Tracks cyberattacks, data breaches, compromised organizations, leaked data, and other security incidents
2255 articles
The actor azazeljakel claims administrator access to preparados[.]gob[.]mx, a Mexican civil protection training portal, and alleges exfiltrating its user list. The article provides no corroboration.
A threat actor using the alias henrymartin allegedly posted EasyPay’s database, reportedly containing about 2 million transactions and 10,000 cards. The claim is unverified; EasyPay is described as defunct.
LA Metro reported a breach and internal operational disruption, though rail and bus services were unaffected. Gambit linked the group claiming the attack to infrastructure and activity associated with Black Shadow, an Iran-linked group.
The threat actor azazeljakel claims to have leaked DCI Group Mexico’s database, allegedly containing about 240,000 national IDs and mortgage-related data. The article provides no independent confirmation of the claim.
Threat actor Sorb claims to be selling a database allegedly linked to UK transport-management firm Tripocity, said to contain about 202,000 users. The report does not identify specific data types or independently verify the claim.
The company says unauthorized access and ransomware disrupted its ordering systems. Wholesale ordering resumed May 18 for most partners; retailer services 楽譜ナビ and 注文くん are being restored feature by feature as of May 27.
A threat actor using the alias sxcfox claims to have leaked a database allegedly linked to ManoMano, containing about 178,000 customer order records. The supplied article does not independently confirm the leak.
The alias kr0x6 claims to be selling live access to an unnamed Spanish public-sector payroll portal, allegedly covering 371 accounts and allowing changes to employees’ payroll deposit details. The claim is unverified in the article.
Threat actor ChimeraZ claims to have leaked a database allegedly belonging to French firm Socotec, containing about 8,400 customer and business invoices. The article does not independently verify the claim.
Threat actor using the alias Sorb claims to be selling a database allegedly belonging to Singapore F&B chain Koufu, reportedly containing about 191,000 user records. The article provides no independent confirmation.
A threat actor using the alias Sorb reportedly offered a database allegedly linked to Brazilian logistics firm EcoAssist, claiming it contains 1.19 million personal records. The report does not independently verify the sale or exposure.
Lithuanian authorities say misused institutional credentials enabled access to more than 600,000 state registry records. Exposed data included personal and property information; suspected accounts were blocked, and possible foreign involvement remains unconfirmed.
An actor using the alias henrymartin claims to have leaked about 96,000 records allegedly tied to La Redoute, including customer and delivery information. The claim is unverified in the article.
PescobarLegado and NyxarGroup allegedly offered internal access and employee data tied to ContactMaster BPO. The article provides no independent evidence that access or exposure occurred.
7-Eleven disclosed an April 8 breach involving systems with franchise documents. Have I Been Pwned analyzed a dataset published online and estimated that about 185,300 people were affected.
Lithuanian authorities say more than 600,000 entries from real estate and legal-entity registers were leaked using credentials of authorized institutions. They suspect foreign involvement but have not named a country.
7-Eleven disclosed unauthorized access to systems storing franchisee documents. ShinyHunters claimed responsibility and posted a data archive; Have I Been Pwned said its analysis found personal information for 185,300 people.
NCO Group claims it leaked a MySQL dump allegedly belonging to Chinese retailer Vigorbuy[.]com, said to include payment and credential data. The claim is unverified, with no independent confirmation provided.
Charter confirmed a breach and said no sensitive personal information or CPNI was exfiltrated. ShinyHunters claims it used vishing to access an employee’s Microsoft Entra account and steal 40 million records from Salesforce.
Chelan County confirmed malware affected all government departments. The county shut down its network, computers, and phone system while investigating the damage and whether personal data was compromised.
MagoSpeak claims to have leaked a database allegedly belonging to Universidad Tecnológica de la Sierra Hidalguense and involving student data. The report does not confirm the database’s authenticity.
Actor EbonCherub allegedly offered sensitive internal infrastructure documentation linked to Iranian operator MCI, naming mymci, ewano, shop mci and Developer_asset. The article provides no independent confirmation.
Qianxin says attackers exploited patched Ghost CMS SQL injection CVE-2026-26980 to obtain Admin API keys and alter sites with JavaScript loaders for ClickFix attacks; it identified over 700 compromised websites.
The Oncology Institute says a third-party cybersecurity incident affected patient information. Kroll notified the provider on May 20, 2026, of unauthorized access to vendor systems affecting patient data.
