Hacker in a Hoodie™ Index

Beyond the Filings · complete ledger

Company results statements (Attested), and outside estimates and news reports (Inferred), approved to this index. No Verified grade appears here; that grade is reserved for the primary filings and enforcement records on the government record. This is the complete record for this feed, uncapped, and like everything on this index it is never summed.

136 approved media-reported incidents, most recent first. The complete record, nothing hidden, never summed.
The full record as open data (CC BY 4.0): CSV · JSON · about the data
Subscribe to new incidents: RSS · JSON Feed
How each figure is graded VVerifiedthe linked primary document states it AAttesteda published report credits a named source IInferredno direct confirmation; a lead, not a figure The full standard →
The revision trail
A cost figure arrives after an incident is disclosed, and it moves as stronger sources report it. Early estimates run below the figure a company eventually discloses. The amount shown for each incident is its most recent claim; the trail beneath it is every claim in order, each with its date, its source, and its grade, from an Inferred estimate to an Attested company figure.
Corrections
Every figure on this ledger is drawn from its cited source and links to it. If we have read one wrong, tell us: info@hackerinahoodie.com.
Napoleon PerdisOct 2026
Not yet quantified
AAttested
Napoleon Perdis lost names, birthdates, addresses, phone numbers, and purchase histories for roughly 339,055 customers through Retail Express, the vendor it paid to store them, where an unauthorized party had access from November 2025 to June 2026. Neither company has said how the intruder got in. Seven months of undetected access sat in a system the cosmetics brand did not run and could not watch. No card data was stored, the notice stresses. Only birthdates and home addresses, which no bank can reissue. The investigation into the incident was 40% faster than the time it took to discover the breach in the first place.
Retail and Consumer
Napoleon Perdis data breach affects 340,000 of the cosmetics company's clients
Initial attack type third-party or supply chain confirmed · Impact data theft confirmed
BAE SystemsOct 2026
Not yet quantified
AAttested
A cybersecurity incident at BAE Systems knocked out the Bankruptcy Noticing Center it runs for the Federal Judiciary, halting bankruptcy notices for every federal bankruptcy court nationwide. The judiciary has not said what happened, when it began, or whether any data was accessed or taken. Every bankruptcy court in the country shared one failure domain, and it belonged to a contractor.
Technology and Software
BAE Systems cyberattack disrupts US federal court operations
Initial attack type not disclosed · Impact operational outage confirmed
Burger King JapanOct 2026
Not yet quantified
AAttested
An outside party spent October 2 to October 7, 2026 inside BK Japan's app member system, reaching about 11.18 million records: names, email addresses, and mobile order history. How they got in, and who they were, the source does not say. Every member in the app sat behind one store of identity, a single failure domain the size of the entire loyalty program. No card data, the company stresses. Just a record of what each person ordered, tied to a name and an inbox.
Retail and Consumer
Burger King Japan data breach exposes 11 million customer records
Initial attack type not disclosed · Impact data theft inferred
Phase EightOct 2026
Not yet quantified
AAttested
Phase Eight, Hobbs, and Whistles were hit together on October 11, when parent TFG London identified a cybersecurity incident in its IT systems. The source names no entry point, no actor, and no data accessed. Three brands running on one parent's infrastructure share one failure domain. Payment information, the company offers, is not believed to be at risk, which leaves every other record in those systems conspicuously unmentioned.
Retail and Consumer
Phase Eight, Hobbs and Whistles owner TFG London hit by cyber attack - just days after ASOS hack
MetaOct 2026
Not yet quantified
AAttested
One employee's stolen credentials let an outside group into some of Meta's GitHub repositories, where product code sat beside personal data on roughly 1,500 people, mostly US employees, that policy said should never have been there. Meta has not said what kinds of personal information were taken. Its spokesperson insists internal systems were not breached, a curious claim about a repository holding the company's code, its secrets, and its own staff's data.
Technology and Software
Meta Says Hackers Took Code, Personal Data of 1,500 in GitHub Breach
Initial attack type compromised credentials inferred
KT CorpOct 2026
Not yet quantified
AAttested
From October 2024 to September 2025, attackers ran a homemade femtocell on KT's network with a valid certificate taken from a lost KT unit, intercepting phone numbers, IMSI and IMEI numbers, and SMS authentication codes. PIPC counts 16,647 subscribers exposed and 368 hit with fraudulent micropayments. The core network's perimeter was a certificate that outlived the hardware it was issued to. BPFDoor had sat on 38 KT servers since March 2024, unreported, and now KT has been accused of intentionally deleting logs and under reporting damages to the Korean government.
Telecommunications
KT Corp Hid Three Cyberattacks, Deleted Logs, Lied to Customers: Lawmakers
Initial attack type compromised credentials confirmed · Impact data theft confirmed + financial theft or fraud
Photon HealthOct 2026
Not yet quantified
AAttested
A zero-day in Metabase, the self-hosted analytics tool Photon Health ran for business metrics and customer dashboards, exposed stored names, addresses, birth dates, phone numbers, and prescription details, potentially exfiltrated. Photon learned of it on August 21, 2026; when the intrusion began, and how many people it reached aren't shared. The Direwolf extortion group claims credit. The perimeter was a reporting tool that had silently become a copy of the prescription record.
Healthcare and Life Sciences
Photon Health; Healthcare Highways Announce Data Security Incidents
Initial attack type software vulnerability inferred · Actor Dire Wolf
Daiichi KoshoOct 2026
breach at Nippon Columbia Group (NCG)
Not yet quantified
AAttested
Malware on a single employee's computer at Nippon Columbia Group, the contractor holding Daiichi Kosho's customer data, put more than 8.7 million records in reach: names, genders, birthdates, emails, and phone numbers for 8,631,000 customers and 93,000 employees. The notice does not say how the malware arrived or how long it sat there. Daiichi Kosho notes its own systems were not breached, which certainly must sound like tone deafness for all the victims.
Media and Entertainment
Karaoke Giant Reveals Data Breach Impacting Eight Million - Infosecurity Magazine
Initial attack type third-party or supply chain inferred · Impact data theft inferred
IntermarchéOct 2026
Not yet quantified
AAttested
Attackers remotely seized refrigeration controllers running older Danfoss software at several French supermarket chains on a Sunday night, then warmed the cases by triggering the built-in defrost cycle. French outlets put it at 250 to 350 stores; Intermarché blames a reported compromise of a service provider managing its in-store refrigeration. Nobody has said how they got in or who they were. The sabotage itself was just a defrost feature, working exactly as designed for whoever held the remote controls.
Retail and Consumer
French supermarkets suffer refrigerator shutdown after 'unprecedented' cyberattack
Initial attack type third-party or supply chain inferred · Impact operational outage confirmed
Ahold DelhaizeOct 2026
Not yet quantified
AAttested
Ahold Delhaize pulled systems offline on October 12, 2026, over a security issue inside its network, taking down the websites of all five US banners plus Albert Heijn, Etos, and Gall & Gall. No entry point, actor, data, or restoration timeline was given. Eight brands on two continents went dark at once: on the network, they were only ever one company. Whether in-store operations were affected also went unsaid.
Retail and Consumer
Retail giant Ahold Delhaize takes systems offline after cyberattack
Initial attack type not disclosed · Impact operational outage confirmed
Oracle HealthOct 2026
Not yet quantified
AAttested
Patient records sat on legacy Cerner servers that Oracle Health inherited with its $28.3 billion acquisition, and a 2025 hack reached names, Social Security numbers, diagnoses, medicines, test results, and images. The Texas attorney general's figure puts the toll near 20 million people, while the federal tally still shows a placeholder of 501 as reported to HHR by Oracle in June 2025. One server, one account, one password = 20 million records lost. Built wrong, defined.
Healthcare and Life Sciences
Oracle Health's Cerner EHR Breach Figure Soars to 20 Million
Initial attack type compromised credentials inferred · Impact data theft confirmed
ASOSOct 2026
Not yet quantified
AAttested
Thousands of ASOS customers heard about the intrusion from the intruders themselves, through an unauthorized push notification sent over the third-party platforms ASOS uses to reach them. A group calling itself the Xuanye Group claims a full compromise of a Snowflake instance; ASOS says names and contact details may have been accessed and has not said how anyone got in. The messaging platform was a public disclosure mechanism that beat ASOS's own communications by hours.
Retail and Consumer
ASOS Confirms Cyberattack, Data Breach
Initial attack type third-party or supply chain inferred · Impact data theft confirmed · Actor Xuanye Group
Central Person RegisterOct 2026
Not yet quantified
AAttested
Someone spent September running automated searches through Denmark's Central Person Register on an unnamed domestic company's legitimate access, harvesting names, addresses, and CPR numbers for roughly 8.8 million people. Nobody has said how that access was obtained or who used it. The register's real perimeter was every outside company that was allowed to login, and one of them was allowed to query an entire nation at machine speed. A national identifier is the one credential a country cannot reissue.
Public Sector and Education
Major Denmark breach exposes personal data of 8.8 million people
Initial attack type third-party or supply chain inferred · Impact data theft confirmed
Osaka Metropolitan UniversityOct 2026
Not yet quantified
AAttested
A suspected ransomware attack stopped about 500 servers at Osaka Metropolitan University at once beginning October 2, taking down coursework systems, email, and digital student IDs and canceling classes through October 8. The entry point, the attacker, any ransom demand, and whether at least 130,000 personal records left all remain unstated. Five hundred servers failing together is one failure domain. Much of the backup data was encrypted too: the recovery plan lived inside the blast radius.
