{
  "version": "https://jsonfeed.org/version/1.1",
  "title": "The Hacker in a Hoodie Index: new incidents",
  "home_page_url": "https://hackerinahoodie.com/",
  "feed_url": "https://hackerinahoodie.com/feed.json",
  "description": "New cyber-incident cost figures on the public record, read from the source and never summed.",
  "language": "en-US",
  "items": [
    {
      "id": "https://hackerinahoodie.com/incident/zerostack-corp-2026-08-21.html",
      "url": "https://hackerinahoodie.com/incident/zerostack-corp-2026-08-21.html",
      "title": "ZeroStack Corp.: not yet quantified",
      "content_text": "Verified figure. Not yet quantified, disclosed Aug 2026, Wholesale and Distribution. ZeroStack Corp. disclosed a material cybersecurity incident under Item 8.01 (other events), not as a 1.05 (material incident), and the filing states nothing further: no entry point, no actor, no data type, no scope. That silence is itself the finding, since a disclosure obligation triggered by materiality has been met while the architecture that produced the exposure remains hidden. A filing can satisfy the law without telling anyone what actually failed. Source: SEC 8-K, Item 8.01.",
      "date_published": "2026-08-21T00:00:00Z",
      "tags": [
        "Wholesale and Distribution",
        "Government record"
      ]
    },
    {
      "id": "https://hackerinahoodie.com/incident/aetos-2026-08-21.html",
      "url": "https://hackerinahoodie.com/incident/aetos-2026-08-21.html",
      "title": "Genesis Healthcare Management: not yet quantified",
      "content_text": "Verified figure. Not yet quantified, disclosed Apr 2026, Healthcare and Life Sciences. Kern Psychiatric Health and Wellness Center's patient data was exposed not on its own systems but on the network of Genesis Healthcare Management, the outsourced management company that discovered unauthorized file access on June 22, 2026. The data was among the most sensitive a person holds, Social Security numbers alongside diagnoses, prescriptions, and treatment records. Outsourcing the back office moved those records to a network the practice did not run. Source: California AG breach notification.",
      "date_published": "2026-08-21T00:00:00Z",
      "tags": [
        "Healthcare and Life Sciences",
        "Government record"
      ]
    },
    {
      "id": "https://hackerinahoodie.com/incident/asos-us-sales-llc-2026-08-21.html",
      "url": "https://hackerinahoodie.com/incident/asos-us-sales-llc-2026-08-21.html",
      "title": "ASOS US Sales LLC: not yet quantified",
      "content_text": "Verified figure. Not yet quantified, disclosed Jul 2026, Retail and Consumer. ASOS traced unauthorized account access to credentials stolen in a different company's breach and reused against it. Nothing in ASOS's systems was breached; a valid credential was just presented by the adversary. Password-only authentication inherits every leak that credential ever appeared in, and the system just works as designed after it is leveraged. Source: California AG breach notification.",
      "date_published": "2026-08-21T00:00:00Z",
      "tags": [
        "Retail and Consumer",
        "Government record"
      ]
    },
    {
      "id": "https://hackerinahoodie.com/incident/apollo-global-2026-08-21.html",
      "url": "https://hackerinahoodie.com/incident/apollo-global-2026-08-21.html",
      "title": "Apollo Global: not yet quantified",
      "content_text": "Attested figure. Not yet quantified, disclosed Aug 2026, Financial Services. The notice attached to this incident reads \"to review,\" which means the source confirms nothing beyond a name and a date: not the vector, not the actor, not what was reached, not how many were affected. Apollo Global sits in the Index with a placeholder where an accounting should be. An institution's disclosure obligation is itself a control point, and a statement that has not yet been given is not transperancy, especially for customers. . Source: Apollo Global reveals data breach after hackers target financial firms.",
      "date_published": "2026-08-21T00:00:00Z",
      "tags": [
        "Financial Services",
        "Beyond the filings"
      ]
    },
    {
      "id": "https://hackerinahoodie.com/incident/alation-2026-08-21.html",
      "url": "https://hackerinahoodie.com/incident/alation-2026-08-21.html",
      "title": "Alation: not yet quantified",
      "content_text": "Attested figure. Not yet quantified, disclosed Aug 2026, Technology and Software. AI data giant Alation confirmed a cyberattack, and the headline confirms nothing else: no entry point, no actor, no data type, no count of records or systems touched. That leaves a data-governance vendor built to sit inside other companies' data stacks, cataloging and connecting sensitive information as its core function, now acknowledging compromise without saying what that position exposed. Source: Alation Confirms Cyberattack: What Security Teams Need to Know.",
      "date_published": "2026-08-21T00:00:00Z",
      "tags": [
        "Technology and Software",
        "Beyond the filings"
      ]
    },
    {
      "id": "https://hackerinahoodie.com/incident/apollo-management-holdings-l-p-2026-08-20.html",
      "url": "https://hackerinahoodie.com/incident/apollo-management-holdings-l-p-2026-08-20.html",
      "title": "Apollo Management Holdings, L.P.: not yet quantified",
      "content_text": "Verified figure. Not yet quantified, disclosed Jul 2026, Financial Services. A social-engineering attack gave an unauthorized party access to Apollo cloud platforms for several days. Personal data, including Social Security numbers, was potentially exposed. A cloud trust model was defeated with one single successful call or message. Source: California AG breach notification.",
