CMMC Phase 2 status: suspended pending review. On July 13, 2026 the Department of War paused the CMMC rollout and suspended Phase 2 pending a 60 day review. CMMC Level 1 and Level 2 self-assessments, SPRS, the annual affirmation, NIST SP 800-171 and DFARS 252.204-7012 still stand. Source: WilmerHale client alert, July 20, 2026.
If you read nothing else
- Patch every Fortinet firewall and look for admin accounts you did not create. Attackers were logging in through a single sign-on flaw.
- Update Microsoft Office and restart it. An Office flaw was used in attacks before the fix shipped.
- Know where your drawings, CAD files and technical data live. That is what ransomware crews went after in January.
Six things from January 2026. Each one says what happened, what it means for a small business or a small defense supplier, and one thing to do about it.
1. Ransomware crews went after design files
Cyble counted 679 ransomware victims claimed in January, more than 30% above the 2025 monthly average. Attackers increasingly took technical documentation, PCB layouts, CAD files and internal blueprints, which puts downstream partners at risk too. Source: Cyble January 2026 report.
The WorldLeaks group claimed it published 1.4TB from Nike, more than 188,000 files, mostly product development, manufacturing and supply chain documents. Nike said it was investigating a potential incident. Source: Infosecurity Magazine, January 27.
What this means for you: if you machine, fabricate or engineer for a prime, your drawings are the prize, and your customer's data leaks with yours.
Do this: list every place CAD and technical data is stored, remove access for anyone who does not need it, and keep one backup copy offline.
2. A federal claims contractor lost files from a file transfer system
On January 2, Sedgwick confirmed a security incident at Sedgwick Government Solutions, which serves DHS, CISA, CBP, ICE and the Department of Labor. It involved an isolated file transfer system. The TridentLocker ransomware group claimed it took 3.4 GB of data. Source: The Record.
What this means for you: file transfer tools are a favorite way in, and government contractors are on the target list.
Do this: find every file transfer or file sharing system you run, confirm it is patched and behind MFA, and delete old files sitting on it.
3. Fortinet firewalls were opened through single sign-on
CVE-2026-24858 (CVSS 9.4) let an attacker with a FortiCloud account log in to other customers' FortiOS, FortiManager and FortiAnalyzer devices when FortiCloud SSO was turned on. Fortinet found two malicious accounts on January 22; attackers downloaded device configurations and created local admin accounts. Fortinet switched FortiCloud SSO off on January 26. Source: Censys advisory.
CISA added it to the Known Exploited Vulnerabilities list on January 27, with a January 30 deadline for federal agencies. Source: CISA KEV catalog.
What this means for you: a patched-looking firewall can still have an attacker's admin account on it.
Do this: ask your IT provider, in writing, to update every Fortinet device and check its admin account list for names nobody recognizes.
4. Microsoft fixed two Windows and Office flaws already in use
January's Patch Tuesday on January 13 fixed 113 CVEs. One, CVE-2026-20805 in Desktop Window Manager, was exploited in the wild as a zero-day. Source: Tenable.
Later in the month Microsoft shipped an emergency fix for CVE-2026-21509, an Office flaw that bypasses protections against unsafe embedded content. Victims had to open a malicious Office file. Office 2021 and later are protected after a restart; Office 2016 and 2019 need the update installed. Source: Help Net Security, January 27. CISA set a February 16 deadline for federal agencies. Source: CISA KEV catalog.
What this means for you: one opened attachment is enough, and older Office versions are not fixed automatically.
Do this: install Windows updates, then close and reopen every Office app. On Office 2016 or 2019, run the update yourself.
5. Customer records from a retailer leaked
On January 18, a member of the Everest ransomware group leaked Under Armour data. Have I Been Pwned said 72.7 million accounts were affected, with names, emails, dates of birth and purchase details. Under Armour had not confirmed it. Source: The Register, January 21.
What this means for you: leaked purchase details make phishing emails look real to your staff.
Do this: remind everyone that an email quoting a real order is not proof it is genuine, and check any payment or login request by phone.
6. Where CMMC stood in January
CMMC Phase 1 began on November 10, 2025: Level 1 and Level 2 self-assessments posted in SPRS, with an annual affirmation. Source: Department of War CIO, CMMC About page. Phase 2, adding third-party C3PAO assessments, was then scheduled for November 10, 2026. Source: WilmerHale.
What this means for you: the self-assessment and affirmation were already live contract requirements in January.
Do this: check that your SPRS score matches your current System Security Plan before your senior official signs the affirmation.
Not sure where you stand? Cyber Grants Alliance offers in-kind CMMC Level 1 and CMMC Level 2 gap assessment grants, at no cost to you. See every program on Grant Programs.