Public Sector and Education
Cyberattack on Osaka University Shuts Down 500 Servers
Initial attack type not disclosed · Impact operational outage confirmed + ransomware
WindRose Health NetworkOct 2026
Not yet quantified
AAttested
A previously undisclosed flaw in an unnamed vendor's remote access tool let an unidentified intruder into part of WindRose Health Network's systems on August 3 and 4, 2026. Names, patient IDs, insurance details, and dates of service for 33,158 patients were potentially copied from ordinary files on that network. The tool could not open medical records, and it did not need to: the patient data was already sitting in files a vendor's door led straight to.
Healthcare and Life Sciences
WindRose Health Network Discloses Data Breach Affecting 33K Individuals
Initial attack type software vulnerability confirmed · Impact data theft inferred
Georgia PowerOct 2026
Not yet quantified
AAttested
Someone got into Georgia Power's online customer portal and reached names, addresses, phone numbers, emails, and the last four digits of Social Security numbers across about 400,000 Southern Company accounts, roughly 300,000 of them Georgia Power's. The source never says how they got in or for how long. One customer portal fronted the parent company's accounts, making it the failure domain for all of them. Limited account information turns out to mean most of a starter kit for online impersonation.
Energy and Utilities
Georgia Power cyberattack exposed 400,000 customer accounts - WSB-TV Channel 2
Initial attack type not disclosed · Impact data theft confirmed
Beyond GravityOct 2026
Not yet quantified
AAttested
Beyond Gravity, the Swiss state-owned aerospace supplier spun off from Ruag, spotted malicious activity in its IT environment on August 12, 2026, and went public weeks later. The entry point, the systems reached, and whatever data left are all absent from the statement. The report suggests a highly professional actor instead, a portrait of the adversary with the security architecture that admitted them cropped out of the picture.
Transportation and Logistics
Swiss space firm Beyond Gravity target of cyberattack
Technical University of DenmarkOct 2026
Not yet quantified
AAttested
Attackers reached the Technical University of Denmark's system for managing identities and access rights and retrieved a large amount of data, touching as many as 200,000 current and former users by DTU's own upper estimate. The entry point, the actor, and exactly what left remain unstated, and DTU cannot yet say either. When identity falls, every boundary it is associated to falls with it.
Public Sector and Education
Hacker attack at DTU could affect up to 200,000 people
Initial attack type compromised credentials inferred · Impact data theft confirmed
AngMar ManagementOct 2026
Not yet quantified
AAttested
AngMar Management Services, a Texas hospice manager, lost patient files around July 18, 2026, in what appears to be Interlock ransomware; the group claims 710 GB. The Texas Attorney General filing counts 35,916 Texans, while the full total and the entry point remain unsaid. A back-office system holding Social Security numbers, diagnoses, and medical histories in one place became the breachable perimeter of patient care. None of the stolen data can be reissued, but at least free credit reporting got offered. Again.
Healthcare and Life Sciences
Texas Hospice Management Company Data Breach Affects 35,000 Texas Residents
Initial attack type not disclosed · Impact data theft confirmed + ransomware · Actor Interlock
Frontline EducationOct 2026
Not yet quantified
AAttested
Attackers walked into Frontline Education through a flaw in third-party software it has never named, leaving with school district staff records, Social Security numbers included. How many employees, and over what time period, Frontline has not said. Districts across the country handed their HR files to one platform, and that platform was run by a supplier nobody no one will identify.
Public Sector and Education
Frontline Education breach exposes school district employee data
Initial attack type software vulnerability confirmed · Impact data theft confirmed
Shinhan BankOct 2026
Not yet quantified
AAttested
Shinhan Bank's "M Shinhan" loan-inquiry site let an outsider bypass authentication and exploit a code flaw on September 29 and 30, 2026, exposing names, phone numbers, incomes, and loan limits for about 25,000 customers, including 66 resident registration numbers and 97 CI records. The bank calls it an AI-driven brute-force attack, its own characterization. A public loan-inquiry page was serving as the authentication boundary for sensitive financial data, scripted guessing isn't brute-force or sophisticated. It's jiggling door handles to see if any of them are unlocked.
Financial Services
South Korean bank hit by data breach affecting thousands of customers
Initial attack type software vulnerability confirmed · Impact data theft confirmed
Housing and Redevelopment Authority (HRA) of Clay CountyOct 2026
Not yet quantified
AAttested
L&Q's website was hit by a targeted cyber-attack in late September 2026, and the autoreply system tied to its webforms handed over the emails and messages of roughly 12,000 residents. The company calls its 'wider operating systems,' holding financial and tenancy data, secure, as if the contact channel residents actually use wasn't part of the perimeter too. No named attacker, no stated entry point beyond the webform pipeline itself. A front door was left open while the filing cabinets got all the locks.
Real Estate and Construction
Housing association hit by cyber attack affecting 12,000
Initial attack type exposed or misconfigured system inferred · Impact data theft confirmed
Department of Customer Services, Open Data and Small and Family BusinessSep 2026
Not yet quantified
AAttested
Queensland's Department of Customer Services, the agency that writes the state's cyber security strategy, lost $809,000 in public money in July 2025 when attackers broke into a third-party telecommunications provider's systems. The department calls this blocked because the cash never reached the attackers, not because the intrusion failed. No government data was reported taken, and the source never names how the vendor's systems were entered. The state's cyber security authority couldn't keep its own payment path safe through a vendor's security perimeter.
Public Sector and Education
Queensland government's cyber security department hit by $800k cyber attack
Initial attack type third-party or supply chain inferred
ATNSSep 2026
Not yet quantified
AAttested
Ransomware-linked malware surfaced inside the operational technology network feeding weather data to ATNS, the South African operator covering roughly a tenth of the world's airspace. ATNS believes its own team stopped the attack, yet its forensics RFQ still chases a second, possibly insider, theft of data and exfiltration to addresses in China, with no stated start date for the intrusion.
Transportation and Logistics
South Africa Seeks Help After Cyberattack Targets Air Traffic Control
Initial attack type not disclosed · Impact ransomware confirmed + data theft
Bee Cheng HiangSep 2026
Not yet quantified
AAttested
Bee Cheng Hiang's marketing team prompted an AI tool to write the code for a mass email in April 2025, and the resulting script left all 95,364 recipients' addresses visible to each other. The only test run checked delivery logs, not the actual email that went out. PDPC calls this Singapore's first AI-related breach, but the tool did exactly what it was told. The missing control was a human reading the output before it shipped.
Retail and Consumer
Nearly 100,000 Bee Cheng Hiang customers' email addresses exposed in first AI-related data breach in Singapore
Initial attack type insider inferred · Impact data theft confirmed
JimsSep 2026
Not yet quantified
AAttested
Colruyt Group's Jims chain lost the data of roughly 150,000 members when an unauthorized person reached the membership management system running behind 31 of its 85 Belgian locations. The notice never names the entry point, only that one shared system sat under a third of the chain, and all of it fell together. No passwords or health data were taken, the company notes, but IBAN numbers were. A password resets. A bank account number does not.
Retail and Consumer
Data breach at Jims underestimated: 150,000 members affected
Initial attack type software vulnerability inferred · Impact data theft confirmed
Fideuram Intesa Sanpaolo Private BankingSep 2026
Not yet quantified
AAttested
Italy's largest bank moved nearly €100 million on the strength of an AI-generated message, and the headline is the only filing on record. No named actor, no description of the channel, no account of which control point signed off on the transfer: the reporting is silent on all of it. What is legible is the architecture: a voice or message was treated as sufficient authorization, with no second boundary built to catch a convincing fake.
Financial Services
Italy's top bank hit by an AI messaging scam which cost it nearly €100 million
Initial attack type phishing or social engineering inferred · Impact financial theft or fraud confirmed
Japanese Railway OperatorsSep 2026
Not yet quantified
AAttested
Keio's hospitality arm went down to ransomware in the early hours of September 26, 2026, dragging payment systems with it while train operations kept running. No group has claimed it, no entry point has been named, and Keio itself says it is still investigating whether customer or partner data went out the door. A railway and a hotel chain shared enough infrastructure that one attack could reach both; the operator built one network for two businesses and called the surviving half a success. Segmentation that actually separates a hotel's payment system from a group's core servers is not optional.
Transportation and Logistics
Japanese Railway Operators Hit with Weekend Cyber Attacks - Infosecurity Magazine
Initial attack type not disclosed · Impact ransomware confirmed
Dodo PizzaSep 2026
Not yet quantified
AAttested
Dodo Pizza says attackers got into its systems and pulled names, addresses, emails, phone numbers, birth dates, and order histories; no payment data, because the company never stored any. DataSuckers claims 68 million records spanning 15 years and 28 countries, a number Dodo has neither confirmed nor broken down. Fifteen years of order history in one reachable database is not a storage choice, it is a single failure domain sized to a 26 nation footprint. The company will not say how many customers were actually hit.
Retail and Consumer
Russian pizza restaurant chain confirms cyberattack: Hackers claim 68 million users exposed
Initial attack type software vulnerability inferred · Impact data theft confirmed · Actor DataSuckers
SimbaSep 2026
Not yet quantified
AAttested
SIMBA confirmed 23,549 customer registrations exposed: names, identity card numbers, dates of birth, mobile numbers, emails. The statement names no entry point and no actor.. No credit card or bank data taken, they say, as if identity card numbers and birthdates were the lesser property. A number can be reissued; a national identity record cannot.
Telecommunications
Simba data breach exposes personal details of 23,500 customers
Initial attack type not disclosed · Impact data theft confirmed
Times CarSep 2026
Not yet quantified
AAttested
Times Car confirms 6.6 million user accounts caught up in a breach, and the headline stops there: no named attack vector, no actor, no accounting of what those accounts actually held. 6.6 million records is not an incident, it's a concentrated risk with an easy to grab handle.
