Security  ·  May 20, 2026

Grafana was breached yesterday. Vercel in April. Stryker in March. None of them were sophisticated attacks.

IBM's X-Force Threat Intelligence Index 2026 found supply chain attacks quadrupled in five years. North America became the most attacked region for the first time in six years. The root cause in almost every major breach of 2026 was not a zero-day exploit — it was an ordinary operational failure that was completely preventable.

The Grafana Labs breach became public knowledge on May 19, 2026. The company's investigation confirmed that the intrusion originated from the TanStack npm supply chain attack — a compromised open-source package that had circulated through the dependency ecosystem before being identified. The attack reached Grafana's GitHub environment, exposing private source code, internal repositories, business contact information, and what Grafana described as "internal operational information and other details about our business." No customer production systems were confirmed compromised.

That last sentence — no customer production systems compromised — is the most favorable reading of the incident, and it should be understood for what it is: a statement about the attacker's objective and capability on the day of the breach, not a statement about what was possible given the access that was obtained. Private source code for one of the most widely deployed visualization tools in enterprise infrastructure is not a trivial exposure. The access path that the TanStack npm attack provided was not specific to Grafana — any organization consuming that package through its dependency chain was potentially exposed. The question of how many organizations actually were, and have not yet disclosed it, remains open.

The TanStack npm attack: how an open-source package becomes an enterprise threat

To understand why the Grafana breach matters beyond Grafana, it is necessary to understand how supply chain attacks through npm work at a structural level. The Node Package Manager registry hosts over two million packages. Large applications commonly have hundreds or thousands of dependencies, many of them transitive — packages that depend on other packages that the application developer never explicitly chose to include. The TanStack library, which provides table, query, and routing utilities for JavaScript applications, is consumed directly or transitively by a very large number of enterprise web applications.

In the TanStack attack, malicious code was introduced into a published version of the package. Any application that updated its dependencies to include the compromised version pulled the malicious code into its build environment. For organizations using automated dependency updates — a common practice in CI/CD pipelines designed to stay current with security patches — the compromise happened without any human making a deliberate decision to include the malicious code.

The attack vector is not exotic. Variants of this pattern have been documented repeatedly over the past several years. The event-stream incident in 2018, the ua-parser-js compromise in 2021, the colors/faker sabotage in 2022, the XZ Utils backdoor in 2024 — supply chain attacks through package registries have been a known and documented threat for nearly a decade. The quadrupling of supply chain breaches documented in IBM's 2026 index reflects not an increase in the novelty of the attack vector but an increase in its systematic exploitation, likely with AI assistance that makes identifying vulnerable packages and constructing malicious code modifications faster and more scalable.

"While AI platforms themselves may become direct targets, the larger risk is the increased volume and sophistication of credential harvesting enabled by AI-assisted phishing and infostealer malware."

— Christopher Caridi, Cyber Threat Analyst, IBM X-Force

The Vercel incident: the OAuth graph as the new perimeter

The April 2026 Vercel breach reveals a different threat vector that is, if anything, more immediately relevant to most organizations than the npm supply chain attack. One Vercel employee authorized Context.ai — a third-party AI productivity tool — with broad Google Workspace permissions. Two months later, Context.ai was compromised through a Lumma Stealer infostealer infection at the vendor. The attacker inherited the OAuth trust chain the employee had established in February. The compromised access included employee records, access keys, API keys, GitHub and NPM tokens, and non-sensitive environment variables.

What makes this incident particularly instructive is the detection failure. Vercel's security team did not discover the breach. The attacker disclosed it publicly when choosing to monetize the stolen data. The breach had a two-month dwell time — two months in which the attacker had the access they obtained and Vercel had no visibility into the compromise. The security controls in place, whatever they were, did not surface the anomalous authentication behavior that should have been visible during that window.

The PKWARE 2026 breach analysis draws the appropriate conclusion: one employee granting broad Workspace permissions to a third-party AI tool gave attackers an inherited trust path into Vercel. The breach was not discovered by the security team; it was discovered when the attacker chose to monetize publicly. The OAuth graph is now the new perimeter, and most companies have no inventory of which third-party apps their employees have authorized.

The scale of the OAuth permission problem across enterprise environments is difficult to overstate. A survey of enterprise Microsoft 365 and Google Workspace environments consistently finds that the average organization has hundreds to thousands of third-party applications authorized to access corporate data — email, calendar, documents, code repositories, and HR systems. Many of these authorizations were created by individual employees for personal productivity tools, AI assistants, note-taking apps, or browser extensions. They are rarely audited, rarely revoked when the employee stops using the tool, and almost never reviewed for scope appropriateness.

Every AI productivity tool that an employee connects to corporate email or calendar is a potential lateral entry point. The permission is typically granted in under sixty seconds. It may persist for years. In the current environment, where enterprise AI tool adoption is being actively encouraged and employees are given wide latitude to experiment with productivity applications, the OAuth graph is expanding faster than any security team is auditing it.

Stryker and the geopolitical dimension

The March 2026 Stryker incident added a different dimension to the breach landscape. Stryker — a medical technology company — experienced a large cyberattack linked to an Iran-aligned hacktivist group. Employees reportedly watched as company computers were wiped in real time. The attack forced offices to shut down while security teams investigated. The destructive nature of the attack — focused on operational disruption through data destruction rather than data exfiltration — reflects a pattern that IBM's 2026 index identifies as a growing trend: geopolitical cyberattacks against organizations connected to government, defense, or healthcare sectors.

