Tracks cyberattacks, data breaches, compromised organizations, leaked data, and other security incidents
2311 articles
A threat actor posted a database allegedly containing 68,385 Aramco workforce records, including national IDs, employee details and broker account numbers. The claimed source of the data and method of compromise remain unconfirmed.
NoName057(16) claims coordinated DDoS attacks against Cypriot government, judicial, utility and transport sites. The Cyprus Ports Authority reportedly used geo-blocking; the article provides no independent confirmation.
Stryker confirmed a global disruption to its Microsoft environment. Employees reported managed devices wiped, while Handala claimed responsibility and said it wiped over 200,000 systems and stole 50 TB; those claims are not independently confirmed.
Bell Ambulance confirmed unauthorized network access in February 2025 and exposure of sensitive information belonging to 237,830 people. Medusa claimed responsibility and allegedly leaked over 219 GB of data; Bell reset passwords and offered affected people credit and身份
Threat actor zSenior is reportedly offering access to a South Korean government server, claiming root privileges, a path to 42 internal hosts, and PostgreSQL superuser access to a host said to contain PII.
Threat actor bytetobreach claims it breached Viking Line and published passenger and NetAxept payment data, credentials and vehicle plates. The actor says it exploited a 2021 Solr LFI to obtain Tomcat credentials; the claims are unverified.
Rusk County, Wisconsin, says a network cybersecurity incident is under investigation; forensic experts are helping assess its scope and restore operations. Officials have not confirmed data access. A prior Lynx listing on ransomware[.]live may be unrelated.
Stryker reported a severe global disruption affecting laptops and network-connected systems. Employees said devices were remotely wiped; Handala claims it stole 50 terabytes of data and wiped over 200,000 systems. Stryker is working with Microsoft to restore systems.
Stryker confirmed a cyberattack disrupted its global Microsoft environment, with business continuity measures in place. Employees reported wiped devices; Handala claimed responsibility and alleged data theft, but Stryker has not confirmed the group's role.
Stryker said a cyberattack caused a global Microsoft environment disruption and that the incident appeared contained. Handala claimed it wiped systems and stole data, but those claims remain difficult to verify.
Albania’s parliament reported a cyberattack that temporarily disrupted internal email, while local media said staff and lawmakers lost computer access for hours. Homeland Justice claimed responsibility, but authorities have not verified its claims and are investigating.
Hider Nex claims its OpKuwait DDoS campaign targeted Kuwaiti government portals, ministries, public authorities and Burgan Bank, causing reported outages. The article provides no independent confirmation.
Team Fearless claims on Telegram that DDoS attacks under #OpIsrael and #freepalestine took four Israeli organizations’ websites offline, naming Alon Israel Oil, Goldtec Technologies, Amarel and a marketing agency. The claims are unverified.
Google reported that UNC6426 used credentials stolen through the nx npm compromise to gain AWS administrator access within 72 hours, exfiltrate S3 data, destroy production resources, and expose internal GitHub repositories.
PoliceEspDoxedBF claims to have leaked Spanish Ministry of Finance employee records containing IDs, IBANs, contact details and addresses. Redacted samples were posted, but the claim is unverified.
The article reports that NyxarGroup is offering 1.8 million records allegedly linked to Maple Respiratory Colombia. The claimed datasets include patient identity and contact details and medical appointment histories; the sale and data authenticity are unverified.
Stryker reports a severe global disruption affecting network-connected systems, with its Cork IT systems down. The company says the root cause is unknown; an unconfirmed statement purporting to be from Handala claims responsibility.
Bell Ambulance reported that a breach discovered Feb. 13, 2025, affected 237,830 people, exposing personal, financial and medical information. The Medusa ransomware gang claimed the attack and demanded $400,000.
Wagon Mound Public Schools took its network offline after the superintendent reported a virus-related disruption. Interlock later claimed it obtained 80GB of data, but the district has not confirmed ransomware or data theft.
A cyberattack on March 7–8 encrypted parts of a Szczecin hospital’s IT system, prompting paper-based workflows. The hospital says urgent care continues while authorities and cybersecurity teams work to restore access.
A hacker-forum listing reportedly offers the Pays de la Loire Mobility Observatory’s operational database for $8,000. The claimed data includes transit network records, live and historical archives, and passenger-flow information; the listing and data are unverified.
An unidentified threat actor claims to have stolen about 25 GB of Hospital Universitario del Valle patient data and is reportedly offering it for $500. The claim and alleged data theft are unverified.
NoName057(16) claims DDoS attacks against Bezeq, Mekorot, Kavim and E.M.I.T. Aviation as part of OpIsrael. The article reports site outages and access errors, citing the group and provided server checks.
A database reportedly containing over 1.1 million Saint Lucia Citizenship by Investment Programme records was published on a cybercrime forum. The alleged data includes passport numbers, contact details, hashed passwords and sensitive application documents.
