Tracks cyberattacks, data breaches, compromised organizations, leaked data, and other security incidents
2314 articles
Cloud Imperium Games reported read-only access to backup systems on January 21, 2026, exposing limited user account details. The company says no passwords or financial data were accessed and it has found no evidence of a public leak.
Handala Hack Team claims it breached Sharjah National Oil Corporation and Israel Opportunity Energy, alleging it exfiltrated 1.3 TB of sensitive data from Sharjah. The claims have not been independently verified.
An anonymous actor reportedly claims to have exfiltrated a 1,389,534-row database from Norway’s Den kulturelle skolesekken and posted samples on a cybercrime forum. The reported data includes personal details and internal communications; the breach is unconfirmed.
The University of Hawaiʻi Cancer Center says ransomware affected its epidemiology division, with information on 87,493 study participants stolen and about 1.15 million additional historical records potentially affected. The group remains unidentified.
The University of Hawaii says a 2025 ransomware attack exposed research files containing Social Security and other identifiers. The incident potentially affected 87,493 study participants and up to 1.15 million people in historical records.
LexisNexis confirmed unauthorized access to a limited number of servers, while FulcrumSec claims it exploited an unpatched React app and leaked 2.04 GB. The company says mostly pre-2020 data was affected and the intrusion is contained.
DragonForce claims it compromised 1.52 TB of FGV data and posted document images. FGV says it has no confirmation of intrusion or theft; a link to earlier service instability is unconfirmed.
The company said external hackers attacked its information systems on March 3, 2026. It implemented security measures and currently assesses that no personal or confidential data leaked and operations were not materially affected.
A reported cyber incident left Wisconsin’s Denmark School District without internet for five school days. WiscNet logged a seven-day handoff-port outage; a ransomware claim naming Incransom remains unconfirmed, and data exposure is unknown.
Madison Square Garden confirmed a breach tied to the Oracle EBS campaign. A vendor investigation found data was stolen in August 2025; names and SSNs were compromised. MSG reported 11 affected Maine residents, but the total is unclear.
Langenzersdorf said a cyberattack on Feb. 27, 2026, left its internal network unavailable and suspended in-person municipal services. The municipality said phone service continued and critical infrastructure was unaffected.
A reported multi-vector DDoS disrupted websites operated by Roskomnadzor and Russia’s Defense Ministry, as well as GRFC infrastructure. Roskomnadzor said it contained the attack, but users continued reporting access problems; no actor claimed responsibility.
An unidentified cybercrime-forum user claims to have scraped BE-ATEX’s internal administrative panel, exposing more than 2,200 customer records and 300 employee or internal-user records. The claim is unverified.
Gambit Security reports that attackers used Claude Code and GPT-4.1 in a cyberattack compromising ten Mexican government bodies and a financial institution, with more than 150GB of data reportedly exfiltrated.
South Korea’s National Tax Service reportedly exposed a seized Ledger wallet’s recovery phrase in release photos. About 4 million PRTG tokens, valued at $4.4–4.8 million, were then transferred; recovery status is unclear.
QuickLens v5.8 was reportedly hijacked and used to push ClickFix prompts and infostealer payloads to about 7,000 users, targeting crypto wallets and credentials. Google removed the extension; reported theft was not confirmed.
Canadian Tire said an October 2025 breach exposed customer information in an e-commerce database. Have I Been Pwned later listed about 42 million records, including 38.3 million email addresses; the company has not publicly confirmed the victim count.
A seller using the handle HexDex is offering 116,122 records allegedly taken from French insurance comparison platform Santeo[.]net. The listing claims the data includes identity, contact and insurance-policy details; the article does not verify the claim.
DarkWebInformer reports that actor empathy leaked 20,218 DevChallenges user records in February 2026, including profile details, email addresses, and subscription and feedback invoice records linked to accounts.
ManoMano says unauthorized access through a third-party customer service provider led to personal data being extracted for about 38 million people. It says passwords were not accessed and it revoked the provider’s access.
A Japanese hospital confirmed personal information was leaked after a January cyberattack. The hospital said attackers used VPN equipment to access its medical system and steal a database; Kyodo reported a ¥15 billion ransom demand.
Konstanz city administration says a cyberattack targeted its mobile-device management system. Names and work email addresses of some employees may be affected; officials say citizen data is not affected and operations remain uninterrupted.
ManoMano began notifying potentially affected customers after a January breach reportedly exposed names, email addresses, phone numbers, and support exchanges. Indra claimed to have stolen data linked to 37.8 million accounts; some details remain unconfirmed.
Ngong Ping 360 says an internal network disruption led to data theft and extortion. Affected information includes names and contact details of employees, customers, suppliers and market tenants; the company says cable car operations are unaffected.
