February 2026 was a month defined by the fragile interconnectedness of our digital ecosystems. As organizations across the healthcare, retail, and tech sectors faced a wave of disruptive attacks, a clear pattern emerged: the most devastating breaches are no longer just about gaining access—they are about the strategic exploitation of the administrative and third-party tools we trust most. From rogue browser extensions to massive leaks of patient data, the incidents of February underscore the reality that cybersecurity is a battle of visibility.

TriZetto Provider Solutions

Healthcare Supply Chain: Massive Cascading Exposure Hits Provider Networks

In one of the most significant administrative breaches of the year, TriZetto Provider Solutions disclosed a cybersecurity event that sent shockwaves through the American healthcare system. According to official filings and partner notifications from organizations like the San Francisco Community Health Center, unauthorized actors gained access to TriZetto’s systems, potentially compromising the personal and protected health information (PHI) of millions. As a major clearinghouse for healthcare claims, the impact was not localized; it trickled down to hundreds of individual clinics and providers whose patient data passed through TriZetto’s infrastructure. The event highlights a critical vulnerability: when a single administrative giant is compromised, the blast radius can span the entire nation.

QualDerm Partners & UMMC

Ransomware and Persistence: A Critical Month for Medical Infrastructure

The healthcare crisis deepened in February as QualDerm Partners and the University of Mississippi Medical Center (UMMC) both navigated significant security failures. QualDerm, which manages a vast network of dermatology practices, reported a breach affecting over 3 million records after an intrusion into its digital environment. Simultaneously, UMMC grappled with a severe ransomware attack that moved beyond data theft, actively crippling IT systems and forcing medical teams to revert to manual processes. These incidents reflect a brutal reality in 2026: healthcare is being targeted not just for its data, but for its operational dependency on uptime, making it the primary theater for high-stakes extortion.

ManoMano

Retail Vulnerability: 38 Million Records Allegedly Exposed via Zendesk Exploit

European DIY and gardening giant ManoMano faced a massive reputational and security challenge in February following reports of a breach impacting an estimated 38 million customers. Security researchers at UpGuard and SecurityWeek noted that the intrusion likely originated from a compromised Zendesk account—a third-party customer support platform. By exploiting this service integration, threat actors were able to exfiltrate vast amounts of customer metadata and contact information. This case serves as a loud warning about “SaaS sprawl”—where every new integration creates a new, often unmonitored, gateway into the corporate core.

Panera Bread & Substack

The Extortion Cycle: From Data Leaks to Class-Action Fallout

Following an initial incident in January, February saw the full weight of the fallout hit Panera Bread. The ShinyHunters extortion group, retaliating for an unpaid ransom, published a massive archive of data belonging to over 5 million accounts. This move immediately triggered a wave of class-action lawsuits, highlighting the legal and financial “tail” that follows a modern breach. Similarly, the publishing platform Substack confirmed that a large-scale scraping and data event had exposed the contact information and metadata of nearly 700,000 users. While no passwords were taken, the incident fueled concerns about how seemingly “minor” metadata can be weaponized for targeted phishing and identity theft.

The “AgreeTo” Outlook Add-in

Rogue Integrations: 4,000 Credentials Stolen via Malicious Add-on

A specialized but highly alarming incident was reported by Malwarebytes involving the “AgreeTo” Microsoft Outlook add-in. What was once a legitimate productivity tool was effectively hijacked by threat actors, turning it into a credential-harvesting machine. Before it was identified and removed, the rogue add-in successfully stole over 4,000 sets of Microsoft account credentials and payment details from unsuspecting professionals. This event marks a shift in attacker tactics, moving away from traditional phishing emails toward the “trojanization” of the very tools employees use to stay organized.

The Governance Gap

The lesson of February 2026 is that our security is only as strong as our least-monitored integration. Whether it’s a national healthcare clearinghouse like TriZetto, a customer support tool at ManoMano, or a simple calendar add-in for Outlook, the common thread is the exploitation of trusted pathways. For organizations to survive this environment, the strategy must evolve from perimeter defense to radical transparency—knowing exactly what tools are connected to your data and having the ability to kill those connections the moment a red flag appears.