      "date_published": "2026-08-20T00:00:00Z",
      "tags": [
        "Financial Services",
        "Government record"
      ]
    },
    {
      "id": "https://hackerinahoodie.com/incident/aesto-2026-08-20.html",
      "url": "https://hackerinahoodie.com/incident/aesto-2026-08-20.html",
      "title": "Aesto: not yet quantified",
      "content_text": "Verified figure. Not yet quantified, disclosed Dec 2025, Healthcare and Life Sciences. Nebraska Orthopaedic Center was exposed through Aesto, the vendor holding its patient data in Amazon Web Services. An unauthorized actor copied protected health information, including identifiers that may include Social Security numbers. The trust boundary sat with the vendor, but the consequences fell right on top of the patients and the provider. Source: California AG breach notification.",
      "date_published": "2026-08-20T00:00:00Z",
      "tags": [
        "Healthcare and Life Sciences",
        "Government record"
      ]
    },
    {
      "id": "https://hackerinahoodie.com/incident/oracle-2026-08-20.html",
      "url": "https://hackerinahoodie.com/incident/oracle-2026-08-20.html",
      "title": "Oracle: not yet quantified",
      "content_text": "Verified figure. Not yet quantified, disclosed Sep 2025, Public Sector and Education. Southern Illinois University tied a data exposure to its Oracle E-Business Suite environment, with files open to unauthorized access for five weeks in mid-2025 and confirmed only in July 2026. The flaw was Oracle's; the exposure was SIU's. You can outsource the software, but not the risk it carries into your own data. Source: California AG breach notification.",
      "date_published": "2026-08-20T00:00:00Z",
      "tags": [
        "Public Sector and Education",
        "Government record"
      ]
    },
    {
      "id": "https://hackerinahoodie.com/incident/aesto-2026-08-20-2.html",
      "url": "https://hackerinahoodie.com/incident/aesto-2026-08-20-2.html",
      "title": "Aesto: not yet quantified",
      "content_text": "Verified figure. Not yet quantified, disclosed Dec 2025, Healthcare and Life Sciences. Northern Inyo Hospital was exposed through Aesto, the vendor holding its patient records in AWS, where a network incident ran two weeks in December 2025. The hospital handed Aesto the job of holding the records; it could not hand off the duty to protect them. Outsourcing proved the work can move, the risk stayed where the patients are. Source: California AG breach notification.",
      "date_published": "2026-08-20T00:00:00Z",
      "tags": [
        "Healthcare and Life Sciences",
        "Government record"
      ]
    },
    {
      "id": "https://hackerinahoodie.com/incident/silver-summit-medical-corporation-2026-08-19.html",
      "url": "https://hackerinahoodie.com/incident/silver-summit-medical-corporation-2026-08-19.html",
      "title": "Silver Summit Medical Corporation: not yet quantified",
      "content_text": "Verified figure. Not yet quantified, disclosed Nov 2025, Healthcare and Life Sciences. Silver Summit Medical Corporation was pulled into a breach through a vendor that held its patient information. Data was acquired from the vendor's systems without authorization, although the notice does not name the vendor or explain the access path. Outsourcing the system moved the control point, not the exposure. The specific vendor was not named. Source: California AG breach notification.",
      "date_published": "2026-08-19T00:00:00Z",
      "tags": [
        "Healthcare and Life Sciences",
        "Government record"
      ]
    },
    {
      "id": "https://hackerinahoodie.com/incident/turner-construction-company-2026-08-18.html",
      "url": "https://hackerinahoodie.com/incident/turner-construction-company-2026-08-18.html",
      "title": "Turner Construction Company: not yet quantified",
      "content_text": "Verified figure. Not yet quantified, disclosed Jul 2026, Real Estate and Construction. Turner Construction found unauthorized access to its systems over nearly two weeks and confirmed that files containing payroll, banking, identity, and address information were reached. The exposure crossed data categories that should not have needed to share one compromise path. Credit monitoring deals with downstream risk; segmentation and constrained authority would have dealt with the cause. Source: California AG breach notification.",
      "date_published": "2026-08-18T00:00:00Z",
      "tags": [
        "Real Estate and Construction",
        "Government record"
      ]
    },
    {
      "id": "https://hackerinahoodie.com/incident/apple-american-group-llc-2026-08-18.html",
      "url": "https://hackerinahoodie.com/incident/apple-american-group-llc-2026-08-18.html",
      "title": "Apple American Group LLC: not yet quantified",
      "content_text": "Verified figure. Not yet quantified, disclosed Apr 2026, Retail and Consumer. Apple American Group, parent group of Applebee's, found that an unknown actor accessed company servers and employee files during a two-day window in April. The notice does not explain the entry point. Monitoring services address the aftermath; they do not explain why one server compromise could reach the files. Clearly, Apple American Group would like the data back in its neighborhood. Source: California AG breach notification.",
      "date_published": "2026-08-18T00:00:00Z",
      "tags": [
        "Retail and Consumer",
        "Government record"
