USA Cybersecurity Status in September 2026

Threats and active campaigns in the USA

Ransomware and extortion, with separate taxonomy

In September, five cases were recorded in the United States with ransomware or extortion as the primary focus, but the material does not allow them to be treated as one homogeneous set. There was one case of exfiltration without encryption, four publications whose exact classification cannot be determined from the material, and several victim mentions on leak sites that do not, by themselves, prove operational impact.

Exfiltration without encryption: Fort Smith

Fort Smith fits best as simple extortion with a claim of mass data theft. The city acknowledged intrusion and forensic work, and tracking sources speak of data theft and publication on a leak site, but not verified encryption in the consolidated material. The case falls into the realm of disclosure pressure, not confirmed unavailability.

Classification cannot be determined: Eudora, Sutton, and other local cases

Eudora had confirmed encryption, according to the former IT administrator, but in other incidents during the month the classification cannot be pinned down with the same certainty. Sutton, Fort Smith, and some notices from hospitals and providers appear as incidents with ongoing activity, group postings, or open investigations, without enough evidence to label them all as encryption, exfiltration, or a simple victim claim.

Leak-site mention only: OnTrac, Electrolux, and other posts

Monitoring from ransomware.live and other platforms added victims such as OnTrac and Electrolux, along with other organizations, but in several of those cases the source only documents the group's post. That does not amount to confirmed operational impact. The distinction matters because a leak-site appearance can be real, doubtful, or inflated, and the material does not always allow that gap to be closed.

Fraud and phishing, with one documented case

The only clearly documented fraud or phishing case in the United States during the period was the prosecution of two former Air Force members, tied to spam and phishing campaigns aimed at U.S. companies to steal credentials and use them in BEC fraud. The sentence was 111 months and 78 months in prison, plus restitution orders.

This confirms that phishing remains a useful entry point for financial fraud and account theft, even though the month was much more dominated by vulnerability exploitation than by mass email campaigns. The signal is smaller in volume, but not in legal sensitivity.

APT, espionage, and advanced intrusion activity

The month's advanced activity centered on the FBI cases, the DMDC, the movements around ShinyHunters, and the OpenAI episode involving federal sites. Not all of that is APT in the strict sense, but it does reflect an intrusion environment closer to reconnaissance, unauthorized access, credential theft, and selective exfiltration than to pure ransomware.

Coverage of NetScaler also showed the use of custom malware and early exploitation before Citrix's public announcement, suggesting campaigns with planning and preparation. In parallel, the OT and ICS front had a different signature, not so much exfiltration as pre-positioning, SCADA hunting, and preparation of compressed files with network schematics and configurations.

Critical vulnerabilities with impact in the USA

September’s technical agenda was defined by active exploitation, KEV additions, and aggressive remediation deadlines. CISA moved against edge appliances, Windows, Linux, collaboration products, commerce platforms, and administration tools that faced real pressure, not just theoretical risk.

Regulation and compliance in the U.S.

September ended with a more active regulatory front than August, especially in banking, telecom, healthcare, privacy, and AI governance. Seven documented regulatory moves stood out, with notable intensity in building frameworks for third parties, incidents, and reporting obligations.

The SEC moved beyond the Reg S-P grace period and reminded regulated firms that they must have written incident response programs, notify customers within 30 days at most, and require vendors to report breaches within 72 hours. In parallel, the OCC updated its Cybersecurity Supervision Work Program to align it with NIST CSF 2.0, without creating new regulatory expectations, but making the exam focus for national banks and federal savings associations clear.

The Fed kept pushing the discussion on vendor risk and AI exposure. Michelle Bowman spoke about protecting banks, especially smaller ones, from risks tied to external services and AI. That was joined by the interagency debate over third-party risk management, with greater scrutiny of core providers and critical vendors.

In telecom, senators advanced a voluntary certification bill for providers and suppliers, in response to the debate that followed Salt Typhoon. In healthcare, Warner and Wyden reintroduced the Health Infrastructure Security and Accountability Act, with mandatory minimum standards, audits, continuity plans, and a $1.3 billion allocation to strengthen hospital cybersecurity.

CISA and the FBI also shaped the regulatory agenda with guidance on third-party ICS integrators. The guidance calls for reducing public exposure, logging remote access, maintaining hardware and software inventories, including security requirements in contracts, and preserving independent operating capability. It is a regulatory intervention grounded in a real attack pattern and aimed at lowering systemic risk across the industrial supply chain.

Most affected sectors in the USA

Healthcare was the most pressured sector, although the pressure did not come only through ransomware. There were incidents at hospitals, health providers, a major health tech player, and cases involving medical or sensitive data, alongside regulatory concerns tied to HIPAA, hospital security, and operational continuity. The signal is clear: healthcare remains a high-value target for information theft, extortion, and disruption.

Government and the public sector also had a difficult month. The FBI, the DMDC, local governments such as Fort Smith and Sutton, and the OpenAI episode involving federal portals showed a pattern of risk around identity, access, and administrative data. In this area, the problem was not a single type of attack, but the overlap between intrusion, data exposure, and dependence on vendors or third-party systems.

Water and OT carried disproportionate weight for the month’s total volume. Colorado and alerts about water utilities in other states showed that remote access and PLCs remain a weak point. The CISA and FBI guidance for ICS integrators was not an isolated piece, but a direct response to a problem that had already materialized.

Finance appeared through regulatory pressure and data incidents, but also through pressure on third parties, core vendors, and oversight. The OCC, the Fed, the FTC, and September legislative proposals put banks at the center of a broader debate on operational resilience, consumer protection, and the use of technology vendors.

