Tracks cyberattacks, data breaches, compromised organizations, leaked data, and other security incidents
2249 articles
Hachioji Gakuen said some servers suffered unauthorized access and ransomware damage. It is investigating with police and outside experts; data exposure and the full impact remain unknown, and its main email address is unavailable.
Network Japan says attackers accessed and deleted its customer database, then demanded cryptocurrency. The company has not confirmed data leaks but cannot rule them out; affected records may include customers’ contact and moving details.
Reliance Group confirmed a partial data breach involving third-party provider Yotta. World Leaks reportedly published files purportedly linked to the Kudankulam Nuclear Power Plant; Indian authorities are investigating.
Threat actor 888 claims a second Conasems database leak involving data for 766,000 users, including CPF numbers, passwords, contact details and sensitive personal attributes. The claim is unverified.
Loyalist College systems, services, internet and email were reportedly taken offline after an incident linked by a staff member to an external cyber threat. Online classes were suspended, while in-person instruction continued.
D1R claimed it exploited a Synopsys website vulnerability to access a 40,000-entry client database and Bosch data. Synopsys said it found no evidence of unauthorized access; a document posted as proof appeared to be a public user manual.
Nihon Kotsu confirmed unauthorized access to internal systems and a malware infection that disrupted phone dispatch and some reservation services. Affected systems were isolated; app bookings remained available, and no customer data leak has been detected so far.
Attackers used NPM publishing credentials to release malicious Jscrambler package versions containing an installation hook and Rust information stealers. NPM data showed 1,479 downloads before the versions were deprecated; Jscrambler revoked credentials and advised user
Aliases misere and ChimeraZ claim access-control flaws exposed data for 595,024 Litige[.]fr users, including personal and legal-case information. The breach and claimed account takeover and staff-dashboard access remain unverified.
Suitable AI was allegedly breached through GraphQL API weaknesses. A partial dump reportedly exposed 15,176 applicant records, including contact details, resumes and salary information.
Brazil’s Superior Military Court said a cyber incident disrupted its portal on July 2. It took the site offline, isolated affected environments and began recovery; the investigation is ongoing.
Nihon Kotsu confirmed unauthorized access and malware infection, taking systems offline. Taxi dispatch, booking and reservation services are disrupted; possible data leakage is under investigation, with no leak confirmed.
Lidl says attackers accessed a file at a service provider and stole some online-shop customers’ personal data in Germany, Belgium and the Netherlands. The shop’s systems were not affected; possible exposure of passwords or payment details remains unconfirmed.
A reported ransomware attack locked data, backups and telephone software on Pushpanjali Hospital’s Windows server in Agra, disrupting operations. Authorities have registered a complaint and are investigating.
A forensic investigation confirmed that a January 2025 SafePay ransomware attack compromised data belonging to 235,911 people. Marlboro-Chesterfield Pathology has agreed to a class-action settlement that received preliminary court approval.
Centers Laboratory reported that attackers accessed its systems in August 2025 and exfiltrated personal and health information. HHS records show 542,377 people were affected; WorldLeaks later listed the company and claimed a 720 GB data leak.
Hahn Airport’s operator described a security incident targeting its IT on June 22 and said flight operations were unaffected. The report raises, but does not confirm, whether the SafePay ransomware group was responsible.
The City of Carros confirmed a cyberattack made its municipal website unavailable. Teams are working to restore services; the attack's nature and whether data was leaked have not been confirmed.
Baraolt and Ghidfalău municipal websites have been offline for several days following a reported cyberattack. Local authorities are working to restore them; Ghidfalău’s mayor says its platform stores no sensitive data.
Threat actor 84City claims to have leaked an SQL dump attributed to PPA Business School, containing 293,967 records. The alleged data includes personal and enrollment details; the claim is unverified.
Threat actor ChimeraZ claims a 1.4GB dump from Bebeboutik’s seller portal contains about 500,000 rows of merchant and business data. The breach claim is unverified, and the company has not publicly addressed it.
Reports say attackers compromised Injective Labs’ SDK repository and published malicious versions across 18 npm packages to steal wallet keys and seed phrases. Users are advised to upgrade to 1.20.23 and rotate exposed credentials.
CISA says privileged AWS GovCloud keys exposed in a public GitHub repository were not used outside the agency and exposed no customer or mission data; it has strengthened secret handling and incident response.
Dutch police say more than six million Odido customer records were stolen and leaked. Investigators cite a deceptive call to customer service followed by phishing and say evidence points to possible Dutch criminal involvement; the case continues.