      ]
    },
    {
      "id": "https://hackerinahoodie.com/incident/cognizant-2026-08-18.html",
      "url": "https://hackerinahoodie.com/incident/cognizant-2026-08-18.html",
      "title": "Cognizant: not yet quantified",
      "content_text": "Attested figure. Not yet quantified, disclosed Aug 2026, Professional and Business Services. Cognizant notified individuals of a data breach and is offering one million dollars in identity theft coverage. The headline confirms notification and a remediation gesture but does not name the entry point, the actor, the number affected, or the data types involved. A company built on managing other organizations' systems and data has disclosed a breach of unspecified scope, and the insurance offer addresses downstream harm, but not the architecture that allowed the exposure. Source: Cognizant notifies individuals of data breach; offers $1 mn identity theft cover.",
      "date_published": "2026-08-18T00:00:00Z",
      "tags": [
        "Professional and Business Services",
        "Beyond the filings"
      ]
    },
    {
      "id": "https://hackerinahoodie.com/incident/langwasser-company-cpas-2026-08-17.html",
      "url": "https://hackerinahoodie.com/incident/langwasser-company-cpas-2026-08-17.html",
      "title": "Langwasser & Company CPAs: not yet quantified",
      "content_text": "Verified figure. Not yet quantified, disclosed May 2026, Professional and Business Services. Langwasser & Company learned that unauthorized tax returns had been filed for some clients, and its investigation found that an unauthorized actor may have accessed personal information. The notice cannot establish the full extent of access. The incident shows identity data doing double duty as both a record and an authentication mechanism: once exposed, it could be used to impersonate the taxpayer. Source: California AG breach notification.",
      "date_published": "2026-08-17T00:00:00Z",
      "tags": [
        "Professional and Business Services",
        "Government record"
      ]
    },
    {
      "id": "https://hackerinahoodie.com/incident/forrestall-cpas-llc-2026-08-17.html",
      "url": "https://hackerinahoodie.com/incident/forrestall-cpas-llc-2026-08-17.html",
      "title": "Forrestall CPAs LLC: not yet quantified",
      "content_text": "Verified figure. Not yet quantified, disclosed Dec 2025, Professional and Business Services. Forrestall CPAs found that an unauthorized individual spent more than a week viewing and taking files from its network. A tax firm is an identity warehouse by design, so broad file access carries consequences well beyond the firm itself. The notice confirms the exposure but says little about how access was gained or why it was not contained sooner. Source: California AG breach notification.",
      "date_published": "2026-08-17T00:00:00Z",
      "tags": [
        "Professional and Business Services",
        "Government record"
      ]
    },
    {
      "id": "https://hackerinahoodie.com/incident/ceva-logistics-2026-08-17.html",
      "url": "https://hackerinahoodie.com/incident/ceva-logistics-2026-08-17.html",
      "title": "CEVA Logistics: not yet quantified",
      "content_text": "Attested figure. Not yet quantified, disclosed Aug 2026, Technology and Software. Another CEVA Logistics supply chain victim. Pokémon Center is notifying customers in the United Kingdom and Germany that it suffered a third-party data breach after hackers stole customer personal and order information. CEVA's reply? Gotta get 'em all. Source: Pokémon Center data breach exposes customer info, cancels some orders.",
      "date_published": "2026-08-17T00:00:00Z",
      "tags": [
        "Technology and Software",
        "Beyond the filings"
      ]
    },
    {
      "id": "https://hackerinahoodie.com/incident/safepal-2026-08-16.html",
      "url": "https://hackerinahoodie.com/incident/safepal-2026-08-16.html",
      "title": "SafePal: not yet quantified",
      "content_text": "Attested figure. Not yet quantified, disclosed Aug 2026, Financial Services. SafePal disclosed a data breach affecting roughly 40,000 customers, exposing customer information associated with purchases while the company says wallet credentials, private keys, and recovery seeds were not compromised. This is high quality signal, cryptocurrrency relatedcustomer data that gives attackers a better map for phishing and social engineering. Exactly what adversaries want for conducting further identity based attacks. Source: SafePal Data Breach Hits Tens of Thousands of Customers - Infosecurity Magazine.",
      "date_published": "2026-08-16T00:00:00Z",
      "tags": [
        "Financial Services",
        "Beyond the filings"
      ]
    },
    {
      "id": "https://hackerinahoodie.com/incident/quantum-health-inc-2026-08-14.html",
      "url": "https://hackerinahoodie.com/incident/quantum-health-inc-2026-08-14.html",
      "title": "Quantum Health, Inc.: not yet quantified",
      "content_text": "Verified figure. Not yet quantified, disclosed May 2026, Healthcare and Life Sciences. A vishing call caused a Quantum Health user to open the door to the network, followed by several days of access, a service outage, and file acquisition. The exposed data included insurance, medical, and other personal information. The call was the trigger; the larger failure was letting one user interaction carry enough authority access the systems and records at that scale. Source: California AG breach notification.",
      "date_published": "2026-08-14T00:00:00Z",
      "tags": [
        "Healthcare and Life Sciences",
        "Government record"
