Tracks cyberattacks, data breaches, compromised organizations, leaked data, and other security incidents
2310 articles
Trend Micro describes attackers using an exposed Spring Boot Actuator endpoint, plaintext Azure AD application secrets and the ROPC flow to obtain a token and exfiltrate files from SharePoint Online.
San Felipe-Del Rio CISD said suspicious email activity preceded outages affecting internet, phone and other internal systems. Phone service was restored while teams monitored and restored systems. Schools remained open; no data access or theft was disclosed.
Trio-Tech says ransomware encrypted files at its Singapore subsidiary and that certain company data was later disclosed without authorization. It took its network offline, hired cybersecurity experts and is working to restore systems.
A company says its overseas subsidiary’s information equipment faced an external network attack on March 23, 2026. It isolated systems and engaged cybersecurity experts; operations remain normal, with no material business or financial impact assessed.
A now-unavailable GitHub advisory reportedly said malware was injected into all Checkmarx KICS Action release tags. The post describes credential and runner-memory targeting; the repository is back online, but the reported claims are not independently confirmed here.
Aqua Security confirmed attackers used compromised credentials to trojanize Trivy v0.69.4 and trivy-action tags, stealing secrets. Researchers link the activity to TeamPCP and report a follow-up CanisterWorm npm campaign. Users were urged to rotate credentials.
Attackers force-pushed 75 trivy-action tags and seven setup-trivy tags with a Python infostealer targeting CI/CD secrets. The incident followed an earlier Trivy compromise; possible TeamPCP involvement remains unconfirmed.
Foster City paused non-emergency services after a ransomware attack and warned public information may have been exposed. Separately, LA Metro restricted access to internal systems after unauthorized activity; it had not found customer or employee data affected.
Los Angeles Metro says it restricted internal administrative systems after detecting unauthorized activity. Some arrival screens and TAP reload options were disrupted; Metro says transit operations continued and customer and employee data were not affected.
Navia Benefit Solutions says hackers accessed its systems from December 22, 2025, to January 15, 2026. The breach likely affected 2,697,540 people, exposing personal and health plan information.
Mutuelle Familiale said it discovered a cybersecurity incident on March 17 that temporarily disrupted several services. Investigations into potentially affected data are ongoing, and about 113,000 members were urged to stay alert.
Former Brightly contractor Cameron Curry was found guilty of stealing company data and threatening to leak employee information unless paid $2.5 million. Brightly paid $7,540 in Bitcoin, and the FBI seized electronic evidence.
Westport Fuel Systems reported detecting unauthorized network access on March 17, 2026, affecting some internal applications and business and employee information. It said manufacturing was unaffected and expects to file annual results after the March 31 deadline.
Heritage Financial Corporation disclosed a cybersecurity incident on March 20, 2026, described as a confirmed data breach involving theft. The article does not specify what was stolen or provide further incident details.
Navia says an unauthorized actor accessed its systems from December 22, 2025, to January 15, 2026, and acquired certain information. Nearly 2.7 million people were notified; the company is offering 12 months of identity protection and credit monitoring.
Bitrefill says attackers accessed production secrets and some cryptocurrency wallets after compromising an employee laptop. The breach exposed about 18,500 purchase records; the company attributes the attack to Lazarus-linked BlueNoroff.
Marquis told Maine officials that its 2025 breach affected just over 672,000 people. The company reported that attackers accessed its systems and stole personal and financial information; a reported ransom payment remains unconfirmed.
Aura says phone phishing gave attackers access to an employee account for about an hour. Roughly 900,000 records were accessed, including contact details for about 35,000 current and former customers; Aura says passwords and financial data were not compromised.
A security incident disrupted Lucas County’s network and public-facing portals in March 2026. Officials took some systems offline as a precaution; the investigation continues, and the county has not disclosed the incident’s nature or any suspected data access.
Blastoize reportedly reposted part of a November 2025 Knownsec document leak. The files allegedly include cross-platform RAT source code, hardware attack plans and records of overseas targeting; Chinese authorities deny the breach.
A seller using the handle Shinchan claims to offer Daryn Online’s database, allegedly containing about 4 million records with personal details, passwords and authentication tokens. The claim is unverified; the seller reportedly shared screenshots and sample records.
Threat actor Spirigatito claims it breached Tanzania’s BRELA systems and exfiltrated 10.2 million records, including data on about 8 million individuals, which it is offering through a marketplace.
Marquis reported that a ransomware attack on August 14, 2025, exposed personal and financial information belonging to 672,075 people. The company attributed the attack to a compromised SonicWall firewall and sued SonicWall.
Aura confirmed that voice phishing led to unauthorized access to nearly 900,000 records. Exposed data included contact details; Aura says SSNs, passwords and financial information were not compromised. ShinyHunters claimed the theft and leaked files.