Retail and Consumer
Times Car confirms data breach affecting 6.6 million user accounts
Initial attack type not disclosed · Impact data theft inferred
MedImpact PBMSep 2026
Not yet quantified
AAttested
MedImpact detected intrusion on October 18, 2025, then took nine months to finish investigating what Qilin claims was 160 gigabytes taken, part of it from Elixir Solutions, the PBM MedImpact acquired from RiteAid. Prescription and treatment data, subscriber numbers, and in limited cases Social Security numbers moved through a vendor pipeline no employer could see into. HIPAA sets a sixty day notification clock. MedImpact ran nine months past it before mailing a single letter.
Healthcare and Life Sciences
MedImpact PBM breach leaves employer plan members' health data exposed
Initial attack type not disclosed · Impact data theft inferred · Actor Qilin
United States Department of DefenseSep 2026
Not yet quantified
AAttested
Unauthorized users reached the Defense Manpower Data Center's personnel database in October, and the Pentagon did not notice until July, nine months later. The records sat unencrypted, so the breach was never a matter of cracking anything; it was a matter of opening a file cabinet nobody had bothered to lock. The notice cites no financial loss, but Social Security numbers belonging to up to four million service members, per Military Times, cannot be reissued like a card number. Nobody has named the entry point or the perpetrator, which says less about the attacker than about what the Pentagon was watching.
Public Sector and Education
'Potential goldmine': Pentagon breach alarms experts as troops' personal data exposed
Initial attack type third-party or supply chain inferred
Arizona Supreme CourtSep 2026
Not yet quantified
AAttested
Arizona's court system was breached by, in the court's own telling, "hackers or automated bots," a phrasing that concedes nobody has actually identified what got in. Court IT caught the intrusion and cut it off; the Chief Justice called in a response team and the FBI afterward. Officials have not said how many Arizonans were affected or what data was taken, financial, medical, or otherwise.
Public Sector and Education
Cyberattack on Arizona court system may have exposed personal data, officials say
Initial attack type phishing or social engineering inferred · Impact data theft inferred
Wales Dyfed-Powys PoliceSep 2026
Not yet quantified
AAttested
Dyfed-Powys Police disclosed on September 25, 2026 a cyberattack first identified earlier that month, one that disrupted non-emergency systems and may have exposed staff information. The force names no entry point, no actor, and no specific data field, only that public records were spared and staff records were not. A police force can wall off the systems the public sees and still leave the systems that hold its own people open. The silence on how it happened is not transparency; it is the extent of what the investigation has figured out so far.
Public Sector and Education
Welsh police force cyberattack sparks investigation into staff information
Initial attack type not disclosed · Impact operational outage confirmed + data theft
BitgetSep 2026
Not yet quantified
AAttested
Bitget's authorization-signing process moved $351.6 million across 19 transfers without a private key ever being touched, because attackers spoofed the transfer data the system trusted rather than the keys meant to guard it. Cold wallets held; hot and warm wallets, the parts kept online, were the entire failure domain. Bitget names North Korean IP patterns as a suspect, but the intrusion method itself remains unstated. The signing process checked the message, not the sender.
Financial Services
Bitget hit by $351.6 million crypto hack in one of year's biggest heists
Initial attack type software vulnerability inferred · Impact financial theft or fraud confirmed · Actor North Korean hacking group
MedImpact Healthcare SystemsSep 2026
Not yet quantified
AAttested
MedImpact identified unauthorized activity in its network in October 2025, and the Qilin ransomware group claims it exfiltrated the data before listing MedImpact on its leak site. The entry point is never named. As a pharmacy benefit manager, MedImpact sits beneath unnamed health plans, employers, and government clients, holding each member's prescriptions, treatment records, and Social Security numbers in one system. Nobody has said how Qilin got in, which is its own answer about what wasn't being watched.
Healthcare and Life Sciences
Data Breaches Announced by MedImpact Healthcare Systems; Rosch Visionary Systems
Initial attack type not disclosed · Impact ransomware inferred + data theft · Actor Qilin
StakeSep 2026
Not yet quantified
AAttested
Stake's customers were exposed not through Stake's systems but through DriveWealth, the US vendor running its trading and wallet services, after a social-engineering campaign DriveWealth says it has since contained. Names, emails, phone numbers, postal addresses, tax status, and tax country moved; trading accounts, portfolios, tax file numbers, and bank details reportedly did not. Stake outsourced the plumbing of its US operation and inherited DriveWealth's exposure along with it. Nobody says who was talked into what; the notice just confirms that someone was.
Financial Services
Stake data breach exposes customer details after hack at partner DriveWealth
Initial attack type phishing or social engineering confirmed · Impact data theft confirmed
NFMSep 2026
Not yet quantified
AAttested
Interlock claims to have pulled more than 2.5 terabytes of files from NFM Lending's systems on or around September 7, 2026, among them customer Social Security numbers and financial account information. NFM has confirmed no entry point, no actor, and no count of affected customers; a proposed class action filed September 16 says the company still hadn't notified anyone. The scope of this breach is being written by a ransomware gang's leak-site post, and the disclosure is being forced by a litigation action.
Financial Services
Ransomware gang claims big hack at NFM Lending
Initial attack type not disclosed · Impact data theft inferred + data extortion · Actor Interlock
Manage My HealthSep 2026
Not yet quantified
AAttested
Manage My Health's patient portal leaked 403,730 Health New Zealand documents and 22,609 patient files in December 2025, reaching almost 100,000 people, mostly in Northland. The Privacy Commissioner of New Zealand stated that Manage My Health and Health New Zealand “failed in their responsibilities”. The penalty? Nearly 5 months later, the commissioner declared that both organizations have until August 2027 to fix their security weaknesses. Yep, one whole year.
Healthcare and Life Sciences
Privacy Commissioner puts Manage My Health, Health NZ on notice after data breach
Initial attack type not disclosed · Impact data theft confirmed
AsusSep 2026
Not yet quantified
AAttested
Asus's eShop platform was accessed by an unnamed party, exposing customer contact details and order records; the notice names no vector, no actor, no count. No payment or bank data was taken, Asus stresses, but a name and an order history are plenty for the phishing campaign Asus itself now warns is coming. The storefront shifted from a customer service interface to a future crime facilitator in the blink of an eye.
Technology and Software
Asus warns customers of eshop data breach
Initial attack type not disclosed · Impact data theft confirmed
BigCommerceSep 2026
Not yet quantified
AAttested
BigCommerce confirmed on September 17, 2026, that compromised credentials from Ribon and Ribon 1.5, third-party apps built by 'Be A Part Of,' a Fastr company, let attackers inject malicious scripts into merchant storefronts. One access key belonging to a single app vendor unlocked data across every store that had installed it, hundreds by Master of Malt's count, not the 'small number' BigCommerce named. The app marketplace was the real perimeter, and nobody was guarding it like one. What BigCommerce calls scope is really just how far one vendor's key happened to reach.
Retail and Consumer
BigCommerce warns customers of potential data leaks following cyber incident
Initial attack type third-party or supply chain confirmed · Impact data theft inferred
CrowdSecSep 2026
Not yet quantified
AAttested
CrowdSec's source code, roughly 300 repositories, 170 of them private, sat exposed after the May 2026 TanStack supply chain attack. Most likely culprit? A single compromised API key. That one key reached across the SaaS console, AWS operations, connectors, and automation scripts: one credential, one blast radius. CrowdSec states confidently that the source code can't be used to cause harm because it can't be used outside of its context. Not finding the leak of the source code for several months does make those reassurances seem a bit bold, given the circumstances.
Technology and Software
CrowdSec Confirms Source Code Stolen in Supply Chain Attack
Initial attack type third-party or supply chain confirmed · Impact data theft confirmed
United Language GroupSep 2026
Not yet quantified
AAttested
United Language Group's network was accessed by unauthorized outsiders for two days in July 2025, exposing claims and billing data that UnitedHealthcare and UnitedHealthcare Global had handed to it to translate: names, Social Security numbers, diagnoses, prescriptions, passports, driver's licenses, and financial account numbers, across 4,649 people. The notice names no entry point and no attacker; only the window forensics could confirm. A translation vendor became the de facto custodian of a health insurer's most sensitive records. Nobody built a perimeter around that arrangement.
Healthcare and Life Sciences
Data Breach at Translation Vendor Affects UnitedHealthcare Plan Members
Initial attack type not disclosed · Impact data theft confirmed
CartrackSep 2026
Not yet quantified
AAttested
Cartrack's ransomware incident in August 2026 reached the one database that mattered most: contact details, bank account information, and vehicle tracking data, all sitting together. Dire Wolf claims 500 gigabytes left the servers; the company has not said how the door was opened. A vehicle tracking firm concentrated banking data and real-time location in a single, reachable store. The notification to South Africa's regulator is still preliminary, which is a polite way of saying nobody yet knows the size of what got out.
Retail and Consumer
Cartrack breach exposes customer data
Initial attack type not disclosed · Impact ransomware confirmed + data theft · Actor Dire Wolf
Boustead SingaporeSep 2026
Not yet quantified
AAttested
Boustead Singapore's overseas unit was hit by a cybersecurity incident, per a Singapore Exchange filing that withholds the business unit's name, the data touched, and the attacker's identity. Restoring systems from a backup proves availability but does nothing to minimize the damage potential of the already exfiltrated data. The promised independent review is itself an admission that nobody yet knows what's actually up.