      ]
    },
    {
      "id": "https://hackerinahoodie.com/incident/paylogix-llc-2026-08-14.html",
      "url": "https://hackerinahoodie.com/incident/paylogix-llc-2026-08-14.html",
      "title": "Paylogix, LLC: not yet quantified",
      "content_text": "Verified figure. Not yet quantified, disclosed Nov 2025, Financial Services. Unauthorized actors accessed Paylogix systems and copied files from its network during a multi-day intrusion. Paylogix itself calls it a cyber event, saving the time needed to translate \"we believe that our systems were accessed but don't think anything was taken\". Source: California AG breach notification.",
      "date_published": "2026-08-14T00:00:00Z",
      "tags": [
        "Financial Services",
        "Government record"
      ]
    },
    {
      "id": "https://hackerinahoodie.com/incident/baylor-genetics-2026-08-14.html",
      "url": "https://hackerinahoodie.com/incident/baylor-genetics-2026-08-14.html",
      "title": "Baylor Genetics: not yet quantified",
      "content_text": "Verified figure. Not yet quantified, disclosed Aug 2026, Healthcare and Life Sciences. Baylor Genetics found an unauthorized third party inside part of its network for about a week with access to stored data. The breach exposed the sensitive personal and medical data of over 248,430 individuals. Clearly, a genetics company can't make a patient whole if their genetic information was stolen. ts a 1-of-1 kind of thing. The notice confirms the access but leaves the entry path and exact acquisition uncertain. Source: California AG breach notification.",
      "date_published": "2026-08-14T00:00:00Z",
      "tags": [
        "Healthcare and Life Sciences",
        "Government record"
      ]
    },
    {
      "id": "https://hackerinahoodie.com/incident/shell-and-philips-2026-08-14.html",
      "url": "https://hackerinahoodie.com/incident/shell-and-philips-2026-08-14.html",
      "title": "Shell and Philips: not yet quantified",
      "content_text": "Attested figure. Not yet quantified, disclosed 2026-08, Energy and Utilities. Cl0p listed nearly fifty companies at once and walked off with 89GB of Shell's facility drawings and test reports. The hole was in PTC's Windchill, patched 17 June. Shell's security spend didn't include understanding the path from Windchill to their doorstep. Source: Shell and Philips hit by Russian ransomware attack.",
      "date_published": "2026-08-14T00:00:00Z",
      "tags": [
        "Energy and Utilities",
        "Beyond the filings"
      ]
    },
    {
      "id": "https://hackerinahoodie.com/incident/h-m-2026-08-14.html",
      "url": "https://hackerinahoodie.com/incident/h-m-2026-08-14.html",
      "title": "H&M: not yet quantified",
      "content_text": "Attested figure. Not yet quantified, disclosed Aug 2026, Retail and Consumer. H&M confirmed that an attack on a business system exposed Korean customers' email addresses, phone numbers, and order or return reference numbers. More sensitive payment and password data were reportedly not affected, but the company did not disclose the number of customers or the access path. The useful boundary held around payment data; disclosure and accountability around the breached business tool remain thin. Source: H&M discloses customer data breach in South Korea.",
      "date_published": "2026-08-14T00:00:00Z",
      "tags": [
        "Retail and Consumer",
        "Beyond the filings"
      ]
    },
    {
      "id": "https://hackerinahoodie.com/incident/ringcentral-2026-08-14.html",
      "url": "https://hackerinahoodie.com/incident/ringcentral-2026-08-14.html",
      "title": "RingCentral: not yet quantified",
      "content_text": "Attested figure. Not yet quantified, disclosed 2026-08, Technology and Software. 623GB out the door, no ransom paid, 280GB published in response. RingCentral assured customers that silence meant safety, and Have I Been Pwned then counted 1.6 million email addresses sitting in the archive. Source: RingCentral data breach exposed info of 1.6 million accounts.",
      "date_published": "2026-08-14T00:00:00Z",
      "tags": [
        "Technology and Software",
        "Beyond the filings"
      ]
    },
    {
      "id": "https://hackerinahoodie.com/incident/french-tax-authority-2026-08-14.html",
      "url": "https://hackerinahoodie.com/incident/french-tax-authority-2026-08-14.html",
      "title": "French Tax Authority: not yet quantified",
      "content_text": "Attested figure. Not yet quantified, disclosed Aug 2026, Public Sector and Education. A stolen identity got someone onto the French tax authority's VPN and into an internal lookup tool built for querying taxpayers. DGFiP cut the access in June, filed it under routine, and let the hacker break the news in August. Source: French tax data stolen in cyberattack, ministry says.",
      "date_published": "2026-08-14T00:00:00Z",
      "tags": [
        "Public Sector and Education",
        "Beyond the filings"
      ]
    },
    {
      "id": "https://hackerinahoodie.com/incident/see-s-candies-inc-2026-08-13.html",
      "url": "https://hackerinahoodie.com/incident/see-s-candies-inc-2026-08-13.html",
      "title": "See’s Candies, Inc.: not yet quantified",
      "content_text": "Verified figure. Not yet quantified, disclosed Apr 2026, Retail and Consumer. See's Candies says an unauthorized user accessed its network, encrypted files, and took data that later appeared on the dark web. The compromise reached both operations and personal information, turning one network foothold into disruption and disclosure. Encryption was the visible event; broad access to the underlying files was the structural failure. Source: California AG breach notification.",