The World Economic Forum's Global Cybersecurity Outlook 2026 situates this pattern in a broader framework. Geopolitics, it argues, has become a defining feature of the cybersecurity landscape — a structural shift from the earlier era in which most attacks were financially motivated criminal enterprises. State-aligned actors are now a routine part of the threat landscape for a much wider set of organizations than was historically the case. Organizations that would previously have considered themselves below the threshold of interest for nation-state actors — mid-sized manufacturers, regional healthcare providers, technology subcontractors — are now within the targeting aperture of geopolitically-motivated attackers, particularly when those organizations have supply chain connections to higher-profile targets.

Why North America is now the most targeted region

IBM's finding that North America surpassed Asia Pacific to become the most targeted region — absorbing 29% of all X-Force incident response cases in 2025, up from 24% in 2024 — reflects a deliberate reorientation of attacker focus. The concentration of frontier AI development, valuable intellectual property, financial infrastructure, and critical technology supply chains in North American organizations makes the region an increasingly high-value target as AI-assisted attack tooling lowers the cost of sophisticated campaigns.

The IBM X-Force data also captures an important dynamic around AI's role in accelerating attacks. Some cybercriminal groups can now breach a network and begin spreading laterally in under thirty seconds. AI-assisted vulnerability discovery has compressed the window between a published CVE and active exploitation to hours in some cases — significantly shorter than the patching cycles of most enterprise environments. This speed asymmetry is the fundamental challenge of the current threat environment: defenders operate on quarterly patch cycles and change management processes; attackers operate on the timescale of automated exploitation pipelines.

"Misconfigured systems, delayed patching, and insufficient access controls remain prime entry points, especially when adversaries are now leveraging AI to reduce the time between a published vulnerability and a live exploit to mere hours."

— Prime Secured, Top Cybersecurity Threats 2026

The CVE-2026-42897 Exchange vulnerability and the patching problem

The active exploitation of CVE-2026-42897 — a cross-site scripting spoofing vulnerability in on-premise Microsoft Exchange Server, CVSS score 8.1 — illustrates the patching problem with particular clarity. This vulnerability was disclosed by Microsoft and is under active exploitation in the wild as of this week. Organizations running on-premise Exchange are exposed until they apply the patch. The number of organizations still running on-premise Exchange in 2026, years into Microsoft's cloud migration push and after multiple high-profile Exchange vulnerabilities, is not small. The enterprise inertia around legacy infrastructure continues to provide attackers with stable, known attack surfaces.

The Linux CVE-2026-31431, dubbed "Copy Fail" or "DirtyCBC," is a separate and equally concerning example. This local privilege escalation vulnerability affects virtually every major Linux distribution running kernels from 2017 onward. A proof-of-concept 732-byte Python exploit is now publicly available. CISA added it to the Known Exploited Vulnerabilities catalog with a May 15 remediation deadline for federal systems. The vulnerability allows any unprivileged local user to obtain root access — meaning that any organization with a compromised web application, a phished low-privilege account, or a container escape is one Python script away from full system compromise on affected Linux hosts.

These are not edge cases in the vulnerability landscape. They are high-severity, actively exploited vulnerabilities in widely deployed infrastructure, with available patches, sitting unpatched in enterprise environments because the patch management processes that should be routine are consistently slower than the exploitation pipelines targeting them.

The AI security incident gap: 50% of orgs affected, 33% unprepared to investigate

Proofpoint's 2026 AI and Human Risk Landscape report — which informed the Hornetsecurity Monthly Threat Report for May 2026 — contains findings that should concern any CISO who has been told their AI security posture is adequate. Half of global organizations experienced a confirmed or suspected AI-related security incident in 2026. This figure includes organizations that reported having AI security controls in place — 63% of respondents. Having AI security controls and experiencing an AI-related security incident are not mutually exclusive, and the frequency with which they are co-occurring suggests that the controls being deployed are insufficient for the threat environment they are meant to address.

Only one-third of organizations report being fully prepared to investigate an AI-related security incident. This gap — between deployment speed and investigative readiness — is structurally predictable. Organizations are deploying AI tools rapidly because competitive pressure demands it. The security teams responsible for investigating incidents when those tools are compromised are building capability more slowly, because building effective incident response for AI-specific threat vectors requires understanding the tools, their access patterns, and their failure modes in ways that are genuinely new.

The finding that should change enterprise security strategy

The most important finding across the IBM X-Force index, the Proofpoint report, and the specific breach investigations of 2026 is not about any individual attack vector. It is about the consistent gap between the sophistication of the attacks and the sophistication of the failures that enabled them. The Grafana breach required a compromised npm package — a known attack vector with available mitigations. The Vercel breach required one OAuth permission grant with no subsequent audit. The Exchange vulnerability exploitation requires running unpatched infrastructure against a known CVE with an available fix.

The breaches that are dominating headlines in 2026 are not the product of nation-state actors using zero-day exploits against hardened targets. They are the product of ordinary operational failures: unaudited dependencies, unreviewed OAuth permissions, delayed patch deployment, insufficient authentication controls. The sophistication gap is not between attacker and defender capability. It is between the available defensive measures and the discipline required to implement and maintain them consistently.

Organizations that "experience fewer credential-based incidents," IBM's X-Force notes, are those that "consistently enforce phishing-resistant MFA and apply strong identity management practices such as conditional access, least-privilege access and continuous monitoring of authentication behavior." These capabilities have been available for years. Their inconsistent deployment is a choice — usually a choice made under budget pressure, prioritization tradeoffs, and the assumption that the probability of being targeted is lower than it actually is.

The 2026 breach data suggests that assumption needs to be revised. The attack surface is large, the tooling available to attackers is increasingly automated and AI-assisted, and the time between vulnerability disclosure and active exploitation has compressed to hours. The organizations that treat security as a continuous operational discipline — not a project to be completed — will continue to generate fewer headlines. The others will generate more.