The worst hack of 2026, broken down.
You didn’t click a dodgy link. You didn’t open a strange email. And you could still have been hacked. In March 2026 that happened to businesses all over the world, in a single night.
What happened
- Apps are built from building blocks. Almost every app and website is assembled from ready-made pieces written by other people. One of the most used is called Axios. It is downloaded more than 100 million times a week.
- One stolen login. An attacker got into the account of the person who looks after Axios.
- One hidden back door. They published an update with one extra piece slipped in. Anyone who installed that update let the attacker in, on Windows, Mac and Linux.
- About three hours. That is how long the poisoned update was available before it was pulled. Then the malware removed its own tracks.
Why it matters to you
Think of a bakery. You lock the doors and you trust your staff, but someone tampered with the flour before it ever reached you. That is a supply chain attack. They don’t break in to you. They break in to someone you trust.
Three things a normal business can do
- Turn on two-step login, everywhere. Email, banking, your website, your domain. This whole attack started with one stolen login.
- Ask whoever builds your website or app: do we wait a few days before taking brand-new updates?
- Ask them one more thing: if one of our building blocks was poisoned, how would we know?
You can’t check every block yourself. You can ask the right questions, and a good developer will have answers.
That’s what Reed Sentinel does. We look at what your business runs on and tell you straight what needs fixing. The call is always free.
Talk to Reed Sentinel →Starting soon: a short email with the scam doing the rounds in South Africa that month, and how to spot it. No sales pitch.
We store only your email address and when you signed up, and use it only for what you asked for. Unsubscribe any time by replying “stop”.
New experiments and real lessons, as they happen.