Hacker in a Hoodie™ Index

The Complete Ledger

Every cyber incident approved to this index, both feeds in one place: SEC 8-K filings and state-regulator notifications graded Verified, company results statements graded Attested, and outside estimates and news reports graded Inferred. Filter by grade, sector, initial attack type, or impact. The complete record, uncapped, and like everything on this index it is never summed.

410 approved cyber incidents on the record, most recent first. The complete record, nothing hidden, never summed.
The full record as open data (CC BY 4.0): CSV · JSON · about the data
Subscribe to new incidents: RSS · JSON Feed
How each figure is graded VVerifiedthe linked primary document states it AAttesteda published report credits a named source IInferredno direct confirmation; a lead, not a figure The full standard →
The revision trail
A cost figure arrives after an incident is disclosed, and it moves as stronger sources report it. Early estimates run below the figure a company eventually discloses. The amount shown for each incident is its most recent claim; the trail beneath it is every claim in order, each with its date, its source, and its grade, from an Inferred early estimate to a higher Attested company figure or Verified filing figure.
Corrections
Every figure on this ledger is drawn from its cited source and links to it. If we have read one wrong, tell us: info@hackerinahoodie.com.
UNM HealthOct 2026
Not yet quantified
AAttested
A cyberattack detected October 26, 2026 knocked out electronic systems across UNM's Health Sciences Center, diverting ambulances for two hours and canceling surgeries and appointments. UNM says the intruder reached only end-user devices, never core servers; how it got in, and whether patient data exited, goes unsaid. Byod, a new ransomware group, claims 36,000 systems and Cerner EHR rosters. Even with its core intact, the hospital stopped, because the failure domain was the desktop, and the desktop ran the clinic.
Healthcare and Life Sciences
Cyber Incident Forces UNM Health to Cancel Surgeries, Divert Ambulance
Initial attack type not disclosed · Impact operational outage confirmed + ransomware · Actor Byod
ENGIEOct 2026
Not yet quantified
AAttested
Engie customer data may have walked out of a third-party marketing tool that partners used to prospect and sell energy offers in France, potentially including names, addresses, phone numbers, customer and contract numbers, and PCE/PDL supply IDs. The count, the entry point, and the actor go unnamed. Engie's own systems held, which matters little once the customer list has been copied into a sales tool. The perimeter was wherever partners were allowed to prospect for additional sales revenue.
Energy and Utilities
Energy giant ENGIE discloses data breach affecting customers
Initial attack type third-party or supply chain inferred · Impact data theft inferred
CopenhagenOct 2026
Not yet quantified
AAttested
Hackers reached a University of Copenhagen test environment holding the names, Danish CPR numbers, phone numbers, and email addresses of 525,000 people, along with PIN access codes for 20,000 staff and students. How they got in has not been said. Copying real identities into a system built for breaking things carried the whole failure domain into the sandbox. New door codes went out within days. Nobody is reissuing 525,000 CPR numbers.
Public Sector and Education
Over 525,000 hit in massive University of Copenhagen data breach
Initial attack type not disclosed · Impact data theft inferred
USForex Inc.Sep 2026
Not yet quantified
VVerified
An unauthorized party reached OFX, parent of USForex, on September 28, 2026, getting into files holding names, birthdates, contact details, transfer and recipient records, and answers to secret questions. The notice does not say how they got in or how many people are affected. By OFX's account, the client-platform databases were untouched, so the exposure lived in files kept outside them, job applicants included. Answers to secret questions were designed never to change, and now a stranger holds them too.
Financial Services
California AG breach notification
Initial attack type not disclosed · Impact data theft confirmed
Denver Health Medical PlanOct 2026
Not yet quantified
AAttested
Denver Health Medical Plan's analytics vendor, SquareML, left an access key on a public website from June 27, 2025, until August 18, 2026, exposing a database holding records on 238,083 members. Names, birthdates, admissions, discharges, and health metrics sat behind it; no Social Security or financial data, the notice adds. A single static key was the entire security fence for nearly fourteen months. The account was read-only, a comfort that thins considerably when reading was the whole risk.
Healthcare and Life Sciences
Denver Health Medical Plan Discloses Vendor Breach Affecting 238K Members
Initial attack type exposed or misconfigured system confirmed · Impact data theft inferred
Tarter Krinsky & DroginOct 2026
Not yet quantified
AAttested
An unauthorized party came and went from Tarter Krinsky & Drogin's servers between July 9 and September 9, 2025, accessing or acquiring files tied to 196,645 patients of the Manhattan law firm's healthcare clients. How it got in, the notice does not say. Records sent to outside counsel made a law firm's file server part of the healthcare security architecture. The haul may include biometric data, the one credential nobody can reissue.
Professional and Business Services
Data Breach at Manhattan Law Firm Involved PHI of 197,000 Individuals
Initial attack type not disclosed · Impact data theft confirmed
LoblawOct 2026
Not yet quantified
AAttested
An unauthorized party was inside Loblaw technology systems from as early as February 23, 2026, reaching names, addresses, birthdates, loyalty numbers, purchase details, and partial card data for about two million shoppers, by CBC's count. The notice never says how they got in. The forced logout across PC Optimum and every other PCiD app exposed the design: one shared identity layer, one shared failure domain. Two years of credit monitoring does not unshare an identity.
Retail and Consumer
Loblaw says March data breach affected about 2 million customers
Initial attack type not disclosed · Impact data theft confirmed
JETSOct 2026
Not yet quantified
AAttested
Attackers reached part of the internal administrative systems at JETS, operator of Jamaica's MultiLink and ACH networks, where the names of some ACH recipients and debit card numbers sat in historical administrative files that may have been exposed. The source gives no entry point, no actor, no count, and no window. The payment networks were walled off well enough to hold. The exposure lived in the archive, where card numbers were kept on the administrative side of the wall.
Financial Services
Cyberattack on JETS exposes customer information; MultiLink and ACH networks unaffected
Initial attack type not disclosed · Impact data theft inferred
QUEST DIAGNOSTICS INCOct 2026
Not yet quantified
VVerified
Someone got into Quanum LSM, the Quest Diagnostics platform clients use to place test orders and retrieve results, and certain patient records may have been accessed before the intrusion was discovered on October 21, 2026. The filing has no access point, no record count, and no data types. Operations carried on undisturbed, because the system that failed was never the lab. A portal built to hand every client its results is a single door into all of them.
Healthcare and Life Sciences
SEC 8-K, Item 8.01
Initial attack type not disclosed · Impact data theft inferred
Deposition Solutions, LLCSep 2019
breach at d/b/a Lexitas
Not yet quantified
VVerified
A web server misconfiguration left files in Lexitas's OnDemand application, also called DepositionNet, reachable without authentication from around September 2019 until a customer flagged it on May 29, 2026. The files were mostly deposition transcripts and exhibits, with personal details buried in testimony for roughly 14,361 people, by the letter's count. The logs are too thin to say who looked. For nearly seven years, the only monitoring that worked was a customer noticing something fishy.
Professional and Business Services
California AG breach notification
Initial attack type exposed or misconfigured system confirmed · Impact data theft inferred
BASS Medical GroupSep 2026
Not yet quantified
VVerified
BASS Medical Group caught suspicious activity in its network around September 4, 2026, and by September 22 had confirmed that treatment codes, billing records, and insurance details may have been accessed or acquired. The notice never says how the intruder got in, when access began, or how many patients are affected. A network that can date its alarm but not its intrusion had no clear view of its own front door.
Healthcare and Life Sciences
California AG breach notification
Initial attack type not disclosed · Impact data theft inferred
ConnectWiseOct 2026
Not yet quantified
AAttested
In mid-October 2026, attackers signed in as ConnectWise's Cloud Backup application identities with a vendor credential of unstated origin, and in two Microsoft 365 tenants, Huntress observed that the app granted itself Global Administrator. Microsoft attributes the campaign to Storm-0940 and puts the targets above 2,250 tenants; how many fell, and what data left those tenants, nobody has said. A backup tool held enough privilege to crown itself keeper of the gate, so one vendor credential became every customer's perimeter.
Technology and Software
Microsoft says ConnectWise breach let Chinese spies loose on 2,250 cloud tenants
Initial attack type compromised credentials confirmed · Actor Storm-0940
CapcomOct 2026
Not yet quantified
AAttested
An unauthorized party reached 11,774,247 CAPCOM ID records, the shared sign-in behind Capcom's web services, forums, and online multiplayer, and changed passwords on 196 accounts without their owners' consent. Email addresses, login histories, and last-login IP addresses were exposed; how the intruder got in, and for how long, goes unsaid. One identity system for everything made one failure domain for everything. No card data, Capcom stresses: only a ledger of who logs in, when, and from where.
Media and Entertainment
Capcom confirms data breach affecting 11.7 million accounts
Initial attack type not disclosed · Impact data theft confirmed
302.aiOct 2026
Not yet quantified
AAttested
AI aggregator 302.ai kept 22.72TB in a public Azure storage bucket with no encryption and no password. Inside sat 17.6 million files, including more than 144,000 chat logs holding prompts, AI replies, names, birth dates, postal addresses, and corporate documents. How long it stood open, and who else found it, goes unsaid. An aggregator sells one interface to every model, and that concentration made a single misconfigured bucket the copy of every conversation. Among the more interesting finds? Multiple chat logs from a customer support chatbot owned by a prominent sex doll manufacturer.
Technology and Software
Security breach at AI aggregator exposes over 18 million files, including some very embarrassing chat records
Initial attack type exposed or misconfigured system confirmed · Impact data theft inferred
Dorsata, Inc.Aug 2026
breach at Metabase
Not yet quantified
VVerified
Dorsata, a health IT vendor for women's health clinics, had its patient database reached between August 10 and 12, 2026 through a flaw in Metabase, the analytics software attached to its platform. Patient names are the only confirmed loss, though the letter's variable data field suggests more for some, and neither the count nor the actor has been named. The security surrounding that PHI turned out to be a reporting tool. Analytics got a direct line into the clinical record, and the protection never followed it there.
Healthcare and Life Sciences
California AG breach notification
Initial attack type software vulnerability confirmed · Impact data theft confirmed
State Bank of IndiaOct 2026
Not yet quantified
AAttested
Some 3,897 State Bank of India customer records sat inside a dark-web trove of about 375,000, a figure matching a BreachForums seller's claimed 375,000 rows and 2,722 PDFs. Names, birthdates, mobile numbers, addresses, CIF identifiers, and loan-lead metadata were exposed; the source and whether any SBI system was breached remain unknown. The bank learned of it from three outside alerts, which says a lot about what SBI couldn't see.
Financial Services
SBI data breach confirmed: Bank identifies 3,897 potentially exposed records during initial investigation, probe underway
Initial attack type not disclosed · Impact data theft confirmed
OnamaeOct 2026
Not yet quantified
AAttested
A hacker installed malware on more than 26,700 Onamae Desktop Cloud servers in a single incident, and Onamae shut every affected machine down within a day. The target, per Onamae, was credentials for trading and securities tools. The entry point goes unnamed. Twenty-six thousand servers falling at once points to a shared layer of control above them, one failure intersect dressed up as thousands of separate machines.
Technology and Software
Japan's Onamae Desktop Cloud hacked, up to 27,000 servers affected
Initial attack type software vulnerability inferred · Impact data theft inferred + operational outage
Toyo Tire Holdings of Americas Inc.Jan 2026
Not yet quantified
VVerified
Toyo Tire Holdings of Americas lost names and Social Security numbers, plus driver's license, financial account, health insurance, or medical details, to an unnamed intruder. The California filing lists January 6 and February 4, 2026; other accounts place the theft on April 6, and nobody has reconciled the calendar. The entry point and the number of people affected go unstated. A company that cannot pin down when its records left was not watching where they lived.
Retail and Consumer
California AG breach notification
Initial attack type not disclosed · Impact data theft confirmed
STS Aviation GroupAug 2025
Not yet quantified
VVerified
An unidentified intruder got into STS Aviation Group's systems around Aug. 5, 2025, and the company needed until Sept. 19, 2026, to learn what walked out: Social Security and passport numbers, payment cards, medical records, fingerprints, race identifiers, salaries, evaluations. The notice names no entry point and no total, only 319 Massachusetts residents so far. A fingerprint, medical records and passports are credentials that two years of credit monitoring can't fix.
Diversified or Holding Company
California AG breach notification
Initial attack type not disclosed · Impact data theft confirmed
Citizens BankSep 2026
Not yet quantified
VVerified
An unauthorized party reached a Citizens Bank system holding names, Social Security numbers, birthdates, phone numbers, and email addresses, an intrusion the bank identified on September 10, 2026. The notice names no entry point, no actor, and no count of customers affected, although independent reports suggest as many as 14,000 in Texas alone. Whatever door was used, one system held the complete kit for impersonating a customer, and that concentration was the design choice. No evidence of misuse so far dismisses the reality of faciliating social enginnering attacks in the future.
Financial Services
California AG breach notification
Initial attack type not disclosed · Impact data theft inferred
Alma Family ServicesJul 2026
Not yet quantified
VVerified
Alma Family Services, an East Los Angeles mental health provider, lost protected health and personal information for 2,753 people when a network server was hacked on July 9, 2026, according to the account published alongside its California filing. The filing page itself names no method, no data type, and no count, and no source says how the attacker reached that server. For a mental health provider, one server was the security framework.
Healthcare and Life Sciences
California AG breach notification
Initial attack type not disclosed · Impact data theft confirmed
NikkeiOct 2026
Not yet quantified
AAttested
Attackers logged into the cloud service Nikkei uses for system development on the morning of October 7 with previously compromised credentials; whose, and how they were lost, goes unsaid. Nikkei puts the haul at roughly 1.83 million records, 150,000 of them carrying names, addresses, phone numbers, and birthdates. A development environment was holding real people behind a single reusable key. And this is Nikkei's third substantial incident disclosed in the last month.
Media and Entertainment
Nikkei discloses third data breach in a month, 1.8M records exposed
Initial attack type compromised credentials confirmed · Impact data theft confirmed
Stitch Connect IncSep 2026
Not yet quantified
VVerified
Stitch Connect, a companionship community for adults over 50, lost names, birthdates, and unspecified medical information; the Texas filing counts 4,062 Texas residents and leaves the national total unstated. The filing gives no incident date, no discovery date, and no account of how anyone got in. A social platform for finding friends had quietly become a file of its members' health records. Nobody has said how that file was guarded or why a social network would even hold that information.
Technology and Software
California AG breach notification
Initial attack type not disclosed · Impact data theft confirmed
Napoleon PerdisOct 2026
Not yet quantified
AAttested
Napoleon Perdis lost names, birthdates, addresses, phone numbers, and purchase histories for roughly 339,055 customers through Retail Express, the vendor it paid to store them, where an unauthorized party had access from November 2025 to June 2026. Neither company has said how the intruder got in. Seven months of undetected access sat in a system the cosmetics brand did not run and could not watch. No card data was stored, the notice stresses. Only birthdates and home addresses, which no bank can reissue. The investigation into the incident was 40% faster than the time it took to discover the breach in the first place.
Retail and Consumer
Napoleon Perdis data breach affects 340,000 of the cosmetics company's clients
Initial attack type third-party or supply chain confirmed · Impact data theft confirmed
Inner City Education FoundationAug 2024
Not yet quantified
VVerified
An unauthorized actor sat inside Inner City Education Foundation's systems from August 4 to September 29, 2024, and may have copied files; the disclosure took two years to arrive. The filing never says how they got in, who they were, how many people are affected, or what data was taken. The assurance that no fraud has been seen comes from the organization that didn't see the intruder for eight weeks and didn't report the incident for 2 years. A bold claim for an organization that didn't see much of anything for 26 months.
Public Sector and Education
California AG breach notification
Initial attack type not disclosed · Impact data theft inferred
California Department of EducationMay 2026
Not yet quantified
VVerified
From May 22 to September 18, someone with one compromised login copied files from ETS, the testing contractor holding California's student data; nobody has said how the credential was lost. The department counts names, addresses, demographics, and disability status for all 7 million students from three school years. One login stood between a single vendor server and a state's children. No Social Security numbers, officials stress, as if disability status could be reissued.
Public Sector and Education
California AG breach notification
Initial attack type compromised credentials confirmed · Impact data theft confirmed
John G. Yphantides, a Professional Law CorporationOct 2026
Not yet quantified
VVerified
John G. Yphantides, a Professional Law Corporation, lost data to a confirmed theft, and the October 2026 attorney general filing omits the entry point, the window, the record count, and the type of data taken. Qilin listed the firm on its leak site and claims to have stolen internal data. A law firm is a concentration point for other people's secrets, and the filing never says what guarded those secrets and failed.
Professional and Business Services
California AG breach notification
Initial attack type not disclosed · Impact data theft confirmed + ransomware · Actor Qilin
Frazer LLPMar 2025
Not yet quantified
VVerified
Frazer LLP sits on the California Attorney General's breach list with nothing else attached: no entry point, no actor, no data type, no count, no window. The filing establishes that a breach happened and stops there, leaving the architecture that failed unnamed. A disclosure that checks the reporting box is not a disclosure at all.