      "date_published": "2026-08-13T00:00:00Z",
      "tags": [
        "Retail and Consumer",
        "Government record"
      ]
    },
    {
      "id": "https://hackerinahoodie.com/incident/trezor-2026-08-13.html",
      "url": "https://hackerinahoodie.com/incident/trezor-2026-08-13.html",
      "title": "Trezor: not yet quantified",
      "content_text": "Attested figure. Not yet quantified, disclosed 2026-08, Financial Services. 13,689 hardware wallet buyers had their home addresses taken from a fulfilment partner. What capped the damage was a 90-day deletion rule, not a security control. Data you have already deleted cannot be stolen, and nobody puts that on a compliance dashboard. Source: Trezor discloses data breach affecting nearly 14,000 customers.",
      "date_published": "2026-08-13T00:00:00Z",
      "tags": [
        "Financial Services",
        "Beyond the filings"
      ]
    },
    {
      "id": "https://hackerinahoodie.com/incident/universal-plant-services-llc-2026-08-12.html",
      "url": "https://hackerinahoodie.com/incident/universal-plant-services-llc-2026-08-12.html",
      "title": "Universal Plant Services, LLC: not yet quantified",
      "content_text": "Verified figure. Not yet quantified, disclosed Jun 2026, Manufacturing. Universal Plant Services found an unauthorized individual inside its network for several days with access to identity, license, and financial-account information. The notice says passwords were reset and accounts secured after discovery, but does not explain the entry path. The control question is why access to one network segment could reach several forms of high-value identity data. Source: California AG breach notification.",
      "date_published": "2026-08-12T00:00:00Z",
      "tags": [
        "Manufacturing",
        "Government record"
      ]
    },
    {
      "id": "https://hackerinahoodie.com/incident/columbia-justice-ministry-2026-08-12.html",
      "url": "https://hackerinahoodie.com/incident/columbia-justice-ministry-2026-08-12.html",
      "title": "Columbia Justice Ministry: not yet quantified",
      "content_text": "Attested figure. Not yet quantified, disclosed 2026-08, Public Sector and Education. Ransomware hit Colombia's Justice Ministry five days before a presidential handover and one day after the national CERT warned this was coming. The warning was the control. It was issued, logged, and changed nothing. Source: Ransomware Hits Colombian Justice Ministry Days Before Presidential Transition.",
      "date_published": "2026-08-12T00:00:00Z",
      "tags": [
        "Public Sector and Education",
        "Beyond the filings"
      ]
    },
    {
      "id": "https://hackerinahoodie.com/incident/lawcare-2026-08-12.html",
      "url": "https://hackerinahoodie.com/incident/lawcare-2026-08-12.html",
      "title": "LawCare: not yet quantified",
      "content_text": "Attested figure. Not yet quantified, disclosed Aug 2026, Professional and Business Services. Lawyers in crisis contacted LawCare in confidence, all of it lived in Beacon CRM, and all of it is now assumed gone. No vendor questionnaire in existence asks whether the supplier left an AWS key in a public JavaScript file. [LawCare] Source: UK legal mental health charity LawCare confirms database was compromised in hacking incident.",
      "date_published": "2026-08-12T00:00:00Z",
      "tags": [
        "Professional and Business Services",
        "Beyond the filings"
      ]
    },
    {
      "id": "https://hackerinahoodie.com/incident/kovack-financial-llc-2026-08-10.html",
      "url": "https://hackerinahoodie.com/incident/kovack-financial-llc-2026-08-10.html",
      "title": "Kovack Financial, LLC: not yet quantified",
      "content_text": "Verified figure. Not yet quantified, disclosed Aug 2025, Financial Services. Kovack reported unauthorized access involving email and sensitive personal information. Kovack took almost a full year to determine that it was necessary to contact their customers, even though they clearly acknowledge in their filing that they discovered the breach on 8/28/2025. The customer comes first, right? Source: California AG breach notification.",
      "date_published": "2026-08-10T00:00:00Z",
      "tags": [
        "Financial Services",
        "Government record"
      ]
    },
    {
      "id": "https://hackerinahoodie.com/incident/health-sciences-centre-2026-08-10.html",
      "url": "https://hackerinahoodie.com/incident/health-sciences-centre-2026-08-10.html",
      "title": "Health Sciences Centre: not yet quantified",
      "content_text": "Attested figure. Not yet quantified, disclosed Aug 2026, Healthcare and Life Sciences. Ransomware took the HVAC and the door locks at Manitoba's largest hospital. The provincial auditor general flagged Shared Health's cybersecurity in 2024. Somebody measured this, wrote it down, and filed it. [Health Sciences Centre, Winnipeg] Source: Ransomware attack on Health Sciences Centre affects doors, ventilation and air-conditioning.",
      "date_published": "2026-08-10T00:00:00Z",
      "tags": [
        "Healthcare and Life Sciences",
        "Beyond the filings"
      ]
    },
    {
      "id": "https://hackerinahoodie.com/incident/framework-2026-08-10.html",
      "url": "https://hackerinahoodie.com/incident/framework-2026-08-10.html",
      "title": "Framework: not yet quantified",
