Tracks cyberattacks, data breaches, compromised organizations, leaked data, and other security incidents
2226 articles
The Berlin Brandenburgische Wohnungsbaugenossenschaft says unauthorized people temporarily accessed parts of its IT systems. An investigation is ongoing; the cooperative says there is currently no evidence they accessed sensitive tenant data.
An actor using the handle “ChimeraZ” claims to have leaked an ISEP user dataset with 5,091 lines covering 5,088 people. The dataset’s authenticity, source and availability have not been independently verified.
Rank Math said PRO plugin copies downloaded or updated during a specified October 15–16 window contained malware. Sites that activated them should be treated as compromised; the company released a clean version and recovery requires more than reinstalling the plugin.
An actor using the handle “ChimeraZ” claims to sell a partial I-CAD dataset with nearly 2.9 million animal records and 50,629 veterinary records. The dataset, its source and availability have not been independently verified.
A suspected incident at utility billing provider CUSI disrupted payment portals and account access for utilities in several states beginning Oct. 10. Some services recovered, but the cause, full scope and affected-customer count remain unknown; ransomware has not been
Rank Math says its compromised PRO plugin version 3.0.123 may have enabled website takeovers and exposed secrets. The company removed the affected files and released version 3.0.124; affected users are urged to restore clean backups or follow cleanup steps.
Community Medical Center in Falls City reported network access and damage attributed to a cyberattack. The hospital shut down its computer system, disrupting some services; whether patient information was affected remains under review.
GTIG reports attackers altered AOMEI’s update infrastructure to deliver a downloader and persistent backdoor. Three tampering windows were confirmed; further windows may have occurred. AnyViewer infections were not separately confirmed.
A network outage at New Mexico’s Institute of American Indian Arts forced an emergency closure and interrupted teaching. Malware was alleged, but the school said the cause was uncertain; data theft and file loss remain unconfirmed.
ConnectWise suspended three cloud services after a compromised credential was used to access Microsoft 365 tenants. Huntress observed sign-ins across 162 tenants and reported nearly 1,000 Entra tenants with activity by October 17.
California says an intruder used a compromised ETS login to copy student records from an SFTP site between May and September 2026. The number affected is unknown; ETS shut down the account and site.
An unauthorized party used compromised login details to access an ETS-operated file-transfer site and copy California student data, including assessment and disability information. ETS and CDE are notifying affected families.
Unauthorised activity on Hachette Australia's distribution subsidiary ADS, believed to have occurred July 18, has disrupted book deliveries to Australian stores and authors. Hachette says secure restoration is ongoing, with no timeline for normal operations.
Quebec’s Commission de la construction says a cyberattack has disrupted its online and phone services since Monday. An investigation is underway; the commission cannot yet confirm whether data was compromised or when services will return.
Romania’s SNR says it detected a cybersecurity incident on Oct. 19, 2026, with early checks indicating ransomware. DNSC is investigating; impact appears concentrated in the internal network, email is suspended, and customer services remain operational.
A ransomware attack on Gyeongbuk Technopark encrypted work records and disrupted systems. Recovery was completed, but some leave and travel records were lost; the organization said no personal information was exposed.
OpenCode says an intruder reached a legacy system, potentially exposing provider keys saved in Console for 1.4% of users. The company urged affected users to revoke and replace keys; copying or use has not been confirmed.
The National League Against Cancer says a cybersecurity incident temporarily affected some Radiotherapy Department services. Authorities are investigating, and the organization is working to restore care.
SOCRadar reports underground posts claiming data exposures involving ZoomInfo, TryCircle, Vicente López, HDB Financial Services and X. The claims vary in age and detail, and their authenticity is unverified.
A compromised ConnectWise application credential was used to request Microsoft 365 access tokens. Huntress reported activity in nearly 1,000 Entra tenants, but that does not mean all were compromised; data access remains unconfirmed.
Sophos researchers found a 96-minute automated sweep using the ConnectWise Cloud Backup app identity to request Microsoft Graph tokens across consenting tenants. The credential’s origin and how tokens were used remain unknown.
Some Rank Math PRO v3.0.123 downloads from October 15–16 contained malware. The vendor removed the files and released v3.0.124; users who activated the compromised version should treat their sites as compromised and follow cleanup guidance.
Nikkei says stolen credentials were used to access a development system on October 7, exposing 1.83 million records. The company reported that 150,000 records contained personal identifiers and said it found no evidence of misuse as of October 16.
A compromised ConnectWise application credential was used to access customer Microsoft 365 tenants, conduct Graph reconnaissance, and attempt persistence. ConnectWise disabled affected identities; the investigation continues.
