Four EU member states referred to court, the Netherlands' NIS2 law enters force August 15, Germany's BSI is auditing 29,000 entities, and the EU published its first AI-cybersecurity action plan. Here's everything that changed in June–July 2026.
15,000 Fortinet credentials exposed. 27 million recovered from dismantled infostealers. A French national registry breached through one government account. Meanwhile, Europe is advancing post-quantum authentication and AI-driven identity security. 8 key stories and what they mean for your team.
This week: 86,000 Fortinet devices compromised, 24 billion credentials leaked, OAuth tokens stolen via a forgotten service account, and an AI agent exfiltrated AWS credentials in under two minutes. 14 incidents, one pattern — and three actions your team can take right now.
Bulgaria's NIS2 grace period ended on 1 June 2026 — board members now face full personal fines, not the discounted 50% rate that applied through May. Luxembourg's NIS2 Directive transposition law entered into force on 10 May 2026, leaving four member states still without implementing legislation....
APT28 hijacked 18,000 routers to steal OAuth tokens. Storm-2372 bypassed MFA without touching a password. 28.6 million secrets leaked on GitHub. April 2026's biggest incidents — and what they have in common.
84% of in-scope organizations admit they're not ready. Belgium set the first conformity assessment deadline on April 18, 2026. The Netherlands is days away from enforcement. Here's where the regulatory wave stands and what IT leaders need to act on now.
Spring 2026 brought the EU's most significant institutional breach, its first cyber sanctions of the year, and four major cybersecurity regulations enforcing simultaneously. NIS2, DORA, CRA, and CSA2 now set hard deadlines — and real penalties. Here's what changed, who's affected, and what to do.