      "content_text": "Attested figure. Not yet quantified, disclosed Aug 2026. Framework confirms customer data were exposed, and the headline is pretty much all you get: no named vector, no timeline, no data type, no actor. A breach notice with no information is not a disclosure. It's a stall tactic. Source: Framework Admits Customer Data Were Exposed in Latest Security Breach.",
      "date_published": "2026-08-10T00:00:00Z",
      "tags": [
        "Beyond the filings"
      ]
    },
    {
      "id": "https://hackerinahoodie.com/incident/levi-strauss-co-2026-08-07.html",
      "url": "https://hackerinahoodie.com/incident/levi-strauss-co-2026-08-07.html",
      "title": "LEVI STRAUSS & CO: not yet quantified",
      "content_text": "Verified figure. Not yet quantified, disclosed Aug 2026, Retail and Consumer. Levi Strauss disclosed that social engineering led to unauthorized access to three employee computers and the exfiltration of corporate files. The attacker did not need to defeat the whole enterprise; a few trusted endpoints were enough to turn legitimate access paths into a data-extraction path. When trust follows the user and device automatically, compromising either can inherit far more authority than the attacker ever earned. Source: SEC 8-K, Item 8.01.",
      "date_published": "2026-08-07T00:00:00Z",
      "tags": [
        "Retail and Consumer",
        "Government record"
      ]
    },
    {
      "id": "https://hackerinahoodie.com/incident/cushman-wakefield-2026-08-07.html",
      "url": "https://hackerinahoodie.com/incident/cushman-wakefield-2026-08-07.html",
      "title": "Cushman & Wakefield: not yet quantified",
      "content_text": "Verified figure. Not yet quantified, disclosed Apr 2026, Real Estate and Construction. Cushman & Wakefield says a vishing attack opened the door to unauthorized activity in its environment. The incident was described as limited, but social engineering that produces unauthorized system access is still a cyber incident and the event was significant enough to trigger mandatory reporting to the California AG. Source: California AG breach notification.",
      "date_published": "2026-08-07T00:00:00Z",
      "tags": [
        "Real Estate and Construction",
        "Government record"
      ]
    },
    {
      "id": "https://hackerinahoodie.com/incident/boston-healthcare-for-the-homeless-program-2026-08-07.html",
      "url": "https://hackerinahoodie.com/incident/boston-healthcare-for-the-homeless-program-2026-08-07.html",
      "title": "Boston Healthcare for the Homeless Program: not yet quantified",
      "content_text": "Verified figure. Not yet quantified, disclosed Oct 2025, Healthcare and Life Sciences. Boston Health Care for the Homeless Program disclosed that patient information was affected through a cybersecurity incident at a third-party provider. The infrastructure may have belonged to someone else, but the risk did not. Third-party architecture is still an attack surface when your data and your patients absorb the consequences. Source: California AG breach notification.",
      "date_published": "2026-08-07T00:00:00Z",
      "tags": [
        "Healthcare and Life Sciences",
        "Government record"
      ]
    },
    {
      "id": "https://hackerinahoodie.com/incident/salesforce-2026-08-07.html",
      "url": "https://hackerinahoodie.com/incident/salesforce-2026-08-07.html",
      "title": "Salesforce: not yet quantified",
      "content_text": "Verified figure. Not yet quantified, disclosed May 2026, Healthcare and Life Sciences. American Addiction Centers lost data through its Salesforce environment, not its health-records application or internal network. Names, Social Security numbers, and brief health descriptions were still reachable because the outreach system had become another sensitive-data store. The boundary held around the clinical system and failed around the SaaS platform that the business trusted beside it. Source: Washington AG breach notification.",
      "date_published": "2026-08-07T00:00:00Z",
      "tags": [
        "Healthcare and Life Sciences",
        "Government record"
      ]
    },
    {
      "id": "https://hackerinahoodie.com/incident/sawyer-savings-bank-2026-08-07.html",
      "url": "https://hackerinahoodie.com/incident/sawyer-savings-bank-2026-08-07.html",
      "title": "Sawyer Savings Bank: not yet quantified",
      "content_text": "Attested figure. Not yet quantified, disclosed Aug 2026, Financial Services. The notice names Sawyer Savings Bank and a disclosure date; it does not name an entry point, an actor, a record count, or the type of data reached. Source: Sawyer Savings Bank Branches Closed After Security Incident.",
      "date_published": "2026-08-07T00:00:00Z",
      "tags": [
        "Financial Services",
        "Beyond the filings"
      ]
    },
    {
      "id": "https://hackerinahoodie.com/incident/ieh-corp-2026-08-06.html",
      "url": "https://hackerinahoodie.com/incident/ieh-corp-2026-08-06.html",
      "title": "IEH Corp: not yet quantified",
      "content_text": "Verified figure. Not yet quantified, disclosed Aug 2026, Manufacturing. On August 4, 2026, IEH Corporation discovered that a threat actor had gained unauthorized access to an employee's Microsoft 365 mailbox. The mailbox held customer communications, purchase orders, engineering documentation and potentially export-controlled technical information - the extent of the exposure from one employee's email is unknown as of the disclosure but concerning due to the combination of customer and potentially proprietary information held by the employee. Source: SEC 8-K, Item 8.01.",
      "date_published": "2026-08-06T00:00:00Z",
      "tags": [
        "Manufacturing",
