Tracks cyberattacks, data breaches, compromised organizations, leaked data, and other security incidents
2226 articles
Nikkei says hackers used compromised credentials to access a cloud development service on October 7 and steal 1.83 million records, including personal information. The company revoked the credentials and is investigating.
Paradigm reported unauthorized network access and possible access to files containing protected health information for more than 970,000 Medi-Cal members. The article also details separate breaches reported by Tarter Krinsky & Drogin and Ridgeway Pharmacy.
OVHcloud says an attacker replaced files in five CLI releases with a secret-stealing build, available for up to 94 minutes. The company removed the files, issued a clean release, and advised affected users to change stored secrets.
Sourcenext says attackers used an internal API from October 9 to 13 to extract customer records, potentially affecting up to 22,519,960 accounts. Exposed fields included passwords and contact details; the company reset customer passwords.
Prosecutors allege former OpenAI engineer Abdulrahman Alfozan planted an encrypted audio recorder in an executive conference room to capture sensitive meetings. A court ordered him detained; the investigation is ongoing.
Eyemart says an incident involved unauthorized access to its systems on February 12, 2026. Files included employee information and payroll data; the company says it contained the incident and is offering identity-protection services.
OpenCode says unauthorized access to a legacy system may have exposed third-party provider keys belonging to 1.4% of Console users. The investigation continues, and affected users were advised to replace keys and review API activity.
A report details EGLO’s 2022 ransomware incident and Localmind’s 2025 cloud intrusion, tracing their entry points, impact and recovery. Localmind says investigators found no evidence of systematic data exfiltration and that on-prem systems were unaffected.
TeamUpdraft says attackers likely accessed its customer database, including UpdraftCentral keys. Patchstack observed signed commands using stolen keys to install backdoors on WordPress sites; the company has closed the access route and issued updates.
An unknown actor abused a ConnectWise-held credential to obtain Microsoft Graph tokens in customer tenants. Unauthorized sign-ins were confirmed in at least 162 tenants; ConnectWise reportedly disabled affected applications, and the investigation continues.
TeamUpdraft says an attacker accessed its website and may have reached its customer database. Patchstack reports stolen UpdraftCentral keys are being used to install backdoors on connected WordPress sites.
Zeabur says attackers used leaked internal credentials to access its infrastructure and steal data from 321,810 accounts and over 3.2 million environment-variable records. The company plans to shut down services by December 31, 2026.
A former OpenAI engineer was detained after prosecutors alleged he placed recording devices at the company and secretly recorded conversations. He faces a charge of illegally intercepting oral communications; the allegations have not been proven.
Attackers used a ConnectWise Cloud Backup API secret to access customer Microsoft 365 tenants. Huntress confirmed unauthorized sign-ins in 162 tenants; ConnectWise suspended services and advised customers to disable affected applications while investigation and recovery
Ahold Delhaize confirmed a cyberattack disrupted services across its US and European brands. Some systems and services remain offline; the company says its investigation has found no evidence that sensitive data was stolen.
Attackers compromised OVHcloud’s CLI repository and modified versions 0.11.0–0.15.0 to steal secrets. OVHcloud says the incident is resolved and urges affected users to clean systems and revoke secrets.
Leipzig says its IT provider Lecos detected and stopped a cyberattack before systems went down. Attackers reportedly stole internal contact and technical directory data; employee and public data were not affected. Investigations are ongoing.
Toho Holdings said attackers accessed an Entouch database used for remote detailing and leaked information including healthcare workers’ names, contact details, and appointment data. The number affected is still under investigation.
ZenPatient says an unauthorized actor accessed or copied company data between December 5, 2025, and February 12, 2026. The company reports no known misuse and is offering affected individuals 12 months of identity protection.
BAYADA says an unauthorized actor accessed certain systems and copied data from February 18 to March 2, 2026. The company reports no indication of related identity theft or fraud and is offering credit monitoring.
A sample breach notice says Cushman & Wakefield discovered unauthorized access on April 29, 2026, and that a third party exfiltrated files containing personal data. The company says it reset credentials and increased monitoring.
CTS Journey Holdings says an unauthorized actor accessed its network from Dec. 3–11, 2025. A forensic review found personal information on affected systems; the notice says 15 Rhode Island residents were impacted.
Moody Bible Institute says information including individuals’ names was acquired from its systems on or about June 12, 2026, after a software vulnerability was exploited. The institute says it patched the flaw and is offering credit monitoring.
Parkview Health disabled its network after suspicious activity, disrupting MyChart and online doctor searches. The health system said there was no indication data was compromised and was working to restore services.
