2026-10-15T17:03:00.0000000Z

Cyber Incident Containment and Investigation Update

Status: Investigation Ongoing
Last Updated: 10/15/2026 8:00 a.m.
Update Frequency: Daily

Important Notice

Based on our current information, the cyber incident outlined in this notice is contained. The investigation into this cybersecurity incident is ongoing and projected to be complete by November 6. Accordingly, all information provided in this update is preliminary and subject to change as additional facts are confirmed. CUSI will provide further updates as new information becomes available or existing information is updated.

Confidentiality Notice: This information is confidential as defined by any applicable contractual provisions regarding “Confidential Information.” It must not be redistributed without the express consent of CUSI.

The information provided below is limited to the services CUSI provides to your organization. Responses regarding CUSI-hosted services do not apply to UMS on-premises configured servers, as those servers are outside the control of CUSI.  Additionally, this information is for your general awareness, so please contact CUSI for specific details on any impact to your organization and specific configuration.

1. Investigation & Incident Response

Is a third-party forensic firm involved, and have law enforcement or CISA been notified?

Yes. CUSI is actively engaged with a third-party forensic firm to assist with the investigation. The Cybersecurity and Infrastructure Security Agency (CISA) has been notified.

The investigation remains ongoing, and additional details will be shared as they are confirmed and approved for release.

2. Vulnerability & Potential Impact

What is the vulnerability, which UMS versions are affected, how it was exploited, and is a CVE pending?

The UMS legacy API contained a previously unknown path traversal and arbitrary file write vulnerability. The vulnerability was exploited to write files to the system to support lateral movement and the retention of keylogger data.

The investigation is ongoing. Further information regarding affected UMS versions and the status of a Common Vulnerabilities and Exposures (CVE) identifier will be provided as details are confirmed and approved for disclosure.

3. Security Enhancements & Ongoing Monitoring

What measures are being implemented to assess and address future cybersecurity issues?

CUSI has established additional security controls across its Azure environments, including hosted UB, CWP, and other CUSI services. These enhancements include:

• Additional hardening: Strengthened security configurations across applicable cloud resources.
• Enhanced logging, monitoring, and alerting: Improved visibility into system activity and potential security events.
• Microsoft Defender: Deployment for applicable resource classes.
• Web Application Firewall (WAF): Protection established for all CWP portals.
• Enhanced endpoint detection and response (EDR/XDR): Improved endpoint monitoring and detection across all virtual machines.
• 24/7 security operations monitoring: CUSI cloud environments are monitored around the clock by a managed Security Operations Center (SOC).

These measures are intended to strengthen detection, monitoring, and response capabilities across CUSI-managed cloud environments.

4. Incident Response Contact & Client Support

Who should clients contact for incident-related questions or technical assistance?

Clients may contact the CUSI Incident Response (IR) team at:

Email: cyberresponse@cusi.com

CUSI's support team is also available to assist clients with remediation-related activities, including patching, configuration changes, and tunnel establishment.

5. Status Updates & Communications

How frequently will CUSI provide updates?

CUSI publishes updates to this status page daily. Updates will reflect new or revised information as it becomes available and is approved for release.

Clients are encouraged to check this page regularly for the latest information regarding the investigation, security enhancements, and applicable product service statuses.

CUSI Cyber Incident Response Team

This page will be updated as the investigation progresses. All information remains preliminary unless otherwise stated and is subject to change as additional facts are confirmed.

Please remember that this information is confidential and must not be redistributed without the express consent of CUSI.