Tracks cyberattacks, data breaches, compromised organizations, leaked data, and other security incidents
2307 articles
An unidentified Telegram-based actor claims to have stolen 700,000 Evolve Your English records from 2020–2026. The advertised “Spain Database” sample reportedly focuses mainly on Colombian users and includes personal, identity, password and bank account data.
A hacker-forum post allegedly offers 258 records from a database claimed to belong to EmergiaCC (Colsubsidio) in Bogotá. Listed data includes executive names, GPS coordinates, addresses and financial details; the claim is unverified.
A threat actor claims to have compromised Airdeals, Airtips, and Payair, taken Airtips offline, and obtained customer and payment data. The actor reportedly demands payment within 48 hours and offers the data for sale for $300.
A cyberattack disrupted the Education Authority’s C2K services, preventing thousands of pupils and staff from accessing school resources. Phased restoration and a full password reset are underway; personal data compromise has not been confirmed.
CERT-EU reportedly assesses with high confidence that a compromised Trivy update led to theft of an AWS management key and data exfiltration from European Commission cloud infrastructure. ShinyHunters published the dataset; up to 71 EU clients may be affected.
Signature Healthcare says a cybersecurity incident is affecting some information systems. Ambulances are being diverted, chemotherapy infusions for April 7 were canceled, and retail pharmacies are closed; emergency and inpatient services remain open.
StepSecurity says it detected malicious axios versions 1.14.1 and 0.30.4 through package analysis and C2 traffic. The maintainer later confirmed social engineering and npm-token theft; Google and Microsoft attributed the operation to North Korean actors.
Drift says the April 1, 2026 theft of $285 million followed a six-month social engineering operation, attributed with medium confidence to UNC4736. Suspected entry points included a malicious VS Code project and a fraudulent TestFlight wallet.
Gritman clinics began reopening Friday after a cyber-related outage disrupted outpatient care. The hospital and emergency department stayed open; Gritman said preliminary findings showed no successful system access or patient-data compromise.
A social-engineering campaign compromised an Axios maintainer account and led to malicious npm releases that installed a cross-platform RAT. Google attributes the activity to UNC1069; maintainers removed the releases and reset credentials.
The Uffizi Galleries confirmed a cyberattack but deny their artwork-protection systems were compromised. Italian media alleged hackers accessed IT systems and sought ransom; the museum disputes key claims and says backups restored its server without data loss.
Omax Autos said ransomware affected its IT infrastructure after detection on March 26, 2026. Core operations and critical functions remain unaffected as the company investigates, assesses potential losses and strengthens cybersecurity measures.
Handala claims it stole more than 2 TB of St. Joseph County data. County officials say only a third-party fax service was hacked; posted files’ authenticity is unverified, and investigations are ongoing.
CERT-EU says attackers used an API key exposed in the TeamPCP Trivy supply-chain attack to access an EC AWS account and exfiltrate 340GB of data tied to websites for up to 71 EU entities; credentials were revoked and rotated.
CERT-AGID reports that a Telegram channel calling itself “Anonymous Algeria” posted 500 scans of Italian identity documents and selfies. Most appear dated 2020–2021; the origin and any link to a recent breach remain unconfirmed.
Nacogdoches Memorial Hospital says an unauthorized party compromised its network and may have accessed patient data, including Social Security numbers and medical records. The hospital notified law enforcement and affected patients; it reports no known misuse.
Axios maintainer Jason Saayman confirmed attackers used targeted social engineering to steal his npm credentials and publish two trojanized releases containing WAVESHAPER.V2. The article links the campaign’s tradecraft to UNC1069.
CERT-EU attributes the European Commission’s March AWS breach to TeamPCP, with high confidence that attackers gained access through a compromised Trivy package and stolen API key. About 92 GB of data was taken; no lateral movement was identified.
Kyushu Denshi reported that ransomware at its Taiwan subsidiary disrupted email, order processing and shipping. It said the attack did not spread to its Japan headquarters and that it detected no signs of data exfiltration.
Northern Ireland’s Education Authority says the C2K school network was targeted in a cyber attack. A network-wide password reset has logged users out and access is unavailable; the EA has not confirmed whether personal data was affected.
Germany’s Die Linke confirmed a cyber incident but said it is unclear whether data was accessed; its membership database was unaffected. Qilin claimed the attack and threatened publication, but posted no data samples.
Hims & Hers says attackers accessed or acquired Zendesk support tickets without authorization from February 4–7, 2026. Tickets may contain personal information; the company says medical records and doctor communications were not compromised.
CERT-EU attributed the European Commission cloud breach to TeamPCP, saying a stolen AWS key enabled data theft. A ShinyHunters leak may affect 42 Commission clients and at least 29 other EU entities; no sites were taken offline.
Former infrastructure engineer Daniel Rhyne pleaded guilty to an extortion plot involving unauthorized access, account deletions and password resets that affected 254 servers and 3,284 workstations at his employer.
