Tracks cyberattacks, data breaches, compromised organizations, leaked data, and other security incidents
2222 articles
Dream says a suspected China-linked actor used custom PHP2Shell and Linux kernel privilege-escalation exploits to root 25 firewall servers across four countries, including three in a U.S. government-affiliated environment; the full compromise remains unclear.
An actor using the handle GoreTerminal claims to have leaked a Capiter dataset with about 208,206 accounts and phone numbers. Screenshots show a listing and sample records, but the dataset and breach claim remain unverified.
The handle “libreboot2016” claims to have published a WhatsApp dataset associated with Mexico’s INBI School of English, containing 3,337,394 messages and 171,967 phone numbers. The dataset and its source remain unverified.
A cybersecurity event at UNM Health Sciences Center disrupted care and classes on Oct. 26. The university says some end-user devices were affected, core systems were not penetrated, and operations have resumed; a criminal investigation continues.
A leak site published internal data on more than 41,000 DHS employees and contractors after the Department of Peace claimed it obtained a database through DHS’s Okta SSO. CyberScoop verified current CISA employees were listed; Okta said it had no evidence of compromise.
Sony Network Communications confirmed unauthorized access to its So-net database, exposing 2,585,481 customer records and 54,401 email addresses with passwords. As of October 27, neither company had confirmed misuse of the exposed data.
GMO Group reports unauthorized access to up to 26,739 virtual servers, stolen customer data and unauthorized trades. It is offering up to $1 million for information identifying those responsible; attackers’ claims about how they accessed the systems remain unverified.
DHMP says a publicly exposed SquareML access key may have enabled access to information about 238,083 members. The key was revoked, and DHMP says it has no evidence the data was viewed or misused.
Keystone says an attacker exploited a third-party monitoring-tool vulnerability to access customer records and its hardware-wallet authenticity key. No recovery phrases, private keys, counterfeit devices or crypto theft were reported; 18,835 unsold devices will be scr~~
A cybersecurity incident disrupted the University of New Mexico Health System, forcing ambulance diversions and clinic cancellations. Employees reported seeing messages claiming data was stolen; the incident’s nature remains unclear and operations resumed in phases.
UNM Health says a cyberattack disrupted patient care and caused system outages, but critical systems are back online. Ransomware group Byod claimed access to systems and personal data; UNM's assessment said core systems and servers were not penetrated.
GMO says data stolen in an intrusion at its Onamae Desktop Cloud was published online. It warned customers of possible malware on their servers and potential exposure of trading credentials; no ransomware activation was reported.
Warp says an attack on a third-party vendor exposed agent decision logs and telemetry. Its CEO estimates roughly 1% of users may be affected; the investigation is ongoing, and the full scope of exposed data is unclear.
Sansec reports attackers altered Convertr’s Plausible analytics tracker to inject a checkout skimmer targeting card and CPF data. Sansec suspects, but has not confirmed, CVE-2026-8467 exploitation; Convertr removed the skimmer and patched Plausible.
Anthropic confirmed Cathedral researchers accessed a limited set of sales, HR and IT systems during a bug-bounty test, reportedly via weaknesses in unnamed third-party software. Anthropic said Claude conversations, source code and model weights were not accessed.
ENGIE confirmed attackers stole French customers’ contact and energy-contract data through a partner marketing platform. The company said its internal systems and customers’ banking data were not affected.
An actor using the handle Syrv4x advertises a 237 MB ACTIL dataset containing a claimed 152,187 records. A screenshot shows the listing and sample records, but the dataset’s authenticity, source and availability remain unverified.
Genesys says attackers accessed internal LMS and CRM systems and likely downloaded business and customer-related information. The incident is contained, but the investigation continues; Genesys says its customer platforms and data were unaffected.
SOCRadar reports five underground listings: alleged Finaxis[.]cloud, WoWInstaller, Argentine Moodle, MyHairCare Australia and HT Médica datasets. The listings remain unverified; HT Médica’s listing does not establish clinical-record exposure.
Quest confirmed unauthorized access to its Quanum Lab Services Manager, affecting personal information and patient records. The company paused platform access and is investigating; the number of affected patients and specific data accessed remain unknown.
Keystone says attackers accessed its web platform through internal Shopify APIs and exfiltrated customer names, contact and shipping details, and purchase histories. The company says wallet keys and seed phrases were not exposed; customers reported impersonation calls.
PingCAP says an intruder used stolen service-account credentials to access internal systems from Sept. 9 to Oct. 7, 2026, copying customer records and source code. Investigators found no impact to data stored in TiDB; access paths were blocked by Oct. 14.
DreamHost reset email and FTP/SFTP passwords after an incident disrupted File Manager access. The company advised users to check for unfamiliar forwarding rules, but has not disclosed whether accounts, files or messages were exposed.
South Korean police say seven suspects were linked to attacks on more than 90 organizations, with authorities believing 8.2 million records were stolen. The alleged leader reportedly used ARTEX AI in most attacks.