Financial Services
Boustead Singapore overseas unit hit by cybersecurity incident
Initial attack type not disclosed · Impact data theft inferred + operational outage
LTFRBSep 2026
Not yet quantified
AAttested
In The Phillipines, the LTFRB pulled its entire LESS platform offline after confirming a breach it still cannot describe: no named entry point, no confirmed actor, no verified data type or record count, months after outside claims of 7.7 gigabytes and 16 million exposed rows. Personnel files, vehicle registrations, and franchise records all live inside one data environment, so when that environment failed, the whole agency went dark at once.
Public Sector and Education
LTFRB confirms data breach, takes records system offline
Initial attack type not disclosed · Impact data theft inferred + operational outage
GyazoSep 2026
Not yet quantified
AAttested
An unpatched flaw in Gyazo's own image upload server let an attacker run arbitrary commands and walk into the database behind it: 23.62 million accounts, their password hashes, and roughly 490 million image metadata records, most from links minted in 2019 or earlier. The upload server was never meant to be the database's front door, but nothing stood between the two to prevent it. The attacker also lifted the list marking which images were private, and Helpfeel cannot say those images went unseen. Calling an image link 'private' was a label, not an actual lock.
Technology and Software
Gyazo breach exposes 23.62 million user records and 490 million image records - PII and metadata exposed in huge attack
Initial attack type software vulnerability inferred
Premier Medical GroupSep 2026
Not yet quantified
AAttested
Premier Medical Group's notice never names an entry point: only that systems were disrupted in June, and files were pulled on June 14, exposing over 280,000 patients' names, diagnoses, medications, and insurance details. The attack vector is absent from the story, and that absence says everything about the brokenness of cybersecurity. PMG's fix is to have patients audit their own insurance statements for services they never received. Reviewing bills is not incident response; it's handing the actual victims a homework job and transferring the damage accountability to the very people PMG let down.
Healthcare and Life Sciences
280,000 Impacted by Premier Medical Group Data Breach
Initial attack type not disclosed · Impact data theft confirmed + operational outage
MEOSep 2026
Not yet quantified
AAttested
MEO called it a 'mass attack' and left it there: no vector named, no actor named, just service disruption and international congestion that also hit Vodafone, NOS, and Digi on the same day. That spread points at shared network infrastructure as the actual failure domain, not a single company's bad luck. 'No customer data breach' is the easiest claim to make when the statement never says what kind of attack this was.
Telecommunications
MEO hit by cyberattack
Initial attack type software vulnerability inferred · Impact operational outage confirmed
TelusSep 2026
Not yet quantified
AAttested
Telus Digital's systems suffered another unauthorized access after disclosing a massive breach in March of this year. What data was taken and how many people it touched remain unstated by anyone with the authority to say. The March attack involved stolen Google Cloud Platform tokens via a third-party vendor. The September event was facilitated through compromised user/account credentials. Telus seems to have some serious identity issues.
Telecommunications
Telus confirms 'unauthorized access' to customers' information | Daily Hive
Initial attack type compromised credentials confirmed · Impact data theft inferred
Florida Department of Highway Safety and Motor VehiclesSep 2026
Not yet quantified
AAttested
FLHSMV blames one compromised credential: a Plant City Police Department login stored on an employee's personal device. ShinyHunters tells a different story. They claim it was an exploited password reset flaw run across multiple DMV and FBI accounts since September 3. Tomato, Tomatoh. The DAVID database's security perimeter turned out to be one officer's personal device. The record count, over 200,000 by the hackers' claim, remains unconfirmed. The breach was also confirmed by the bad guys days before Florida admitted it.
Public Sector and Education
Florida confirms DMV database breached via stolen police account
Initial attack type compromised credentials confirmed · Impact data theft inferred · Actor ShinyHunters
RevolutSep 2026
Not yet quantified
AAttested
Revolut released customer records to someone impersonating a government agency from that agency's own email domain. No hack required, just a trusted sender field. Passports, birth dates, addresses, KYC selfies, and financial histories were the haul, but Revolut has declared that the number of impacted customers is small. The extortion group disputes that and has been releasing files on Telegram to make their case. "It's just a few rich people's passports" doesn't sound reassuring coming from a massive global bank.
Financial Services
Revolut discloses data breach exposing financial info, passports
Initial attack type phishing or social engineering confirmed · Impact data theft confirmed + data extortion
Anne Arundel Medical CenterSep 2026
breach at Luminis Healthcare
Not yet quantified
AAttested
Luminis Health's cyberattack, announced September 4, 2026, knocked out the phone system and MyChart portal at both Anne Arundel Medical Center and Doctors Community Medical Center, forcing rescheduled appointments while care continued. The notice names no entry point, no actor, and no confirmation that patient data was touched at all. Two hospitals going dark on the same day is not two incidents; it is one shared infrastructure with a single point of failure.
Healthcare and Life Sciences
Anne Arundel Medical Center cyberattack delays patient care
Initial attack type exposed or misconfigured system inferred · Impact operational outage confirmed
Surfshark VPNSep 2026
Not yet quantified
AAttested
An internet-facing test server, left reachable by misconfiguration, gave an intruder a way into Surfshark's engineering environment sometime before August 31. From there, the attacker reached an isolated proxy VPS and found build credentials sitting exposed in the code history. Surfshark says no encryption keys, user identities, or VPN traffic were touched.
Technology and Software
Surfshark VPN says hackers breached internal testing, proxy servers
Initial attack type exposed or misconfigured system confirmed · Impact data theft inferred
Hilltop National BankOct 2026
Not yet quantified
IInferred
Hilltop National Bank's online and mobile banking went dark for two weeks starting September 8, 2026, in a cybersecurity incident the bank declines to explain: no entry point, no actor, no account of what was reached. Its backup system had to come off the internet alongside everything else, so the recovery copy shared the failure domain it existed to escape. The assurance of no compromised data covers only the period since restoration, which leaves the outage itself conspicuously unaccounted for.
Financial Services
Hilltop National Bank closes Wyoming branches after cybersecurity incident
Initial attack type not disclosed · Impact operational outage confirmed
Liquid NetworkSep 2026
Not yet quantified
AAttested
Liquid Network's federation wallet held 4,200 Bitcoin behind a single point of failure, and roughly 4,000 of it left through SideSwap, the settlement rail the network itself authorized. Liquid insists the key was never compromised, which only relocates the flaw: a preliminary read points to a bug that let L-BTC be minted outright, no key needed. The source names no attacker, no confirmed fix, and calls it 'white-hat' anyway, a label that describes a hope, not a fact. A federation of eighty companies still built one wallet that a single bug could empty.
Financial Services
Bitcoin-based Liquid Network hit by US$320 million hack, halts transactions
Initial attack type software vulnerability inferred · Impact financial theft or fraud confirmed + operational outage
MathspaceSep 2026
Not yet quantified
AAttested
Mathspace's internal reporting system was reached through a known vulnerability in a self-hosted install, left unpatched from August 10 to August 27. The company puts the toll at 1,079,819 people: names, usernames, emails, login and activity metadata, though it says academic records, credentials, and school links stayed clear. A patch that exists and simply wasn't applied is not an attack; it is a maintenance doorway with a sign that tells the bad guys, "come on in, take what you want".
Technology and Software
More than 1 million users affected in Mathspace data breach across Australia and New Zealand
Initial attack type software vulnerability inferred · Actor ShinyHunters
IDScanSep 2026
Not yet quantified
AAttested
A dark-web marketplace called Nexus claims to hold over 153 million driver's license records, 10 million ID cards, and 579,000 medical cards, some paired with front-and-back scans in visible, infrared, and ultraviolet light. Krebs traced nine sample matches by timestamp and transaction history to businesses tied to IDScan.net, the identity-verification vendor sitting behind car rental counters, retailers, banks, hotels, and cannabis shops. IDScan has not confirmed a breach, named how anyone got in, or counted who was affected; a law firm did the notifying instead. One verification vendor serving five industries is not a shared perimeter; it is a single point where everyone's risk piles up at once.
Technology and Software
IDScan Faces Four Lawsuits Over Alleged Data Breach
Initial attack type not disclosed · Impact data theft inferred
WeverseSep 2026
Not yet quantified
AAttested
Weverse leaked internal user IDs and purchase metadata for 422,584 accounts through an unnamed flaw in its payment information API, a flaw an external reporter found before Weverse did. The company's own inspection began only after KISA flagged it on September 3, confirming that the data already sat with an outside actor. Strengthening access controls after the leak is not a fix; it is an admission of what the API was never built to secure from the jump. No names, no contact details, only the payment trail attached to every one of those customers' accounts.
Media and Entertainment
Weverse Notifies Users Of Data Leak
Initial attack type software vulnerability confirmed · Impact data theft confirmed
Gangnam UnniSep 2026
Not yet quantified
AAttested
Gangnam Unni's breach ran through an API built to retrieve consultation records, hit once on September 4 and again by another route the next day. The filing does not say how the access was authorized or whose credentials made it work; it names the door, not the key. What came out was 219,665 people's names, contact details, procedure histories, hospital and doctor names, appointment times, uploaded photographs, and some payment details. An API meant to serve consultation records to the platform served them up just as efficiently to someone who found the path twice. In bulk.
Healthcare and Life Sciences
South Korea's top cosmetic surgery app hacked, data of 220,000 users exposed
Initial attack type exposed or misconfigured system inferred · Impact data theft confirmed
New Hampshire Supreme CourtSep 2026
breach at Thomson Reuters
Not yet quantified
AAttested
An unauthorized user reached names and addresses tied to New Hampshire cases filed between 2002 and 2015, sitting inside C-Track, the case management platform that West Publishing, a subsidiary of Thomson Reuters, runs for court systems across 11 states, Canada, and the Virgin Islands. The source names no entry point and no actor, only a March 2026 intrusion found on June 30. One vendor's platform became the shared perimeter for a dozen separate judiciaries. The exposure lived entirely inside West Publishing's own database, walled off from the other judicial branch's systems that were never touched.
