Tracks cyberattacks, data breaches, compromised organizations, leaked data, and other security incidents
2262 articles
Bitwarden confirmed a brief compromise of its npm CLI release, @bitwarden/[email protected], containing a preinstall credential stealer. Researchers linked it to the Checkmarx campaign; Bitwarden found no evidence vault data or production systems were compromised.
Suffolk says an investigation found an attempted ransomware attack that the city detected and blocked. Investigators have not confirmed whether data was accessed or obtained, but names and other personal information may have been exposed.
ADT says attackers accessed and stole customer and prospective-customer data on April 20, including names, phone numbers and addresses. ShinyHunters’ claim of 10 million stolen records remains unconfirmed by ADT.
An incident response case describes INC operators exploiting weak FortiGate access and stale, over-privileged accounts to move laterally, exfiltrate about 410 GB, and encrypt systems lacking EDR.
An unauthorized party allegedly compromised Foodini and published a compressed archive of platform files, including system files, binary data, and internal application and operational data.
A threat actor claims to have stolen 50.52 GB of files from Terra West Management Services and subsidiary Battle Born Recovery Solutions, and is offering the data for $600.
Vercel says its investigation found additional customer accounts affected by an attack traced to a Context.ai compromise involving Lumma Stealer and stolen API tokens. The number of affected accounts and containment status remain undisclosed; Vercel found no evidence of
CISA validated a breach at an unnamed U.S. federal agency involving Cisco Firepower/ASA devices, finding FIRESTARTER persistence that enabled access in March 2026 and Line Viper VPN-authentication bypass. Updated checks and remediation are required.
Bitwarden confirmed attackers briefly published malicious @bitwarden/cli v2026.4.0 on npm, stealing developer and cloud credentials. Its investigation found no evidence of vault or production-data compromise; affected users should rotate exposed credentials.
kittykatkrew claims it breached the Arkansas State Crime Lab through its public LASSO portal and stole court calendars, personnel records, and account metadata. The report says an archive was offered free online.
Rituals says attackers downloaded personal data from its My Rituals membership database. Potentially exposed fields include contact and demographic details. The company says passwords and payment data were not accessed, access was blocked, and the affected-member count
Socket says trojanized Checkmarx KICS images and extensions delivered credential-stealing malware. The malicious Docker digest was served for about 84 minutes; TeamPCP claimed responsibility, but attribution remains unconfirmed.
France Titres (ANTS) says a breach detected April 15 may have exposed user information, including names and email addresses. The agency notified affected users and authorities, added security measures, and warned of phishing.
Hong Kong’s privacy watchdog found that a ransomware attack on Yau Yat Chuen Garden City Club affected more than 9,000 people and involved personal data. The club says it has no evidence the data was publicly leaked.
Orange, Virginia, reported a three-day technology outage in February. LockBit listed the town on its leak site in March, but officials have not linked the events, and no compromise has been confirmed.
A DDoS attack against Mastodon.social caused a major outage on April 20. Mitigations restored access within hours, and Mastodon reported normal operations the next day; no one publicly claimed responsibility.
An actor reportedly claims to have breached Reliance Jio and exposed an alleged real-time algorithmic trading system, a redis_dump.txt file, NSE Futures & Options data, trading metrics and system alerts. The article provides no independent confirmation.
NSW internal monitoring detected a suspected transfer of confidential commercial and financial documents involving multiple departments. Police launched Strike Force Civic and laid charges; authorities believe the alleged data is secured, with no current service impact.
The article reports that threat actor 888 posted a database said to contain 6,700 Ledil Immobilier user records, including contact, address, property and transaction data. It says the dataset was offered free on darkforums[.]su; the claims are unverified in the supplied
France’s ANTS reported a security incident that may have exposed account and personal data. Actor breach3d claims to offer up to 19 million records for sale; the claim is unconfirmed, and the investigation continues.
Vercel says a compromise of third-party AI tool Context.ai led to an employee’s Google Workspace account being taken over and some non-sensitive environment variables accessed. Vercel is investigating and told affected customers to rotate credentials.
A report alleges that 3,652 files of SSEDOMEX 911 and 089 records from 2016–2026 were offered for $1,200, potentially exposing personal information, sensitive incident details and dispatch data. The claim is unverified in the article.
Vercel says a stolen OAuth token linked to Context.ai gave an attacker access to some environments and variables not marked sensitive. The companies are investigating; Vercel recommends credential rotation and other safeguards.
Bluesky said a DDoS attack starting late April 15, 2026 disrupted feeds, notifications, threads and search. Service stabilized by about 9 p.m. PDT April 16; the company reported no evidence of unauthorized access. “313 Team” claimed responsibility, but attribution is un