        "Government record"
      ]
    },
    {
      "id": "https://hackerinahoodie.com/incident/station-casinos-llc-2026-08-05.html",
      "url": "https://hackerinahoodie.com/incident/station-casinos-llc-2026-08-05.html",
      "title": "Station Casinos, LLC: not yet quantified",
      "content_text": "Verified figure. Not yet quantified, disclosed Mar 2026, Retail and Consumer. Station Casinos reported an external system breach involving unauthorized access and sensitive personal information. The interesting security question is not whether the company offered identity protection afterward; it is why unauthorized access was able to reach data worth protecting in the first place. Breach response happens after the architecture has already made its most important decision about trust. Source: California AG breach notification.",
      "date_published": "2026-08-05T00:00:00Z",
      "tags": [
        "Retail and Consumer",
        "Government record"
      ]
    },
    {
      "id": "https://hackerinahoodie.com/incident/new-york-city-regional-center-llc-2026-08-05.html",
      "url": "https://hackerinahoodie.com/incident/new-york-city-regional-center-llc-2026-08-05.html",
      "title": "New York City Regional Center, LLC: not yet quantified",
      "content_text": "Verified figure. Not yet quantified, disclosed Mar 2026, Public Sector and Education. New York City Regional Center confirms a cybersecurity incident involving personal information, but says Massachusetts law prevents it from describing the nature of the event. That is enough to classify the event as cyber, but not enough to explain the failed control or the scope of access. The uncertainty belongs in the record rather than being filled with attack-story assumptions. Source: California AG breach notification.",
      "date_published": "2026-08-05T00:00:00Z",
      "tags": [
        "Public Sector and Education",
        "Government record"
      ]
    },
    {
      "id": "https://hackerinahoodie.com/incident/zenith-bank-2026-08-05.html",
      "url": "https://hackerinahoodie.com/incident/zenith-bank-2026-08-05.html",
      "title": "Zenith Bank: not yet quantified",
      "content_text": "Attested figure. Not yet quantified, disclosed Aug 2026, Financial Services. The notice for Zenith Bank's August 2026 incident contains no facts: no confirmed entry point, no named actor, no data types, no count of people affected. What remains is a disclosure obligation met with a placeholder, from an institution whose core function is holding other people's money and identity records. The duty to explain a breach is being treated as different from the duty to prevent one. Source: Zenith Bank customers told to immediately check their deposits after data breach.",
      "date_published": "2026-08-05T00:00:00Z",
      "tags": [
        "Financial Services",
        "Beyond the filings"
      ]
    },
    {
      "id": "https://hackerinahoodie.com/incident/grant-county-public-hospital-district-2-2026-08-04.html",
      "url": "https://hackerinahoodie.com/incident/grant-county-public-hospital-district-2-2026-08-04.html",
      "title": "Grant County Public Hospital District #2: not yet quantified",
      "content_text": "Verified figure. Not yet quantified, disclosed Dec 2025, Healthcare and Life Sciences. Sixteen days of open AWS in December, six months to work out whose SSNs had left, and 28 provider clients who found out in June. HIPAA measures the notification. It does not hold you accountable for doing it in a timely manner. Source: Washington AG breach notification.",
      "date_published": "2026-08-04T00:00:00Z",
      "tags": [
        "Healthcare and Life Sciences",
        "Government record"
      ]
    },
    {
      "id": "https://hackerinahoodie.com/incident/liechtenstein-office-of-justice-2026-08-03.html",
      "url": "https://hackerinahoodie.com/incident/liechtenstein-office-of-justice-2026-08-03.html",
      "title": "Liechtenstein Office of Justice: not yet quantified",
      "content_text": "Attested figure. Not yet quantified, disclosed Aug 2026, Public Sector and Education. EU anti-money-laundering rules require a single register naming the humans behind Liechtenstein's companies, foundations, and trusts. Overnight on 30 July, copies covering 31,000 entities left. The transparency measure worked exactly as designed, for the adversaries. Source: Cyberattack hits Liechtenstein's anti-money laundering data register, Vaduz says.",
      "date_published": "2026-08-03T00:00:00Z",
      "tags": [
        "Public Sector and Education",
        "Beyond the filings"
      ]
    },
    {
      "id": "https://hackerinahoodie.com/incident/brinks-home-2026-08-03.html",
      "url": "https://hackerinahoodie.com/incident/brinks-home-2026-08-03.html",
      "title": "Brinks Home: not yet quantified",
      "content_text": "Attested figure. Not yet quantified, disclosed Aug 2026, Retail and Consumer. Brinks Home's disclosure names a leak, not a cause: no entry point, no actor, no data type, no count. Just files surfacing after the fact. Announcing a leak isn't transparency. Brinks should know better than most that sounding an alarm isn't the same as responding to one. Source: Brinks Home Discloses Data Breach as Hackers Leak Files.",
      "date_published": "2026-08-03T00:00:00Z",
      "tags": [
        "Retail and Consumer",
        "Beyond the filings"
      ]
    },
    {
      "id": "https://hackerinahoodie.com/incident/unlimited-technology-systems-2026-08-01.html",
      "url": "https://hackerinahoodie.com/incident/unlimited-technology-systems-2026-08-01.html",
