Tracks cyberattacks, data breaches, compromised organizations, leaked data, and other security incidents
2256 articles
Ukrainian authorities allege an 18-year-old from Odesa was linked to a scheme that used info-stealing malware to obtain customer credentials and session data, compromising nearly 30,000 accounts at a California retailer and enabling unauthorized purchases.
Delano Public Schools canceled classes after discovering unauthorized system access and ransom messages. The district says data may have been stolen, but its initial assessment found no student or sensitive personal information affected.
Ukrainian cyberpolice say an 18-year-old suspect ran an infostealer operation targeting a California online store, affecting about 28,000 accounts. Authorities seized devices and evidence; no arrest was announced.
Freiburg University Hospital reports data theft at an external service provider affecting 54,000 patients. The exposed information reportedly included diagnoses, addresses and invoices; other university hospitals in the state were also affected.
Rhomberg Bau says attackers took data from some company systems and made demands. The company disconnected affected systems, including finance and project-calculation systems; construction sites and its rail division were not affected.
The Kinsmen Foundation said unauthorized access to some applications may have compromised donors’ contact details and email addresses. The Kinsmen Club says its 50/50-sale database is separate; law enforcement and third-party experts are involved.
Kintetsu World Express says systems affected by unauthorized access at its Singapore subsidiary have been safely reopened and impacted operations restored. No impact outside Singapore or to core systems has been confirmed.
LaPampaLeaks claims to have shared a Uruguay DNIC database containing more than 5.8 million citizen records, reportedly including national ID numbers, first names, and surnames. The claim is unverified.
Grafana says attackers used a GitHub workflow token missed during rotation after the TanStack npm supply-chain attack to access private repositories and steal source code. The company reports no customer production systems or data were compromised.
GitHub says a poisoned VS Code extension compromised an employee device and led to internal repository exfiltration. It removed the extension version, contained the incident and rotated critical secrets; it has no evidence customer data outside the repositories was also
GitHub says a malicious VS Code extension on an employee device led to the exfiltration of about 3,800 internal repositories. TeamPCP claimed access; GitHub said it found no evidence that customer data outside those repositories was affected.
GitHub is investigating access to internal repositories after confirming an employee-device compromise tied to a poisoned VS Code extension; TeamPCP claims about 3,800 repositories. The article also details malicious durabletask PyPI releases in the Mini Shai-Hulud camp
Grafana Labs said its GitHub environment was breached through a TanStack npm supply-chain attack linked to TeamPCP. The company reported no evidence of production-system compromise and said it rotated tokens and strengthened GitHub security.
Ahmed Al Kadi says an unauthorized third party accessed its IT environment on 18 April 2026 and ransomware encrypted part of its systems. The organization engaged specialists, notified South Africa’s Information Regulator, and warned users about follow-on scams.
GitHub is investigating unauthorized access to internal repositories after TeamPCP claimed it accessed about 4,000 private-code repositories and offered them for sale. GitHub says it has no evidence of impact to customer data outside its internal repositories.
GitHub says an attack using a malicious Visual Studio Code extension led to theft of about 3,800 internal repositories. It removed the extension, isolated affected endpoints and rotated security keys; log analysis continues.
GitGuardian found a public GitHub repository reportedly exposing credentials for privileged AWS GovCloud accounts and CISA internal systems. CISA is investigating and says it has no indication sensitive data was compromised; lawmakers seek briefings.
POST Luxembourg says an undocumented Huawei router behavior, triggered by specially crafted traffic, caused a nationwide outage in July 2025. The flaw has no public CVE, and its patch status remains unclear.
Masterbyte allegedly offered 3,500 Nirvasa user records for $600. The claimed data includes contact and address details and appointment-related metadata; the article does not independently verify the dataset or the alleged breach.
A threat actor known as macaroni allegedly leaked 695,402 records tied to Morocco’s Watiqa[.]ma civil-document platform. The claimed data includes personal and administrative information; the leak is not independently confirmed in the article.
7-Eleven confirmed unauthorized access to systems storing franchisee documents and exposure of personal information. ShinyHunters claimed it stole over 600,000 records and later leaked a 9.4GB archive.
StepSecurity reported malicious commits in two actions-cool GitHub Actions repositories, with code designed to extract runner credentials and send them to t[.]m-kosche[.]com. GitHub disabled access to one repository; a link to Mini Sha-Hulud is possible.
CKC Network and Gakusan say ransomware hit their shared inquiry-management system. They have not confirmed data loss or external transfer, but cannot rule out exposure of students’ personal information and are investigating.
A January 2022 cyberattack on Medizin Campus Bodensee disrupted operations at Friedrichshafen and Tettnang. Authorities later dismantled Hive, which was linked to the attack, and the main suspect remains wanted under a European arrest warrant.
