This week in IT and cyber security: 1–7 August 2026

It has been a busy week on the System Force blog – from a record-breaking Microsoft security update to AI-powered scams that are getting alarmingly convincing. Here is a quick catch-up on everything we published this week.

Microsoft is retiring SMS and voice MFA – and your deadline is closer than you think

Microsoft has confirmed it will switch off SMS and voice-based multi-factor authentication in Entra ID on 1 February 2027, with passkeys becoming the new default. Crucially, if you do not act before September 2026, Microsoft will auto-enrol your users and prompt them to register passkeys themselves – which risks a wave of disruption and unexpected help-desk calls. Audit which staff still rely on text or voice codes now, and plan your passkey rollout on your own terms rather than in a last-minute rush.

AI scams: deepfakes, cloned voices and smarter phishing

Deepfakes, cloned voices and flawlessly written phishing emails have made the old “spot the typo” advice largely obsolete. Fraudsters can now replicate your managing director’s voice from a few seconds of audio and use it to ring a member of staff authorising an urgent payment – and small businesses are squarely in the firing line. The good news is that simple procedural controls, such as always calling back on a known number before moving money, stop the overwhelming majority of these attacks.

Beacon CRM breach: a warning for any business using third-party software

Over 1,500 UK charities using the Beacon CRM platform have been caught up in a breach after compromised credentials gave attackers access to database backups. The incident is a sharp reminder that your data security is only as strong as the suppliers you trust with it. Any organisation storing customer or supporter data in a third-party platform should review their vendor list, confirm MFA is enforced across all accounts, and have an incident response plan that covers supplier breaches as well as internal ones.

State hackers stealing email without a single click

The NCSC, joined by agencies from 14 partner nations, has warned of a Russian state-backed group called LAUNDRY BEAR exploiting a vulnerability in Zimbra webmail to silently copy and exfiltrate business email – no link clicked, no attachment opened. If your business uses Zimbra, patching to version 10.1.13 or 10.0.18 is urgent. For everyone else, the advisory is a timely reminder of why keeping email platforms patched and MFA enabled matters so much.

July Patch Tuesday: Microsoft’s biggest security update ever

Microsoft’s July 2026 security update addressed more than 570 vulnerabilities – a record – including two zero-days being actively exploited in the wild, affecting Active Directory Federation Services and SharePoint. The sheer volume makes prioritisation critical: if you manage your own Windows systems, deploying the patches for those two zero-days should be top of your list this week, followed by the 57 critical-rated remote code execution fixes.

Your CCTV might be a data protection issue you don’t know about

Any business camera that captures identifiable people is processing personal data under UK GDPR, and the ICO issued its highest-ever number of fines in 2025. Our practical guide covers what the regulator expects – from clear signage and retention limits to handling footage access requests – and what tends to get businesses into trouble. If your cameras have been running for years without a compliance check, this is a good moment to take stock.

Questions about any of this, or wondering how your own business measures up? We are always happy to have a no-pressure conversation. Get in touch with the System Force IT team and we will take a look.