It was another loaded weekend in business IT: a new software supply chain attack, a fresh ransomware claim with a data leak threat attached, a European AI acquisition, and new data on just how many SMBs are still stuck in AI pilot mode. Here are the five stories that matter most if you are running a small or midsize business, or leading its IT.
A new software supply chain attack shows old, abandoned developer accounts are a real risk. Researchers uncovered “SleeperGem,” an attack where two RubyGems maintainer accounts that had sat quiet for six or seven years were hijacked and used to slip malware into three packages, one of them impersonating Microsoft’s own Git Credential Manager and carrying over 500,000 downloads. The malicious code checks for CI/CD environment variables to avoid detection inside automated build pipelines before installing itself as a persistent background service. You do not need to write Ruby code for this to matter. If any vendor or contractor you rely on builds software using open source packages, and nearly all of them do, this is a reminder that “our vendor was never breached” is not the same as “our vendor’s dependencies were never breached.” It is a fair question to ask a software vendor how they monitor the packages their product depends on. Read more at The Hacker News
A ransomware group is threatening to leak a retailer’s data by early August, a reminder double extortion is still standard practice. The ransomware group Blackout claimed an attack on Bluebell Group, a Hong Kong based retail brand operator, and says it will publish stolen data if its demands are not met by August 8. It is the latest example of “double extortion,” where attackers steal data before encrypting anything, so paying for a decryption key does not make the exposure risk go away. If your incident response plan only covers how you would restore from backup, it is missing half the problem. Worth a gut check on whether your plan, or your provider’s, actually addresses what happens if attackers threaten to publish your data regardless of whether your systems come back online. Read more at DeXpose
SAP just completed a bet on AI built for spreadsheets and databases, not chatbots. SAP finalized its acquisition of Prior Labs, a German startup behind tabular foundation models, AI trained specifically on structured business data rather than text or images, and committed more than 1 billion euros over four years to scale it into what SAP calls a frontier AI lab. Most of the AI hype cycle has been about chatbots and text generation, but most of what actually runs a business, inventory, financials, supply chain data, lives in tables and databases. If you use SAP, this is worth watching as a signal of where AI features inside your existing tools are headed next, not just a headline about someone else’s acquisition. Read more at SAP News Center
New data: nearly one in three SMBs is stuck testing AI and never gets past the pilot. Data from Pax8 shows SMB interest in AI remains strong, but a large share of small and midsize businesses stay stuck in pilot mode rather than putting AI into everyday production use, widening the gap between AI enthusiasm and actual results. If this describes your business, you are not behind, you are typical. The bottleneck is rarely the tool itself. It is usually the lack of a plan for how a pilot graduates into something an employee actually uses every day. Worth asking whoever is running your AI pilot what “done” is actually supposed to look like. Read more at ChannelE2E
Anthropic’s revenue climb is fueling fresh IPO speculation. New reporting this week shows Anthropic’s annualized revenue run rate hit roughly $47 billion in May, up from about $9 billion at the end of 2025, months after the company confidentially filed paperwork for a possible IPO. Enterprise customers reportedly account for around 80 percent of that revenue. Whatever AI vendor you use or are evaluating, financial stability is part of the decision, not just capability. A well funded, revenue generating company you can build a workflow around is worth more than a flashier tool from a company you are not sure will exist, or keep its pricing stable, in two years. Read more at MLQ
Follow up to Friday’s story: the Gemini 3.5 Pro launch did not happen. Google’s next flagship AI model, which multiple outlets expected to launch on July 17, has reportedly slipped again after its coding performance fell short of internal expectations in testing, sending Alphabet shares down roughly 4 percent and erasing about $200 billion in market value. Google is said to have gone back into parts of the training process rather than ship a model it was not satisfied with. Nothing about pricing or the rumored 2 million token context window has been confirmed. Worth remembering next time a “launching this month” AI headline gets treated as a sure thing. Read more at The Motley Fool
Sponsored by Lucky 13 Solutions
Business in Motion. Tech in Sync. Lucky 13 Solutions is a managed services provider helping small and midsize businesses keep their IT reliable, secure, and well-supported, without needing a full in-house team. Learn more at l13s.com.
Get the Business IT News Roundup in your inbox: