11-Sep-2026 | McKesson Breach, AI-Powered PaperCut Attacks and EU Cyber Rules

Hacked dAily is the first AI-driven cybersecurity podcast, created by Cytadel Cyber and published daily for CISOs, security leaders, and business decision-makers. Today’s briefing: 1. McKesson: A cyberattack linked to ShinyHunters may have exposed data belonging to about 6.4 million patients, employees, and healthcare providers. The incident highlights the privacy, regulatory, and operational risks facing healthcare suppliers and their connected ecosystems. 2. EU Cyber Resilience Act: Manufacturers of connected products will face strict deadlines to report exploited vulnerabilities and serious incidents. The rules increase legal and operational pressure on vendors while moving cyber disclosure from best practice toward mandatory compliance. 3. AI-powered PaperCut attacks: A suspected Russian-speaking group used hundreds of AI agents and offensive tools to compromise at least 440 systems across 395 organizations in 48 countries. The campaign demonstrates how AI can compress the path from vulnerability testing to large-scale intrusion, increasing risks for enterprises worldwide. 4. Voice attacks and personal devices: Researchers warn that attackers are using phone-based social engineering and bring-your-own-device arrangements to bypass Microsoft 365 protections. Unmanaged smartphones and persuaded users can provide a route to corporate data despite strong controls on company systems. 5. Conti ransomware conviction: A Ukrainian national received four years in prison for supporting the Conti gang, which targeted more than 1,000 organizations and extorted victims in Bitcoin. The case reinforces that ransomware developers and affiliates can face serious criminal consequences years after attacks, even when operating overseas. Hacked Daily is sponsored by Cytadel, an offensive cyber assurance company specialising in AI-powered attacks. Cytadel’s expert-led Red Team Assessments follow real attack chains across people, identity and technology to verify whether they can become AI fraud or ransomware disruption. We verify your defences before attackers do. Learn more at cytadel.co.uk.