Tracks cyberattacks, data breaches, compromised organizations, leaked data, and other security incidents
2261 articles
France detained a 15-year-old suspected of using “breach3d” to sell data from the confirmed ANTS breach. The agency reported 11.7 million affected accounts; exposed fields included contact and birth-date information. The suspect has not been formally charged.
Instructure says it experienced a cybersecurity incident involving a criminal threat actor and is investigating with outside forensics experts. It has not disclosed the impact or linked maintenance of some Canvas services to the incident.
A cyberattack targeted Clinique Ambroise-Paré in Beuvry on April 21. The clinic said its patient-record management software and IT network were affected.
The compromised [email protected] npm release ran malicious code during installation to collect secrets from developer and CI/CD environments. Socket also links a compromised GitHub account to the package’s publication.
Columbia Surgical Partners said its parent company suffered a ransomware attack, leaving the clinic unable to access electronic medical records. The issue was being addressed, but no resolution timeline was provided.
Stelia North America confirmed a cyberattack, isolated affected systems and said the incident is contained to its IT environment. Comparitech reports Rhysida claims responsibility and demands 27 bitcoin for 10 TB of data.
Sandhills Medical says it discovered a ransomware attack in May 2025 and disclosed that nearly 170,000 people were affected. Information included government IDs, financial details and personal health information.
B&G Foundation said malware caused unauthorized access and a server outage discovered April 21. It isolated affected servers and networks; no external leak of personal or confidential data has been confirmed. Investigation and recovery continue.
Reports say four SAP npm packages were backdoored to steal developer and CI/CD credentials. Researchers link the attack to TeamPCP with medium confidence; the affected versions were deprecated.
Checkmarx confirmed data was exfiltrated on March 30 after attackers used credentials stolen in the Trivy supply-chain attack. Lapsus$ later claimed a 96GB archive of stolen data; Checkmarx says it is investigating and has taken containment and credential-reset measures
ClickUp says publicly queryable Split[.]io feature-flag configurations exposed 893 customer email addresses and one live workspace API token. It removed the emails, invalidated the token and plans automated checks for personal information and credentials.
Vimeo says an unauthorized actor accessed technical data, video titles, metadata and some customer emails through a breach at analytics vendor Anodot. Vimeo says credentials, payment data and video content were not accessed; its investigation continues.
The Rural Municipality of Gimli says its systems were affected by a cybersecurity incident and has hired a firm to investigate. Bill payments cannot be processed at its office, while the incident’s scope and any data access remain unknown.
The company says its information security unit confirmed a ransomware attack on April 29, 2026. Its systems and website are operating normally, with no material operational impact or confidential-data leakage identified so far.
The article reports that the B3 school cluster in Bruck an der Mur was hacked. A ransom demand threatens publication of data if it is not paid.
Vimeo says an unauthorized actor accessed some customer and user data following the Anodot breach. The data mainly included technical details, video titles, metadata and some email addresses; Vimeo disabled the integration and is investigating.
Vimeo says attackers accessed technical data, video titles and metadata, and some customer email addresses in an attack involving analytics vendor Anodot. ShinyHunters separately claims the hack and threatens to leak data for ransom.
Checkmarx says LAPSUS$ published data it believes came from its private GitHub repository, accessed after a Trivy supply-chain attack linked to TeamPCP. Malicious KICS artifacts reportedly stole secrets; customer-data exposure remains under investigation.
Attackers abused Robinhood’s account-creation flow to send authentic-looking login alerts containing phishing links. Robinhood said its systems and customer accounts were not breached and no personal information or funds were affected.
Cherry Health says a technology outage has disrupted its phone system, but clinics remain open. An anonymous employee alleged ransomware; the claim is unconfirmed, and the organization has not said whether patient data was affected.
Medtronic confirmed its systems were hacked but has not confirmed data theft. ShinyHunters claimed to have stolen millions of records; Medtronic reported no impact to products, patient safety, or operations and is investigating possible access to personal information.
Attackers injected HTML into Robinhood account-creation emails to send convincing phishing alerts linking to robinhood[.]casevaultreview[.]com. Robinhood removed the vulnerable Device field and said customer accounts and data were not breached.
Senators Hassan and Banks asked Navigate360 about an alleged breach of its P3 Global Intel tip line. Hackers claimed to have taken 93 GB of data; the company had not confirmed that sensitive information was released.
DarkWebInformer reports that actor Spirigatito leaked three DKS datasets totaling 1,389,534 rows, allegedly containing personal details, internal messages and programme logistics; the report warns of social-engineering and operational risks.
