July 2025 Cybersecurity Roundup

In late July, Microsoft on-prem SharePoint servers were mass-exploited, with the National Nuclear Security Administration (NNSA) among the victims. Officials said the impact was limited, but the campaign hit hundreds of organizations and highlights the risk of lagging on-prem patches versus cloud hardening. 

If you still run SharePoint on-prem, review Microsoft/CISA guidance and hunt for web shells. (Reuters, The Washington Post)

How to protect your organization: 

• Migrate to secure cloud services, as this can help reduce exposure to on-premises vulnerabilities.
  
• Apply vendor security patches immediately and verify the fixes have closed the vulnerability.
  
• Isolate critical systems when a breach is suspected to prevent lateral movement.
• Regularly audit access and credentials for outdated accounts and excessive permissions.

Why it matters: 

When critical flaws are found in widely used platforms, attackers race to exploit them before organizations can patch. Decision-makers can reduce risk to their organizations by moving high-value collaboration systems to managed, cloud-based environments and insisting on documented patch completion from their IT managers or vendors.

On July 21, Hong Kong’s privacy watchdog said 419,000 customers were affected by a Louis Vuitton data leak, following notices in other regions. The brand said payment data wasn’t obtained, but contact details and order info were exposed. Luxury retail’s sprawling data flows make tight vendor controls and rapid breach notification essential. (Reuters)

How to protect your organization: 

• Encrypt customer data both in transit and at rest to prevent unauthorized access.
  
• Have a breach response plan that includes timely regulatory and customer notifications.
  
• Limit stored personal data to only what is necessary for operations.
• Monitor systems for suspicious activity and investigate anomalies immediately.

Why it matters: 

Delayed responses can multiply financial, legal, and reputational damage, especially when regulators are involved and when the brand’s reputation is tied to exclusivity and trust. 

In the luxury sector, the customer base often includes high-profile individuals, making exposed contact and order information particularly valuable to scammers, phishers, and even competitors. Executives should ensure their organization has a tested breach response plan and only keep necessary data stored in the first place. 

Microsoft’s July 8 update addressed 137 vulnerabilities, including one publicly disclosed SQL Server zero-day and 14 rated Critical. 

With consideration to rapid exploit adoption, organizations must prioritize the security of internet-facing services and disable preview-pane processing where applicable. It is recommended to track Microsoft’s release notes and vendor write-ups for detection guidance. (BleepingComputer, Microsoft Security Response Center)

How to protect your organization: 

• Deploy SQL Server updates immediately and confirm installation of Microsoft OLE DB Driver 18 or 19 to fully mitigate the zero-day risk.
  
• Block Office document previews in Outlook and Windows Explorer until all Office updates are applied to prevent auto-triggering malicious files.
  
• Restrict SharePoint user permissions so that only trusted accounts have access until the patch is deployed.
• Create a “critical patch checklist” that includes verification steps and team sign-off to ensure nothing is missed during urgent updates.

Why it matters: 

These flaws expose platforms at the core of business operations, including databases, productivity suites, and collaboration tools. This makes them attractive targets for data theft and ransomware attacks. 

By formalizing these steps into a critical patch checklist with clear verification and team sign-off, leadership can make patching both faster and more reliable, preventing security gaps caused by oversight or miscommunication.