      "title": "Unlimited Technology Systems: not yet quantified",
      "content_text": "Attested figure. Not yet quantified, disclosed Aug 2026, Healthcare and Life Sciences. 3.8 million patients, from five days in October 2025, took until July 2026 to size. UTS says an unauthorized actor copied patient data from its commercial data center during five days in October 2025. The scale came from concentration: a billing vendor that most patients never chose held identity, insurance, and medical data for many providers in one place. Source: Unlimited Technology Systems breach impacts 3.8 million people.",
      "date_published": "2026-08-01T00:00:00Z",
      "tags": [
        "Healthcare and Life Sciences",
        "Beyond the filings"
      ]
    },
    {
      "id": "https://hackerinahoodie.com/incident/amgen-inc-2026-07-31.html",
      "url": "https://hackerinahoodie.com/incident/amgen-inc-2026-07-31.html",
      "title": "AMGEN INC: not yet quantified",
      "content_text": "Verified figure. Not yet quantified, disclosed Jul 2026, Healthcare and Life Sciences. Amgen disclosed that threat actors compromised third-party cloud storage environments containing company information, stealing files that may include patient health information, confidential business data, intellectual property, and research materials. The company has activated its incident response plan, engaged independent forensic experts, and is assessing the full scope of the exposure. Source: SEC 8-K, Item 1.05.",
      "date_published": "2026-07-31T00:00:00Z",
      "tags": [
        "Healthcare and Life Sciences",
        "Government record"
      ]
    },
    {
      "id": "https://hackerinahoodie.com/incident/aesto-2026-07-31.html",
      "url": "https://hackerinahoodie.com/incident/aesto-2026-07-31.html",
      "title": "Aesto: not yet quantified",
      "content_text": "Verified figure. Not yet quantified, disclosed Dec 2025, Public Sector and Education. Stanislaus County Health Services Agency was exposed through Aesto, the vendor that stored healthcare data in Amazon Web Services. An unauthorized actor may have accessed or acquired protected health information during the vendor's network incident. The county did not need to be breached directly; inherited access through the vendor was enough. Source: California AG breach notification.",
      "date_published": "2026-07-31T00:00:00Z",
      "tags": [
        "Public Sector and Education",
        "Government record"
      ]
    },
    {
      "id": "https://hackerinahoodie.com/incident/commonspirit-health-2026-07-30.html",
      "url": "https://hackerinahoodie.com/incident/commonspirit-health-2026-07-30.html",
      "title": "CommonSpirit Health: not yet quantified",
      "content_text": "Verified figure. Not yet quantified, disclosed Jan 2026, Technology and Software. MicroCode experienced ransomware on a server that hosted CommonSpirit Health's tracking database and documents. Unauthorized access lasted for months, but the investigation could not confirm whether the data was viewed or taken. The uncertainty should be preserved: this is a confirmed system compromise with sensitive data in scope, not a confirmed exfiltration. Source: Washington AG breach notification.",
      "date_published": "2026-07-30T00:00:00Z",
      "tags": [
        "Technology and Software",
        "Government record"
      ]
    },
    {
      "id": "https://hackerinahoodie.com/incident/healthstream-inc-2026-07-29.html",
      "url": "https://hackerinahoodie.com/incident/healthstream-inc-2026-07-29.html",
      "title": "HEALTHSTREAM INC: not yet quantified",
      "content_text": "Verified figure. Not yet quantified, disclosed Jul 2026, Technology and Software. HealthStream disclosed that it detected unauthorized activity on its network on July 23, 2026, prompting the company to activate its incident response plan, engage external cybersecurity experts, and notify law enforcement. The investigation determined that a threat actor exfiltrated certain company data, but the company says its cloud-based platforms remain operational and it does not currently expect a material impact to its business or financial results. Source: SEC 8-K, Item 8.01.",
      "date_published": "2026-07-29T00:00:00Z",
      "tags": [
        "Technology and Software",
        "Government record"
      ]
    },
    {
      "id": "https://hackerinahoodie.com/incident/analog-devices-inc-2026-07-29.html",
      "url": "https://hackerinahoodie.com/incident/analog-devices-inc-2026-07-29.html",
      "title": "ANALOG DEVICES INC: not yet quantified",
      "content_text": "Verified figure. Not yet quantified, disclosed Jun 2026, Technology and Software. Analog Devices disclosed that it identified unauthorized access to certain company systems on June 23, 2026, prompting the company to activate its incident response plan, engage external cybersecurity experts, and notify law enforcement. The investigation determined that certain files were exfiltrated, although the company said it had no evidence the data had been publicly released or misused at the time of filing. Importantly, Analog Devices reported no operational disruption and stated it does not believe the incident is reasonably likely to materially impact its business, operations, or financial condition. The company also revealed it is separately assessing an unrelated cybersecurity matter that surfaced in public reporting on July 26, 2026. Source: SEC 8-K, Item 8.01.",
      "date_published": "2026-07-29T00:00:00Z",
      "tags": [
        "Technology and Software",
        "Government record"
      ]
    }
  ]
}