Tracks cyberattacks, data breaches, compromised organizations, leaked data, and other security incidents
2226 articles
Credentials associated with ConnectWise Cloud Backup were used to authenticate to Microsoft 365 tenants. Huntress reported more than 300 successful sign-ins among over 1,000 tenants; ConnectWise says downstream compromise remains unconfirmed.
OpenCode says a breach tied to an alleged large-scale distillation attack exposed external-provider API keys for 1.4% of Console users. Users reported unauthorized charges and suspended Google Cloud projects; the project says no other data appears exposed.
Bullhorn disabled access to its platform to contain a cyberattack that caused a system-wide outage. The company is investigating; it has not determined whether customer data was exfiltrated.
Researchers say attackers compromised AOMEI's update infrastructure in brief windows from May to July 2026, delivering CROSSROAD and SHINYROAD to Backupper users. AOMEI says it secured its servers, but customer systems may still need remediation.
ConnectWise suspended Cloud Backup and related services while probing attackers’ use of a stolen M365 API secret to access customer tenants. Huntress reported 300 successful sign-ins among nearly 1,000 attempts; data access remains unclear.
Researchers confirmed Pegasus infected University of Belgrade rector Vladan Ðokić’s device in 2026 via a zero-click exploit. Lawyer Rade Bajić also received an Apple spyware threat notification, but the spyware type on his device remains unknown.
San Luis Potosí’s mayor says attackers breached municipal systems, extracted information, and demanded payment. The city filed a federal complaint; no citizen database breach has been reported, and security upgrades are underway.
LOXONE says it detected unauthorized access to internal systems on Oct. 18, 2026, and isolated affected systems. A notice attributed to the Samurai ransomware group claimed 201.6 GB was copied and encrypted; LOXONE has not confirmed data theft.
Jerome School District said a cyberattack took its communications and network operations offline, forcing Monday class cancellations. Officials activated emergency procedures and are investigating; the attacker, ransomware involvement and any data access remain unknown.
FTAPI confirmed unauthorized access to a locally operated internal server on September 14 and ransomware deployment. It says its platform, customer systems, and exchanged data were unaffected; forensic investigations continue.
Universal Plant Services says an unauthorized person accessed data on its network from June 8–12, 2026. The potentially involved information includes names with Social Security, driver’s license, or financial account details.
Terry J. Dubrow’s medical practice says an unauthorized actor accessed its network starting January 16, 2025, and acquired patient data. The practice says it contained the incident and has no evidence of misuse or public disclosure.
May Trucking says it detected suspicious network activity on June 21, 2026, and found files acquired without authorization. Some affected files contained individuals’ names and Social Security numbers.
Turner Construction disclosed unauthorized system access between July 2 and 15, 2026, involving files containing personal and financial information. It notified about 6,098 California residents and is offering five years of identity protection.
Kern Psychiatric Health and Wellness Center says files containing patient data were accessed without authorization on Genesis Healthcare Management’s network. Potentially affected information includes medical and identifying details; no misuse is known.
LACMA says an unauthorized party accessed part of its network from July 7–11, 2025, affecting files containing some individuals’ personal information. It is offering a year of identity-theft protection.
Pan American Group says an unknown actor accessed servers on April 8–9, 2026, and accessed or acquired files that may have contained individuals’ information. The company is offering 12 months of credit monitoring.
Catalyst Brands says an unauthorized party accessed third-party servers supporting its HR and payroll services around May 26, 2026, and obtained personal information, including Social Security numbers and government IDs.
Fun For Less Tours says an unknown party accessed its network and acquired files in a ransomware attack discovered October 27, 2025. The company later found some recipients’ personal information in the files.
NSE Insurance Agencies says files containing personal information may have been accessed and acquired during unauthorized network access from Nov. 6–29, 2025. The company says it is unaware of resulting identity fraud or misuse.
Bristol City Council says records were exported from Southville Primary School’s management system. A possible link to an earlier attack affecting council-run schools is unconfirmed; investigations are underway.
A Kumamoto hospital suspended its appointment system after its provider reported possible unauthorized access. Patients can still book by phone, but some services require manual work; other medical institutions using the provider’s system may also be affected.
ConnectWise disabled seven application identities and suspended Cloud Backup after attackers accessed the identities and compromised Microsoft 365 tenants. Huntress reported nearly 1,000 tenants with related sign-ins, including 300 successful ones.
The Japan Times group said it confirmed a ransomware attack on Sept. 18 targeting an administrative file server last used in August 2022. Data attackers claimed to have stolen appeared online Oct. 15; its contents and scope remain under review.
