Tracks cyberattacks, data breaches, compromised organizations, leaked data, and other security incidents
2230 articles
AngMar reported unauthorized access to its systems in July 2026, affecting 35,916 Texans. Ransomware group Interlock later claimed it stole 710 GB, a claim absent from AngMar’s notice; the full scope remains unknown.
Weld Re-8 said unusual IT activity disrupted network drives, printing and external internet access on Sept. 13. It isolated affected systems and launched an investigation with law enforcement; unauthorized access and restoration status remain unconfirmed.
South Africa’s ATNS found ransomware-associated malware in an operational technology network supporting air traffic weather services and is seeking forensic investigators. A separate possible data theft at a Mozambique airport is also under investigation.
A threat actor called ChimeraZ is offering data allegedly stolen from French company KEL Group, claiming about 1.3 million people were affected and alleging website disruption and backup deletion. The claims are unverified.
A post attributed to “Syrv4x” claims to offer a 7 MB dataset with 42,495 Laboratoire LCS records, including names, birth dates and order details. The data’s authenticity and source have not been verified.
A post claims to offer 15,818 SFR customer records in a free 13 MB dataset, with contact, order and banking-related fields. The claim remains unverified.
A listing attributed to Syrv4x claims to offer 9,537 KRYS Group records in customer and appointment files. The claim is unverified; visible fields reportedly include personal and contact details.
Attackers are exploiting NetScaler flaws CVE-2026-88771 and CVE-2026-88772. Researchers report opportunistic scanning, log poisoning and webshells, with over 100 victim organizations tracked; fewer than 10% of exposed hosts may be patched.
The ransomware group interlock claims it exposed Tekko Enterprises data, including utility-system materials, employee identifying information, security-clearance records, and contract financials. The post says the claim is unverified.
DIVD says an attacker exploited an undisclosed vulnerability and used an autonomous AI agent for post-exploitation activity. The investigation is ongoing, the impact is unclear, and the nonprofit has notified authorities.
Microsoft says Storm-3068 abused a compromised account to access Azure DevOps, modify pipelines, collect Kubernetes credentials, and expand into cloud infrastructure. Its response team helped the customer investigate and contain the intrusion.
The Defense Manpower Data Center says unauthorized users accessed files containing unencrypted personal information from October 2025 until the vulnerability was discovered in July 2026. A Department of War official told CNN about 3.05 million people were affected.
Qbusoft confirmed patient data was stolen from its Medyc platform via SQL injection. Names, PESEL numbers and contact details were exposed; medical records may also have been accessed. Authorities are investigating, and the company says it patched the flaw.
Bright Smile Dental Care discovered ransomware on a server on August 3, 2026, affecting patient record and dental imaging software. Patient data was encrypted, and the company says there is no evidence it was accessed or misused.
Keio confirmed a ransomware attack on group servers on September 26, 2026. Some group-company business systems are affected; railway operations are unaffected, and the company has not confirmed information leakage.
Stevens Point city staff suspect they stopped a ransomware attack early after suspicious activity disrupted city servers. No data theft has been identified, and the city is restoring services while investigating.
Keio confirmed a ransomware attack disrupted some business systems, with train operations unaffected; it is investigating possible data access. Separately, Tokyo Metro said attackers accessed systems containing 59,000 member email addresses.
SK Logi said unauthorized access to internal systems began around 2 a.m. on September 20, 2026. Its order system was unavailable, and shipping and inventory operations were affected. Data exposure and recovery timing remain under investigation.
UWAYS and the Uways Qarani group claim access to Prince Sultan Military Medical City and thousands of personnel and medical records. Screenshots reference another hospital and do not verify a breach or its scope.
A post attributed to “Syrv4x” offers a dataset allegedly linked to French training organization Les Clés de l’Atelier. It is said to contain 10,193 lines and potentially sensitive personal and training data; authenticity is unverified.
A forum post by Syrv4x offers a claimed 3 MB dataset of 7,770 Spareka appointment records. A visible sample lists customer contact details and appliance repair information, but authenticity and acquisition method are unverified.
UpGuard found more than 16,000 misconfigured Supabase databases exposing sensitive data. Reported cases included customer records, plaintext passwords, private messages and SMS; researchers linked the exposures to configuration errors but said scans did not prove AI use
Times Car says an intrusion exposed personal, driver’s license and account data for about 6.6 million current and former members. Credit card data was unaffected; the company is investigating and warning customers about fraud attempts.
FBI job applicant portals remain offline after ShinyHunters claimed access to FBI systems and sensitive data. The FBI is investigating; Mandiant separately reports renewed exploitation of an Oracle PeopleSoft vulnerability. Portals: apply[.]fbijobs[.]gov and fbijobs[.]
