Tracks cyberattacks, data breaches, compromised organizations, leaked data, and other security incidents
2263 articles
France’s ANTS portal breach, detected April 15, 2026, may have exposed account identifiers and personal details. Authorities say uploaded documents and direct account access were unaffected; investigations and security measures are ongoing.
Sprendlingen-Gensingen says its municipal administration and utilities were targeted in a ransomware attack on April 16. Systems were taken offline; forensic investigators are examining the access method and affected data, and personal-data theft remains unclear.
Threat actor Rabid is advertising a claimed 250GB+ CIBN archive said to contain member records, scanned IDs, academic certificates, source code and internal documents. The article does not independently verify the alleged leak.
DarkWebInformer reports that actor Sorb is offering a database allegedly from Taiseer with 71,000 user records, including bcrypt hashes and 27,000 national ID scans. The seller claims ongoing access; the article provides no independent confirmation.
Mile Bluff Medical Center says a security event involving data encryption is disrupting some phone and computer functionality. The hospital activated security protocols, began an investigation, and is working to restore systems.
Attackers used a compromised axios maintainer account to publish malicious npm releases that delivered a cross-platform RAT. Huntress observed at least 135 endpoints contacting the attacker’s infrastructure during the exposure window.
LayerZero says preliminary indicators point to North Korea’s Lazarus Group (TraderTraitor) in KelpDAO’s reported $290–293 million rsETH theft, enabled by poisoned RPC data and DDoS against healthy nodes. KelpDAO paused contracts as an investigation continues.
Hudson Rock linked the Vercel breach to a Context.ai employee’s device infected with Lumma Stealer. Vercel said an attacker used OAuth access to reach environments and variables; a group claiming to be ShinyHunters says it is selling data.
Vercel says a compromise of a third-party AI tool’s Google Workspace OAuth app enabled attackers to take over an employee account and access some environments; a limited subset of customers had credentials or environment variables compromised.
Kelp confirmed a crypto theft reported at nearly $290 million. LayerZero attributed it preliminarily to TraderTraitor and blamed Kelp’s single-verifier setup; a Kelp source disputed that account. LayerZero and Aave are assessing responses.
A defaced Seiko USA page claimed attackers accessed its Shopify backend and stole customer data, threatening publication after 72 hours. The actor and claims remain unverified; Seiko has not publicly confirmed the incident and removed the message.
Vercel reported unauthorized access after an employee’s Google Workspace account was accessed through compromised Context.ai OAuth tokens. The article outlines potential exposure and steps for organizations to find and revoke the app’s access, investigate activity, and,
Bluesky says a DDoS attack beginning April 15 disrupted feeds, notifications, threads and search. The app stabilized after mitigation, and the company found no evidence of unauthorized access to private user data. 313 Team claimed responsibility; Bluesky has not підт
France’s Interior Ministry says a security incident detected April 15 at the ANTS portal may have exposed account credentials and personal details. Uploaded documents were reportedly not accessed; an investigation and additional safeguards are underway.
An unidentified seller allegedly offered Champhunt’s database and source code for Monero, claiming 224,300 user records were exposed, including contact details, hashed passwords, dates of birth, and profile data. The breach is unconfirmed.
Vercel says attackers used a compromised Context.ai integration to access an employee’s Google Workspace account and internal systems, exposing some non-sensitive environment variables. The scope and possible exfiltration remain under investigation.
Minidoka Memorial Hospital said an April 5 cyber incident limited imaging and led to some emergency transfers; imaging access was restored by April 19. A reported Blackwater leak-site claim remains unverified, with no data exposure confirmed.
Vercel confirmed unauthorized access to some internal systems and says core services remain operational. ShinyHunters claims stolen assets, while Vercel investigates and advises rotating non-sensitive environment variables and reviewing audit logs.
On April 20, 2026, the company said it detected a cyberattack and activated security and recovery plans. It reported no personal or confidential data leakage found so far and no material operational impact based on its current assessment.
Vercel confirmed unauthorized access to internal systems affecting a limited subset of customers. An actor claiming to be ShinyHunters alleges data theft and a $2 million ransom; the shared data's authenticity is unverified, and actors linked to ShinyHunters deny they**
Temse took its IT systems offline as a precaution after detecting irregularities. Municipal services are limited while Belgium’s Centre for Cybersecurity investigates; the incident’s nature and impact remain unknown.
Grinex said it is suspending operations after an April 15, 2026 theft of about $13.74 million. Analysts traced funds across TRON and Ethereum; the exchange blamed Western intelligence, while a criminal exploit or false flag remained possible.
Ukraine says it has tracked three campaign waves since 2023; researchers attribute the activity to APT28 and report over 170 compromised email accounts. Attackers exploited Roundcube flaws; ARMA and SAP report no confirmed internal data theft.
DarkWebInformer reports that HexDex is offering data allegedly linked to 1,926,409 French Basketball Federation members and about 800,000 parents, including contact, club and medical-certificate details. The claim is not independently verified in the article.
