Tracks cyberattacks, data breaches, compromised organizations, leaked data, and other security incidents
2259 articles
JDownloader confirmed its website was compromised on May 6–7, 2026, and altered Windows and Linux installer links. The Windows payload installed a Python RAT; affected users were advised to reinstall their systems and reset passwords.
Instructure said an unauthorized actor exploited an issue involving Free-For-Teacher accounts, prompting another Canvas shutdown on May 7 before restoration. ShinyHunters claims a second breach and massive student-data theft; Dark Reading could not confirm the claims.
Threat actor fuckiewuckie claims a May 2026 re-leak of 787,217 student records from Dubai-based MoreIdeas General Trading LLC, allegedly including names, contact details, addresses and parent ID proof.
A threat actor named shabat allegedly offered about 105,000 records from Belgian sports and fitness chain ANIMO for sale, including personal details and IBAN and BIC data. The claim is not independently confirmed.
Alameda_slim claims it breached Mexican lab Laboratorios CEFLO and released about 21,000 records, reportedly including sensitive test results and patients’ personal details. The breach is unconfirmed.
LaPampaLeaks claims it accessed Antel’s TuID Digital platform using a backend API key and released 8GB of files. The actor says the data included citizen records, identity details, biometric-status information and API keys.
A threat actor claimed to have released 7,169,561 Meetic records for free. The sample reportedly includes usernames, emails, IP addresses, registration details and partial profile information; the claim is unverified.
Sohaib Akhter was convicted of federal computer fraud conspiracy and password trafficking. Prosecutors said he and his brother accessed an EEOC complainant’s email and deleted 96 government databases after being fired.
West Pharmaceutical’s plant in Nouvion-en-Thiérache has been affected by a cyberattack and is shut down since May 4. An investigation is underway; the amount of affected data and the restart date remain unknown.
NVIDIA confirmed a breach at its Armenian GeForce NOW partner exposed user information. NVIDIA says its own network was unaffected; GFN.am said passwords were not exposed. A forum post attributed to a ShinyHunters impersonator claimed a larger theft.
A threat actor identified as boltak claims to sell authenticated admin access to a U.S. non-emergency medical transport platform, 500,000+ patient records and Smart-Data-Hub source code; the article provides no independent confirmation.
A seller identified as Moon_WALK claims to offer a 2.47GB database allegedly taken from the Homes at World real-estate platform, with more than 7 million agent and investor records containing personal and property details.
MDGhost is advertising a data sale linked to Community Choice Credit Union, claiming more than 1 million records. The alleged data includes card and contact details; screenshots reportedly suggest possible admin-dashboard access.
A threat actor claims to have leaked 1,504,635 LDLC customer records. The reportedly exposed sample includes contact and address details, account information, internal IDs, customer codes, and VAT regime data. The claim is unverified in the supplied content.
A threat actor identified as Blastoize is allegedly selling 243 million records attributed to Brazilian credit provider Credilink. The reported data includes CPF IDs, addresses, vehicle ownership and presumed income; a 12 million-record sample is offered free.
Trellix confirmed unauthorized access to part of its source code repository and is investigating. RansomHouse claimed responsibility and said the intrusion involved encryption, but its screenshots were not verified. Trellix found no evidence its release or distribution
A former federal contractor was convicted of conspiring to destroy government databases after his 2025 dismissal. Prosecutors said he and his brother deleted about 96 databases, including sensitive investigative and FOIA records, and tried to conceal their actions.
Have I Been Pwned says data from 197,400 people was exposed in the Zara breach. Inditex attributed unauthorized access to a former technology provider and said credentials and payment data were not exposed; ShinyHunters claimed responsibility.
Braintrust said hackers accessed an internal AWS account that may have exposed customer AI-provider API keys. At least one customer was affected, and three others reported suspicious usage spikes; the investigation is ongoing.
A cybersecurity incident at Canvas operator Instructure caused outages at universities nationwide. Stanford cited information indicating names, emails, student IDs and user messages were involved; ShinyHunters claimed responsibility, but Instructure has not confirmed it
Trellix said part of its source code repository was breached. RansomHouse claimed credit and posted screenshots apparently showing access to internal services; Trellix is investigating, and the claimed data theft remains unspecified.
Hunt Intelligence reports an intrusion into Oman’s Ministry of Justice, with more than 26,000 user records and sensitive judicial data exfiltrated. A custom webshell was found; attribution to Iranian-linked actors remains inconclusive.
BleepingComputer reports that ShinyHunters defaced Canvas login portals at about 330 institutions and threatened to leak data. Instructure took Canvas offline; it confirmed data was stolen in an earlier attack and is still investigating.
Instructure confirmed a May 2026 Canvas incident and said user data, including names, emails, student IDs and messages, was accessed. ShinyHunters claimed responsibility and threatened extortion; its claims about 275 million people and 3.65 TB remain unverified.
