-08 (no entry file had ever been composed for it) rather than a new entity key.

Borderline drops:

• borderline-drop: McKesson (US pharmaceutical distributor) ShinyHunters breach, no direct Swiss/EU public-sector nexus (US healthcare business units); the disclosed technique (vishing into Okta SSO, then Salesforce/Snowflake exfiltration) is not new or materially evolved; this store already carries the same ShinyHunters vishing-to-SSO-to-SaaS chain against Odido, Madison Square Garden, Brinks Home, EY and NAIC among others, and McKesson adds no lesson those entries do not already teach for this constituency. The actor is already tracked with confirmed EU targeting, but a same-actor read alone does not by itself clear the out-of-nexus breach gate absent a new angle.

Contradiction: 2026-08-30/berlin-landesnetz-rhysida-extortion-phishing-vector; Security Affairs states Berlin first disclosed the compromise on 2026-08-17; Berliner Zeitung, Der Tagesspiegel and rbb24 (all independently fetched and cited in the same entry) converge on 2026-08-14 for both public disclosure and department isolation. The entry follows the three-source consensus and records the discrepancy in its sourcing_note.

Coverage-backlog re-check: all six previously-open rows re-gated on today's facts. Struck: the Berlin Landesnetz row (published, see above). Stayed open, untouched or lightly re-checked at low cost: Zurich District Court verdict (not due until 2026-09-10); Siemens S7 joint-advisory re-read (low priority, not re-probed); CVE-2026-16242 OpenShift/HyperShift (still out of window); the Keycloak Red Hat product-state correction (low priority, meta-fact only); Boston Scientific cybersecurity incident (re-checked news.bostonscientific.com's 2026-08-29 update, CrowdStrike now named as the IR firm, scope confirmed on-premise-only, but still no attacker attribution, vector, or ransom claim from any party; the blocking condition, no evidence-bound ATT&CK mapping possible, has not resolved).

Single-source items: none; the one published entry is multi-source (six independent outlets fetched and cited).

Watchlist: no product or supplier watchlist configured for this deployment (config/org-profile.yaml); the product and supplier sweeps were no-ops as a result; the sector/region lens was applied in their place.

Coverage gaps: schneier (Atom feed returned zero items via the jina fallback transport); inside-it.ch's "Insel Gruppe verschiebt Wechsel zu ServiceNow" article (403 on every transport tried, flagged as a lead pointing to a possible Bern-hospital-group security incident, not corroborated); cisa-advisories, cisa-directives (reachable, but no server-rendered listing content this run; two consecutive runs now, per the state digest's fetch_gaps_in_window; KEV JSON and CSAF mirror covered the exploited-vulnerability and ICS surfaces in their place); edpb, us-treasury-ofac (bridge returned page chrome without the actual listing; no lead pointed to either source this run).

Essential-coverage: no misses; all essential-tier sources across all four domains were attempted and returned content (even where that content held no in-window item).