Professional and Business Services
California AG breach notification
Initial attack type not disclosed · Impact data theft inferred
Covered CaliforniaMay 2026
Not yet quantified
VVerified
A May 13, 2026 phishing attack reached Covered California's internal spreadsheets of certified insurance agents: names, agency names, license numbers, roles, and Social Security numbers or FEINs. The filing names no count, no actor, and no account of whose credentials fell. It reached the California Attorney General roughly five months later. A registry of identity numbers kept as loose spreadsheets makes one phished login the entire security boundary.
Healthcare and Life Sciences
California AG breach notification
Initial attack type phishing or social engineering confirmed · Impact data theft inferred
BAE SystemsOct 2026
Not yet quantified
AAttested
A cybersecurity incident at BAE Systems knocked out the Bankruptcy Noticing Center it runs for the Federal Judiciary, halting bankruptcy notices for every federal bankruptcy court nationwide. The judiciary has not said what happened, when it began, or whether any data was accessed or taken. Every bankruptcy court in the country shared one failure domain, and it belonged to a contractor.
Technology and Software
BAE Systems cyberattack disrupts US federal court operations
Initial attack type not disclosed · Impact operational outage confirmed
Burger King JapanOct 2026
Not yet quantified
AAttested
An outside party spent October 2 to October 7, 2026 inside BK Japan's app member system, reaching about 11.18 million records: names, email addresses, and mobile order history. How they got in, and who they were, the source does not say. Every member in the app sat behind one store of identity, a single failure domain the size of the entire loyalty program. No card data, the company stresses. Just a record of what each person ordered, tied to a name and an inbox.
Retail and Consumer
Burger King Japan data breach exposes 11 million customer records
Initial attack type not disclosed · Impact data theft inferred
MLD Mortgage Inc. dba The Money StoreSep 2026
Not yet quantified
VVerified
An intruder entered The Money Store's network on September 8, 2026, through a remote monitoring and management platform used by a third-party service provider; unusual activity surfaced a day later. Storm, the ransomware group claiming the attack, posted the lender's name to its leak site within two weeks, and the filing gives no count of those affected. Inside sat whole loan files: Social Security numbers, account details, income, and credit histories. A vendor tool built to reach every machine did exactly that, for whoever held the controls.
Financial Services
California AG breach notification
Initial attack type third-party or supply chain confirmed · Impact ransomware inferred + data extortion · Actor Storm
City of Foster CityFeb 2026
Not yet quantified
VVerified
Ransomware sat inside Foster City's systems from February 28 to March 25, 2026, taking names, birthdates, and health insurance numbers, and for a smaller group Social Security, passport, and medical records. Staff noticed on March 19, and the intruder kept access for six more days. The source never says how they got in, who they were, or how many people were hit. Containment meant unplugging the whole city at once, and only 911 sat outside the blast radius.
Public Sector and Education
California AG breach notification
Initial attack type not disclosed · Impact ransomware confirmed + data theft
BDG Law GroupSep 2025
Not yet quantified
VVerified
An unauthorized actor left BDG Law Group's network carrying names, Social Security numbers, driver's license and passport numbers, and medical information, after a disruption the firm noticed on September 11, 2025. The notice is silent on the entry point, the number of people affected, and how long the access lasted. A law firm took thirteen months to deliver a public notice which is a story worth understanding, but that hasn't been disclosed.
Professional and Business Services
California AG breach notification
Initial attack type not disclosed · Impact data theft confirmed + operational outage
Porter and CompanyAug 2026
Not yet quantified
VVerified
Porter and Company had unencrypted personal information compromised around August 30, 2026, a date the filing leaves ambiguous between the breach itself and its discovery. The attorney general filing names no entry point, no actor, no record count, and no specific data types. The one architectural fact on the record is that the data sat unencrypted, readable by whoever reached it. Whatever the entry door was, nothing behind it was locked.
Professional and Business Services
California AG breach notification
Initial attack type not disclosed · Impact data theft confirmed
Magna Hospitality GroupMay 2025
Not yet quantified
VVerified
Magna Hospitality Group's network was breached on May 22, 2025, and its California filing says nothing about how, what data was taken, or how many people it touched. Qilin claimed the attack in October of 2025, saying it exfiltrated roughly 385 GB. The ransomware group published its account a full year before Magna's notice did. When the extortionist is the first to speak, both detection and disclosure run on the attacker's schedule.
Diversified or Holding Company
California AG breach notification
Initial attack type not disclosed · Impact ransomware inferred + data theft · Actor Qilin
American Board of Preventive MedicineMar 2026
Not yet quantified
VVerified
An unauthorized actor spent March 8 to 10, 2026 inside the American Board of Preventive Medicine's network and left with names and possibly health or medication data; the filing names no entry point and no count of victims. Reports link the Genesis ransomware group to the organization around May, a date the March window leaves unexplained. Three days of access took six and a half months of manual review to inventory, which says the network never knew what it was holding.
Healthcare and Life Sciences
California AG breach notification
Initial attack type not disclosed · Impact data theft confirmed + ransomware · Actor Genesis
JM Bullion, Inc.Apr 2026
Not yet quantified
VVerified
Someone held unauthorized access to JM Bullion's systems from April 12 to April 14, 2026, reaching names, Social Security numbers, driver's licenses, financial details, and payment card numbers. The filings name no entry point and no count, only affected residents in states like Massachusetts and Rhode Island. A bullion dealer kept each buyer's identity and means of payment together in one reachable place. The intrusion was caught in two days; the customers heard about it six months later. And JM Bullion knows the pain of breaches from experience, having suffered a Magecart skimming attack in 2020.
Professional and Business Services
California AG breach notification
Initial attack type not disclosed · Impact data theft confirmed
Phase EightOct 2026
Not yet quantified
AAttested
Phase Eight, Hobbs, and Whistles were hit together on October 11, when parent TFG London identified a cybersecurity incident in its IT systems. The source names no entry point, no actor, and no data accessed. Three brands running on one parent's infrastructure share one failure domain. Payment information, the company offers, is not believed to be at risk, which leaves every other record in those systems conspicuously unmentioned.
Retail and Consumer
Phase Eight, Hobbs and Whistles owner TFG London hit by cyber attack - just days after ASOS hack
Initial attack type not disclosed · Impact operational outage
MetaOct 2026
Not yet quantified
AAttested
One employee's stolen credentials let an outside group into some of Meta's GitHub repositories, where product code sat beside personal data on roughly 1,500 people, mostly US employees, that policy said should never have been there. Meta has not said what kinds of personal information were taken. Its spokesperson insists internal systems were not breached, a curious claim about a repository holding the company's code, its secrets, and its own staff's data.
Technology and Software
Meta Says Hackers Took Code, Personal Data of 1,500 in GitHub Breach
Initial attack type compromised credentials inferred
KT CorpOct 2026
Not yet quantified
AAttested
From October 2024 to September 2025, attackers ran a homemade femtocell on KT's network with a valid certificate taken from a lost KT unit, intercepting phone numbers, IMSI and IMEI numbers, and SMS authentication codes. PIPC counts 16,647 subscribers exposed and 368 hit with fraudulent micropayments. The core network's perimeter was a certificate that outlived the hardware it was issued to. BPFDoor had sat on 38 KT servers since March 2024, unreported, and now KT has been accused of intentionally deleting logs and under reporting damages to the Korean government.
Telecommunications
KT Corp Hid Three Cyberattacks, Deleted Logs, Lied to Customers: Lawmakers
Initial attack type compromised credentials confirmed · Impact data theft confirmed + financial theft or fraud
Photon HealthOct 2026
Not yet quantified
AAttested
A zero-day in Metabase, the self-hosted analytics tool Photon Health ran for business metrics and customer dashboards, exposed stored names, addresses, birth dates, phone numbers, and prescription details, potentially exfiltrated. Photon learned of it on August 21, 2026; when the intrusion began, and how many people it reached aren't shared. The Direwolf extortion group claims credit. The perimeter was a reporting tool that had silently become a copy of the prescription record.
Healthcare and Life Sciences
Photon Health; Healthcare Highways Announce Data Security Incidents
Initial attack type software vulnerability inferred · Actor Dire Wolf
Mercadien, P.C. CPAsOct 2026
Not yet quantified
VVerified
Between September and November 2025, intruders reached Mercadien's network and the Box.com storage where the auditor kept bank and credit union customers' Social Security numbers, ID numbers, account details, passwords, and IRS PINs, over 400,000 people's worth by the source's count. The source does not say how they got in. The banks' own networks were never touched; their auditors' file share had quietly become their perimeter. Orrstown Bank waited over six months to be told. At least 7 other financial institutions were impacted by this incident.
Financial Services
California AG breach notification
Initial attack type not disclosed · Impact data theft inferred
Daiichi KoshoOct 2026
breach at Nippon Columbia Group (NCG)
Not yet quantified
AAttested
Malware on a single employee's computer at Nippon Columbia Group, the contractor holding Daiichi Kosho's customer data, put more than 8.7 million records in reach: names, genders, birthdates, emails, and phone numbers for 8,631,000 customers and 93,000 employees. The notice does not say how the malware arrived or how long it sat there. Daiichi Kosho notes its own systems were not breached, which certainly must sound like tone deafness for all the victims.
Media and Entertainment
Karaoke Giant Reveals Data Breach Impacting Eight Million - Infosecurity Magazine
Initial attack type third-party or supply chain inferred · Impact data theft inferred
IntermarchéOct 2026
Not yet quantified
AAttested
Attackers remotely seized refrigeration controllers running older Danfoss software at several French supermarket chains on a Sunday night, then warmed the cases by triggering the built-in defrost cycle. French outlets put it at 250 to 350 stores; Intermarché blames a reported compromise of a service provider managing its in-store refrigeration. Nobody has said how they got in or who they were. The sabotage itself was just a defrost feature, working exactly as designed for whoever held the remote controls.
Retail and Consumer
French supermarkets suffer refrigerator shutdown after 'unprecedented' cyberattack
Initial attack type third-party or supply chain inferred · Impact operational outage confirmed
Ahold DelhaizeOct 2026
Not yet quantified
AAttested
Ahold Delhaize pulled systems offline on October 12, 2026, over a security issue inside its network, taking down the websites of all five US banners plus Albert Heijn, Etos, and Gall & Gall. No entry point, actor, data, or restoration timeline was given. Eight brands on two continents went dark at once: on the network, they were only ever one company. Whether in-store operations were affected also went unsaid.
Retail and Consumer
Retail giant Ahold Delhaize takes systems offline after cyberattack
Initial attack type not disclosed · Impact operational outage confirmed
Blueberry PediatricsAug 2026
Not yet quantified
VVerified
A criminal used a Metabase flaw to copy pediatric records out of Blueberry Pediatrics' analytics platform, found August 22, 2026: names, birthdates, insurance numbers, medical records, billing codes, for a count nobody has determined. Between August 9 and 12, a different attacker reached Photon, its prescription vendor, through the same flaw. A business intelligence tool held the whole chart, and the shared software made the two vendors one failure domain. No Social Security or card numbers, the notice stresses; only a child's medical history, which cannot be reissued.
Healthcare and Life Sciences
California AG breach notification
Initial attack type software vulnerability inferred
Oracle HealthOct 2026
Not yet quantified
AAttested
Patient records sat on legacy Cerner servers that Oracle Health inherited with its $28.3 billion acquisition, and a 2025 hack reached names, Social Security numbers, diagnoses, medicines, test results, and images. The Texas attorney general's figure puts the toll near 20 million people, while the federal tally still shows a placeholder of 501 as reported to HHR by Oracle in June 2025. One server, one account, one password = 20 million records lost. Built wrong, defined.
Healthcare and Life Sciences
Oracle Health's Cerner EHR Breach Figure Soars to 20 Million
Initial attack type compromised credentials inferred · Impact data theft confirmed
ASOSOct 2026
Not yet quantified
AAttested
Thousands of ASOS customers heard about the intrusion from the intruders themselves, through an unauthorized push notification sent over the third-party platforms ASOS uses to reach them. A group calling itself the Xuanye Group claims a full compromise of a Snowflake instance; ASOS says names and contact details may have been accessed and has not said how anyone got in. The messaging platform was a public disclosure mechanism that beat ASOS's own communications by hours.
Retail and Consumer
ASOS Confirms Cyberattack, Data Breach
Initial attack type third-party or supply chain inferred · Impact data theft confirmed · Actor Xuanye Group
Harman FitnessSep 2025
Not yet quantified
VVerified
Someone got into Harman Fitness's network on September 4, 2025, and the former Crunch Fitness franchise operator reached the California Attorney General thirteen months later. The filing never says how; reports put the toll at 4,714 people and list identifiers, financial data, and health information. NETRUNNER claimed a compromise in April 2026, a link nobody has confirmed. Thirteen months of silence leaves a lot of questions for an organization that sold it's franchises to another company earlier this year.
Retail and Consumer
California AG breach notification
Initial attack type not disclosed · Impact data theft confirmed · Actor NETRUNNER
Advantest America, Inc.Jan 2026
Not yet quantified
VVerified
Ransomware reached multiple portions of Advantest's IT network, traced after the Tokyo test-equipment maker spotted unusual activity on February 15, 2026. The source names no entry point, no group, no count, and cannot yet say whether customer or employee data was touched. Encryption landing across several parts of a network measures how far one intrusion was allowed to travel. Nobody has said how they got in, which is its own answer about what was being watched.
Manufacturing
California AG breach notification
Initial attack type not disclosed · Impact ransomware confirmed
Central Person RegisterOct 2026
Not yet quantified
AAttested
Someone spent September running automated searches through Denmark's Central Person Register on an unnamed domestic company's legitimate access, harvesting names, addresses, and CPR numbers for roughly 8.8 million people. Nobody has said how that access was obtained or who used it. The register's real perimeter was every outside company that was allowed to login, and one of them was allowed to query an entire nation at machine speed. A national identifier is the one credential a country cannot reissue.
Public Sector and Education
Major Denmark breach exposes personal data of 8.8 million people
Initial attack type third-party or supply chain inferred · Impact data theft confirmed
Osaka Metropolitan UniversityOct 2026
Not yet quantified
AAttested
A suspected ransomware attack stopped about 500 servers at Osaka Metropolitan University at once beginning October 2, taking down coursework systems, email, and digital student IDs and canceling classes through October 8. The entry point, the attacker, any ransom demand, and whether at least 130,000 personal records left all remain unstated. Five hundred servers failing together is one failure domain. Much of the backup data was encrypted too: the recovery plan lived inside the blast radius.
Public Sector and Education
Cyberattack on Osaka University Shuts Down 500 Servers
Initial attack type not disclosed · Impact operational outage confirmed + ransomware
WindRose Health NetworkOct 2026
Not yet quantified
AAttested
A previously undisclosed flaw in an unnamed vendor's remote access tool let an unidentified intruder into part of WindRose Health Network's systems on August 3 and 4, 2026. Names, patient IDs, insurance details, and dates of service for 33,158 patients were potentially copied from ordinary files on that network. The tool could not open medical records, and it did not need to: the patient data was already sitting in files a vendor's door led straight to.
Healthcare and Life Sciences
WindRose Health Network Discloses Data Breach Affecting 33K Individuals
Initial attack type software vulnerability confirmed · Impact data theft inferred
Georgia PowerOct 2026
Not yet quantified
AAttested
Someone got into Georgia Power's online customer portal and reached names, addresses, phone numbers, emails, and the last four digits of Social Security numbers across about 400,000 Southern Company accounts, roughly 300,000 of them Georgia Power's. The source never says how they got in or for how long. One customer portal fronted the parent company's accounts, making it the failure domain for all of them. Limited account information turns out to mean most of a starter kit for online impersonation.
Energy and Utilities
Georgia Power cyberattack exposed 400,000 customer accounts - WSB-TV Channel 2
Initial attack type not disclosed · Impact data theft confirmed
Beyond GravityOct 2026
Not yet quantified
AAttested
Beyond Gravity, the Swiss state-owned aerospace supplier spun off from Ruag, spotted malicious activity in its IT environment on August 12, 2026, and went public weeks later. The entry point, the systems reached, and whatever data left are all absent from the statement. The report suggests a highly professional actor instead, a portrait of the adversary with the security architecture that admitted them cropped out of the picture.
Transportation and Logistics
Swiss space firm Beyond Gravity target of cyberattack
Initial attack type not disclosed · Impact operational outage inferred
Fragomen, Del Rey, Bernsen & Loewy, LLPMay 2026
Not yet quantified
VVerified
A social engineering campaign gave an outsider remote access to a single Fragomen user account, caught May 5, 2026, and a subset of files left a firm whose business is immigration and identity records. How many people are in those files goes unsaid, exactly as it did in 2020, when Google employees' immigration data was the target at the same law firm. One persuaded employee was the entire boundary. Five months of review, and still no number of victims, not identification of a method and now real disclosure except a notice.
Professional and Business Services
California AG breach notification
Initial attack type phishing or social engineering confirmed · Impact data theft confirmed
Technical University of DenmarkOct 2026
Not yet quantified
AAttested
Attackers reached the Technical University of Denmark's system for managing identities and access rights and retrieved a large amount of data, touching as many as 200,000 current and former users by DTU's own upper estimate. The entry point, the actor, and exactly what left remain unstated, and DTU cannot yet say either. When identity falls, every boundary it is associated to falls with it.