Public Sector and Education
NH Supreme Court data accessed in C-Track breach
Initial attack type third-party or supply chain inferred · Impact data theft confirmed
Resource Center of DallasSep 2026
Not yet quantified
AAttested
An unauthorized party sat inside the Resource Center of Dallas's network for eight days in February 2026 before anyone noticed; the disclosure never says how it got in, which is its own answer about what was being watched. What the adversary took was not a card number but the full architecture of a person: medical information, health insurance details, Social Security numbers, and the record of care sought at an LGBTQIA+ health provider. The review took until July to even confirm what was gone. Eight days inside a network with no detection is a design flaw that let nearly 13,000 patients' records leave with zero friction.
Healthcare and Life Sciences
Resource Center of Dallas Notifies 12,500 Patients About Cyber Incident
Initial attack type not disclosed · Impact data theft confirmed
Thomson ReutersSep 2026
Not yet quantified
AAttested
Thomson Reuters detected unauthorized activity in a C-Track cloud environment on June 30, 2026, three months after the intrusion it now traces to March. The stolen files touched court records and personal data across eleven states, the Virgin Islands, and Ontario; the company still cannot say what was taken or how many people were affected. One cloud platform running case management for a dozen jurisdictions turns a single failure into a multi-state event. We'll see if Thomson Reuters gets a "get out of jail free" card for this incident.
Professional and Business Services
Thomson Reuters hit by cyberattack that saw court documents across 11 states accessed by a hacker
Initial attack type not disclosed · Impact data theft confirmed
TvingSep 2026
Not yet quantified
AAttested
A stolen developer access key let an unidentified hacker into Tving's internal systems, exposing 39.54 million accounts and 361 technical assets, including source code, before the data moved to overseas accounts that investigators still haven't traced. That single key was the trust boundary for the entire platform, not just one developer's corner of it. A developer's credential was never built to double as a perimeter. Tving caught the intrusion on May 30 but didn't report it until June 1, turning a breach into a fine as well.
Technology and Software
Nearly 40 mln Tving accounts compromised in massive S. Korea data breach: probe
Initial attack type compromised credentials confirmed · Impact data theft confirmed
Ontario Court SystemSep 2026
breach at Thomson Reuters
Not yet quantified
AAttested
Ontario's courts didn't lose control of their own systems; they lost control of Thomson Reuters Canada's, the vendor running C-Track, a case management platform holding some of its documents and records. Thomson Reuters caught 'unauthorized activity' on June 30, contained it, and confirmed access to files whose contents the province still couldn't describe by its September 2 statement. Assurances of 'no evidence of identity theft' mean little when the institution making them still can't say what was taken, especially when sensitive court documents have nothing to do with 'identity'.
Public Sector and Education
Cyberattack hit Ontario courts, sealed information possibly accessed
Initial attack type third-party or supply chain confirmed · Impact data theft inferred
Oculus PathologySep 2026
Not yet quantified
AAttested
Oculus Pathology's breach notice covers a three-day window, March 31 to April 2, 2026, of unauthorized access to employee email accounts. Inside that window, 20,040 patients had names, Social Security numbers, driver's license numbers, tax IDs, payment card data, and full clinical records, diagnosis through prescription, exposed. One inbox held identity, finance, and medical history all at once, because nothing segregated them. A single email account eviscerated the entire catalog of the security tools deployed around it.
Healthcare and Life Sciences
Oculus Pathology Notifies 20,000 Patients About April 2026 Security Incident
Initial attack type not disclosed · Impact data theft confirmed
METR (Model Evaluation and Threat Research)Sep 2026
Not yet quantified
AAttested
A vibe-coded orchestration tool on a researcher's personal AWS instance failed open, silently disabling authentication and parking a METR API key on the public internet; an attacker took the key, added SSH persistence, and burned roughly $600,000 in credits over three weeks. The security perimeter ended where an employee's own cloud account began. Authentication that fails open isn't a control; it's an embossed invitation. As for the May incident, METR learned at the time it was being targeted by attackers potentially seeking financial gain or access to advanced AI models; the organization described this as a "sustained external attack campaign." The attackers used agents to automate reconnaissance and vulnerability discovery, including credential stuffing, OAuth-related attacks, scanning for newly deployed services, and phishing attempts.
Technology and Software
AI Model Evaluator METR Hit by Credential Theft, Probing
Initial attack type exposed or misconfigured system confirmed · Impact financial theft or fraud confirmed
Metro Atlanta cityAug 2026
Not yet quantified
AAttested
Norcross, Georgia, was hit by ransomware on August 1, with no vector named, no actor named, and no accounting of what data, if any, left the network. City officials notified police and cybersecurity professionals and kept most services running while restoration continued. Calling in digital fixers after the fact is incident response, not architecture. The filing never says what allowed the encryption in. An organization that cannot name the crack in its defenses has not yet found the boundary that failed.
Public Sector and Education
Metro Atlanta city hit by ransomware, working on full system restoration
Initial attack type not disclosed · Impact ransomware confirmed
U.S. Bureau of Alcohol, Tobacco, Firearms and ExplosivesAug 2026
Not yet quantified
AAttested
ATF confirmed a 'major incident' only after Qilin's ransomware gang posted the agency's name to its dark web leak site, not from its own monitoring. The bureau says the breach was confined to a standalone system, separate from its enterprise network and eForms. Qilin has not said whether it stole data or demanded a ransom, and ATF has not said what that system held. An agency that tracks explosives learned about its own breach from the people who lit the fuse. Or, it knew about it and didn't bother to disclose it.
Public Sector and Education
ATF confirms “major incident” after recent Qilin breach claims
Initial attack type not disclosed · Impact ransomware inferred · Actor Qilin
Manchester Airports GroupAug 2026
Not yet quantified
AAttested
MAG's breach note names neither the entry point nor the attacker, only the wreckage: 8.7 million customers' emails, phone numbers, vehicle registration numbers, and postcodes, pulled from the car park, lounge, and wifi sign-up systems shared across Manchester, Stansted, and East Midlands. Three airports ran their ancillary bookings through one common system, so a single hole became a three-airport hole. MAG points out that no bank details were held there, as if a name, a plate number, and a postcode were not already enough to track someone.
Transportation and Logistics
UK airports operator hit by cyber-attack and customer data accessed
Initial attack type not disclosed · Impact data theft confirmed
CarharttAug 2026
Not yet quantified
AAttested
ShinyHunters says it pulled more than 50GB from Carhartt's Databricks analytics platform, claiming the intrusion on August 13 and later publishing the archive after Carhartt declined a $3.3 million ransom demand. How the platform was actually entered, credentials, misconfiguration, or something else, is not stated; Carhartt has not confirmed the breach at all. Troy Hunt's independent analysis puts the toll at 12.9 million accounts, names, emails, phones, addresses, and over 15,000 internal @carhartt.com employee addresses sitting in the same analytics warehouse as the customer file. An analytics platform became the record of the whole company, employees, and customers alike, and nobody built a wall between them.
Retail and Consumer
Carhartt data breach exposes information of 12.9 million accounts
Initial attack type not disclosed · Impact data theft confirmed + data extortion · Actor ShinyHunters
Troutman Pepper LockeAug 2026
Not yet quantified
AAttested
Troutman Pepper Locke's breach began when one employee, targeted by a social engineering attack, trusted communications that looked legitimate but were not, exposing information now claimed to affect roughly 37,000 people in an accompanying lawsuit. The account gives no vendor, no malware, no stolen credential chain: just a single inbox that functioned as the firm's whole perimeter. A law firm built on judgment left one employee's judgment as its only control point.
Professional and Business Services
Large Atlanta law firm hit with data breach and associated lawsuit
Initial attack type phishing or social engineering confirmed · Impact data theft inferred
Sotheby's InternationalAug 2026
Not yet quantified
AAttested
Sotheby's International, a luxury real estate firm, reported it is investigating a cyber security incident involving unauthorized access to data held in a third-party software platform used to store marketing contact information. The company said the person who accessed the data claimed to have obtained 1.6 million contacts but it refuted that claim because it did not have that many on its database. Regardless of the number, given Sotheby's clientele, even marketing data seems to be a valuable haul from a valuable brand.
Retail and Consumer
Luxury real estate firm hit by cyber security attack
Initial attack type third-party or supply chain confirmed · Impact data theft confirmed
Conwy MindAug 2026
breach at Beacon CRM
Not yet quantified
AAttested
A North Wales mental health charity confirms sensitive data was accessed, informing their clients that their trusted provider Beacon CRM had experienced a breach on 7/29/2026 that affected many of Beacon's non-profit clients.
Public Sector and Education
Cyber attack on North Wales mental health charity sees sensitive data accessed
Initial attack type not disclosed · Impact data theft confirmed
Apollo GlobalAug 2026
Not yet quantified
AAttested
The notice attached to this incident reads "to review," which means the source confirms nothing beyond a name and a date: not the vector, not the actor, not what was reached, not how many were affected. Apollo Global sits in the Index with a placeholder where an accounting should be. An institution's disclosure obligation is itself a control point, and a statement that has not yet been given is not transperancy, especially for customers. .
