Tracks cyberattacks, data breaches, compromised organizations, leaked data, and other security incidents
2234 articles
Zdrowit S.A. confirmed unauthorized access to its IT systems and encryption of some resources. A ransomware group later published a file allegedly linked to the company, but its origin and whether data leaked remain unverified.
Gambit researchers report that a financially motivated actor used AI agent frameworks to compromise at least 119 websites, steal over 600,000 card records from two companies, and disrupt some retailers through cleanup procedures.
A cyberattack on Hungarian insurer Genertel on September 17 exposed personal data belonging to some customers. The company temporarily suspended online services while investigating.
Spokane Public Schools reported an overnight network security incident and took several systems offline as a precaution, disrupting services for families. The district has not disclosed further technical details.
Fresenius Medical Care reported unauthorized access to a limited number of internal systems. The company said the incident was contained and did not affect patient care, manufacturing, or business continuity.
Boryeong Cord Blood Bank reported a ransomware infection affecting its personal-information system. Names, ID numbers, contact details and birth information may have been exposed; South Korea’s privacy commission is investigating.
Skroutz Last Mile reported unauthorized access affecting shipment-related names, addresses and phone numbers. The company said payment details and passwords were not compromised, and warned users about phishing.
CTOS Digital reported unauthorized access to consumer personal data. The company says it contained the affected environment, engaged an independent incident response team, and that its systems remain operational.
ShinyHunters claims it breached FBI systems and stole data, including information allegedly belonging to agents and applicants. The FBI is investigating; some data in a sample appeared authentic, but its origin is unconfirmed.
Quest says a breach involving a third-party provider’s vulnerability exposed information belonging to 1,991,613 customers, including passport, licence and credit card details. It advised affected customers to consider replacing documents.
The FBI is investigating unauthorized activity affecting FBIjobs[.]gov after ShinyHunters claimed it stole sensitive data on agents and applicants and temporarily defaced the site. The FBI has not confirmed the theft.
Sweden’s IMY fined Miljödata $183,000 after finding inadequate software checks and intrusion monitoring contributed to an August 2025 breach affecting 2.2 million people and exposing sensitive data.
Three Elsevier domains redirected to a LAPSUS$-branded page for about 78 minutes. Researchers suspect a DNS or CDN change; Elsevier has not explained the incident or confirmed whether user data was exposed.
A cyberattack hit a daycare document-exchange platform in the Kaiserslautern district. Authorities took it offline as a precaution; personal data may have been compromised and is under investigation.
ShinyHunters claims it exploited an unpatched Oracle PeopleSoft zero-day to access FBI systems and steal employee and applicant data. BleepingComputer has not independently verified the alleged vulnerability or breach.
Attackers used compromised Ribon app credentials from September 13–17 to access customer data in BigCommerce stores. BigCommerce says credentials were compromised through a Fastr system compromise and that malicious scripts affected a small number of storefronts.
A reported five-day attack on West Bengal’s state data center allegedly involved malware and may have exposed data from four departments. Government portals and services were disrupted; officials have not confirmed theft.
A ransomware attack on Data Hub disrupted trading systems serving 72 Nepalese brokerages. SEBON formed a five-member probe team; affected systems remain offline for forensic analysis, with an isolated 4:00 AM backup available for recovery.
A forum actor named RedStone claims to sell a database tied to the French Federation of Speleology, allegedly containing 93,493 member records and personal and financial data. The claims, including RCE and defacements, are unverified.
A forum actor called Individual claims to have breached Nigeria’s FCT-IRS and advertises 87 tables, about 5 million records, 7 GB of data, and 121,000 users. The alleged dataset includes identity and tax information; the claim is unverified.
Forum actor Quantique claims to have scraped ColisPort APIs and released 19,741 records containing shipment and customer data. The report says the claim is unverified and may be incomplete.
Attackers used compromised Ribon app credentials to access shopper data and inject scripts into a small number of BigCommerce stores. Master of Malt reported exposed customer details; BigCommerce said its platform and payment data were not breached.
LMU Munich reported unauthorized access to a system holding student enrollment data, including personal, financial, health insurance, and academic information. The university said there is no evidence of misuse or publication.
Boustead Singapore said an overseas business unit contained a cybersecurity incident, restored critical data and systems from backups, and notified authorities including Singapore’s PDPC. It reported no material impact and plans an independent audit.