Public Sector and Education
Hacker attack at DTU could affect up to 200,000 people
Initial attack type compromised credentials inferred · Impact data theft confirmed
AngMar ManagementOct 2026
Not yet quantified
AAttested
AngMar Management Services, a Texas hospice manager, lost patient files around July 18, 2026, in what appears to be Interlock ransomware; the group claims 710 GB. The Texas Attorney General filing counts 35,916 Texans, while the full total and the entry point remain unsaid. A back-office system holding Social Security numbers, diagnoses, and medical histories in one place became the breachable perimeter of patient care. None of the stolen data can be reissued, but at least free credit reporting got offered. Again.
Healthcare and Life Sciences
Texas Hospice Management Company Data Breach Affects 35,000 Texas Residents
Initial attack type not disclosed · Impact data theft confirmed + ransomware · Actor Interlock
Frontline EducationOct 2026
Not yet quantified
AAttested
Attackers walked into Frontline Education through a flaw in third-party software it has never named, leaving with school district staff records, Social Security numbers included. How many employees, and over what time period, Frontline has not said. Districts across the country handed their HR files to one platform, and that platform was run by a supplier nobody no one will identify.
Public Sector and Education
Frontline Education breach exposes school district employee data
Initial attack type software vulnerability confirmed · Impact data theft confirmed
Aldrich Services LLPAug 2026
Not yet quantified
VVerified
Aldrich Services LLP was breached on August 22 and 23, 2026, and the California filing stops there: no entry point, no data types, no count of people affected. The sample letter carries the title "Notice of Data Event," a phrase built to sound like a casual report on the weather.
Professional and Business Services
California AG breach notification
Initial attack type not disclosed · Impact data theft inferred
Lincoln Property Company Commercial LLCMar 2026
Not yet quantified
VVerified
Lincoln Property Company lost roughly 800 gigabytes of contracts, audits, and employee records to a ransomware attack that INC Ransom claims began April 1, 2026, six days before discovery on April 7. The exposed data potentially includes employee Social Security numbers and financial account details. The entry point appears only as a class-action lawsuit's allegation of spear-phishing. Adding insult to injury, Lincoln Property Company didn't bother to change the file name on their California AG disclosure, where it is clearly titled "Notification Letter - Template.pdf". Lose 800 gigabytes of data, go through the motion of disclosure without even trying.
Real Estate and Construction
California AG breach notification
Initial attack type phishing or social engineering inferred · Impact ransomware confirmed + data theft · Actor INC Ransom
Shinhan BankOct 2026
Not yet quantified
AAttested
Shinhan Bank's "M Shinhan" loan-inquiry site let an outsider bypass authentication and exploit a code flaw on September 29 and 30, 2026, exposing names, phone numbers, incomes, and loan limits for about 25,000 customers, including 66 resident registration numbers and 97 CI records. The bank calls it an AI-driven brute-force attack, its own characterization. A public loan-inquiry page was serving as the authentication boundary for sensitive financial data, scripted guessing isn't brute-force or sophisticated. It's jiggling door handles to see if any of them are unlocked.
Financial Services
South Korean bank hit by data breach affecting thousands of customers
Initial attack type software vulnerability confirmed · Impact data theft confirmed
Housing and Redevelopment Authority (HRA) of Clay CountyOct 2026
Not yet quantified
AAttested
L&Q's website was hit by a targeted cyber-attack in late September 2026, and the autoreply system tied to its webforms handed over the emails and messages of roughly 12,000 residents. The company calls its 'wider operating systems,' holding financial and tenancy data, secure, as if the contact channel residents actually use wasn't part of the perimeter too. No named attacker, no stated entry point beyond the webform pipeline itself. A front door was left open while the filing cabinets got all the locks.
Real Estate and Construction
Housing association hit by cyber attack affecting 12,000
Initial attack type exposed or misconfigured system inferred · Impact data theft confirmed
DriveWealthSep 2026
Not yet quantified
VVerified
DriveWealth's network was entered between September 4 and 5, 2026 via a social engineering campaign aimed at an unidentified third-party service provider. As the Brokerage-as-a-Service layer underneath Revolut, Stake, and Hatch, one vendor's failure became three brands' breach notice, spilling names, employment data, citizenship, and tax and portfolio data across five countries. Passwords and card numbers were left untouched; too bad the records of who these customers were not.
Financial Services
California AG breach notification
Initial attack type third-party or supply chain confirmed · Impact data theft confirmed
American Family Connect Insurance CompanyJun 2026
Not yet quantified
VVerified
Something reached American Family Connect Insurance Company twice, on June 30 and again on August 20, 2026, by the dates in its California filing. The listing names no entry point, no data type, and no count of people affected. Two breach dates seven weeks apart point to a failure domain nobody had noticed, or closed in between.
Insurance
California AG breach notification
Initial attack type software vulnerability inferred · Impact data theft inferred
ProCampsMar 2026
Not yet quantified
VVerified
ProCamps was breached on March 17, 2026, according to its filing, and the notice reached California's Attorney General six and a half months later. The filing names no entry point, no head count, and no data type. Its letter template carries the ProHoldings name, a hint that the failure domain may span more than one brand. Nobody has said what was taken from a business built on camp registrations, which is its own answer about what was being watched.
Professional and Business Services
California AG breach notification
Initial attack type not disclosed · Impact data theft inferred
Department of Customer Services, Open Data and Small and Family BusinessSep 2026
Not yet quantified
AAttested
Queensland's Department of Customer Services, the agency that writes the state's cyber security strategy, lost $809,000 in public money in July 2025 when attackers broke into a third-party telecommunications provider's systems. The department calls this blocked because the cash never reached the attackers, not because the intrusion failed. No government data was reported taken, and the source never names how the vendor's systems were entered. The state's cyber security authority couldn't keep its own payment path safe through a vendor's security perimeter.
Public Sector and Education
Queensland government's cyber security department hit by $800k cyber attack
Initial attack type third-party or supply chain inferred
ATNSSep 2026
Not yet quantified
AAttested
Ransomware-linked malware surfaced inside the operational technology network feeding weather data to ATNS, the South African operator covering roughly a tenth of the world's airspace. ATNS believes its own team stopped the attack, yet its forensics RFQ still chases a second, possibly insider, theft of data and exfiltration to addresses in China, with no stated start date for the intrusion.
Transportation and Logistics
South Africa Seeks Help After Cyberattack Targets Air Traffic Control
Initial attack type not disclosed · Impact ransomware confirmed + data theft
Bee Cheng HiangSep 2026
Not yet quantified
AAttested
Bee Cheng Hiang's marketing team prompted an AI tool to write the code for a mass email in April 2025, and the resulting script left all 95,364 recipients' addresses visible to each other. The only test run checked delivery logs, not the actual email that went out. PDPC calls this Singapore's first AI-related breach, but the tool did exactly what it was told. The missing control was a human reading the output before it shipped.
Retail and Consumer
Nearly 100,000 Bee Cheng Hiang customers' email addresses exposed in first AI-related data breach in Singapore
Initial attack type insider inferred · Impact data theft confirmed
JimsSep 2026
Not yet quantified
AAttested
Colruyt Group's Jims chain lost the data of roughly 150,000 members when an unauthorized person reached the membership management system running behind 31 of its 85 Belgian locations. The notice never names the entry point, only that one shared system sat under a third of the chain, and all of it fell together. No passwords or health data were taken, the company notes, but IBAN numbers were. A password resets. A bank account number does not.
Retail and Consumer
Data breach at Jims underestimated: 150,000 members affected
Initial attack type software vulnerability inferred · Impact data theft confirmed
Challenge Financial Services, Inc.Aug 2026
Not yet quantified
VVerified
An unauthorized party sat inside Challenge Financial Services' environment for two days in August 2026 before anyone noticed; the filing never says how they got in. Thirteen days passed between that access and discovery, and in that space is where names, Social Security numbers, addresses, and birth dates left the building. Settra, the ransomware group claiming the haul, is also the only source describing what was taken. A breach notice that leans on the extortionist's own numbers isn't disclosure, it's a company reading its intruder's ransom payment timing demand back to its customers.
Financial Services
California AG breach notification
Initial attack type not disclosed · Impact data theft confirmed + ransomware · Actor Settra
City of McMinnvilleJun 2026
Not yet quantified
VVerified
Unauthorized access touched McMinnville's network from June 1 to July 18, 2026, and the city sat on that for ten weeks before notifying residents on September 29. The ransomware group RansomHouse claims the stolen files; the city's notice covers only the legal minimum. An independent review by a local resident with a cybersecurity background of the leak found tax returns, bank records, HR files, police investigative material, and medical data in the same haul, and pointed to a leaky city website as the source. This incident looks messy with a different viewpoint offered by the ransomware gang, the city's disclosures and a lone citizen willing to investigate.
Public Sector and Education
California AG breach notification
Initial attack type exposed or misconfigured system inferred · Impact ransomware inferred + data theft · Actor RansomHouse
Poppins Payroll CompanySep 2026
Not yet quantified
VVerified
Poppins Payroll lost household employers' and employees' records through a flaw in Metabase, the analytics software it uses, from September 2 to 3, 2026. The California notice names no data elements and no count; an accompanying summary lists Social Security numbers, birth dates, wage records, and banking data for thousands across several states. A dashboard tool sat close enough to payroll to read all of it. The reporting layer became the perimeter, and nobody guarded it as one.
Professional and Business Services
Washington AG breach notification
Initial attack type software vulnerability confirmed · Impact data theft confirmed
Fideuram Intesa Sanpaolo Private BankingSep 2026
Not yet quantified
AAttested
Italy's largest bank moved nearly €100 million on the strength of an AI-generated message, and the headline is the only filing on record. No named actor, no description of the channel, no account of which control point signed off on the transfer: the reporting is silent on all of it. What is legible is the architecture: a voice or message was treated as sufficient authorization, with no second boundary built to catch a convincing fake.
Financial Services
Italy's top bank hit by an AI messaging scam which cost it nearly €100 million
Initial attack type phishing or social engineering inferred · Impact financial theft or fraud confirmed
Japanese Railway OperatorsSep 2026
Not yet quantified
AAttested
Keio's hospitality arm went down to ransomware in the early hours of September 26, 2026, dragging payment systems with it while train operations kept running. No group has claimed it, no entry point has been named, and Keio itself says it is still investigating whether customer or partner data went out the door. A railway and a hotel chain shared enough infrastructure that one attack could reach both; the operator built one network for two businesses and called the surviving half a success. Segmentation that actually separates a hotel's payment system from a group's core servers is not optional.
Transportation and Logistics
Japanese Railway Operators Hit with Weekend Cyber Attacks - Infosecurity Magazine
Initial attack type not disclosed · Impact ransomware confirmed
Dodo PizzaSep 2026
Not yet quantified
AAttested
Dodo Pizza says attackers got into its systems and pulled names, addresses, emails, phone numbers, birth dates, and order histories; no payment data, because the company never stored any. DataSuckers claims 68 million records spanning 15 years and 28 countries, a number Dodo has neither confirmed nor broken down. Fifteen years of order history in one reachable database is not a storage choice, it is a single failure domain sized to a 26 nation footprint. The company will not say how many customers were actually hit.
Retail and Consumer
Russian pizza restaurant chain confirms cyberattack: Hackers claim 68 million users exposed
Initial attack type software vulnerability inferred · Impact data theft confirmed · Actor DataSuckers
SimbaSep 2026
Not yet quantified
AAttested
SIMBA confirmed 23,549 customer registrations exposed: names, identity card numbers, dates of birth, mobile numbers, emails. The statement names no entry point and no actor.. No credit card or bank data taken, they say, as if identity card numbers and birthdates were the lesser property. A number can be reissued; a national identity record cannot.
Telecommunications
Simba data breach exposes personal details of 23,500 customers
Initial attack type not disclosed · Impact data theft confirmed
Times CarSep 2026
Not yet quantified
AAttested
Times Car confirms 6.6 million user accounts caught up in a breach, and the headline stops there: no named attack vector, no actor, no accounting of what those accounts actually held. 6.6 million records is not an incident, it's a concentrated risk with an easy to grab handle.
Retail and Consumer
Times Car confirms data breach affecting 6.6 million user accounts
Initial attack type not disclosed · Impact data theft inferred
MedImpact PBMSep 2026
Not yet quantified
AAttested
MedImpact detected intrusion on October 18, 2025, then took nine months to finish investigating what Qilin claims was 160 gigabytes taken, part of it from Elixir Solutions, the PBM MedImpact acquired from RiteAid. Prescription and treatment data, subscriber numbers, and in limited cases Social Security numbers moved through a vendor pipeline no employer could see into. HIPAA sets a sixty day notification clock. MedImpact ran nine months past it before mailing a single letter.
Healthcare and Life Sciences
MedImpact PBM breach leaves employer plan members' health data exposed
Initial attack type not disclosed · Impact data theft inferred · Actor Qilin
United States Department of DefenseSep 2026
Not yet quantified
AAttested
Unauthorized users reached the Defense Manpower Data Center's personnel database in October, and the Pentagon did not notice until July, nine months later. The records sat unencrypted, so the breach was never a matter of cracking anything; it was a matter of opening a file cabinet nobody had bothered to lock. The notice cites no financial loss, but Social Security numbers belonging to up to four million service members, per Military Times, cannot be reissued like a card number. Nobody has named the entry point or the perpetrator, which says less about the attacker than about what the Pentagon was watching.
Public Sector and Education
'Potential goldmine': Pentagon breach alarms experts as troops' personal data exposed
Initial attack type third-party or supply chain inferred
Arizona Supreme CourtSep 2026
Not yet quantified
AAttested
Arizona's court system was breached by, in the court's own telling, "hackers or automated bots," a phrasing that concedes nobody has actually identified what got in. Court IT caught the intrusion and cut it off; the Chief Justice called in a response team and the FBI afterward. Officials have not said how many Arizonans were affected or what data was taken, financial, medical, or otherwise.
Public Sector and Education
Cyberattack on Arizona court system may have exposed personal data, officials say
Initial attack type phishing or social engineering inferred · Impact data theft inferred
Financial Administrative Support ServicesMay 2025
Not yet quantified
VVerified
An unknown actor sat inside Financial Administrative Support Services' network before March 26, 2025, undetected, then came back between June 8 and June 11 and copied data out. FASS is a back-office accounting vendor for nonprofits, the kind of quiet chokepoint that holds financial and administrative records for clients who never chose it directly. The notice names no entry point and no data type beyond "your information," which is its own kind of disclosure. A three-month-old intrusion only surfaced because a second one forced someone to finally look.
Professional and Business Services
California AG breach notification
Initial attack type not disclosed · Impact data theft confirmed
OneMain Financial Group, LLCMay 2026
Not yet quantified
VVerified
Three years after New York regulators fined OneMain $4.25 million for cybersecurity failures that they said increased the company's vulnerability to unauthorized access to customer information, OneMain has disclosed that an unauthorized actor gained access to its systems and acquired personal information belonging to 122,783 people, including Social Security numbers. The company has not disclosed how the attacker got in, leaving unresolved whether the breach involved the same access-management or application-security control areas at the center of the 2023 enforcement action. No SEC disclosure was filed for this event, no mention of it in the latest 10Q and while an investigation hasn't tied this incident to any prior cybersecurity deficiencies, 4.25 mm reasons with no statement by NYDFS that the deficiences were closed sure makes you go hmmmm.
Financial Services
California AG breach notification
Initial attack type exposed or misconfigured system inferred · Impact data theft confirmed
Wales Dyfed-Powys PoliceSep 2026
Not yet quantified
AAttested
Dyfed-Powys Police disclosed on September 25, 2026 a cyberattack first identified earlier that month, one that disrupted non-emergency systems and may have exposed staff information. The force names no entry point, no actor, and no specific data field, only that public records were spared and staff records were not. A police force can wall off the systems the public sees and still leave the systems that hold its own people open. The silence on how it happened is not transparency; it is the extent of what the investigation has figured out so far.
Public Sector and Education
Welsh police force cyberattack sparks investigation into staff information
Initial attack type not disclosed · Impact operational outage confirmed + data theft
BitgetSep 2026
Not yet quantified
AAttested
Bitget's authorization-signing process moved $351.6 million across 19 transfers without a private key ever being touched, because attackers spoofed the transfer data the system trusted rather than the keys meant to guard it. Cold wallets held; hot and warm wallets, the parts kept online, were the entire failure domain. Bitget names North Korean IP patterns as a suspect, but the intrusion method itself remains unstated. The signing process checked the message, not the sender.
Financial Services
Bitget hit by $351.6 million crypto hack in one of year's biggest heists
Initial attack type software vulnerability inferred · Impact financial theft or fraud confirmed · Actor North Korean hacking group
MedImpact Healthcare SystemsSep 2026
Not yet quantified
AAttested
MedImpact identified unauthorized activity in its network in October 2025, and the Qilin ransomware group claims it exfiltrated the data before listing MedImpact on its leak site. The entry point is never named. As a pharmacy benefit manager, MedImpact sits beneath unnamed health plans, employers, and government clients, holding each member's prescriptions, treatment records, and Social Security numbers in one system. Nobody has said how Qilin got in, which is its own answer about what wasn't being watched.