Energy and transportation saw less volume, but high risk because of their critical nature. The tankers under investigation in the Gulf of Mexico and the CenterPoint Energy case show that vectors affecting OT, IT, and customer data can coexist. In telecommunications, the discussion shifted more toward public policy, although interest in certification and vendor resilience points to sustained concern.

Trends and signals to watch in the USA

Compared with August, volume fell sharply from 92 to 53 verified incidents, but risk did not ease. Unclassified incidents, ransomware or extortion cases, and documented fraud or phishing declined, while critical CVEs mentioned rose from 18 to 27. Last month was dominated by ransomware, this month by vulnerabilities. That reversal is the main tactical signal.

The second signal is the consolidation of the edge and remote access as the most urgent attack surface. SonicWall, Citrix, Mikrotik, WSO2, VMware, Check Point, and Microsoft products appeared with active exploitation or added to the KEV. The market for appliances and internet-exposed software continued to serve as the first line of impact for attackers, with objectives ranging from initial access to positioning for later intrusion.

The third trend is the growing density of incidents in third-party and vendor environments. The FBI case, the debate over ICS integrators, the interagency banking guidance, and regulatory moves on core providers and external service providers point in the same direction. This is not only about vendor audits, but about operational continuity in the face of critical dependency.

In health care and local government, September showed that the combination of exfiltration, ransomware, and administrative exposure remains active, but with fewer mass cases than in August. At the same time, the narrative of AI-assisted attack appeared less as a direct operational fact in the USA and more as a broader risk context, especially in the campaigns described by Anthropic and Unit 42 in other arenas.

The most relevant signal for October is straightforward: the pace of KEV publication and mitigation deadlines will continue to shape the defense agenda. If last month was the warning of a ransomware surge, September was the reminder that vulnerability exploitation remains the fastest path to compromise services, data, and industrial networks.

Security recommendations for teams in the USA

Prioritize patching edge and remote access appliances, with a focus on NetScaler, SonicWall, WSO2, Mikrotik, VMware, Check Point, and Microsoft products that were added to KEV or showed active exploitation. In organizations with public exposure, the remediation window should be measured in hours, not weeks.

Review third-party dependencies immediately, especially ICS integrators, core banking providers, and external services with persistent remote access. Contracts should include session logging, hardware and software inventory, accelerated incident notification, and the ability to operate without the integrator if that third party is compromised.

In government, health care, and utilities, strengthen monitoring for identity, authentication, and exfiltration. The FBI, Astrana, CenterPoint, and Fort Smith cases show that initial access still comes through credentials, impersonation, or exposed systems. Protecting the perimeter is not enough if sensitive data is already reachable internally or through connected portals.

In OT and water environments, limit direct internet exposure, log and segment remote access, and keep manual procedures ready. The CISA and FBI guidance on ICS integrators, along with the Colorado case, shows that operational continuity depends on both architecture and operational discipline.

For response teams, distinguish precisely between encryption, simple extortion, and mere publication on a leak site. That distinction is essential to avoid overestimating or underestimating the event, measure the real impact, and communicate with legal, executives, and regulators without mixing unverified claims with confirmed intrusions.

Frequently Asked Questions

What changed between August and September 2026 in the USA?

September saw fewer verified incidents than August, 53 compared with 92, and far less ransomware. At the same time, pressure on critical vulnerabilities increased, with 27 CVEs mentioned versus 18 the month before. The main signal shifted from ransomware to technical exploitation, especially on exposed edge devices and remote access.

Which sectors were most exposed this month in the USA?

Healthcare, government, water, finance, energy, telecommunications, transportation, and digital services all had documented incidents. The most sensitive combination crossed government and defense, with the FBI and the DMDC, while water and OT stood out because of the Colorado cases and the CISA-FBI guidance for ICS integrators.

Which vulnerabilities drove the operational urgency in the USA?

Citrix NetScaler, SonicWall SMA1000, Microsoft Windows, WSO2, Adobe Commerce, SharePoint, Mikrotik RouterOS, and the Linux kernel dominated the agenda. The common thread was active exploitation or inclusion in CISA’s KEV catalog, which forced immediate patching priority in exposed environments.

How should the month’s five ransomware or extortion cases be read?

They should not be grouped as a single block. One is better characterized as exfiltration without encryption, four do not allow the impact type to be determined with certainty, and in several cases the source only records publication on a leak site. That distinction changes the damage assessment completely.

What does the US regulatory front mean for banks and vendors?

It means tighter oversight of third parties, greater documentation demands, and less room for informal responses. Reg S-P already requires rapid notification, the OCC aligned its work with NIST, the Fed strengthened its focus on vendors, and the TPRM debate points to core providers with stricter responsibilities.

Material limitations

This report was prepared exclusively from the material provided for the US and September 2026. The 53 verified facts from the period are the basis for all indicators. The three facts in the comparative frame block were used only for month-over-month trend analysis and do not count toward the month’s volume. The four facts without confirmed dates were excluded from the indicators.

A zero value, especially for CVEs or categories such as fraud, does not mean the phenomenon is absent in the United States or across the region. It means it did not appear in the material analyzed for this period with the level of confirmation required by these rules.

The report’s stated time window includes 53 facts dated in September 2026, plus three facts from earlier months used only for comparison, and four without confirmed dates excluded from the counts. The material does not include aggregated telemetry such as incidents, and any figure for attempts or blocks should be read, if it appears, as operational noise and not as a confirmed intrusion.

Consumer social media posts and sponsored content were also excluded as evidence. When third-party mentions were used, priority was given to official bodies, vendor notices, CISA, FBI, SEC, OCC, Fed, and other primary or directly observed sources. When a claim depended only on attacker attribution or secondary coverage, it was treated as such and not as a closed fact.