Cybercrime’s new wave: Clop’s zero-day theft, MFA gaps, and Latvia’s 1.2M data leak

A cluster of late-August 2026 reporting points to a coordinated escalation in cybercrime tradecraft, spanning ransomware-style data theft, identity attacks, and mass compromise of internet-connected devices. Cyberscoop reports that Clop, a prolific data-theft and extortion group, has exploited a critical zero-day vulnerability at large scale, claiming it stole data from dozens of organizations, including major publicly traded firms. BleepingComputer adds that password spraying attacks surged 155x in H1 2026, with Huntress observing campaigns that generated more than 81 million login attempts in just two weeks, enabled by legacy authentication and MFA policy gaps. Separately, The Record reports that Latvian officials resigned after a cyberattack exposed data tied to about 1.2 million people, roughly two-thirds of the country’s population, after the road traffic agency confirmed the breach. Geopolitically, the common thread is not just criminality but the erosion of trust in digital governance and the growing leverage of cyber operations over state capacity. Identity-layer weaknesses—especially MFA bypasses and inconsistent enforcement across login flows—create a low-cost entry point that can be exploited by both financially motivated actors and actors seeking strategic disruption. Latvia’s incident is particularly sensitive because it involves government-linked data at national scale, turning a cyber event into a political accountability test and potentially accelerating security spending, procurement changes, and tighter oversight of vendors. Meanwhile, the reported compromise of thousands of Dahua devices via credential attacks and authentication bypasses underscores how widely deployed surveillance/IoT ecosystems can become a force multiplier for attackers, including through peer-to-peer relay techniques that complicate takedown and attribution. The market implications are likely to be felt through cybersecurity spending expectations, insurance pricing, and risk premia for firms with exposed identity and remote-access surfaces. Zero-day exploitation claims and large-scale data theft can pressure enterprise IT budgets toward incident response, detection, and identity governance, while password-spraying surges typically increase demand for MFA hardening, conditional access, and passwordless migration. For device ecosystems, mass compromise of Dahua endpoints can raise compliance and remediation costs for integrators and operators, and may influence hardware and software vendors’ liability and reputational risk. In trading terms, the most immediate effects are indirect but directionally supportive for cybersecurity equities and insurers, while the broader macro impact is likely contained unless additional breaches trigger systemic outages or regulatory penalties that hit earnings guidance. What to watch next is whether these incidents converge into a sustained campaign pattern—particularly if Clop’s claimed zero-day theft leads to follow-on extortion waves targeting the same sectors. For identity attacks, the key trigger is whether organizations close MFA gaps across all authentication flows, including legacy services and edge cases that allow unprotected login paths; a continued rise in spraying volume would signal that attackers are still finding exploitable policy inconsistencies. For Latvia, the escalation/de-escalation hinge is on whether further internal investigations reveal systemic procurement or operational failures, and whether regulators impose sanctions or require remediation timelines for affected systems. On the IoT side, monitor for indicators of continued exploitation of Dahua authentication-bypass flaws and for whether P2P relay infrastructure is disrupted, as that would affect the attackers’ ability to scale compromises beyond the initially reported 14,500+ devices.

Geopolitical Implications

• 01

  Cyber operations are increasingly producing governance legitimacy shocks, as seen in Latvia’s resignations after a national-scale data exposure.

• 02

  Identity-layer vulnerabilities lower the barrier for coercive or disruptive campaigns across public and private sectors.

• 03

  Compromise of surveillance/IoT hardware can create persistent leverage and complicate attribution and remediation for governments and integrators.

Key Signals

• —Expansion of Clop-linked extortion activity after the zero-day claim.
• —Whether password-spraying volumes and successful login rates continue rising despite MFA hardening efforts.
• —Latvia’s regulatory and procurement actions following the resignations and breach confirmation.
• —Patch adoption and any disruption of P2P relay infrastructure tied to Dahua exploitation.