Healthcare and Life Sciences
Data Breaches Announced by MedImpact Healthcare Systems; Rosch Visionary Systems
Initial attack type not disclosed · Impact ransomware inferred + data theft · Actor Qilin
StakeSep 2026
Not yet quantified
AAttested
Stake's customers were exposed not through Stake's systems but through DriveWealth, the US vendor running its trading and wallet services, after a social-engineering campaign DriveWealth says it has since contained. Names, emails, phone numbers, postal addresses, tax status, and tax country moved; trading accounts, portfolios, tax file numbers, and bank details reportedly did not. Stake outsourced the plumbing of its US operation and inherited DriveWealth's exposure along with it. Nobody says who was talked into what; the notice just confirms that someone was.
Financial Services
Stake data breach exposes customer details after hack at partner DriveWealth
Initial attack type phishing or social engineering confirmed · Impact data theft confirmed
HILTJul 2026
Not yet quantified
VVerified
HILT filed a breach notice with the California Attorney General in July 2026, but the filing names no vector, no actor, no data type, and no count. A securitization trust exists to specify exactly what it holds; this filing cannot specify what was taken. The deadline was met before the incident was explained, and the record stops there.
Financial Services
California AG breach notification
Initial attack type not disclosed · Impact data theft inferred
NSE Insurance AgenciesNov 2025
Not yet quantified
VVerified
NSE Insurance Agencies filed a breach notice with the California Attorney General for an incident dated November 6, 2025, and stopped there. No other data provided: the filing names a date and nothing else. Disclosure isn't clarity; it is checking the box.
Insurance
California AG breach notification
Initial attack type not disclosed · Impact data theft
Blanchard Training & Development, Inc.Mar 2026
Not yet quantified
VVerified
Blanchard Training & Development's California filing gives two dates, March 3 and 4, 2026, and nothing else: no vector, no data type, no count. A ransomware group calling itself PayoutsKing claims credit and threatened to leak the data, but a claim of responsibility is not a description of harm. The regulatory record here is a blank form with a date stamped on it. The pathway of the incident and whether the ransom was paid or rejected, who knows?
Professional and Business Services
California AG breach notification
Initial attack type not disclosed · Impact ransomware inferred + data extortion · Actor PayoutsKing
Peña and BrombergMay 2026
Not yet quantified
VVerified
Peña & Bromberg's network was hit by ransomware detected on May 7, 2026, claimed by a group calling itself genesis. The firm's filing to the California Attorney General, four months later, still does not say how the attacker got in or how many records went out.
Professional and Business Services
California AG breach notification
Initial attack type not disclosed · Impact ransomware confirmed · Actor genesis
5Star Life Insurance CompanyNov 2025
Not yet quantified
VVerified
5Star Life Insurance filed notice of a November 13, 2025 incident, naming no attack vector and no actor, only that names, Social Security numbers, and insurance records may have been exposed. The company underwrites coverage for the Armed Forces Benefit Association, so this is a military-family exposure in every record. Ten months passed before that admission reached the public. A filing this thin isn't disclosure; it's a placeholder.
Insurance
California AG breach notification
Initial attack type not disclosed · Impact data theft inferred
NFMSep 2026
Not yet quantified
AAttested
Interlock claims to have pulled more than 2.5 terabytes of files from NFM Lending's systems on or around September 7, 2026, among them customer Social Security numbers and financial account information. NFM has confirmed no entry point, no actor, and no count of affected customers; a proposed class action filed September 16 says the company still hadn't notified anyone. The scope of this breach is being written by a ransomware gang's leak-site post, and the disclosure is being forced by a litigation action.
Financial Services
Ransomware gang claims big hack at NFM Lending
Initial attack type not disclosed · Impact data theft inferred + data extortion · Actor Interlock
Astrana Health, Inc.Sep 2026
Not yet quantified
VVerified
Astrana Health Management detected threat actors impersonating its own staff and spoofing the company's main corporate phone number to talk employees into handing over access sometime in September 2026. The company confirms private and confidential data was accessed, but will not yet say what kind, how much, or whose. The security boundary here was a familiar voice and a familiar caller ID, not any technical control. A phone number is not authentication, and Astrana built its access controls on the assumption that it was.
Professional and Business Services
SEC 8-K, Item 1.05
Initial attack type phishing or social engineering confirmed · Impact data theft confirmed
Fairwinds Credit UnionSep 2025
breach at Mercadien
Not yet quantified
VVerified
Fairwinds sent member data to Mercadien, the outside firm hired to satisfy a regulatory quality-control check, and that data sat exposed on Mercadien's systems from September 7 to November 7, 2025. The credit union's own network was never touched; the compliance requirement simply relocated the sensitive information to a vendor with its own, unaudited security posture. Mercadien did not tell Fairwinds which members were affected until August 13, 2026, nine months after it coughed up its own customers' data. The filing shows how little visibility Fairwinds had into a trusted vendor system holding its members' information
Financial Services
California AG breach notification
Initial attack type third-party or supply chain inferred · Impact data theft inferred
Manage My HealthSep 2026
Not yet quantified
AAttested
Manage My Health's patient portal leaked 403,730 Health New Zealand documents and 22,609 patient files in December 2025, reaching almost 100,000 people, mostly in Northland. The Privacy Commissioner of New Zealand stated that Manage My Health and Health New Zealand “failed in their responsibilities”. The penalty? Nearly 5 months later, the commissioner declared that both organizations have until August 2027 to fix their security weaknesses. Yep, one whole year.
Healthcare and Life Sciences
Privacy Commissioner puts Manage My Health, Health NZ on notice after data breach
Initial attack type not disclosed · Impact data theft confirmed
AsusSep 2026
Not yet quantified
AAttested
Asus's eShop platform was accessed by an unnamed party, exposing customer contact details and order records; the notice names no vector, no actor, no count. No payment or bank data was taken, Asus stresses, but a name and an order history are plenty for the phishing campaign Asus itself now warns is coming. The storefront shifted from a customer service interface to a future crime facilitator in the blink of an eye.
Technology and Software
Asus warns customers of eshop data breach
Initial attack type not disclosed · Impact data theft confirmed
Modoc Medical CenterJan 2026
Not yet quantified
VVerified
Modoc Medical Center's filing to the California Attorney General names a window, January 19 to January 27, 2026, and nothing else. No explanation, just an eight-day gap when data was available to the bad guys. A notice this thin isn't disclosure, it is theater.
Healthcare and Life Sciences
California AG breach notification
Initial attack type not disclosed · Impact data theft inferred
BigCommerceSep 2026
Not yet quantified
AAttested
BigCommerce confirmed on September 17, 2026, that compromised credentials from Ribon and Ribon 1.5, third-party apps built by 'Be A Part Of,' a Fastr company, let attackers inject malicious scripts into merchant storefronts. One access key belonging to a single app vendor unlocked data across every store that had installed it, hundreds by Master of Malt's count, not the 'small number' BigCommerce named. The app marketplace was the real perimeter, and nobody was guarding it like one. What BigCommerce calls scope is really just how far one vendor's key happened to reach.
Retail and Consumer
BigCommerce warns customers of potential data leaks following cyber incident
Initial attack type third-party or supply chain confirmed · Impact data theft inferred
United UnderwritersApr 2026
Not yet quantified
VVerified
United Underwriters filed a breach notice with the California Attorney General for an incident on April 7, 2026, and stopped there. No vector, no actor, no data type, no count: the filing names a date and nothing else. A notice that discloses only its own existence isn't transparency; it's compliance theater.
Insurance
California AG breach notification
Initial attack type not disclosed · Impact data theft
Fun For Less Tours, Inc.Oct 2025
Not yet quantified
VVerified
ANUBIS claims to hold passport scans, personal identifiers, and internal files lifted from Fun For Less Tours, threatening publication within ten to eleven days of its December listing. The filing offers no confirmed entry point, no verified record count, and no proof beyond the extortion group's own countdown. Whatever door opened, it apparently led straight into a central reservation or document system where travelers' passports sat in one place, unsegmented from everything else.
Media and Entertainment
California AG breach notification
Initial attack type not disclosed · Impact data extortion confirmed + data theft · Actor ANUBIS
Ridgeway Pharmacy LtdJun 2026
Not yet quantified
VVerified
Ridgeway Pharmacy's website, built and run by a third-party vendor, was accessed by an unauthorized party before the company learned of it on August 21, 2026. The notice names no entry point beyond the vendor-built site and no data type beyond 'personal information.' Ridgeway's internal systems were untouched, but that's little comfort to patients who had their data taken. Stolen is stolen, and Ridgeway was the entrusted steward for that data, regardless of the system it sat in.
Healthcare and Life Sciences
California AG breach notification
Initial attack type third-party or supply chain inferred · Impact data theft confirmed
CrowdSecSep 2026
Not yet quantified
AAttested
CrowdSec's source code, roughly 300 repositories, 170 of them private, sat exposed after the May 2026 TanStack supply chain attack. Most likely culprit? A single compromised API key. That one key reached across the SaaS console, AWS operations, connectors, and automation scripts: one credential, one blast radius. CrowdSec states confidently that the source code can't be used to cause harm because it can't be used outside of its context. Not finding the leak of the source code for several months does make those reassurances seem a bit bold, given the circumstances.
Technology and Software
CrowdSec Confirms Source Code Stolen in Supply Chain Attack
Initial attack type third-party or supply chain confirmed · Impact data theft confirmed
United Language GroupSep 2026
Not yet quantified
AAttested
United Language Group's network was accessed by unauthorized outsiders for two days in July 2025, exposing claims and billing data that UnitedHealthcare and UnitedHealthcare Global had handed to it to translate: names, Social Security numbers, diagnoses, prescriptions, passports, driver's licenses, and financial account numbers, across 4,649 people. The notice names no entry point and no attacker; only the window forensics could confirm. A translation vendor became the de facto custodian of a health insurer's most sensitive records. Nobody built a perimeter around that arrangement.
Healthcare and Life Sciences
Data Breach at Translation Vendor Affects UnitedHealthcare Plan Members
Initial attack type not disclosed · Impact data theft confirmed
CartrackSep 2026
Not yet quantified
AAttested
Cartrack's ransomware incident in August 2026 reached the one database that mattered most: contact details, bank account information, and vehicle tracking data, all sitting together. Dire Wolf claims 500 gigabytes left the servers; the company has not said how the door was opened. A vehicle tracking firm concentrated banking data and real-time location in a single, reachable store. The notification to South Africa's regulator is still preliminary, which is a polite way of saying nobody yet knows the size of what got out.
Retail and Consumer
Cartrack breach exposes customer data
Initial attack type not disclosed · Impact ransomware confirmed + data theft · Actor Dire Wolf
Boustead SingaporeSep 2026
Not yet quantified
AAttested
Boustead Singapore's overseas unit was hit by a cybersecurity incident, per a Singapore Exchange filing that withholds the business unit's name, the data touched, and the attacker's identity. Restoring systems from a backup proves availability but does nothing to minimize the damage potential of the already exfiltrated data. The promised independent review is itself an admission that nobody yet knows what's actually up.
Financial Services
Boustead Singapore overseas unit hit by cybersecurity incident
Initial attack type not disclosed · Impact data theft inferred + operational outage
LTFRBSep 2026
Not yet quantified
AAttested
In The Phillipines, the LTFRB pulled its entire LESS platform offline after confirming a breach it still cannot describe: no named entry point, no confirmed actor, no verified data type or record count, months after outside claims of 7.7 gigabytes and 16 million exposed rows. Personnel files, vehicle registrations, and franchise records all live inside one data environment, so when that environment failed, the whole agency went dark at once.
Public Sector and Education
LTFRB confirms data breach, takes records system offline
Initial attack type not disclosed · Impact data theft inferred + operational outage
Opportune LLPJun 2026
Not yet quantified
VVerified
Opportune LLP's attorney general filing states that a breach occurred and stops there: no vector, no record count, no data type, no incident date. The only detailed account comes from the bad guy. Chaos, the ransomware group that claims to hold the firm's entire internal data environment, is using it as leverage. A filing that outsources its own facts to the extortionist has already lost the room. The control point here was disclosure itself, and Opportune ceded it to the attacker's press release.
Energy and Utilities
California AG breach notification
Initial attack type not disclosed · Impact ransomware inferred + data extortion · Actor Chaos
Los Angeles City Attorney's OfficeDec 2025
Not yet quantified
VVerified
The Los Angeles City Attorney's Office lost 7.7 terabytes across 337,000 files, unredacted LAPD personnel records, Internal Affairs findings, witness names, health data, and criminal complaints, all pulled from a third-party discovery platform, not city or LAPD networks. WorldLeaks, an extortion group, claims responsibility, but the notice never says how it got in. Calling LAPD's systems untouched is beside the point: the vendor holding every unredacted case file was the real treasure trove, and nobody guarded it as one. The filing does not mention the massive scale or societal implications of this breach.
Public Sector and Education
California AG breach notification
Initial attack type third-party or supply chain confirmed · Impact data theft confirmed + data extortion · Actor WorldLeaks
CallonDoc, Inc.Dec 2025
Not yet quantified
VVerified
CallOnDoc's entire explanation to California regulators for over 1.1 million exposed patient records was one sentence: unauthorized access, discovered December 28, 2025. No attack vector named, no control point identified, just a date and a headcount. What leaked was not card numbers but diagnoses, prescriptions, and contact details, the full shape of a patient's medical life. A database of that size sitting reachable enough for a dark web seller called iProfessor to resell it is not a misfortune; it is a filing cabinet with no lock and no protections open for anyone who could get to it.
Healthcare and Life Sciences
California AG breach notification
Initial attack type not disclosed · Impact data theft confirmed · Actor iProfessor
Boston Capital Holdings LPJan 2026
Not yet quantified
VVerified
An intruder reached Boston Capital Holdings' files through its cloud services on or about January 16, 2026, and the firm only began reviewing a claim of unauthorized access on February 12. Personal information for about 16,000 people may have been taken, though no story or disclosure names the data, the service, or the flaw. LeakNet claims responsibility; neither the company nor regulators have confirmed it. The cloud was the perimeter, and nearly four weeks passed before anyone checked whether it was still holding. Boston Capital Holdings blamed "sophisticated attackers" not an architecture that allowed those attackers to go unnoticed for a month.
Financial Services
Washington AG breach notification
Initial attack type not disclosed · Impact data theft inferred · Actor LeakNet
GyazoSep 2026
Not yet quantified
AAttested
An unpatched flaw in Gyazo's own image upload server let an attacker run arbitrary commands and walk into the database behind it: 23.62 million accounts, their password hashes, and roughly 490 million image metadata records, most from links minted in 2019 or earlier. The upload server was never meant to be the database's front door, but nothing stood between the two to prevent it. The attacker also lifted the list marking which images were private, and Helpfeel cannot say those images went unseen. Calling an image link 'private' was a label, not an actual lock.
Technology and Software
Gyazo breach exposes 23.62 million user records and 490 million image records - PII and metadata exposed in huge attack
Initial attack type software vulnerability inferred
Premier Medical GroupSep 2026
Not yet quantified
AAttested
Premier Medical Group's notice never names an entry point: only that systems were disrupted in June, and files were pulled on June 14, exposing over 280,000 patients' names, diagnoses, medications, and insurance details. The attack vector is absent from the story, and that absence says everything about the brokenness of cybersecurity. PMG's fix is to have patients audit their own insurance statements for services they never received. Reviewing bills is not incident response; it's handing the actual victims a homework job and transferring the damage accountability to the very people PMG let down.
Healthcare and Life Sciences
280,000 Impacted by Premier Medical Group Data Breach
Initial attack type not disclosed · Impact data theft confirmed + operational outage
Leggett & Platt, Incorporated Employee Benefits PlanOct 2025
Not yet quantified
VVerified
Leggett & Platt's benefit plan data was exposed sometime in October 2025, filed with California regulators nearly a year later. As with almost all filings about data being stolen, no details are provided: only a courtesy notice that a breach happened and someone eventually wrote it down. A filing that omits its own mechanism is still an admission that no one was watching closely enough to describe it.
Professional and Business Services
California AG breach notification
Initial attack type not disclosed · Impact data theft inferred
Tarter Krinsky & Drogin LLPSep 2025
Not yet quantified
VVerified
Tarter Krinsky & Drogin's filing with the California Attorney General names a two-day window in September 2025 and stops there. No vector, no actor, no count, no data type: the notice confirms a breach happened without saying what happened. Yet another regulatory required disclosure that discloses absolutely nothing. Feels like the transparency we need, right?
Professional and Business Services
California AG breach notification
Initial attack type not disclosed · Impact data theft inferred
Alliance Environmental Group, LLCApr 2026
Not yet quantified
VVerified
Alliance Environmental Group's April 2026 incident reached the California Attorney General five months later, with the filing still marked draft pending operator summary. With zero details other than informing customers that their data had been stolen, the notice describes a reporting obligation met, not a breach explained.
Professional and Business Services
California AG breach notification
Initial attack type not disclosed · Impact data theft confirmed
MEOSep 2026
Not yet quantified
AAttested
MEO called it a 'mass attack' and left it there: no vector named, no actor named, just service disruption and international congestion that also hit Vodafone, NOS, and Digi on the same day. That spread points at shared network infrastructure as the actual failure domain, not a single company's bad luck. 'No customer data breach' is the easiest claim to make when the statement never says what kind of attack this was.
