Construction companies potentially vulnerable through accounting software, report says

Unidentified attackers have been systematically targeting internet-exposed installations of Foundation accounting software by brute-forcing Microsoft SQL Server accounts and exploiting unchanged default credentials; Huntress found about 500 hosts running Foundation, ~33 publicly exposed with default credentials, and observed nearly 35,000 login attempts on one host, potentially impacting a small subset of on‑premise users while Foundation's cloud customers were not affected.