Cybersecurity 2026: the most serious breaches of the first half

The context: a first semester under siege

2026 opened with unprecedented pressure on global digital infrastructures. According to the report published by TechCrunch on June 7, 2026 , the most serious cases include massive violation of the DOGE system, intrusion into critical energy and water networks, and compromise of an FBI surveillance system. Therefore, no sector can consider itself immune.

In Italy, the situation is just as worrying. The National Cybersecurity Agency has reported an uptick in incidents within manufacturing and professional services. Plus, small and medium-sized businesses are the most exposed group, mainly because they often lack proper security setups. As a result, getting a handle on these six-month trends is step one for fighting back effectively.

The numbers that matter: frequency, vectors, and costs

Analyzing the available data, three significant metrics stand out. First of all, frequency: the number of significant breaches in the first half of 2026 already exceeds the total for the whole year of 2023. Secondly, attack vectors: advanced phishing and software supply chain vulnerabilities remain the preferred channels. Finally, costs: according to the IBM's Cost of a Data Breach Report , the average global cost of a breach has exceeded $4.8 million.

However, for Italian SMEs, the direct economic damage is only part of the problem. Reputational damage and loss of trust from B2B customers often have more lasting consequences. In fact, in industrial supply or professional services contexts, a security incident can lead to immediate contract terminations.

• Ransomware: present in 67% of serious incidents this semester
• Supply chain attack: up 43% compared to the first half of 2025
• Critical infrastructure affected: energy, water, transport, healthcare
• Average detection time: still over 190 days in the most serious cases

Therefore, the time window between intrusion and detection remains the critical point to address.

Anatomy of the most serious breaches: what really happened

The DOGE case is probably the most iconic incident of the past six months. A massive government database was stolen and then put up for sale on dark web forums. On top of that, the breach leaked sensitive metadata about public contracts, which could spell trouble for dozens of private suppliers.

Attacks on energy and water infrastructure follow a different pattern instead. Specifically, these are persistent intrusions—known as APTs, or Advanced Persistent Threats—that lie dormant for months before triggering. Similarly, the breach of the FBI surveillance system showed that even organizations with heavy security resources can still get hacked through side doors and stolen credentials.

For SMEs, the operational lesson is clear. Despite this, many companies continue to treat cybersecurity as a cost to be minimized rather than a strategic investment. Therefore, the gap between risk awareness and concrete action remains the real structural problem.

Strategic reading: three recurring patterns in 2026

Looking across the incidents of the semester, Gartner identifies three dominant patterns that deserve specific attention from medium-sized organizations.

Pattern 1 — The supplier chain as an entry point. More and more often, the attacker doesn't hit the final target directly. Instead, they compromise a software supplier, a logistics partner, or a third-tier cloud provider. Therefore, the perimeter security of a single company becomes insufficient if not accompanied by a risk assessment of the entire digital supply chain.

Pattern 2 — Identity as the new perimeter. Stolen or poorly managed credentials are the root cause of over 60% of serious incidents. In particular, multi-factor authentication is not yet universally adopted in Italian SMEs. Therefore, a relatively small investment in identity management yields a disproportionate security return.

Pattern 3 — Ransomware becomes selective. Criminal groups have abandoned indiscriminate mass campaigns. Instead, they select specific targets based on estimated payment capacity and data criticality. Consequently, SMEs with revenues over 10 million euros are increasingly in their sights.

Impact on Italian SMEs: systemic vulnerabilities and intervention opportunities

Italian B2B SMEs have some structural vulnerabilities that make them particularly exposed to the trends described. First of all, the reliance on outdated legacy software is still widespread, especially in manufacturing and retail. Furthermore, privileged credential management is often informal, left to undocumented practices.

However, there are also concrete opportunities for rapid intervention. The consulting on AI solutions applied to security is opening up new scenarios even for non-enterprise budgets. For example, machine learning-based anomaly detection systems are now accessible as a cloud service, without requiring dedicated infrastructure.

Similarly, staff training—often overlooked—remains the most effective defense against phishing. Therefore, a structured awareness program, even a short one, significantly reduces the human attack surface. We at SHM Studio we observe that many clients underestimate this aspect until the moment of the incident.

The construction site still open: NIS2 and compliance as a strategic lever

The NIS2 Directive, as adopted into Italian law, sets strict rules for a much wider range of organizations than before. Specifically, many small and medium businesses that supply essential operators now fall under the new rules. So, compliance is no longer just something big corporations have to worry about.

However, NIS2 shouldn't just be seen as an obligation. On the contrary, it represents an operational framework that, if adopted methodically, concretely improves a company's security posture. Among other things, organizations that have already started adaptation processes show significantly shorter incident response times.

For companies that want to delve deeper into the topic also in the dimension of digital presence, the design of secure web infrastructures and the correct configuration of authentication systems are concrete starting points. Furthermore, the secure management of data collected through digital campaigns — including google ads campaigns and the LinkedIn campaigns — requires increasing attention in a stricter regulatory context.

Operational implications: priorities for the second half of 2026

Based on the analyzed trends, it is possible to identify an operational priority order for SMEs that want to face the second half of the year with greater resilience. We at SHM Studio we summarize the main indications.

• Digital supply chain audit: map all software vendors and cloud services in use, verifying their security policies and compliance certificates.
• Identity and access management: implement MFA on all critical systems and review access privileges quarterly.
• Incident response plan: have a documented plan that defines roles, response times, and communication procedures in case of a breach.
• Backup and disaster recovery: verify that backups are isolated from the main network and periodically test the restore.
• Continuous training: structure awareness sessions at least semi-annually, with targeted phishing simulations.

Furthermore, companies that invest in digital visibility and in digital marketing strategies must consider security as an integral part of their online presence. In fact, a compromised site or a campaign hijacked by malicious actors causes damage that goes far beyond the technical perimeter.

In summary, the first half of 2026 made it clear that cybersecurity is no longer a specialized topic. It's an enabling condition for any structured digital activity. To delve deeper into how to integrate these aspects into an overall digital strategy, you can contact the SHM Studio team or explore the resources available in the Blog . Finally, those who manage digital content and communication will also find the section dedicated to useful SEO copywriting , where content security and its optimization meet.