Telecommunications
MEO hit by cyberattack
Initial attack type software vulnerability inferred · Impact operational outage confirmed
CENTERPOINT ENERGY INCSep 2026
Not yet quantified
VVerified
An external-facing system that CenterPoint has not named let an unauthorized party snatch names, service addresses, billing amounts, autopay status, and partial Social Security numbers from at least 6.73 million customers. For thirteen days, the only account of the breach came from the attacker's forum post and five plaintiffs' firms, while the company said nothing. The 8-K calls this not reasonably likely to be material, a clock that starts when the registrant decides it is material, not when the data becomes public property. Materiality is a legal timer; exposure was already two weeks old before Centerpoint filed an 8k and still called it immaterial.
Energy and Utilities
SEC 8-K, Item 8.01
Initial attack type exposed or misconfigured system inferred · Impact data theft confirmed · Actor 4d722e4d656f77
Accela, Inc.Dec 2025
Not yet quantified
VVerified
Accela's permitting platform is the shared back office for government agencies nationwide, and Bernalillo County warned applicants of a third-party compromise and related phone scams months before Accela filed anything with California. The state filing names no entry point, no actor, no record count, and no data type; it names only that a notice exists. One vendor's platform becomes the effective perimeter for every jurisdiction sitting behind it. The silence in the filing is not an oversight; it is the finding.
Technology and Software
California AG breach notification
Initial attack type third-party or supply chain inferred · Impact data theft inferred
Cambridge Mercantile Corp.Jun 2026
breach at U.S.A.
Not yet quantified
VVerified
Corpay's own network stayed untouched; the exposure ran through Klue, the market intelligence platform wired into its CRM, where an unauthorized party sat inside the integration infrastructure for two days in June 2026. Names, email addresses, and physical addresses were pulled out of the vendor's side of that connection. Corpay never lost control of its network. It lost control of the security boundary the moment a third-party integration became a second entrance into its customer data.
Financial Services
California AG breach notification
Initial attack type third-party or supply chain confirmed · Impact data theft confirmed
Catalyst Physician GroupDec 2025
Not yet quantified
VVerified
A single compromised login let an unauthorized actor into a Catalyst RCM server over November 8 and 9, 2025, with no phishing lure or exploited flaw named, just a credential that should not have worked. Catalyst RCM processes billing and revenue cycle data for multiple healthcare clients, including Catalyst Physician Group and the lab now known as Vanta Diagnostics, so one login opened files belonging to entities that never chose that vendor's security posture. Personal details, medical data, and insurance information moved together because the billing pipeline treated them as one bundle worth protecting equally, which it wasn't. It took Catalyst nearly 10 months to report the incident, and they graciously give you only 3 months to sign up for identity protection. 3x less time for you to respond than it took them to respond.
Healthcare and Life Sciences
California AG breach notification
Initial attack type compromised credentials confirmed · Impact data theft confirmed
Cornerstone Staffing Solutions, Inc.Nov 2025
Not yet quantified
VVerified
Cornerstone Staffing's November 2025 ransomware attack, claimed by the Qilin group, leaked job seeker resumes, contact details, and application documents alongside internal corporate files. The filing names the extortion group but never the door it walked through: no vector, no entry point, no count. Even in the presence of a known ransomware attack executed by a notoriously well-known ransomware gang, it took Cornerstone 9 months to determine that the exposed data was worthy of filing an incident report over.
Professional and Business Services
California AG breach notification
Initial attack type not disclosed · Impact ransomware confirmed + data theft · Actor Qilin
Suffolk Federal Credit UnionSep 2025
Not yet quantified
VVerified
Suffolk Credit Union's member data was taken not from its own network but from Mercadien, P.C., CPAs, the accounting vendor it had already stopped using by the time anyone noticed. The intrusion ran from September 17 to October 9, 2025; how Mercadien's systems were breached is not stated. Names, Social Security numbers, driver's license numbers, and financial account numbers went out the vendor's door, nearly a year before the credit union got the final count. Ending a vendor relationship doesn't retroactively empty the digital file cabinet they were still holding.
Financial Services
California AG breach notification
Initial attack type third-party or supply chain confirmed · Impact data theft confirmed
zHealth, Inc.Jan 2026
Not yet quantified
VVerified
The network at zHealth was accessed by an unauthorized third party for two days in January 2026, though the company did not notice until an investigator found it in June, five months later. The notice does not say how the door opened; a cloud EHR vendor that cannot name its own entry point is not offering transparency, it is confessing a blind spot. Names, medical information, and health insurance details went out of the gap that zHealth can't describe. Over 118,000 patients get no explanation, just another offer for credit protection.
Healthcare and Life Sciences
California AG breach notification
Initial attack type not disclosed · Impact data theft confirmed
TelusSep 2026
Not yet quantified
AAttested
Telus Digital's systems suffered another unauthorized access after disclosing a massive breach in March of this year. What data was taken and how many people it touched remain unstated by anyone with the authority to say. The March attack involved stolen Google Cloud Platform tokens via a third-party vendor. The September event was facilitated through compromised user/account credentials. Telus seems to have some serious identity issues.
Telecommunications
Telus confirms 'unauthorized access' to customers' information | Daily Hive
Initial attack type compromised credentials confirmed · Impact data theft inferred
Florida Department of Highway Safety and Motor VehiclesSep 2026
Not yet quantified
AAttested
FLHSMV blames one compromised credential: a Plant City Police Department login stored on an employee's personal device. ShinyHunters tells a different story. They claim it was an exploited password reset flaw run across multiple DMV and FBI accounts since September 3. Tomato, Tomatoh. The DAVID database's security perimeter turned out to be one officer's personal device. The record count, over 200,000 by the hackers' claim, remains unconfirmed. The breach was also confirmed by the bad guys days before Florida admitted it.
Public Sector and Education
Florida confirms DMV database breached via stolen police account
Initial attack type compromised credentials confirmed · Impact data theft inferred · Actor ShinyHunters
RevolutSep 2026
Not yet quantified
AAttested
Revolut released customer records to someone impersonating a government agency from that agency's own email domain. No hack required, just a trusted sender field. Passports, birth dates, addresses, KYC selfies, and financial histories were the haul, but Revolut has declared that the number of impacted customers is small. The extortion group disputes that and has been releasing files on Telegram to make their case. "It's just a few rich people's passports" doesn't sound reassuring coming from a massive global bank.
Financial Services
Revolut discloses data breach exposing financial info, passports
Initial attack type phishing or social engineering confirmed · Impact data theft confirmed + data extortion
Anne Arundel Medical CenterSep 2026
breach at Luminis Healthcare
Not yet quantified
AAttested
Luminis Health's cyberattack, announced September 4, 2026, knocked out the phone system and MyChart portal at both Anne Arundel Medical Center and Doctors Community Medical Center, forcing rescheduled appointments while care continued. The notice names no entry point, no actor, and no confirmation that patient data was touched at all. Two hospitals going dark on the same day is not two incidents; it is one shared infrastructure with a single point of failure.
Healthcare and Life Sciences
Anne Arundel Medical Center cyberattack delays patient care
Initial attack type exposed or misconfigured system inferred · Impact operational outage confirmed
Surfshark VPNSep 2026
Not yet quantified
AAttested
An internet-facing test server, left reachable by misconfiguration, gave an intruder a way into Surfshark's engineering environment sometime before August 31. From there, the attacker reached an isolated proxy VPS and found build credentials sitting exposed in the code history. Surfshark says no encryption keys, user identities, or VPN traffic were touched.
Technology and Software
Surfshark VPN says hackers breached internal testing, proxy servers
Initial attack type exposed or misconfigured system confirmed · Impact data theft inferred
BOSTON SCIENTIFIC CORPSep 2026
First disclosed Aug 2026 · Item 8.01
Not yet quantified
VVerified
Boston Scientific's on-premise systems were breached beginning August 25, 2026, by intruders the company has not named, with the intrusion still active a week later. The company draws a line between cloud and on-premise, but the breach crossed it anyway, severing cardiac implants and monitors from remote pairing while also halting manufacturing, shipping, and orders. A boundary that only exists on an architecture diagram is not a boundary. Boston Scientific declined to say whether this was ransomware, which is itself a kind of answer.
Healthcare and Life Sciences
SEC 8-K, Item 1.05
Initial attack type not disclosed · Impact operational outage confirmed
Filing history
Aug 2026Item 8.01 ↗first disclosed
Sep 2026Item 1.05 ↗headline
Veradigm Inc.Sep 2026
Not yet quantified
VVerified
An unauthorized party pulled patient personal information, including Social Security numbers, out of a Veradigm API using credentials lifted from an unnamed third-party vendor. Veradigm will not say who that vendor is, how many people were affected, or when the access began. Twice in less than two years, an attacker appears to have compromised an organization in Veradigm's extended ecosystem, acquired legitimate credentials there, and then exercised those credentials against a Veradigm-controlled data resource.
Technology and Software
SEC 8-K, Item 8.01
Initial attack type compromised credentials confirmed · Impact data theft confirmed
Hibbett Retail, Inc.Apr 2026
Not yet quantified
VVerified
An unknown intruder sat inside Hibbett's network for three days in April 2026 before anyone noticed, walking out with HR files on current and former employees, their dependents, and their beneficiaries. The company has not said how the door was pried open. A retailer that tracks 1,169 stores and 12,500 employees somehow built no tripwire around the one system holding everyone's family details in one place. Credit monitoring is the offer; it does nothing for the trusted records that were never a credit card to begin with.
Retail and Consumer
California AG breach notification
Initial attack type not disclosed · Impact data theft confirmed
Hilltop National BankOct 2026
Not yet quantified
IInferred
Hilltop National Bank's online and mobile banking went dark for two weeks starting September 8, 2026, in a cybersecurity incident the bank declines to explain: no entry point, no actor, no account of what was reached. Its backup system had to come off the internet alongside everything else, so the recovery copy shared the failure domain it existed to escape. The assurance of no compromised data covers only the period since restoration, which leaves the outage itself conspicuously unaccounted for.
Financial Services
Hilltop National Bank closes Wyoming branches after cybersecurity incident
Initial attack type not disclosed · Impact operational outage confirmed
Liquid NetworkSep 2026
Not yet quantified
AAttested
Liquid Network's federation wallet held 4,200 Bitcoin behind a single point of failure, and roughly 4,000 of it left through SideSwap, the settlement rail the network itself authorized. Liquid insists the key was never compromised, which only relocates the flaw: a preliminary read points to a bug that let L-BTC be minted outright, no key needed. The source names no attacker, no confirmed fix, and calls it 'white-hat' anyway, a label that describes a hope, not a fact. A federation of eighty companies still built one wallet that a single bug could empty.
Financial Services
Bitcoin-based Liquid Network hit by US$320 million hack, halts transactions
Initial attack type software vulnerability inferred · Impact financial theft or fraud confirmed + operational outage
MathspaceSep 2026
Not yet quantified
AAttested
Mathspace's internal reporting system was reached through a known vulnerability in a self-hosted install, left unpatched from August 10 to August 27. The company puts the toll at 1,079,819 people: names, usernames, emails, login and activity metadata, though it says academic records, credentials, and school links stayed clear. A patch that exists and simply wasn't applied is not an attack; it is a maintenance doorway with a sign that tells the bad guys, "come on in, take what you want".
Technology and Software
More than 1 million users affected in Mathspace data breach across Australia and New Zealand
Initial attack type software vulnerability inferred · Actor ShinyHunters
IDScanSep 2026
Not yet quantified
AAttested
A dark-web marketplace called Nexus claims to hold over 153 million driver's license records, 10 million ID cards, and 579,000 medical cards, some paired with front-and-back scans in visible, infrared, and ultraviolet light. Krebs traced nine sample matches by timestamp and transaction history to businesses tied to IDScan.net, the identity-verification vendor sitting behind car rental counters, retailers, banks, hotels, and cannabis shops. IDScan has not confirmed a breach, named how anyone got in, or counted who was affected; a law firm did the notifying instead. One verification vendor serving five industries is not a shared perimeter; it is a single point where everyone's risk piles up at once.
Technology and Software
IDScan Faces Four Lawsuits Over Alleged Data Breach
Initial attack type not disclosed · Impact data theft inferred
WeverseSep 2026
Not yet quantified
AAttested
Weverse leaked internal user IDs and purchase metadata for 422,584 accounts through an unnamed flaw in its payment information API, a flaw an external reporter found before Weverse did. The company's own inspection began only after KISA flagged it on September 3, confirming that the data already sat with an outside actor. Strengthening access controls after the leak is not a fix; it is an admission of what the API was never built to secure from the jump. No names, no contact details, only the payment trail attached to every one of those customers' accounts.
Media and Entertainment
Weverse Notifies Users Of Data Leak
Initial attack type software vulnerability confirmed · Impact data theft confirmed
Gangnam UnniSep 2026
Not yet quantified
AAttested
Gangnam Unni's breach ran through an API built to retrieve consultation records, hit once on September 4 and again by another route the next day. The filing does not say how the access was authorized or whose credentials made it work; it names the door, not the key. What came out was 219,665 people's names, contact details, procedure histories, hospital and doctor names, appointment times, uploaded photographs, and some payment details. An API meant to serve consultation records to the platform served them up just as efficiently to someone who found the path twice. In bulk.
Healthcare and Life Sciences
South Korea's top cosmetic surgery app hacked, data of 220,000 users exposed
Initial attack type exposed or misconfigured system inferred · Impact data theft confirmed
New Hampshire Supreme CourtSep 2026
breach at Thomson Reuters
Not yet quantified
AAttested
An unauthorized user reached names and addresses tied to New Hampshire cases filed between 2002 and 2015, sitting inside C-Track, the case management platform that West Publishing, a subsidiary of Thomson Reuters, runs for court systems across 11 states, Canada, and the Virgin Islands. The source names no entry point and no actor, only a March 2026 intrusion found on June 30. One vendor's platform became the shared perimeter for a dozen separate judiciaries. The exposure lived entirely inside West Publishing's own database, walled off from the other judicial branch's systems that were never touched.
Public Sector and Education
NH Supreme Court data accessed in C-Track breach
Initial attack type third-party or supply chain inferred · Impact data theft confirmed
Catalyst Brands LLCMay 2026
Not yet quantified
VVerified
Catalyst Brands became aware of a breach on 26 May 2026. ShinyHunters told everyone else on 12 June, thirteen days before California's thirty-day deadline expired, and Catalyst stayed quiet for another eighty-four. The letters went out on 4 September, exactly thirty days after Catalyst determined the scope, because the statute counts thirty days from discovery and then stops counting while you determine the scope. This wasn't a disclosure of a ransomware event; it was meeting reporting deadlines to the day.
Retail and Consumer
California AG breach notification
Initial attack type third-party or supply chain inferred · Impact data theft inferred · Actor ShinyHunters
Bimbo Bakeries USAAug 2025
Not yet quantified
VVerified
An unauthorized party gained remote access to a portion of Bimbo Bakeries' network in February 2024, reaching a single server holding names, Social Security numbers, and dates of birth for 560 employees and vendors. The filing does not say how they got in or what else they touched. Medusa claims credit and a $6.5 million ransom, unconfirmed by Bimbo; the server didn't care whose name was on the note. One server was the whole perimeter for every employee and vendor record it held.
Manufacturing
California AG breach notification
Initial attack type third-party or supply chain inferred · Impact data theft confirmed + data extortion · Actor Medusa
Elixir Medical CorporationJul 2026
Not yet quantified
VVerified
An unauthorized party reached Elixir Medical's network over two days in July 2026; the entry point and actor go unnamed. By August, the exposed files held Social Security numbers, driver's license numbers, card numbers, medical details, and bank information for employees, consultants, and dependents. The notice spends one-half of a page providing no details on how Elixir was breached or how many records were exposed, but then spends three and a half pages telling the victims how they can protect themselves against damaging use of their personal data.
Healthcare and Life Sciences
California AG breach notification
Initial attack type exposed or misconfigured system inferred · Impact data theft confirmed
LHC Group, Inc.Apr 2026
Not yet quantified
VVerified
A vished employee handed over account credentials on April 7, 2026, and a threat actor rode them into LHC's third-party vendor platform for eight days, reading patient files until April 15. LHC's own network was never touched; the vendor's login screen was the entire perimeter, and a phone call walked right through it. Clinical summaries, diagnosis codes, Medicare and Medicaid numbers, and some Social Security numbers went out with it. A phone call is not a sophisticated attack; it is a password reset nobody double-checked.
Healthcare and Life Sciences
Washington AG breach notification
Initial attack type phishing or social engineering confirmed · Impact data theft confirmed
Corroborating records
LHC GroupAAttestedLHC Group data breach impacts thousands ↗
Resource Center of DallasSep 2026
Not yet quantified
AAttested
An unauthorized party sat inside the Resource Center of Dallas's network for eight days in February 2026 before anyone noticed; the disclosure never says how it got in, which is its own answer about what was being watched. What the adversary took was not a card number but the full architecture of a person: medical information, health insurance details, Social Security numbers, and the record of care sought at an LGBTQIA+ health provider. The review took until July to even confirm what was gone. Eight days inside a network with no detection is a design flaw that let nearly 13,000 patients' records leave with zero friction.
