SharePoint Flaws Still Open, Microsoft 365 Accounts Hacked, and AI Script Leaks 95,000 Emails

by TC3 Research Desk | Oct 4, 2026

SharePoint security updates are critical because Warlock ransomware continues exploiting unpatched vulnerabilities that have been available for over a year, putting small businesses at immediate risk of breach and operational downtime. Four major threats emerged this week affecting Microsoft 365 users, backup systems, and AI tool deployment.

In today's October 4th, 2026 cybersecurity update for small business owners:

WARLOCK RANSOMWARE EXPLOITING SHAREPOINT: The Warlock ransomware group continues to exploit year-old unpatched SharePoint vulnerabilities (collectively dubbed ToolShell) to breach water utilities, telecommunications companies, governments, and universities worldwide. Despite patches being available for over a year, organizations running outdated SharePoint installations remain at risk. Small businesses using SharePoint should immediately verify all security updates are installed.

NIKKEI MICROSOFT 365 BREACH: Japanese business newspaper Nihon Keizai Shimbun (Nikkei) suffered a cyberattack compromising Microsoft 365 accounts, resulting in 9,000 spoofed emails being sent and potential exposure of cloud data belonging to 1,646 individuals. The incident demonstrates the importance of enabling multi-factor authentication on all Microsoft 365 accounts to prevent account takeover attacks.

SINGAPORE AI-RELATED DATA BREACH: Singapore reported its first AI-related data breach after an employee used a generative artificial intelligence tool to create a Python script that inadvertently exposed email addresses of 95,000 customers. The April 25th incident highlights new risks when employees use AI coding assistants without proper review processes, particularly when handling customer data.

TERREBONNE PARISH CYBERATTACK: Terrebonne Parish in Louisiana is working to restore government services after a suspected cyberattack disrupted systems, preventing residents from paying bills online and accessing various parish services. The incident reinforces the need for offline backup systems that are disconnected from primary networks.

OIL TANKER PROPULSION SYSTEM BREACH: The U.S. Coast Guard and FBI boarded a U.S.-bound oil tanker after discovering hackers had breached the vessel's propulsion system. This incident is part of a broader pattern of cyberattacks targeting operational technology and industrial control systems, demonstrating that cyber threats now extend beyond data theft to physical system compromise.

Key takeaways for small business owners: Keep SharePoint and all software updated, enable multi-factor authentication on Microsoft 365, review AI-generated code before deployment, maintain offline backups, and secure any internet-connected industrial or building control systems.

Why is sharepoint security update so urgent for manufacturers and professional services?

Warlock ransomware targets outdated SharePoint installations (ToolShell vulnerabilities) used by utilities, telecom, and government agencies. Small manufacturers and professional services firms using SharePoint must verify all patches are installed immediately. The Nikkei breach shows Microsoft 365 accounts can be compromised without multi-factor authentication, exposing client data and reputation. Singapore's AI breach exposed 95,000 customer emails when an employee used an unapproved AI coding tool without code review. Terrebonne Parish lost resident access to bill payment systems for days. Action: Audit SharePoint patch status today, enforce MFA on all Microsoft 365 accounts, prohibit AI tools from processing customer data, and test offline backup recovery procedures.

Key takeaways

  • Verify SharePoint patches installed; Warlock exploits year-old ToolShell flaws affecting small businesses using outdated versions
  • Enable multi-factor authentication on all Microsoft 365 accounts to block account takeover attacks like the Nikkei breach
  • Review and restrict generative AI tool use for code generation, data handling, and customer information processing
  • Test offline backup and recovery procedures monthly; Terrebonne Parish lost services for days due to single network compromise

Frequently asked questions

How do I know if my SharePoint needs the security update?

Check your SharePoint version against Microsoft's latest patches. Run Windows Update or SQL Server updates if you host SharePoint on-premises. Contact your IT provider or MSP for verification. If your last patch was more than 3 months ago, assume you need updates.

What happens if we get hit by Warlock ransomware?

Warlock encrypts files and demands payment. Your business stops accessing documents, emails, and customer data. Services go offline until you pay (no guarantee files are restored) or restore from clean backups. Recovery takes days or weeks.

Do we really need multi-factor authentication if we have strong passwords?

Yes. Nikkei had strong security but attackers stole credentials and logged in without MFA, sending 9,000 spoofed emails before detection. MFA blocks account takeover even if passwords are compromised.

Can employees use ChatGPT or similar AI tools to write code?

Only if someone reviews the output before deployment. Singapore's 95,000 customer email exposure happened because an AI script went live without review. Require code review and prohibit AI tools from accessing real customer data during testing.

Sources

Keep reading

Produced with AI from TC3's daily cyber briefing video. Not individually reviewed before publishing; questions go to a human at [email protected].