Tracks cyberattacks, data breaches, compromised organizations, leaked data, and other security incidents
2222 articles
SOCRadar reports unverified dark-web claims involving data or access tied to Pataya Food, Belgium’s military, China’s Housing Provident Fund, Vercel and Vijay Sales, with alleged datasets, records or privileged access described.
Chainalysis says an external actor used offensive agentic techniques to access its systems and internal tools, exposing some customer identifiers and contact details. The company says credentials and investigation data were not compromised; its investigation continues.
Polymarket says it will pay $3.9 million after a malicious script reportedly used logged-in traders’ sessions to move assets. DebugBear disclosed compromised DNS records; the attackers’ access method remains unknown.
The article reports unauthorized access to Amadeus’s airline distribution platform using valid credentials, with multiple carriers disclosing passenger-record exposure. It cites affected customer counts and warns PNR data may enable targeted phishing; investigators said
Binance disclosures describe a reported attack path from a compromised developer laptop to hot-wallet withdrawal approvals and billions in stolen assets. The incident underscores the need to test how attackers could move from initial access to critical systems.
Abrigo took Sageworks offline on October 30 after detecting irregular activity. Most services have been restored, but borrower-facing features remain unavailable; the company has not disclosed the incident’s nature, and a breach is unconfirmed.
Ukraine’s Air Alert app and Russia’s emergency warning app broadcast false threat alerts. Ukraine’s app team confirmed unauthorized interference, temporarily disabled notifications, then began restoring service; Russia’s emergency ministry also confirmed its app was hit
Reported cyberattacks remotely accessed supermarket refrigeration systems across seven European countries, setting units to defrost and spoiling food. No group has claimed responsibility, and attribution to Russia remains speculation.
More than 115 stores across six European countries reported refrigeration disruptions after attackers remotely changed settings or activated defrost functions. Multiple chains confirmed impacts; whether the incidents were coordinated remains unclear.
BTCPay Server says attackers targeted instances running version 2.4.1 or earlier, logging in as administrators and draining hot wallets. The project urges affected operators to take instances offline and update to 2.4.7.
Oberspreewald-Lausitz confirmed an IT security incident and shut down its systems as a precaution, leaving email and most services unavailable. A cyberattack has not been officially confirmed; the investigation is ongoing.
Matten municipality says a March 14–15, 2026 cyberattack encrypted some municipal data, which was fully restored. Its analysis found no data theft or publication; operations continued and critical systems were reportedly unaffected.
Foster City says ransomware was discovered on its network, prompting service suspensions and most computer systems to be taken offline. The city says 911 and emergency response remain operational, and public information may have been accessed.
A cyberattack disrupted terminals, databases and the SovraCup booking system at Papardo Hospital. The hospital says care continues and no sensitive data was stolen; it activated its response plan and used backups to move some operations to the cloud.
Cota Co. reported that a cyberattack caused system disruption on March 27, 2026. The company is investigating possible data exposure with outside experts and working to restore systems.
A ransomware attack attributed to Qilin disrupted Netalia systems, preventing online payment of Genoa police fines. Data encryption is reported; exfiltration remains unconfirmed, and the city extended the discounted payment deadline.
SRA says a cyberattack targeted file servers decommissioned in January 2026. Historical data from 2023–2025 may have been accessed by unauthorized parties; the investigation is ongoing, and daily operations were unaffected.
Tallahassee confirmed a cyber event on April 17. Staff isolated the threat, the city shut down its website, and Leon County paused its network link with the city. An official said no data was compromised as assessment continued.
A hijacked DebugBear page-speed script injected malicious code into Polymarket, redirecting signed-in traders’ positions and funds. Blockchain tracing identified about $2.64 million moved; Polymarket says it is refunding affected users and adding script protections.
A breach of Scope Systems’ cloud-based operations has left Australian mining companies scrambling to access key systems. Northern Star Resources and Evolution Mining are among those thought to be targeted.
Ahmed Al-Kadi Private Hospital confirmed an unauthorized party accessed its IT environment and ransomware encrypted part of it. Patient care was not disrupted; whether personal or medical information was accessed or removed remains unknown.
Geneva’s IFAGE foundation says an April cyberattack compromised staff data. Student data and teaching systems were unaffected; the investigation continues, and the extent of any data theft remains unknown.
3i Infotech reported a suspected ransomware incident identified on May 16, 2026. A forensic firm is investigating, and the company said its initial assessment found no material operational impact.
Hongsu said a ransomware attack discovered on April 10 caused estimated losses of about NT$22 million. The company reported no major production or shipping impact and no detected leak of commercial secrets or important information.