Healthcare and Life Sciences
Resource Center of Dallas Notifies 12,500 Patients About Cyber Incident
Initial attack type not disclosed · Impact data theft confirmed
Mogren, Glessner & Ahrens, P.S.Jun 2026
Not yet quantified
VVerified
Mogren, Glessner & Ahrens's main server was encrypted on June 9, 2026, and discovered the next day. The filing never says how the attacker got in. An IT contractor assured the firm that nothing had been exfiltrated. The firm reformatted from backup and moved on. Two months later, a hacker's email arrived with the firm's own pleadings attached, claiming 380 gigabytes taken. The reformatting the firm took based on a clean-slate recommendation also erased any way to check the claim. To Mogren, Glessner & Ahrens' credit, their detailed description of the incident is rare among government-mandated filings.
Professional and Business Services
Washington AG breach notification
Initial attack type not disclosed · Impact ransomware confirmed + data extortion
Thomson ReutersSep 2026
Not yet quantified
AAttested
Thomson Reuters detected unauthorized activity in a C-Track cloud environment on June 30, 2026, three months after the intrusion it now traces to March. The stolen files touched court records and personal data across eleven states, the Virgin Islands, and Ontario; the company still cannot say what was taken or how many people were affected. One cloud platform running case management for a dozen jurisdictions turns a single failure into a multi-state event. We'll see if Thomson Reuters gets a "get out of jail free" card for this incident.
Professional and Business Services
Thomson Reuters hit by cyberattack that saw court documents across 11 states accessed by a hacker
Initial attack type not disclosed · Impact data theft confirmed
TvingSep 2026
Not yet quantified
AAttested
A stolen developer access key let an unidentified hacker into Tving's internal systems, exposing 39.54 million accounts and 361 technical assets, including source code, before the data moved to overseas accounts that investigators still haven't traced. That single key was the trust boundary for the entire platform, not just one developer's corner of it. A developer's credential was never built to double as a perimeter. Tving caught the intrusion on May 30 but didn't report it until June 1, turning a breach into a fine as well.
Technology and Software
Nearly 40 mln Tving accounts compromised in massive S. Korea data breach: probe
Initial attack type compromised credentials confirmed · Impact data theft confirmed
Fishbrain ABJul 2026
Not yet quantified
VVerified
Fishbrain doesn't say what let attackers into its user database on August 19, only that a vulnerability existed and was later patched; the entry point stays unnamed. The haul was names, birth dates, emails, phone numbers, usernames, country data, and password hashes with salts, for a count the company won't state. Hashed isn't the same as safe: Fishbrain admits some of those hashes may be crackable. Patching the hole after 20 million anglers' credentials were already in reach isn't security, it was bait for the bad guys.
Technology and Software
California AG breach notification
Initial attack type software vulnerability inferred · Impact data theft confirmed
HumanEdge, Inc.Mar 2026
Not yet quantified
VVerified
HumanEdge doesn't say how intruders got in; the filing gives a date, March 18, 2026, and nothing else. What exited the building were Social Security numbers, driver's license numbers, financial account data, medical records, and health insurance information, for at least 2,222 people across three states. A staffing firm had quietly become a records bureau for identity and health data. That concentration, not the unnamed intruder, is the actual finding.
Professional and Business Services
California AG breach notification
Initial attack type not disclosed · Impact data theft confirmed
YouLend US LLCJun 2026
Not yet quantified
VVerified
Unauthorized access sat inside YouLend's network for four days in June 2026, pulling full names, Social Security numbers, dates of birth, addresses, and financial or credit card account details. The filing names no entry point and no attacker; whatever let someone in for those four days goes unexplained in the very document meant to explain it. That omission is not modesty; it is architecture kept off the record. Like many mandatory filings with State AG offices, there are no media reports of this breach. Just letters to customers and flashing "was your personal data stolen?" law firm recruitment pages for civil litigation.
Financial Services
California AG breach notification
Initial attack type not disclosed · Impact data theft confirmed
Knowledge Research CenterJul 2026
Not yet quantified
VVerified
Knowledge Research Center's filing confirms a breach and stops there: no vector, no data type, no record count, no date. No media reports, no coverage, no information. That's the disclosure system working exactly as designed, built to satisfy a statute rather than inform anyone.
Healthcare and Life Sciences
California AG breach notification
Initial attack type not disclosed · Impact data theft
Ontario Court SystemSep 2026
breach at Thomson Reuters
Not yet quantified
AAttested
Ontario's courts didn't lose control of their own systems; they lost control of Thomson Reuters Canada's, the vendor running C-Track, a case management platform holding some of its documents and records. Thomson Reuters caught 'unauthorized activity' on June 30, contained it, and confirmed access to files whose contents the province still couldn't describe by its September 2 statement. Assurances of 'no evidence of identity theft' mean little when the institution making them still can't say what was taken, especially when sensitive court documents have nothing to do with 'identity'.
Public Sector and Education
Cyberattack hit Ontario courts, sealed information possibly accessed
Initial attack type third-party or supply chain confirmed · Impact data theft inferred
Oculus PathologySep 2026
Not yet quantified
AAttested
Oculus Pathology's breach notice covers a three-day window, March 31 to April 2, 2026, of unauthorized access to employee email accounts. Inside that window, 20,040 patients had names, Social Security numbers, driver's license numbers, tax IDs, payment card data, and full clinical records, diagnosis through prescription, exposed. One inbox held identity, finance, and medical history all at once, because nothing segregated them. A single email account eviscerated the entire catalog of the security tools deployed around it.
Healthcare and Life Sciences
Oculus Pathology Notifies 20,000 Patients About April 2026 Security Incident
Initial attack type not disclosed · Impact data theft confirmed
NovoCure LtdSep 2026
Not yet quantified
VVerified
Novocure's SEC filing names no vector and no actor for the unauthorized access it discovered in mid-August 2026, only the aftermath. More than 1,400 U.S. patients had ID numbers exposed without names, while fewer than 50 in the western U.S. lost both identity and provider contact details, a split that reads like several systems failing on different terms, not one breach. Employee names, job titles, and phone numbers leaked from the same event, which the filing still frames as a story about untouched treatment devices. No devices were breached, they say; the record of who these patients are was.
Healthcare and Life Sciences
SEC 8-K, Item 8.01
Initial attack type third-party or supply chain inferred · Impact data theft confirmed
Park Dental Partners, Inc.Aug 2026
Not yet quantified
VVerified
Park Dental Research's systems got tied up in ransomware by the Interlock group. Employee Social Security numbers, driver's license numbers, bank account details, passports, and I-9 forms were accessed by an unauthorized party in April 2026; the notification letters never say how the door opened. Interlock claims it exfiltrated 260 gigabytes and says so plainly; yet the company's own letter and 8k filing never mentions ransomware at all.
Healthcare and Life Sciences
SEC 8-K, Item 1.05
Initial attack type not disclosed · Impact ransomware confirmed + data theft · Actor Interlock
Filing history
Aug 2026Item 1.05 ↗headline
Oct 2026Item 1.05 ↗
Kaniksu Community HealthDec 2025
breach at Aesto
Not yet quantified
VVerified
Kaniksu Community Health's December 2025 breach ran through Aesto, the same vendor turning up again and again across this index as a single point of failure for multiple health systems. The filing names only "personal information": names, dates of birth, addresses, phone numbers, no Social Security numbers, no financial data, and no entry point stated. The notice suggests this is good news because nothing there opens a new account in anyone's name. Good news is relative: a name and a birthdate can't be reissued, and they don't expire.
Healthcare and Life Sciences
California AG breach notification
Initial attack type third-party or supply chain inferred · Impact data theft confirmed
METR (Model Evaluation and Threat Research)Sep 2026
Not yet quantified
AAttested
A vibe-coded orchestration tool on a researcher's personal AWS instance failed open, silently disabling authentication and parking a METR API key on the public internet; an attacker took the key, added SSH persistence, and burned roughly $600,000 in credits over three weeks. The security perimeter ended where an employee's own cloud account began. Authentication that fails open isn't a control; it's an embossed invitation. As for the May incident, METR learned at the time it was being targeted by attackers potentially seeking financial gain or access to advanced AI models; the organization described this as a "sustained external attack campaign." The attackers used agents to automate reconnaissance and vulnerability discovery, including credential stuffing, OAuth-related attacks, scanning for newly deployed services, and phishing attempts.
Technology and Software
AI Model Evaluator METR Hit by Credential Theft, Probing
Initial attack type exposed or misconfigured system confirmed · Impact financial theft or fraud confirmed
Nutex Health Inc.Aug 2026
First disclosed Aug 2026 · Item 8.01
Not yet quantified
VVerified
Nutex Health's own filing says only that it found unauthorized activity on its network, then points back to an earlier 8-K for the rest. No vector, no actor, no data type, no count: the filing discloses the fact of a breach while withholding the shape of one.
Professional and Business Services
SEC 8-K, Item 1.05
Initial attack type software vulnerability inferred · Impact operational outage inferred · Actor The Gentlemen
Filing history
Aug 2026Item 8.01 ↗first disclosed
Aug 2026Item 1.05 ↗headline
Berkeley Research Group, LLCFeb 2025
Not yet quantified
VVerified
Berkeley Research Group found an intruder inside its own network between February 28 and March 2, 2025, copying files before anyone caught the motion. The notice never says how the actor got in, what was taken, or how many people it belonged to, which is its own kind of disclosure. A firm built on producing precise findings for other people's disputes can't produce one for its own breach. Eighteen months later, the silence is still the headline, not the incident.
Professional and Business Services
California AG breach notification
Initial attack type not disclosed · Impact data theft confirmed
Virta Health Corp. and Virta Medical, PCMar 2026
Not yet quantified
VVerified
Virta Health's compromised repository sat apart from its production platform, but unauthorized access still ran from March 19 to 22, 2026, exposing Social Security numbers, diagnoses, physician information, and medical record numbers for 14,636 people. The filing does not say how Lapsus$, the group that claimed the breach, got in. Separation from production is not isolation; the side repository still holds the whole clinical record. Lapsus$ posted Virta to its leak site on March 23, a full day before anyone at Virta noticed, which says more about who was watching than about who broke in.
Healthcare and Life Sciences
California AG breach notification
Initial attack type not disclosed · Impact data theft confirmed · Actor Lapsus$
Metro Atlanta cityAug 2026
Not yet quantified
AAttested
Norcross, Georgia, was hit by ransomware on August 1, with no vector named, no actor named, and no accounting of what data, if any, left the network. City officials notified police and cybersecurity professionals and kept most services running while restoration continued. Calling in digital fixers after the fact is incident response, not architecture. The filing never says what allowed the encryption in. An organization that cannot name the crack in its defenses has not yet found the boundary that failed.
Public Sector and Education
Metro Atlanta city hit by ransomware, working on full system restoration
Initial attack type not disclosed · Impact ransomware confirmed
MCKESSON CORPAug 2026
Not yet quantified
VVerified
ShinyHunters claims it vished several McKesson employees' Okta credentials, then walked those single sign-on logins straight into Salesforce and Snowflake. McKesson has not confirmed the entry point or the data taken; only the extortion group has spoken. Single sign-on was built to make log-ins easy, but when secured incorrectly (or not at all) it is just the easy button to own an entire company. The group claims roughly 284 million patient records, the kind of data no reset can undo.
Wholesale and Distribution
SEC 8-K, Item 7.01
Initial attack type phishing or social engineering inferred · Impact data theft inferred + data extortion · Actor ShinyHunters
Bennett CollegeAug 2026
Not yet quantified
VVerified
Bennett College calls it a network disruption, the polite word for three weeks of unaccounted access between October 27 and November 15, 2025. The filing never names how anyone got in or who they were; it only names what sat exposed: Social Security numbers, driver's license and passport numbers, financial accounts, medical and health insurance information. A network with no stated entry point is not a mystery; it is an admission that nobody was watching the door closely enough to say which one opened. Credit monitoring 10 months after the breach will not touch the medical history or the passport number, now loose in the world.
Public Sector and Education
California AG breach notification
Initial attack type not disclosed · Impact data theft confirmed
RB American Group LLCApr 2026
Not yet quantified
VVerified
An unknown actor moved through RB American Group's network for two days in April 2026; the filing never says how they got in. What sat behind a single boundary was nearly every category of sensitive data a company can hold, from SSNs to biometric data to medical records. That is not a breach of one system; it is proof that one network was a straight arrow pass through all of them. As an Arby's franchisee, RB American Group's victims are justified in having, at least, a beef.
Retail and Consumer
Washington AG breach notification
Initial attack type not disclosed · Impact data theft confirmed
Indico Data SolutionsMay 2026
Not yet quantified
VVerified
Indico Data Solutions lost names, addresses, and Social Security numbers out of online file stores in May 2026; the filing does not say how someone got in, only that access was unauthorized. The company that touched this data was never the insurer a customer chose, but a back-office AI vendor that the insurer quietly handed the file to. Consent stopped at the front door; the data kept moving through vendors, and nobody was asked to approve.
Insurance
California AG breach notification
Initial attack type not disclosed · Impact data theft confirmed
Integrated Specialty Coverages, LLCJun 2026
breach at “ISC”
Not yet quantified
VVerified
An unauthorized third party sat inside a limited part of ISC's environment for four days in February 2025, and the filing never says how it got in. What it took reads like a full identity kit: Social Security numbers, driver's license and government ID numbers, biometric data, and medical details tied to insurance claims. ISC administers other companies' insurance programs.
Healthcare and Life Sciences
California AG breach notification
Initial attack type not disclosed · Impact data theft confirmed
U.S. Bureau of Alcohol, Tobacco, Firearms and ExplosivesAug 2026
Not yet quantified
AAttested
ATF confirmed a 'major incident' only after Qilin's ransomware gang posted the agency's name to its dark web leak site, not from its own monitoring. The bureau says the breach was confined to a standalone system, separate from its enterprise network and eForms. Qilin has not said whether it stole data or demanded a ransom, and ATF has not said what that system held. An agency that tracks explosives learned about its own breach from the people who lit the fuse. Or, it knew about it and didn't bother to disclose it.
Public Sector and Education
ATF confirms “major incident” after recent Qilin breach claims
Initial attack type not disclosed · Impact ransomware inferred · Actor Qilin
Manchester Airports GroupAug 2026
Not yet quantified
AAttested
MAG's breach note names neither the entry point nor the attacker, only the wreckage: 8.7 million customers' emails, phone numbers, vehicle registration numbers, and postcodes, pulled from the car park, lounge, and wifi sign-up systems shared across Manchester, Stansted, and East Midlands. Three airports ran their ancillary bookings through one common system, so a single hole became a three-airport hole. MAG points out that no bank details were held there, as if a name, a plate number, and a postcode were not already enough to track someone.
Transportation and Logistics
UK airports operator hit by cyber-attack and customer data accessed
Initial attack type not disclosed · Impact data theft confirmed
CarharttAug 2026
Not yet quantified
AAttested
ShinyHunters says it pulled more than 50GB from Carhartt's Databricks analytics platform, claiming the intrusion on August 13 and later publishing the archive after Carhartt declined a $3.3 million ransom demand. How the platform was actually entered, credentials, misconfiguration, or something else, is not stated; Carhartt has not confirmed the breach at all. Troy Hunt's independent analysis puts the toll at 12.9 million accounts, names, emails, phones, addresses, and over 15,000 internal @carhartt.com employee addresses sitting in the same analytics warehouse as the customer file. An analytics platform became the record of the whole company, employees, and customers alike, and nobody built a wall between them.
Retail and Consumer
Carhartt data breach exposes information of 12.9 million accounts
Initial attack type not disclosed · Impact data theft confirmed + data extortion · Actor ShinyHunters
Murfreesboro Medical ClinicApr 2026
Not yet quantified
VVerified
BianLian, a ransomware group, claims it pulled records for 559,000 patients and employees off Murfreesboro Medical Clinic's network on or around April 22, 2023; the filing never says how the door opened. What exited? Names, Social Security numbers, driver's license copies, dependent data, full diagnostic and prescription histories. Bascially the entire archive of a person's medical life, sitting behind one network boundary. That is not a sophisticated breach; that is a single failure domain holding everything a person has ever told a doctor. A settlement can pay a claim; it cannot reissue a diagnosis.
Healthcare and Life Sciences
California AG breach notification
Initial attack type not disclosed · Impact data theft confirmed + data extortion · Actor BianLian
News Corp UK & Ireland LimitedJul 2026
Not yet quantified
VVerified
News UK says an unauthorized third party entered part of its network and took customer records from an unnamed business application. In an interesting twist for a news organization, there is not a single story available in the media about this incident. The exposed data was enough to identify and convincingly target customers, but the company has not disclosed which brand, system, or control failed, or how many people were affected overall. The breach is confirmed; the public explanation has been designed to satisfy notification requirements, not to explain the failure.
Media and Entertainment
Washington AG breach notification
Initial attack type not disclosed · Impact data theft confirmed
Troutman Pepper LockeAug 2026
Not yet quantified
AAttested
Troutman Pepper Locke's breach began when one employee, targeted by a social engineering attack, trusted communications that looked legitimate but were not, exposing information now claimed to affect roughly 37,000 people in an accompanying lawsuit. The account gives no vendor, no malware, no stolen credential chain: just a single inbox that functioned as the firm's whole perimeter. A law firm built on judgment left one employee's judgment as its only control point.