Financial Services
Apollo Global reveals data breach after hackers target financial firms
Initial attack type not disclosed · Impact data theft inferred
AlationAug 2026
Not yet quantified
AAttested
AI data giant Alation confirmed a cyberattack, and the headline confirms nothing else: no entry point, no actor, no data type, no count of records or systems touched. That leaves a data-governance vendor built to sit inside other companies' data stacks, cataloging and connecting sensitive information as its core function, now acknowledging compromise without saying what that position exposed.
Technology and Software
Alation Confirms Cyberattack: What Security Teams Need to Know
Initial attack type not disclosed · Impact data theft inferred
Connecticut Department of Social ServicesAug 2026
Not yet quantified
AAttested
A state Medicaid portal exposed data on 41,000 members. Per usual, the state and their auditor declared that "no social security numbers were taken" but the laundry list of other data elements stolen suggest a ready-made-cookbook for use in other forms of targeted consumer attacks such as social engineering and financial scams.
Public Sector and Education
State says data from 41,000 Medicaid members exposed in portal breach
Initial attack type not disclosed · Impact data theft confirmed
SFRAug 2026
Not yet quantified
AAttested
2.1 million SFR fiber customer records surfaced as exposed and SFR has confirmed that attackers compromised a legitimate user account to access an internal fiber connection management tool named NOVA. The data loss is a treasure trove of information for targeted scams and phishing against SFR customers.
Telecommunications
SFR data breach in France: 2.1 million fibre customer records exposed
Initial attack type compromised credentials confirmed · Impact data theft confirmed
CanvasAug 2026
Not yet quantified
AAttested
Vulnerabilities in Canvas, the third-party learning platform four Hong Kong institutions leaned on, exposed more than 153,000 student and staff accounts; names, IDs, emails, login credentials, course messages. The institutions' internal systems were in place but ended up being irrelevant, since Canvas was the actual perimeter, and one vendor's flaw became four campuses' breach.
Public Sector and Education
More than 153,000 students, staff affected in Canvas data breach: privacy watchdog
Initial attack type third-party or supply chain confirmed · Impact data theft confirmed
Sakura InternetAug 2026
Not yet quantified
AAttested
Up to 1.36 million Sakura Internet accounts were exposed in a recently disclosed breach, which was only discovered when Sakura was investigating an entirely separate breach in one of its other business units.
Telecommunications
Sakura Internet hack exposes data of up to 1.36 million accounts
Initial attack type not disclosed · Impact data theft inferred
CognizantAug 2026
Not yet quantified
AAttested
Cognizant notified individuals of a data breach and is offering one million dollars in identity theft coverage. The headline confirms notification and a remediation gesture but does not name the entry point, the actor, the number affected, or the data types involved. A company built on managing other organizations' systems and data has disclosed a breach of unspecified scope, and the insurance offer addresses downstream harm, but not the architecture that allowed the exposure.
Professional and Business Services
Cognizant notifies individuals of data breach; offers $1 mn identity theft cover
Initial attack type not disclosed · Impact data theft confirmed
Latvia's Road Traffic Safety Directorate CSDDAug 2026
Not yet quantified
AAttested
An unpatched, internet-facing hole in a CSDD system, one that was legally classed as critical, requiring multi-factor authentication and penetration testing it never got, gave attackers a path to eighteen years of payment records: 1.2 million people, 200,000 companies, IDs and addresses intact. The immediate result? The resignation of the entire safety advisory board.
Public Sector and Education
Data of 1.2 million people leaked in CSDD cyberattack in Latvia - including personal ID numbers and addresses
Initial attack type software vulnerability confirmed · Impact data theft confirmed
Pokemon CenterAug 2026
breach at CEVA Logistics
Not yet quantified
AAttested
Another CEVA Logistics supply chain victim. Pokémon Center is notifying customers in the United Kingdom and Germany that it suffered a third-party data breach after hackers stole customer personal and order information. CEVA's reply? Gotta get 'em all.
Technology and Software
Pokémon Center data breach exposes customer info, cancels some orders
Initial attack type third-party or supply chain confirmed · Impact data theft confirmed
Access BankAug 2026
Not yet quantified
AAttested
Access Bank lost N1.3bn to hackers in an expanding attack against Nigerian banks nationwide. entry point, method, and timeline all unnamed. The breach notification is precise on the loss but skips, entirely, how the breach occurred.
Financial Services
Banks continue to battle hackers over deposits, as Access Bank loses N1.3bn
Initial attack type not disclosed · Impact financial theft or fraud confirmed
Bits of GoldAug 2026
Not yet quantified
AAttested
Bits of Gold, Israel's largest crypto broker, confirms a breach touching 200,000 customers. The Tel Aviv, Israel-based company reported the security breach on Sunday, saying a hacker gained unauthorized access to a third-party data analytics network and,gained access to customers’ names, national ID numbers, emails, phone numbers, IP addresses, bank account details, and public wallet addresses.
Financial Services
Israel's largest crypto broker Bits of Gold hit by data breach affecting 200,000 customers
Initial attack type third-party or supply chain confirmed · Impact data theft confirmed
SafePalAug 2026
Not yet quantified
AAttested
SafePal disclosed a data breach affecting roughly 40,000 customers, exposing customer information associated with purchases while the company says wallet credentials, private keys, and recovery seeds were not compromised. This is high quality signal, cryptocurrrency relatedcustomer data that gives attackers a better map for phishing and social engineering. Exactly what adversaries want for conducting further identity based attacks.
Financial Services
SafePal Data Breach Hits Tens of Thousands of Customers - Infosecurity Magazine
Initial attack type not disclosed · Impact data theft confirmed
Sogang UniversityAug 2026
Not yet quantified
AAttested
About 180,000 students, alumni, and employees at Sogang University had their data exposed through the school's integrated login system. IDs, names, affiliations, emails, phone numbers, encrypted passwords. The entry point stays unnamed, the attacker unidentified; what's clear is one login system built to serve every population became one failure domain for all of them. Network separation arrived after detection, not before.
Public Sector and Education
Sogang University hit by personal information breach of 180,000
Initial attack type not disclosed · Impact data theft confirmed
Shell and PhilipsAug 2026
Not yet quantified
AAttested
Cl0p listed nearly fifty companies at once and walked off with 89GB of Shell's facility drawings and test reports. The hole was in PTC's Windchill, patched 17 June. Shell's security spend didn't include understanding the path from Windchill to their doorstep.
Energy and Utilities
Shell and Philips hit by Russian ransomware attack
Initial attack type software vulnerability confirmed · Impact data theft confirmed + data extortion · Actor Cl0p
H&MAug 2026
Not yet quantified
AAttested
H&M confirmed that an attack on a business system exposed Korean customers' email addresses, phone numbers, and order or return reference numbers. More sensitive payment and password data were reportedly not affected, but the company did not disclose the number of customers or the access path. The useful boundary held around payment data; disclosure and accountability around the breached business tool remain thin.
Retail and Consumer
H&M discloses customer data breach in South Korea
Initial attack type not disclosed · Impact data theft confirmed
RingCentralAug 2026
Not yet quantified
AAttested
623GB out the door, no ransom paid, 280GB published in response. RingCentral assured customers that silence meant safety, and Have I Been Pwned then counted 1.6 million email addresses sitting in the archive.
Technology and Software
RingCentral data breach exposed info of 1.6 million accounts
Initial attack type not disclosed · Impact data extortion confirmed + data theft
French Tax AuthorityAug 2026
Not yet quantified
AAttested
A stolen identity got someone onto the French tax authority's VPN and into an internal lookup tool built for querying taxpayers. DGFiP cut the access in June, filed it under routine, and let the hacker break the news in August.
Public Sector and Education
French tax data stolen in cyberattack, ministry says
Initial attack type compromised credentials confirmed · Impact data theft inferred
TrezorAug 2026
Not yet quantified
AAttested
13,689 hardware wallet buyers had their home addresses taken from a fulfilment partner. What capped the damage was a 90-day deletion rule, not a security control. Data you have already deleted cannot be stolen, and nobody puts that on a compliance dashboard.
Financial Services
Trezor discloses data breach affecting nearly 14,000 customers
Initial attack type third-party or supply chain inferred · Impact data theft confirmed
Columbia Justice MinistryAug 2026
Not yet quantified
AAttested
Ransomware hit Colombia's Justice Ministry five days before a presidential handover and one day after the national CERT warned this was coming. The warning was the control. It was issued, logged, and changed nothing.
Public Sector and Education
Ransomware Hits Colombian Justice Ministry Days Before Presidential Transition
Initial attack type not disclosed · Impact ransomware confirmed
LawCareAug 2026
Not yet quantified
AAttested
Lawyers in crisis contacted LawCare in confidence, all of it lived in Beacon CRM, and all of it is now assumed gone. No vendor questionnaire in existence asks whether the supplier left an AWS key in a public JavaScript file. [LawCare]
Professional and Business Services
UK legal mental health charity LawCare confirms database was compromised in hacking incident
Initial attack type exposed or misconfigured system inferred · Impact data theft inferred
Sunshine HealthAug 2026
Not yet quantified
AAttested
No system was breached at Sunshine Health. A caller posing as someone trusted asked an employee to hand over health-plan files, and the employee did. About 41,569 people had their names, birth dates, and medical histories walk out through a phone call. The security boundary was a person's willingness to help, and it held only as long as the caller sounded familiar.
