Tracks cyberattacks, data breaches, compromised organizations, leaked data, and other security incidents
2309 articles
St Anne's Catholic School in Southampton closed for four days after it reported a ransomware attack. The school said it had contained the incident and had no evidence that data was compromised.
A breach at Nova Scotia Power exposed data from about 915,000 current and former customers. The article reports a SocGholish infection, data exfiltration and ransomware deployment, followed by regulatory scrutiny and expanded customer protections.
Hightower Holding says attackers used compromised credentials to access and exfiltrate files in January 2026. The company reported that 131,483 people were affected and that the files included personal information.
The Handala Hack Team claims it exposed personal information about 28 Lockheed Martin engineers in Israel and threatened them and their families. The article says there is no public evidence of a breach of Lockheed Martin’s corporate networks.
A ransomware attack disrupted cargo-management and other digital systems at Spain’s Port of Vigo. Officials isolated affected servers, shifted some logistics to manual processes, and reported a ransom demand; the access method and any data compromise remain under1a16
Malicious LiteLLM 1.82.7 and 1.82.8 releases on PyPI contained code designed to steal credentials and install a persistent downloader. Impact is unknown; researchers suspect a compromised maintainer account and link the activity to self-identified TeamPCP.
Maine behavioral health provider AMHC confirmed a recent network disruption and an ongoing investigation after Qilin listed it on its leak site. The provider said it would not deal with the cybercriminals; whether data was stolen remains unclear.
Martinsville officials said a cyberattack was contained on March 25 and warned that some municipal services could be delayed or limited for the rest of the week. They said no citizen information was compromised.
Sorb claims to be selling an 18,000-record Alyna database for $300. The listing reportedly includes MD5-hashed passwords, personal and location data, booking details, and Kfast tokens; the claim is unverified.
A dark web seller reportedly seeks $8,000 for a purported 3TB database allegedly taken from Iran’s Oghab 44 air base. Claimed contents include war operations, missile, nuclear-systems and aircraft information; the claim is unverified.
A threat actor claims to have breached National Oil Ethiopia through an Exchange ProxyLogon vulnerability, disabled Kaspersky, compromised Veeam backups, deployed ransomware and stolen four databases, including an ERP database over 800GB.
Navia reported unauthorized access and acquisition of personal and health-plan information, affecting nearly 2.7 million people. HackerOne says 287 employees may be affected; it is investigating with Navia.
Stryker is restoring production after attackers allegedly used Microsoft Intune to wipe more than 200,000 employee devices. Unit 42 says persistence was removed; a DOJ affidavit describes disrupted hospital communications and emergency care in Maryland.
INP Schweiz says company data was stolen during a February cyber incident, but not sensitive customer, financial or personnel data. Akira claims the attack and says it holds about 9 GB; INP has not confirmed the perpetrators or extortion.
Researchers say malicious LiteLLM versions 1.82.7 and 1.82.8 steal credentials and install persistence. Reports of about 500,000 data exfils remain independently unconfirmed; version 1.82.6 is identified as clean.
ByteToBreach alleges it compromised National Oil Ethiopia, gained Active Directory admin access, exfiltrated over 800 GB of data and deployed ransomware. The claims are not independently verified in the supplied content.
Poland reported 270,000 cyberattacks in 2025. Officials described a Dec. 29 destructive attack on a heat-and-power plant and renewable sites; electricity supply continued. CERT and ESET analyses pointed to possible Russian-linked actors, but no culprit was publicly ind[
Local reporting says some Duffy’s locations could not process card payments for days and its rewards program was disrupted. A Qilin listing has not been confirmed by the company and does not establish what happened on its network.
A 1.08 GB database dump allegedly containing over 352,000 Armenian ManyChat records includes contact details, hashed passwords and account data. A sample suggests a link to Telcell, but the exposure is not independently confirmed.
The Dutch Ministry of Finance confirmed unauthorized access to policy-department systems detected on March 19. Access was blocked; the investigation continues. Citizen-facing tax, customs and benefits systems were unaffected, and data theft is unknown.
Infinite Campus says an employee’s Salesforce account was accessed during an extortion attempt. The company says exposed data was mostly public directory information, reports no customer databases were accessed, and is scanning data and contacting districts.
HackerOne says a BOLA flaw at benefits administrator Navia exposed personal data belonging to 287 employees between Dec. 22, 2025, and Jan. 15, 2026. Navia said claims and financial information were unaffected.
The Dutch Ministry of Finance says attackers accessed several internal systems after a third-party alert. Affected systems were taken offline while investigators assess the entry point and possible data exposure; tax and customs services remain operational.
An unknown actor claims to have stolen 2 TB of Energetika Ljubljana’s TE-TOL project files and is offering the dataset for 3 BTC. The alleged breach is unconfirmed.