Professional and Business Services
Large Atlanta law firm hit with data breach and associated lawsuit
Initial attack type phishing or social engineering confirmed · Impact data theft inferred
Livara Health Medical Group - dba SpineZoneDec 2025
breach at Aesto
Not yet quantified
VVerified
SpineZone's patient records were exposed not on its own network but inside Aesto Health, the Birmingham vendor it paid to migrate and archive data into Amazon Web Services. The breach window ran from December 2 to December 18, 2025, and it took Aesto until May 2026 to confirm what protected health information had actually been taken. Names, Social Security numbers, driver's license numbers, financial account details, and full medical and billing histories moved through that one AWS account, along with the records of more than two dozen other providers' patients. SpineZone outsourced the archive; it did not outsource the liability for losing it.
Healthcare and Life Sciences
California AG breach notification
Initial attack type third-party or supply chain confirmed · Impact data theft confirmed
Together Women's Health LLCDec 2025
breach at Aesto
Not yet quantified
VVerified
Together Women's Health filed its breach notice under Aesto, the same vendor whose AWS environment has already surfaced in other patients' notifications this year. The letter names Social Security numbers and two dates in December 2025, and stops there: no stated entry point, no actor, no count of people affected. A filing this thin is its own kind of disclosure. When a vendor keeps reappearing as the common thread across unrelated clinics, the failure isn't in any one exam room; it's in the shared filing cabinet everyone quietly outsourced to.
Healthcare and Life Sciences
California AG breach notification
Initial attack type not disclosed · Impact data theft inferred
Sotheby's InternationalAug 2026
Not yet quantified
AAttested
Sotheby's International, a luxury real estate firm, reported it is investigating a cyber security incident involving unauthorized access to data held in a third-party software platform used to store marketing contact information. The company said the person who accessed the data claimed to have obtained 1.6 million contacts but it refuted that claim because it did not have that many on its database. Regardless of the number, given Sotheby's clientele, even marketing data seems to be a valuable haul from a valuable brand.
Retail and Consumer
Luxury real estate firm hit by cyber security attack
Initial attack type third-party or supply chain confirmed · Impact data theft confirmed
Museum Associates d/b/a Los Angeles Museum of ArtJul 2025
breach at LACMA
Not yet quantified
VVerified
Los Angeles County Museum of Art (LACMA) discovered a breach on Monday, July 7, 2025. Then it took them until February of 2026 to figure out what go stolen (LACMA, Louvre much?). Then it took them until August 24, 2026 to post the incident with the California AG and on their on website. What's missing in the AG report? All the sensitive data types that were stolen.
Public Sector and Education
California AG breach notification
Initial attack type not disclosed · Impact data theft inferred
AestoAug 2026
Not yet quantified
VVerified
Aesto Health's AWS infrastructure was breached, exposing the PII and PHI of 9,540,683 people across up to 29 provider clients, from VillageMD to Monroe Health Center. The filing names no entry point and no actor, only the aggregate count. Aesto was hired to migrate and archive records; instead, it became the single failure domain for dozens of practices that never touched its cloud. One vendor's infrastructure was the perimeter for an entire health system's worth of patients.
Healthcare and Life Sciences
California AG breach notification
Initial attack type not disclosed · Impact data theft confirmed
Conwy MindAug 2026
breach at Beacon CRM
Not yet quantified
AAttested
A North Wales mental health charity confirms sensitive data was accessed, informing their clients that their trusted provider Beacon CRM had experienced a breach on 7/29/2026 that affected many of Beacon's non-profit clients.
Public Sector and Education
Cyber attack on North Wales mental health charity sees sensitive data accessed
Initial attack type not disclosed · Impact data theft confirmed
Kern Psychiatric Health and Wellness Center, IncApr 2026
breach at Genesis Healthcare Management
Not yet quantified
VVerified
Kern Psychiatric Health and Wellness Center's patient data was exposed not on its own systems but on the network of Genesis Healthcare Management, the outsourced management company that discovered unauthorized file access on June 22, 2026. The data was among the most sensitive a person holds, Social Security numbers alongside diagnoses, prescriptions, and treatment records. Outsourcing the back office moved those records to a network the practice did not run.
Healthcare and Life Sciences
California AG breach notification
Initial attack type not disclosed · Impact data theft confirmed
ASOS US Sales LLCJul 2026
Not yet quantified
VVerified
ASOS traced unauthorized account access to credentials stolen in a different company's breach and reused against it. Nothing in ASOS's systems was breached; a valid credential was just presented by the adversary. Password-only authentication inherits every leak that credential ever appeared in, and the system just works as designed after it is leveraged.
Retail and Consumer
California AG breach notification
Initial attack type compromised credentials confirmed · Impact data theft inferred
POLAM Federal Credit UnionMay 2025
Not yet quantified
VVerified
POLAM Federal Credit Union's filing to the California Attorney General names a May 2025 breach and nothing else - no entry point, no actor, no data type, no count. Fifteen months between incident and disclosure is itself a problem. Providing zero details but offering every impact customer yet another round of free credit monitoring suggest that transparency isn't a requirement anyone is holding POLAM accontable for.
Financial Services
California AG breach notification
Initial attack type not disclosed · Impact data theft inferred
Apollo GlobalAug 2026
Not yet quantified
AAttested
The notice attached to this incident reads "to review," which means the source confirms nothing beyond a name and a date: not the vector, not the actor, not what was reached, not how many were affected. Apollo Global sits in the Index with a placeholder where an accounting should be. An institution's disclosure obligation is itself a control point, and a statement that has not yet been given is not transperancy, especially for customers. .
Financial Services
Apollo Global reveals data breach after hackers target financial firms
Initial attack type not disclosed · Impact data theft inferred
AlationAug 2026
Not yet quantified
AAttested
AI data giant Alation confirmed a cyberattack, and the headline confirms nothing else: no entry point, no actor, no data type, no count of records or systems touched. That leaves a data-governance vendor built to sit inside other companies' data stacks, cataloging and connecting sensitive information as its core function, now acknowledging compromise without saying what that position exposed.
Technology and Software
Alation Confirms Cyberattack: What Security Teams Need to Know
Initial attack type not disclosed · Impact data theft inferred
Connecticut Department of Social ServicesAug 2026
Not yet quantified
AAttested
A state Medicaid portal exposed data on 41,000 members. Per usual, the state and their auditor declared that "no social security numbers were taken" but the laundry list of other data elements stolen suggest a ready-made-cookbook for use in other forms of targeted consumer attacks such as social engineering and financial scams.
Public Sector and Education
State says data from 41,000 Medicaid members exposed in portal breach
Initial attack type not disclosed · Impact data theft confirmed
SFRAug 2026
Not yet quantified
AAttested
2.1 million SFR fiber customer records surfaced as exposed and SFR has confirmed that attackers compromised a legitimate user account to access an internal fiber connection management tool named NOVA. The data loss is a treasure trove of information for targeted scams and phishing against SFR customers.
Telecommunications
SFR data breach in France: 2.1 million fibre customer records exposed
Initial attack type compromised credentials confirmed · Impact data theft confirmed
Apollo Management Holdings, L.P.Jul 2026
Not yet quantified
VVerified
A social-engineering attack gave an unauthorized party access to Apollo cloud platforms for several days. Personal data, including Social Security numbers, was potentially exposed. A cloud trust model was defeated with one single successful call or message.
Financial Services
California AG breach notification
Initial attack type phishing or social engineering confirmed · Impact data theft inferred
Nebraska Orthopaedic Center, P.C.Dec 2025
breach at Aesto
Not yet quantified
VVerified
Nebraska Orthopaedic Center was exposed through Aesto, the vendor holding its patient data in Amazon Web Services. An unauthorized actor copied protected health information, including identifiers that may include Social Security numbers. The trust boundary sat with the vendor, but the consequences fell right on top of the patients and the provider.
Healthcare and Life Sciences
California AG breach notification
Initial attack type third-party or supply chain confirmed · Impact data theft confirmed
Southern Illinois UniversitySep 2025
breach at Oracle
Not yet quantified
VVerified
Southern Illinois University tied a data exposure to its Oracle E-Business Suite environment, with files open to unauthorized access for five weeks in mid-2025 and confirmed only in July 2026. The flaw was Oracle's; the exposure was SIU's. You can outsource the software, but not the risk it carries into your own data.
Public Sector and Education
California AG breach notification
Initial attack type software vulnerability inferred · Impact data theft inferred
Northern Inyo Healthcare District d/b/a Northern Inyo HospitalDec 2025
breach at Aesto
Not yet quantified
VVerified
Northern Inyo Hospital was exposed through Aesto, the vendor holding its patient records in AWS, where a network incident ran two weeks in December 2025. The hospital handed Aesto the job of holding the records; it could not hand off the duty to protect them. Outsourcing proved the work can move, the risk stayed where the patients are.
Healthcare and Life Sciences
California AG breach notification
Initial attack type not disclosed · Impact data theft inferred
Rockwood Retirement CommunitiesFeb 2026
breach at Spokane United Methodist Homes
Not yet quantified
VVerified
Spokane United Methodist Homes, doing business as Rockwood Retirement Communities, lost files to unauthorized network access spotted around February 16, 2026; sending notices to over 7,000 addresses that names, Social Security numbers, driver's license and passport numbers, Medicaid and Medicare identifiers, financial accounts, and medical records had been taken. Declaring no known misuse yet only means the theft has not been priced out.
Healthcare and Life Sciences
Washington AG breach notification
Initial attack type not disclosed · Impact data theft confirmed
CanvasAug 2026
Not yet quantified
AAttested
Vulnerabilities in Canvas, the third-party learning platform four Hong Kong institutions leaned on, exposed more than 153,000 student and staff accounts; names, IDs, emails, login credentials, course messages. The institutions' internal systems were in place but ended up being irrelevant, since Canvas was the actual perimeter, and one vendor's flaw became four campuses' breach.
Public Sector and Education
More than 153,000 students, staff affected in Canvas data breach: privacy watchdog
Initial attack type third-party or supply chain confirmed · Impact data theft confirmed
Silver Summit Medical CorporationNov 2025
Not yet quantified
VVerified
Silver Summit Medical Corporation was pulled into a breach through a vendor that held its patient information. Data was acquired from the vendor's systems without authorization, although the notice does not name the vendor or explain the access path. Outsourcing the system moved the control point, not the exposure. The specific vendor was not named.
Healthcare and Life Sciences
California AG breach notification
Initial attack type third-party or supply chain confirmed · Impact data theft confirmed
Sakura InternetAug 2026
Not yet quantified
AAttested
Up to 1.36 million Sakura Internet accounts were exposed in a recently disclosed breach, which was only discovered when Sakura was investigating an entirely separate breach in one of its other business units.
Telecommunications
Sakura Internet hack exposes data of up to 1.36 million accounts
Initial attack type not disclosed · Impact data theft inferred
Turner Construction CompanyJul 2026
Not yet quantified
VVerified
Turner Construction found unauthorized access to its systems over nearly two weeks and confirmed that files containing payroll, banking, identity, and address information were reached. The exposure crossed data categories that should not have needed to share one compromise path. Credit monitoring deals with downstream risk; segmentation and constrained authority would have dealt with the cause.
Real Estate and Construction
California AG breach notification
Initial attack type not disclosed · Impact data theft confirmed
Apple American Group LLCApr 2026
Not yet quantified
VVerified
Apple American Group, parent group of Applebee's, found that an unknown actor accessed company servers and employee files during a two-day window in April. The notice does not explain the entry point. Monitoring services address the aftermath; they do not explain why one server compromise could reach the files. Clearly, Apple American Group would like the data back in its neighborhood.
Retail and Consumer
California AG breach notification
Initial attack type not disclosed · Impact data theft inferred
CognizantAug 2026
Not yet quantified
AAttested
Cognizant notified individuals of a data breach and is offering one million dollars in identity theft coverage. The headline confirms notification and a remediation gesture but does not name the entry point, the actor, the number affected, or the data types involved. A company built on managing other organizations' systems and data has disclosed a breach of unspecified scope, and the insurance offer addresses downstream harm, but not the architecture that allowed the exposure.
Professional and Business Services
Cognizant notifies individuals of data breach; offers $1 mn identity theft cover
Initial attack type not disclosed · Impact data theft confirmed
Latvia's Road Traffic Safety Directorate CSDDAug 2026
Not yet quantified
AAttested
An unpatched, internet-facing hole in a CSDD system, one that was legally classed as critical, requiring multi-factor authentication and penetration testing it never got, gave attackers a path to eighteen years of payment records: 1.2 million people, 200,000 companies, IDs and addresses intact. The immediate result? The resignation of the entire safety advisory board.
Public Sector and Education
Data of 1.2 million people leaked in CSDD cyberattack in Latvia - including personal ID numbers and addresses
Initial attack type software vulnerability confirmed · Impact data theft confirmed
Langwasser & Company CPAsMay 2026
Not yet quantified
VVerified
Langwasser & Company learned that unauthorized tax returns had been filed for some clients, and its investigation found that an unauthorized actor may have accessed personal information. The notice cannot establish the full extent of access. The incident shows identity data doing double duty as both a record and an authentication mechanism: once exposed, it could be used to impersonate the taxpayer.
Professional and Business Services
California AG breach notification
Initial attack type not disclosed · Impact data theft inferred + financial theft or fraud
Forrestall CPAs LLCDec 2025
Not yet quantified
VVerified
A tax firm is an identity warehouse by design, and Forrestall CPAs left an intruder inside its network for roughly a week, from December 22 to 30, reading and taking files that nothing inside kept apart. What left was the full identity kit: Social Security numbers, driver's licenses, financial accounts, dates of birth. The firm has confirmed 218 residents in Massachusetts and left the national count blank. How the door opened, and why a week passed before anyone noticed, the notice does not say.
Professional and Business Services
California AG breach notification
Initial attack type not disclosed · Impact data theft confirmed
Pokemon CenterAug 2026
breach at CEVA Logistics
Not yet quantified
AAttested
Another CEVA Logistics supply chain victim. Pokémon Center is notifying customers in the United Kingdom and Germany that it suffered a third-party data breach after hackers stole customer personal and order information. CEVA's reply? Gotta get 'em all.
Technology and Software
Pokémon Center data breach exposes customer info, cancels some orders
Initial attack type third-party or supply chain confirmed · Impact data theft confirmed
Access BankAug 2026
Not yet quantified
AAttested
Access Bank lost N1.3bn to hackers in an expanding attack against Nigerian banks nationwide. entry point, method, and timeline all unnamed. The breach notification is precise on the loss but skips, entirely, how the breach occurred.
Financial Services
Banks continue to battle hackers over deposits, as Access Bank loses N1.3bn
Initial attack type not disclosed · Impact financial theft or fraud confirmed
Bits of GoldAug 2026
Not yet quantified
AAttested
Bits of Gold, Israel's largest crypto broker, confirms a breach touching 200,000 customers. The Tel Aviv, Israel-based company reported the security breach on Sunday, saying a hacker gained unauthorized access to a third-party data analytics network and,gained access to customers’ names, national ID numbers, emails, phone numbers, IP addresses, bank account details, and public wallet addresses.
Financial Services
Israel's largest crypto broker Bits of Gold hit by data breach affecting 200,000 customers
Initial attack type third-party or supply chain confirmed · Impact data theft confirmed
SafePalAug 2026
Not yet quantified
AAttested
SafePal disclosed a data breach affecting roughly 40,000 customers, exposing customer information associated with purchases while the company says wallet credentials, private keys, and recovery seeds were not compromised. This is high quality signal, cryptocurrrency relatedcustomer data that gives attackers a better map for phishing and social engineering. Exactly what adversaries want for conducting further identity based attacks.
Financial Services
SafePal Data Breach Hits Tens of Thousands of Customers - Infosecurity Magazine
Initial attack type not disclosed · Impact data theft confirmed
Sogang UniversityAug 2026
Not yet quantified
AAttested
About 180,000 students, alumni, and employees at Sogang University had their data exposed through the school's integrated login system. IDs, names, affiliations, emails, phone numbers, encrypted passwords. The entry point stays unnamed, the attacker unidentified; what's clear is one login system built to serve every population became one failure domain for all of them. Network separation arrived after detection, not before.
Public Sector and Education
Sogang University hit by personal information breach of 180,000
Initial attack type not disclosed · Impact data theft confirmed
Quantum Health, Inc.May 2026
Not yet quantified
VVerified
A vishing call caused a Quantum Health user to open the door to the network, followed by several days of access, a service outage, and file acquisition. The exposed data included insurance, medical, and other personal information. The call was the trigger; the larger failure was letting one user interaction carry enough authority access the systems and records at that scale.
Healthcare and Life Sciences
California AG breach notification
Initial attack type phishing or social engineering confirmed · Impact data theft confirmed + operational outage
Paylogix, LLCNov 2025
Not yet quantified
VVerified
Unauthorized actors accessed Paylogix systems and copied files from its network during a multi-day intrusion. Paylogix itself calls it a cyber event, saving the time needed to translate "we believe that our systems were accessed but don't think anything was taken".
