Tracks cyberattacks, data breaches, compromised organizations, leaked data, and other security incidents
2258 articles
CKC Network and Gakusan say ransomware hit their shared inquiry-management system. They have not confirmed data loss or external transfer, but cannot rule out exposure of students’ personal information and are investigating.
A January 2022 cyberattack on Medizin Campus Bodensee disrupted operations at Friedrichshafen and Tettnang. Authorities later dismantled Hive, which was linked to the attack, and the main suspect remains wanted under a European arrest warrant.
Obey_Your_Master claims to have leaked 362,786 records from Perm National Research Polytechnic University’s internal student research monitoring system. The alleged data may include user profiles, email details, and faculty identifiers.
[Citizen] Kyyzo claims to have leaked more than 12,300 records linked to DPMPTSP Kabupaten Belu, including licensing, registration, contact, and application-status information. The claim is unverified.
Grafana Labs says an unauthorized party used a stolen token to access its GitHub environment and download its codebase. The company says no customer data or personal information was accessed and refused CoinbaseCartel’s ransom demand.
Grafana Labs said attackers used a stolen access token to breach its GitHub environment and download source code. It found no evidence of customer data exposure, refused an extortion demand and is continuing its investigation.
The HHS tracker lists millions affected across several U.S. healthcare breaches. Counts include 1.8 million at NYC Health and Hospitals and 2.5 million at Nacogdoches Memorial Hospital, though the latter may be a typo.
A cyberattack on Murray County, Georgia’s government network led several offices to close or limit services. Officials said 911 services, public safety operations, and scheduled primary voting remain available.
7-Eleven says an April 8 intrusion into systems storing franchisee documents exposed unspecified personal information. ShinyHunters separately claimed 600,000+ Salesforce records and demanded a ransom; the company reported two affected Maine residents.
Grafana says an unauthorized party used a stolen token to access its GitHub environment and download its codebase. It reports no customer data or system impact, invalidated the credentials, and refused an extortion demand; CoinbaseCartel attribution is unconfirmed.
OpenAI says a supply-chain attack affected its signing certificates and led to limited credential exfiltration from internal repositories; it found no evidence of customer-data theft. macOS users must update by June 12. TanStack packages were also affected.
A threat actor claims to have breached Spain’s Ícaro Cloud using reused MSP credentials, exposing data from 20 client networks, including more than 3,500 OPNsense backups. The claim is unverified.
DarkWebInformer reports that threat actor Lagui claims to be selling a database linked to French retailer Auchan, containing 1,291,028 customer entries. The alleged records may include names, contact details, addresses and loyalty data; the claim is unverified.
Threat actor Lagui claims to offer for sale a database allegedly linked to French driving school Stych, containing 1,342,952 customer entries with identity, contact, location, license-related and profile data. The claim is unverified.
THORChain reported that a compromised vault led to about $10.7 million in protocol-owned funds being stolen. The network halted signing activity; the company said initial indications showed user funds were safe. The investigation is ongoing.
Arwini and KVN confirmed a cyberattack discovered May 4. Up to 80,000 anonymized records may be affected, but investigators have not established whether or how many were accessed; systems were shut down and the incident reported.
IFAGE said a cyberattack on April 11–12 compromised ordinary employee data; student information and teaching systems were unaffected. No ransom was demanded, operations continued, and the investigation into what was stolen remains ongoing.
A threat actor named smiro662 allegedly advertises a 32 GB archive with more than 50,000 Burkina Faso passport and national ID scans, reportedly containing personal details, document numbers, photos, and signatures.
Oriental Diamond says a ransomware attack on May 4, 2026 encrypted internal-server data and may have exposed personal information. It isolated servers, notified authorities, began restoration and investigation, suspended VPN use and strengthened authentication.
American Lending Center says a ransomware attack detected in July 2025 compromised its internal network and may have exposed personal information belonging to more than 123,000 people. The company found no evidence of misuse.
OpenAI says two employee devices were infected in the TanStack supply-chain attack, exposing internal repositories and resulting in limited credential-material exfiltration. The company rotated credentials, revoked certificates and is requiring macOS app updates.
OpenAI says tainted npm packages compromised two employees’ workstations during the TanStack incident. It says code-signing certificates may have been exposed, is rotating them, and found no evidence of codebase or user-data leakage.
OpenAI said the Mini Shai-Hulud campaign breached two employees’ devices and exposed limited credentials and code-signing certificates. It reported no impact to customer data, production systems, or deployed software and is rotating certificates as a precaution.
TeamPCP claims to offer nearly 450 Mistral AI repositories for sale after a TanStack supply-chain attack. Mistral says a codebase management system was compromised and some SDK packages briefly contaminated, but core repositories and hosted services were not compromised
