Tracks cyberattacks, data breaches, compromised organizations, leaked data, and other security incidents
2259 articles
Instructure says it reached a deal with the unauthorized actor behind the Canvas breach and received the data and digital confirmation of deletion. It cautions that deletion cannot be guaranteed; student IDs, emails, names and messages appeared affected.
West Pharmaceutical Services says a May 4 ransomware attack disrupted global operations and exfiltrated data before encrypting files. Some systems and processes have been restored, while the data impact and full restoration timeline remain undetermined.
West Pharmaceutical Services reported unauthorized data exfiltration, encrypted systems and global operational disruption. Core enterprise systems are restored, but recovery at some sites remains ongoing; the financial impact is undetermined.
Instructure says it reached an agreement with the actor after a reported Canvas breach affecting nearly 9,000 organizations. The company says data was returned and destroyed; it has restricted access and warned of targeted phishing risks.
Zestix is allegedly selling a 2,211-file, 2.19 GB archive linked to the SAW-TAD smart diaper sensing project and SPMet, reportedly containing R&D materials, firmware, business records, and metrology files.
A threat actor claims to sell a database linked to French perfumery KAMS PARIS, allegedly containing 187,927 customer records. A sample reportedly includes names, contact details, birth dates and IBANs; the claim is unverified.
Instructure says unauthorized access to Canvas exposed user and enrollment information and caused widespread disruption. ShinyHunters claims it stole 3.65 TB; the company says credentials, course content and submissions were not compromised.
The UK ICO fined South Staffordshire Water £963,900 after finding Cl0p remained in its network for nearly two years. Weak monitoring, excessive privileges and unpatched ZeroLogon enabled the intrusion; data on 633,887 people was published.
Checkmarx said attackers using credentials stolen in the Trivy supply-chain attack accessed its GitHub environment and published a rogue Jenkins AST plugin containing malicious code. Its behavior is unknown; users should rotate secrets and investigate.
Checkmarx confirmed a modified Jenkins AST plugin was published to the Jenkins Marketplace. Researchers say TeamPCP gained unauthorized repository access; Checkmarx released a newer plugin version, but did not explain how the modified version was published.
Threat actor INT3X claims it released 731 records allegedly taken from Mansoura University, including names, work details, phone numbers, job titles, workplaces, and row IDs. The claim is unconfirmed.
A confidential source told Escudo Digital that Crypto24 used LockBit 5.0 against Notin, affecting about 15 Spanish notaries and disrupting email. Notin's website was down; the company had not responded, and allegedly stolen data and any ransom demand were unknown.
Instructure confirmed data was stolen in a Canvas breach. Attackers used XSS flaws to hijack admin sessions and later deface login portals with a ransom message. ShinyHunters claimed responsibility; Canvas was restored May 9.
Heberger, a construction company based in Schifferstadt, confirmed it was hit by a cyberattack on Thursday, May 7, shortly after 7 a.m. The report gives no details about affected systems or impact.
SailPoint says unauthorized access to some GitHub repositories on April 20, 2026, was contained. The company attributed the access to a third-party application vulnerability and said its investigation found no evidence that production or staging customer data was Access
Checkmarx warned that a malicious Jenkins AST plugin version was published. It advised users to update and released a newer version; the company has not explained how the malicious version was published.
JR Tokai Takashimaya reported unauthorized access to its part-time hiring server. Up to 1,338 employees’ personal data, including bank account details, may have been exposed; leakage is unconfirmed and a ransomware infection is suspected.
Seidensha Electronic Industrial said an after-hours IT system outage began April 22 and it is investigating a possible cyberattack. It isolated network connections; effects on personal information and other assets remain unknown.
Marutake says unauthorized external access led to a ransomware-caused outage. Some systems remain disrupted, recovery may take days, and personal-information leakage has not been confirmed; medicine supply continues through alternative methods.
The company says hackers attempted logins and cyberattacks against its headquarters’ internal network. It reports activating defenses, finding no data leakage or significant operational impact, and engaging a cybersecurity firm.
Phoenix Art Museum said unauthorized access began Dec. 3, 2025, and files containing names and Social Security numbers of eight Maine and Massachusetts residents were identified. Rhysida claimed responsibility; the museum offered one year of monitoring.
ALS reported unauthorized third-party access to parts of its IT systems, temporarily disrupting some operations. Most services have been restored; the company is investigating the incident’s scope and potential customer and financial impact.
Trend Micro says a document released by SHADOW-AETHER-015 lists 8,809 Canvas institutions across 50 countries. The breach’s full scope is still being established, with phishing and social engineering identified as key follow-on risks.
An Italian news report says Unoaerre was hit by a cyberattack and received a €3.8 million bitcoin ransom demand. Systems recovery is ongoing; initial checks found no irreversible damage, while possible access to sensitive data remains under investigation.
