Tracks cyberattacks, data breaches, compromised organizations, leaked data, and other security incidents
2242 articles
A cyberattack disrupted internet and external email access at two Berlin Senate administrations, which were isolated from the state network. Authorities are investigating conflicting reports about data exfiltration and a possible vulnerability used by the attackers.
Two Berlin state administrations were isolated from the state network after a suspected attack exploiting an IT vulnerability. Sensitive data may have leaked; investigations continue, and the offices remain without normal internet access.
UT San Antonio delayed fall classes until Aug. 24 after unauthorized activity prompted officials to restrict some systems. The university says it found no evidence of a data breach; its investigation continues.
Japan’s Ryomo Systems says it detected unauthorized access on August 14, 2026, and is investigating the intrusion’s scope and entry route. It has not confirmed data theft, customer-system access, or the attackers’ identity.
Darktrace says a customer downloaded a fake Gemini installer promoted via Google Colab and a secondary site. The Vidar stealer communicated with attacker infrastructure, and endpoint alerts indicated browser credential theft before Darktrace contained the device.
A forum listing attributed to Knox claims to offer a 452.29GB imaging backup from Beijing’s 301 Hospital, including DICOM studies and patient metadata. The sale and archive are unverified; a headline claim about a head of state scan is especially uncertain.
A forum user, konata_izumi_shell, alleges a breach of Santa Cruz’s INOCUIDAD system exposed records for over 160,000 food handlers and 100,000 businesses, including identity details, medical screening results and health card photos. The claim is unverified.
A listing attributed to ZeroBytes allegedly offered a partial database from France’s Ministry of Education, including staff directories and student monitoring records. It claimed 346,178,591 raw lines; the breach remains unconfirmed.
SafePal says a flaw in an order-tracking plug-in exposed information for nearly 40,000 customers. The issue is fixed, and the company says wallets, seed phrases and private keys remain secure.
Heights Finance reported that access to a third-party cloud platform exposed data for 734,828 people. Potentially affected information includes financial details and government IDs; the company says its other systems were not affected.
Ukraine’s ARMA says its servers suffered unauthorized interference with signs of a cyberattack. The SBU is investigating the latest incident, while NABU is investigating earlier unauthorized access to an agency register.
Cameron Regional Medical Center confirmed a ransomware attack discovered June 18, 2026. Anubis claimed it stole hospital data, while the hospital says its investigation is ongoing and it cannot yet confirm what information was affected.
CG Power reported a suspected cyber incident affecting its IT systems on August 18, 2026. The company says core and manufacturing systems remain unaffected and that experts are investigating; it notified CERT-In.
Pokémon Center says a cyberattack on logistics provider CEVA exposed UK and German customers’ contact and order details. Payment-card data was not accessible, while warehouse disruption caused delays and some order cancellations.
TheHatman claims to be selling 3.64 million employee and tenant-account records from major companies’ Azure tenants. Hudson Rock says the data appears authentic, but the access and exfiltration methods are unknown; TCS and Gap report no evidence of a breach.
A listing attributed to exfilar alleges Intraverse (Gamifi) was exposed through a keyless Firebase Realtime Database, claiming 16,898,017 leaves or 518MB of data. It says the exposure was observed Aug. 17, 2026.
A forum user named bytetobreach claims RFZO databases were shared through five file mirrors. The claim is unverified; the poster estimates about 5 million individuals may be affected and says no ransom was demanded.
Forum user exfilar is offering an unverified dataset allegedly taken from Kenyan recruitment platform Snapstartalent[.]com, claiming it includes national IDs, 45,165 resumes and 14,965 video interviews.
France’s DGFiP says attackers used compromised employee and third-party credentials to steal data belonging to 678,000 users. Exposed information included tax, company and real-estate records; the investigation continues.
Baylor Genetics said an unauthorized party accessed parts of its network from June 11 to 17. Patient and employee information may have been exposed; the company said it has no confirmed reports of identity theft or misuse.
France’s Finance Ministry says attackers accessed DGFiP systems and extracted data on 678,000 people. ZeroBytes separately claimed access to the SPDC platform and offered records for sale; that claim is unconfirmed.
GE and Shell are investigating Clop data-theft claims; Philips confirmed a contained compromise of an internal enterprise server with no customer impact. The claims are linked to exploitation of CVE-2026-12569 in PTC Windchill and FlexPLM.
Hudson Rock describes six organizations affected by the LiteLLM/Trivy supply-chain campaign, alleging exposed CI/CD credentials enabled access to cloud, code, and other systems. Reported impacts range from stolen data to malicious Telnyx SDK releases.
SafePal says an exploited order-tracking flaw exposed personal and order data for about 39,798 customers. A threat actor claims to be selling the data, which BleepingComputer has not independently verified; SafePal says wallet credentials and funds were not compromised.