Healthcare and Life Sciences
Data Breaches Reported by Sunshine Health; Health Payment Systems
Initial attack type phishing or social engineering confirmed · Impact data theft confirmed
Health Sciences CentreAug 2026
Not yet quantified
AAttested
Ransomware took the HVAC and the door locks at Manitoba's largest hospital. The provincial auditor general flagged Shared Health's cybersecurity in 2024. Somebody measured this, wrote it down, and filed it. [Health Sciences Centre, Winnipeg]
Healthcare and Life Sciences
Ransomware attack on Health Sciences Centre affects doors, ventilation and air-conditioning
Initial attack type not disclosed · Impact ransomware confirmed + operational outage
FrameworkAug 2026
Not yet quantified
AAttested
Framework confirms customer data were exposed, and the headline is pretty much all you get: no named vector, no timeline, no data type, no actor. A breach notice with no information is not a disclosure. It's a stall tactic.
Technology and Software
Framework Admits Customer Data Were Exposed in Latest Security Breach
Initial attack type not disclosed · Impact data theft confirmed
Sawyer Savings BankAug 2026
Not yet quantified
AAttested
The notice names Sawyer Savings Bank and a disclosure date; it does not name an entry point, an actor, a record count, or the type of data reached.
Financial Services
Sawyer Savings Bank Branches Closed After Security Incident
Initial attack type not disclosed · Impact operational outage inferred
North Carolina PortsAug 2026
Not yet quantified
AAttested
North Carolina Ports confirms operations disrupted by a cyberattack. Operations were disrupted and impacted by gate mechanisms being activated. No threat groups have been identified for this event but ports are critical infrastructure and a desirable target for many types of adversaries.
Transportation and Logistics
North Carolina Ports confirms cyberattack disrupting operations
Initial attack type not disclosed · Impact operational outage confirmed
Zenith BankAug 2026
Not yet quantified
AAttested
The notice for Zenith Bank's August 2026 incident contains no facts: no confirmed entry point, no named actor, no data types, no count of people affected. What remains is a disclosure obligation met with a placeholder, from an institution whose core function is holding other people's money and identity records. The duty to explain a breach is being treated as different from the duty to prevent one.
Financial Services
Zenith Bank customers told to immediately check their deposits after data breach
Initial attack type not disclosed · Impact data theft inferred
BeaconAug 2026
Not yet quantified
AAttested
Beacon CRM flared up as a news headline in the UK, and the headline is nearly all there is - no entry point, no actor, no data type, no count. What's confirmed is the scale: a single CRM widely used by charities, meaning one vendor's compromise fans out into every donor and beneficiary file it was trusted to hold. The platform was the perimeter for organizations that focused on the mission of helping other while depending on Beacon CRM to help them.
Public Sector and Education
Beacon CRM, Widely Used by Charities, Suffers Data Breach
Initial attack type not disclosed · Impact data theft confirmed
English National BalletAug 2026
breach at Beacon CRM
Not yet quantified
AAttested
English National Ballet's headline confirms a cyber attack and a possible breach; entry point, actor, and what data may have been reached go unnamed in the source. The National Ballet finds itself unable to answer these questions because they don't have them. They are one of the many clients of Beacon CRM.
Public Sector and Education
English National Ballet suffers possible data breach following cyber attack
Initial attack type not disclosed · Impact data theft inferred
Liechtenstein Office of JusticeAug 2026
Not yet quantified
AAttested
EU anti-money-laundering rules require a single register naming the humans behind Liechtenstein's companies, foundations, and trusts. Overnight on 30 July, copies covering 31,000 entities left. The transparency measure worked exactly as designed, for the adversaries.
Public Sector and Education
Cyberattack hits Liechtenstein's anti-money laundering data register, Vaduz says
Initial attack type not disclosed · Impact data theft confirmed
Brinks HomeAug 2026
Not yet quantified
AAttested
Brinks Home's disclosure names a leak, not a cause: no entry point, no actor, no data type, no count. Just files surfacing after the fact. Announcing a leak isn't transparency. Brinks should know better than most that sounding an alarm isn't the same as responding to one.
Retail and Consumer
Brinks Home Discloses Data Breach as Hackers Leak Files
Initial attack type not disclosed · Impact data theft inferred
Unlimited Technology SystemsAug 2026
Not yet quantified
AAttested
3.8 million patients, from five days in October 2025, took until July 2026 to size. UTS says an unauthorized actor copied patient data from its commercial data center during five days in October 2025. The scale came from concentration: a billing vendor that most patients never chose held identity, insurance, and medical data for many providers in one place.
Healthcare and Life Sciences
Unlimited Technology Systems breach impacts 3.8 million people
Initial attack type not disclosed · Impact data theft confirmed
Minnesota State OfficialsJul 2026
Not yet quantified
AAttested
Minnesota officials disclosed a coordinated cyberattack targeting more than 30 community water systems between July 26 and July 27, 2026. Several communities, including Braham, Plymouth, South St. Paul and Maple Plain, reported disruptions to operational technology supporting water treatment, although officials stated there was no impact to drinking water quality or public safety. In Braham, the attack temporarily shut down the city's water treatment plant until operators restored service using manual processes. The incident is one of the largest coordinated cyberattacks against U.S. municipal water systems publicly disclosed to date and underscores the continued targeting of critical infrastructure.
Public Sector and Education
Authorities investigating a coordinated cyberattack against Minnesota water systems
Initial attack type not disclosed · Impact operational outage confirmed
UnitelJul 2026
Not yet quantified
AAttested
Angola's largest telecommunications provider suffered a cyberattack that disrupted nationwide voice, mobile data, and internet services just one day before its planned stock market listing. The incident affected more than 21 million subscribers, forcing the company to activate incident response and recovery efforts while services remained degraded. Unitel has not disclosed the attack vector, threat actor, or whether customer data was compromised, but did proceed with their public offering.
Telecommunications
Angola's Unitel hit by cyberattack ahead of stock market debut
Initial attack type not disclosed · Impact operational outage confirmed
Bank of BarodaJul 2026
Not yet quantified
AAttested
State-owned Bank of Baroda (BoB) on Monday, July 27, confirmed a security incident that led to unauthorised access to “certain data” by threat actors. The incident involved comprise of an employee’s email account, Bank of Baroda said. Reports suggest that the exfiltrator dumped 1TB on the internet, for free.
Financial Services
Bank of Baroda confirms data breach, says employee email account compromised in hack
Initial attack type compromised credentials confirmed · Impact data theft confirmed
Triple-AJul 2026
Not yet quantified
AAttested
Triple- A, a Singapore-based company said it unauthorized access on July 25th, 2026 and temporarily placed certain services into maintenance mode for about three hours while it secured the affected infrastructure. Triple-A did not disclose the amount lost or explain how the wallets were compromised. Onchain investigator Specter previously estimated the losses at about $11.8 million.
Financial Services
Triple-A Confirms Treasury Wallet Breach After Reported $11.8M Loss
Initial attack type not disclosed · Impact financial theft or fraud confirmed + operational outage
Chick-Fil-AJun 19
Not yet quantified
AAttested
According to the notification letter sent to affected customers, hackers launched an automated attack against Chick-fil-A's website and mobile application between June 17 and June 19 using credentials obtained from a third-party source. Chik-Fil-A has not disclosed the number of customers impacted and has filed incident notifications with several State AG offices around the US.
Retail and Consumer
Newsweek
Initial attack type compromised credentials confirmed · Impact data theft inferred
NichireiJul 2026
Not yet quantified
AAttested
The ransomware attack caused widespread chaos, directly impacting approximately 5,000 corporate clients. The breach paralyzed cold storage warehouse logistics and frozen food shipments nationwide, forcing major retailers to scramble.
Wholesale and Distribution
Company announcement
Initial attack type not disclosed · Impact ransomware confirmed + operational outage
Origin EnergyJul 2026
Not yet quantified
AAttested
Origin Energy confirmed that full bank account details belonging to 60 customers were accessed in a July breach. While 60 may seem small compared to the 900,000 Australian customers impacted by this massive breach, it isn't small for each one of those 60 people who took the hit for Origin Energy's lack of stewardship.
Energy and Utilities
Origin Energy says bank account details of 60 customers accessed in July data breach
Initial attack type not disclosed · Impact data theft confirmed
SunoJul 2026
Not yet quantified
IInferred
404 Media disclosed that Suno was breached in Nov 2025, as confirmed by HaveIBeenPwnd. Suno has not yet publicly disclosed the cyberattack or notified individuals that their information was taken, and has refused to answer reporter questions on this matter.
Technology and Software
Security analyst report
Initial attack type not disclosed · Impact data theft inferred
PaidworkJul 2026
Not yet quantified
AAttested
Gig-work platform Paidwork disclosed that a breach exposed the personal and financial information of approximately 23 million users after a stolen database surfaced publicly. The leaked data reportedly includes names, email addresses, phone numbers, physical addresses, dates of birth, banking and payout information, device details, IP addresses, and bcrypt-hashed passwords.
Technology and Software
Paidwork data breach reportedly exposes 23M accounts and bank data
Initial attack type not disclosed · Impact data theft confirmed
EcopetrolJul 2026
Not yet quantified
IInferred
The Colombian state-controlled ‌energy company Ecopetrol announced on Friday that a cyberattack resulted in the theft of data tied to about 3,300 user accounts ​and that it could not "guarantee" the breach would ​not have a "material adverse" financial impact.
Energy and Utilities
News: Reuters
Initial attack type not disclosed · Impact data theft confirmed
AbbottJul 2026
Not yet quantified
IInferred
Abbott did not disclose what kind of information was accessed. The company declined to respond further to MedTech Dive’s request for comment regarding when the attack was discovered and what kind of information was accessed.
Healthcare and Life Sciences
News: MedTech Dive
Initial attack type not disclosed · Impact data theft inferred
StadlerJul 2026
Not yet quantified
IInferred
Stadler refuses to pay ransom to the Everest hacking group, claims core IT systems were not hacked. ENISA warned that the railway sector’s growing strategic importance was outpacing its ability to manage cyber risks. Findings point to weaknesses highlighted by the Stadler breach. Only 35% of railway companies surveyed regularly assessed the effectiveness of their cybersecurity controls, while 50% did so on an ad hoc basis. Just 25% regularly tested business-continuity and disaster-recovery arrangements.
Transportation and Logistics
Media report
Initial attack type not disclosed · Impact data extortion inferred · Actor Everest
Ernst & YoungJul 2026
Not yet quantified
AAttested
EY says it detected unusual activity on April 23 and determined that the attacker accessed the platform between March 28 and April 12, downloading multiple documents. The ShinyHunters extortion gang added Ernst & Young to its data leak site, claiming it conducted the attack and threatened to release the allegedly stolen data if the company does not contact the group by July 31, 2026. E&Y took more than 3 months to disclose the cyber incident.
Professional and Business Services
Ernst & Young data breach claimed by ShinyHunters extortion gang
Initial attack type not disclosed · Impact data theft confirmed + data extortion · Actor ShinyHunters
Centers Lab NJ LLCJul 2026
Not yet quantified
IInferred
Healthcare diagnostics company Centers Laboratory (Centers Lab NJ LLC) has informed the US government that a data breach discovered nearly one year ago affects more than 540,000 individuals.
Healthcare and Life Sciences
News: SecurityWeek
Initial attack type not disclosed · Impact data theft confirmed
FiestaJul 2026
Not yet quantified
AAttested
The Las Vegas-based insurance and tax-services franchisor said it became aware on June 9, 2025, that systems within its network environment had been affected by a cyber incident. Following a forensic investigation and an "extensive data review," it was determined on June 26, 2026, that potentially accessed or acquired files contained personal information. While it took a year for Fiesta to determine that customer data had been exposed, Fiesta violated no disclosure laws as written due to their efforts to notify customers within 17 days of the confirmation that customer data had been impacted.
Financial Services
Fiesta Insurance took a year to identify breached customer data - report
Initial attack type not disclosed · Impact data theft confirmed
Mount Royal UniversityJul 2026
Not yet quantified
IInferred
Mount Royal University Confirms Data Stolen in Ransomware Attack.
Public Sector and Education
News: SecurityWeek
Initial attack type not disclosed · Impact ransomware confirmed + data theft
AccentureJul 2026
Not yet quantified
IInferred
Accenture faces massive data breach that could put clients at risk.
Professional and Business Services
News: Cybersecurity Dive
Initial attack type not disclosed · Impact data theft confirmed
MedtronicJul 2026
Not yet quantified
IInferred
Medtronic Notifies 3.8M Individuals About April 2026 Cyberattack.
Healthcare and Life Sciences
News: The HIPAA Journal
Initial attack type not disclosed · Impact data theft inferred
MCBSJul 2026
Not yet quantified
AAttested
MCBS confirmed that there had been unauthorized network access between September 22 and September 25, 2025, and files containing protected health information may have been viewed or exfiltrated from its network. The review of the affected data was completed on May 28, 2026, some 8 months after the network intrusion.
Healthcare and Life Sciences
MCBS Announces Cybersecurity Incident Impacting 1.26M Individuals
Initial attack type not disclosed · Impact data theft confirmed
Tennessee Pathology GroupJul 2026
Not yet quantified
AAttested
An investigation was launched on December 1, 2025, when anomalous activity was identified within its computer network. During the course of the investigation, unauthorized network access was confirmed. It is unclear from the breach notice when the unauthorized access occurred or for how long the network was compromised. The review of the exposed data was completed on April 27, 2026, when it was confirmed that personal and protected health information had been exposed. Notification letters were mailed to the affected individuals on June 23, 2026, and complimentary credit monitoring and identity theft protection services have been offered to certain individuals. Over 169,000 customer and patient records were exposed.
Healthcare and Life Sciences
Tennessee Pathology Group Announces 170K-record Data Breach
Initial attack type not disclosed · Impact data theft confirmed
QantasJul 2025
Not yet quantified
AAttested
An unnamed threat actor impersonating "Qantas IT help" contacted the airline's call centre. The agent was tricked into connecting a customised version of Salesforce's Data Loader tool to the customer relationship management platform used by Qantas, which enabled mass data extraction. 5.67 mm customer records were exposed. The cost of cyber losses and recovery has never been disclosed, with Qantas executives agreeing to forfeit $800k AUD in bonuses due to the incident.
Transportation and Logistics
Company statement
Initial attack type phishing or social engineering confirmed · Impact data theft confirmed
TfL Transport for LondonSep 2024
£29M
Spent responding & recovering
Direct expense
Scattered Spider exfilitrated 15 million lines of user data and then exposed the user data of 10 mm customers. The stolen database included names, contact details, home addresses, and Oyster refund data containing banking details and sort codes for about 5,000 customers
Losses on the record
£10M
Orders & sales lost
Business interruption
These measure different things and are never added together.
See the full accounting
Business interruption · realized£10M · A
Direct expense · realized£29M · A
Shown individually, never summed across measures.
Attested: a published report credits an identifiable source for this figure.
Transportation and Logistics
Company announcement
Initial attack type not disclosed · Impact data theft confirmed · Actor Scattered Spider
What the company has said it cost
The company’s own disclosed figure, as it changed over time. The categorized losses on the record carry their own sources.
undated$49mmAAttestedCompany announcement ↗
Kawasaki Motors EuropeSep 2024
Not yet quantified
AAttested
Kawasaki originally stated that they experienced a cyber attack, but avoided an incident by shutting down and isolating their servers. The action had a direct impact on operations. Ransomhub later dumped 487 GB of data after Kawasaki refused to pay for a ransom, contradicting Kawasaki's initial representations of the breach and its consequences.
Retail and Consumer
Company statements to media
Initial attack type not disclosed · Impact operational outage confirmed + data extortion · Actor Ransomhub
CDKJun 2024
$25M
Spent responding & recovering
Direct expense
CDK's ransomware event drove an immediate payment of $25mm in Bitcoin payments to the BlackSuit ransomware gang. A year before the incident CDK was acquired by a private equity organization, effectively turning it into a private company. Several public companies were impacted, resulting in 8k filings that show in excess of $1bn losses across the automotive industry.
Attested: a published report credits an identifiable source for this figure.
Technology and Software
Company announcement
Initial attack type not disclosed · Impact ransomware confirmed + financial theft or fraud · Actor BlackSuit
What the company has said it cost
The company’s own disclosed figure, as it changed over time. The loss on the record is this same figure, typed and categorized.
undated$25mmAAttestedCompany announcement ↗
MedisecureApr 2024
Not yet quantified
AAttested
Medisecure experienced a massive ransomware and data exfiltration attack, exposing 6.5 TB of data included names, addresses, Medicare numbers, and sensitive prescription medication and healthcare card details. The costs of this attack in losses and recovery expenses were never disclosed, as Medisecure declared insolvency within weeks of the disclosure of the incident.
Healthcare and Life Sciences
Company announcements
Initial attack type not disclosed · Impact ransomware confirmed + data theft
AscensionDec 2024
$1.3B
Total reported cost
Total incident cost
Ascension stated that an employee at one of its facilities accidentally downloaded a malicious file they believed was legitimate, which the company characterised as an honest mistake. Security reporting also linked the intrusion to the suspected exploitation of CVE-2024-1709, a vulnerability in ConnectWise's ScreenConnect remote-access software. The combination highlights how a single user action and unpatched third-party software can open the door to a major ransomware incident.
Losses on the record
See the full accounting
Total incident cost · realized$1.3B · A
Shown individually, never summed across measures.
Attested: a published report credits an identifiable source for this figure.
Healthcare and Life Sciences
Company PR statements
Initial attack type phishing or social engineering confirmed · Impact ransomware confirmed
What the company has said it cost
The company’s own disclosed figure, as it changed over time. The loss on the record is this same figure, typed and categorized.
undated$1.3BAAttestedCompany PR statements ↗
CranewareJul 2020
Not yet quantified
AAttested
Craneware sits inside the billing systems of more than 2,000 US hospitals and roughly 10,000 clinics and pharmacies, so an intrusion into a Scottish software vendor is really an intrusion into American healthcare's revenue plumbing. The company stressed that much of what left was non-sensitive or already public regulatory data, a reassurance that quietly conceded a significant volume had gone, employee records and a subset of customer and partner data among it. Contained is not the same as empty-handed when the files are already gone.
Healthcare and Life Sciences
Cybersecurity incident report
Initial attack type not disclosed · Impact data theft confirmed
HarrodsSep 2025
Not yet quantified
AAttested
Attackers gained access to approximately 430,000 customer records through one of Harrods' third-party provider systems. The stolen data included names and contact details such as email addresses and telephone numbers. Additional information relating to marketing preferences, loyalty tier levels and connections to Harrods co-branded cards was also caught up in the breach.
Retail and Consumer
Media reports
Initial attack type third-party or supply chain confirmed · Impact data theft confirmed
Open CodeOct 2026
Not yet quantified
AAttested
An intruder reached a legacy system OpenCode was already preparing to shut down, exposing the third-party API keys, OpenAI and Anthropic among them, that 1.4% of Console users had saved in their workspaces. The company ties it to a large-scale distillation attack but has not said how anyone got in, how long they stayed, or how many keys were exposed. By choosing to publish a low percentage figure as the "victim" count Open Code is obfuscating the fact that the number of victims is probably in the several thousands and that the exposed keys must be remediated by the same victims that trusted Open Code with their security.
Technology and Software
Company Statement
Initial attack type not disclosed · Impact data theft confirmed
← Back to the index