Financial Services
California AG breach notification
Initial attack type not disclosed · Impact data theft confirmed
Baylor GeneticsAug 2026
Not yet quantified
VVerified
Baylor Genetics found an unauthorized third party inside part of its network for about a week with access to stored data. The breach exposed the sensitive personal and medical data of over 248,430 individuals. Clearly, a genetics company can't make a patient whole if their genetic information was stolen. ts a 1-of-1 kind of thing. The notice confirms the access but leaves the entry path and exact acquisition uncertain.
Healthcare and Life Sciences
California AG breach notification
Initial attack type not disclosed · Impact data theft inferred
Lennar Mortgage, LLCMay 2026
Not yet quantified
VVerified
Lennar Corporation and Lennar Mortgage, LLC were each breached through social engineering within two months, March 24 to 30 and May 26 to June 1, 2026; Lennar reported at least 61,295 people affected, their names, Social Security numbers, government IDs, and financial data exposed. One tricked employee is not an anomaly; it is the actual perimeter, and nothing closed it between the two hits. Notice went out in August, nearly four months after the first intrusion began. That gap is its own design failure, not an oversight.
Real Estate and Construction
Washington AG breach notification
Initial attack type phishing or social engineering confirmed · Impact data theft confirmed
Shell and PhilipsAug 2026
Not yet quantified
AAttested
Cl0p listed nearly fifty companies at once and walked off with 89GB of Shell's facility drawings and test reports. The hole was in PTC's Windchill, patched 17 June. Shell's security spend didn't include understanding the path from Windchill to their doorstep.
Energy and Utilities
Shell and Philips hit by Russian ransomware attack
Initial attack type software vulnerability confirmed · Impact data theft confirmed + data extortion · Actor Cl0p
H&MAug 2026
Not yet quantified
AAttested
H&M confirmed that an attack on a business system exposed Korean customers' email addresses, phone numbers, and order or return reference numbers. More sensitive payment and password data were reportedly not affected, but the company did not disclose the number of customers or the access path. The useful boundary held around payment data; disclosure and accountability around the breached business tool remain thin.
Retail and Consumer
H&M discloses customer data breach in South Korea
Initial attack type not disclosed · Impact data theft confirmed
RingCentralAug 2026
Not yet quantified
AAttested
623GB out the door, no ransom paid, 280GB published in response. RingCentral assured customers that silence meant safety, and Have I Been Pwned then counted 1.6 million email addresses sitting in the archive.
Technology and Software
RingCentral data breach exposed info of 1.6 million accounts
Initial attack type not disclosed · Impact data extortion confirmed + data theft
French Tax AuthorityAug 2026
Not yet quantified
AAttested
A stolen identity got someone onto the French tax authority's VPN and into an internal lookup tool built for querying taxpayers. DGFiP cut the access in June, filed it under routine, and let the hacker break the news in August.
Public Sector and Education
French tax data stolen in cyberattack, ministry says
Initial attack type compromised credentials confirmed · Impact data theft inferred
See’s Candies, Inc.Apr 2026
Not yet quantified
VVerified
See's Candies says an unauthorized user accessed its network, encrypted files, and took data that later appeared on the dark web. The compromise reached both operations and personal information, turning one network foothold into disruption and disclosure. Encryption was the visible event; broad access to the underlying files was the structural failure.
Retail and Consumer
California AG breach notification
Initial attack type not disclosed · Impact ransomware confirmed + data theft
TrezorAug 2026
Not yet quantified
AAttested
13,689 hardware wallet buyers had their home addresses taken from a fulfilment partner. What capped the damage was a 90-day deletion rule, not a security control. Data you have already deleted cannot be stolen, and nobody puts that on a compliance dashboard.
Financial Services
Trezor discloses data breach affecting nearly 14,000 customers
Initial attack type third-party or supply chain inferred · Impact data theft confirmed
Universal Plant Services, LLCJun 2026
Not yet quantified
VVerified
Universal Plant Services found an unauthorized individual inside its network for several days with access to identity, license, and financial-account information. The notice says passwords were reset and accounts secured after discovery, but does not explain the entry path. The control question is why access to one network segment could reach several forms of high-value identity data.
Manufacturing
California AG breach notification
Initial attack type not disclosed · Impact data theft inferred
Columbia Justice MinistryAug 2026
Not yet quantified
AAttested
Ransomware hit Colombia's Justice Ministry five days before a presidential handover and one day after the national CERT warned this was coming. The warning was the control. It was issued, logged, and changed nothing.
Public Sector and Education
Ransomware Hits Colombian Justice Ministry Days Before Presidential Transition
Initial attack type not disclosed · Impact ransomware confirmed
LawCareAug 2026
Not yet quantified
AAttested
Lawyers in crisis contacted LawCare in confidence, all of it lived in Beacon CRM, and all of it is now assumed gone. No vendor questionnaire in existence asks whether the supplier left an AWS key in a public JavaScript file. [LawCare]
Professional and Business Services
UK legal mental health charity LawCare confirms database was compromised in hacking incident
Initial attack type exposed or misconfigured system inferred · Impact data theft inferred
Sunshine HealthAug 2026
Not yet quantified
AAttested
No system was breached at Sunshine Health. A caller posing as someone trusted asked an employee to hand over health-plan files, and the employee did. About 41,569 people had their names, birth dates, and medical histories walk out through a phone call. The security boundary was a person's willingness to help, and it held only as long as the caller sounded familiar.
Healthcare and Life Sciences
Data Breaches Reported by Sunshine Health; Health Payment Systems
Initial attack type phishing or social engineering confirmed · Impact data theft confirmed
Kovack Financial, LLCAug 2025
Not yet quantified
VVerified
Kovack reported unauthorized access involving email and sensitive personal information. Kovack took almost a full year to determine that it was necessary to contact their customers, even though they clearly acknowledge in their filing that they discovered the breach on 8/28/2025. The customer comes first, right?
Financial Services
California AG breach notification
Initial attack type not disclosed · Impact data theft confirmed
Health Sciences CentreAug 2026
Not yet quantified
AAttested
Ransomware took the HVAC and the door locks at Manitoba's largest hospital. The provincial auditor general flagged Shared Health's cybersecurity in 2024. Somebody measured this, wrote it down, and filed it. [Health Sciences Centre, Winnipeg]
Healthcare and Life Sciences
Ransomware attack on Health Sciences Centre affects doors, ventilation and air-conditioning
Initial attack type not disclosed · Impact ransomware confirmed + operational outage
FrameworkAug 2026
Not yet quantified
AAttested
Framework confirms customer data were exposed, and the headline is pretty much all you get: no named vector, no timeline, no data type, no actor. A breach notice with no information is not a disclosure. It's a stall tactic.
Technology and Software
Framework Admits Customer Data Were Exposed in Latest Security Breach
Initial attack type not disclosed · Impact data theft confirmed
LEVI STRAUSS & COAug 2026
Not yet quantified
VVerified
Levi Strauss disclosed that social engineering led to unauthorized access to three employee computers and the exfiltration of corporate files. The attacker did not need to defeat the whole enterprise; a few trusted endpoints were enough to turn legitimate access paths into a data-extraction path. When trust follows the user and device automatically, compromising either can inherit far more authority than the attacker ever earned.
Retail and Consumer
SEC 8-K, Item 8.01
Initial attack type phishing or social engineering confirmed · Impact data theft confirmed
Cushman & WakefieldApr 2026
Not yet quantified
VVerified
Cushman & Wakefield says a vishing attack opened the door to unauthorized activity in its environment. The incident was described as limited, but social engineering that produces unauthorized system access is still a cyber incident and the event was significant enough to trigger mandatory reporting to the California AG.
Real Estate and Construction
California AG breach notification
Initial attack type phishing or social engineering confirmed · Impact data theft inferred
Boston Healthcare for the Homeless ProgramOct 2025
Not yet quantified
VVerified
Boston Health Care for the Homeless Program disclosed that patient information was affected through a cybersecurity incident at a third-party provider. The infrastructure may have belonged to someone else, but the risk did not. Third-party architecture is still an attack surface when your data and your patients absorb the consequences.
Healthcare and Life Sciences
California AG breach notification
Initial attack type third-party or supply chain confirmed · Impact data theft inferred
American Addiction CentersMay 2026
breach at Salesforce
Not yet quantified
VVerified
American Addiction Centers lost data through its Salesforce environment, not its health-records application or internal network. Names, Social Security numbers, and brief health descriptions were still reachable because the outreach system had become another sensitive-data store. The boundary held around the clinical system and failed around the SaaS platform that the business trusted beside it.
Healthcare and Life Sciences
Washington AG breach notification
Initial attack type not disclosed · Impact data theft confirmed
Sawyer Savings BankAug 2026
Not yet quantified
AAttested
The notice names Sawyer Savings Bank and a disclosure date; it does not name an entry point, an actor, a record count, or the type of data reached.
Financial Services
Sawyer Savings Bank Branches Closed After Security Incident
Initial attack type not disclosed · Impact operational outage inferred
North Carolina PortsAug 2026
Not yet quantified
AAttested
North Carolina Ports confirms operations disrupted by a cyberattack. Operations were disrupted and impacted by gate mechanisms being activated. No threat groups have been identified for this event but ports are critical infrastructure and a desirable target for many types of adversaries.
Transportation and Logistics
North Carolina Ports confirms cyberattack disrupting operations
Initial attack type not disclosed · Impact operational outage confirmed
IEH CorpAug 2026
Not yet quantified
VVerified
The entire compromise was one employee's Microsoft 365 mailbox, opened by a phishing page that harvested a password because credentials were the only lock on the door. Inside sat purchase orders, engineering documentation, and potentially export-controlled technical data tied to the THAAD and Patriot programs: defense secrets kept in an ordinary inbox. No actor has been named and no theft confirmed, but the exposure was set long before the phishing page loaded. A missile-parts maker had filed regulated engineering where a single stolen login could reach it.
Manufacturing
SEC 8-K, Item 8.01
Initial attack type phishing or social engineering confirmed · Impact data theft inferred
Station Casinos, LLCMar 2026
Not yet quantified
VVerified
Station Casinos reported an external system breach involving unauthorized access and sensitive personal information. The interesting security question is not whether the company offered identity protection afterward; it is why unauthorized access was able to reach data worth protecting in the first place. Breach response happens after the architecture has already made its most important decision about trust.
Retail and Consumer
California AG breach notification
Initial attack type not disclosed · Impact data theft confirmed
New York City Regional Center, LLCMar 2026
Not yet quantified
VVerified
New York City Regional Center confirms a cybersecurity incident involving personal information, but says Massachusetts law prevents it from describing the nature of the event. That is enough to classify the event as cyber, but not enough to explain the failed control or the scope of access. The uncertainty belongs in the record rather than being filled with attack-story assumptions.
Public Sector and Education
California AG breach notification
Initial attack type not disclosed · Impact data theft inferred
Zenith BankAug 2026
Not yet quantified
AAttested
The notice for Zenith Bank's August 2026 incident contains no facts: no confirmed entry point, no named actor, no data types, no count of people affected. What remains is a disclosure obligation met with a placeholder, from an institution whose core function is holding other people's money and identity records. The duty to explain a breach is being treated as different from the duty to prevent one.
Financial Services
Zenith Bank customers told to immediately check their deposits after data breach
Initial attack type not disclosed · Impact data theft inferred
BeaconAug 2026
Not yet quantified
AAttested
Beacon CRM flared up as a news headline in the UK, and the headline is nearly all there is - no entry point, no actor, no data type, no count. What's confirmed is the scale: a single CRM widely used by charities, meaning one vendor's compromise fans out into every donor and beneficiary file it was trusted to hold. The platform was the perimeter for organizations that focused on the mission of helping other while depending on Beacon CRM to help them.
Public Sector and Education
Beacon CRM, Widely Used by Charities, Suffers Data Breach
Initial attack type not disclosed · Impact data theft confirmed
Grant County Public Hospital District #2Dec 2025
breach at Aesto
Not yet quantified
VVerified
Grant County's patient data lived inside Aesto Health's AWS infrastructure, one vendor holding records for at least two dozen hospital clients at once. Hackers moved through that shared environment for sixteen days in December 2025, pulling names, Social Security numbers, driver's license numbers, financial accounts, and medical and insurance details, all told, touching 9.5 million people. The source names no entry point and no attacker; what it names instead is the design, one cloud tenancy standing in as the perimeter for two dozen separate hospitals. Concentration isn't efficiency when a single vendor breach becomes two dozen hospital breaches wearing one name.
Healthcare and Life Sciences
Washington AG breach notification
Initial attack type third-party or supply chain inferred · Impact data theft confirmed
English National BalletAug 2026
breach at Beacon CRM
Not yet quantified
AAttested
English National Ballet's headline confirms a cyber attack and a possible breach; entry point, actor, and what data may have been reached go unnamed in the source. The National Ballet finds itself unable to answer these questions because they don't have them. They are one of the many clients of Beacon CRM.
Public Sector and Education
English National Ballet suffers possible data breach following cyber attack
Initial attack type not disclosed · Impact data theft inferred
Liechtenstein Office of JusticeAug 2026
Not yet quantified
AAttested
EU anti-money-laundering rules require a single register naming the humans behind Liechtenstein's companies, foundations, and trusts. Overnight on 30 July, copies covering 31,000 entities left. The transparency measure worked exactly as designed, for the adversaries.
Public Sector and Education
Cyberattack hits Liechtenstein's anti-money laundering data register, Vaduz says
Initial attack type not disclosed · Impact data theft confirmed
Brinks HomeAug 2026
Not yet quantified
AAttested
Brinks Home's disclosure names a leak, not a cause: no entry point, no actor, no data type, no count. Just files surfacing after the fact. Announcing a leak isn't transparency. Brinks should know better than most that sounding an alarm isn't the same as responding to one.
Retail and Consumer
Brinks Home Discloses Data Breach as Hackers Leak Files
Initial attack type not disclosed · Impact data theft inferred
Unlimited Technology SystemsAug 2026
Not yet quantified
AAttested
3.8 million patients, from five days in October 2025, took until July 2026 to size. UTS says an unauthorized actor copied patient data from its commercial data center during five days in October 2025. The scale came from concentration: a billing vendor that most patients never chose held identity, insurance, and medical data for many providers in one place.
Healthcare and Life Sciences
Unlimited Technology Systems breach impacts 3.8 million people
Initial attack type not disclosed · Impact data theft confirmed
AMGEN INCJul 2026
Not yet quantified
VVerified
The files that left Amgen never sat on Amgen's network: patient health records, research, and intellectual property lived in third-party cloud storage, and that is where the theft happened. The company has named no vendor, no access path, and no count of the people exposed, the standard silence of a breach whose front door belongs to someone else. When the perimeter is a contract with a cloud provider, the forensics begin on property the victim never controlled.
Healthcare and Life Sciences
SEC 8-K, Item 1.05
Initial attack type third-party or supply chain inferred · Impact data theft confirmed
Stanislaus County Health Services AgencyDec 2025
breach at Aesto
Not yet quantified
VVerified
Stanislaus County Health Services Agency was exposed through Aesto, the vendor that stored healthcare data in Amazon Web Services. An unauthorized actor may have accessed or acquired protected health information during the vendor's network incident. The county did not need to be breached directly; inherited access through the vendor was enough.
Public Sector and Education
California AG breach notification
Initial attack type third-party or supply chain confirmed · Impact data theft inferred
Microcode, Inc.Jan 2026
breach at CommonSpirit Health
Not yet quantified
VVerified
MicroCode experienced ransomware on a server that hosted CommonSpirit Health's tracking database and documents. Unauthorized access lasted for months, but the investigation could not confirm whether the data was viewed or taken. The uncertainty should be preserved: this is a confirmed system compromise with sensitive data in scope, not a confirmed exfiltration.
Technology and Software
Washington AG breach notification
Initial attack type not disclosed · Impact ransomware confirmed
HEALTHSTREAM INCJul 2026
Not yet quantified
VVerified
HealthStream's cloud platforms stayed up and intact, which was never where the data went missing. The intrusion landed on the corporate file servers, where copies of credentialing data for roughly 75 customers sat staged for conversion, troubleshooting, and analytics, alongside employee and billing records. No actor has surfaced and no files were encrypted; the exposure came not through the product but through the copies the product was never meant to spawn.
Technology and Software
SEC 8-K, Item 8.01
Initial attack type not disclosed · Impact data theft confirmed
ANALOG DEVICES INCJun 2026
Not yet quantified
VVerified
Analog Devices lost files from its systems on June 23, 2026, and disclosed neither the door the intruders came through nor the data they carried out. The only count belongs to the people who took it: the extortion group ExfilSquad claims about 570,000 records of customer names and home addresses, a figure the company holds at arm's length as a separate, unverified matter. A breach described only by its thieves is confirmed without being explained.
Technology and Software
SEC 8-K, Item 8.01
Initial attack type not disclosed · Impact data extortion inferred + data theft · Actor ExfilSquad
Clinical Registry SolutionsApr 2026
Not yet quantified
VVerified
Clinical Registry Solutions confirmed unauthorized network access and acquisition of files containing St. Mary's patient information.
Healthcare and Life Sciences
California AG breach notification
Initial attack type not disclosed · Impact data theft confirmed
Sunrise CompanyApr 2026
Not yet quantified
VVerified
Sunrise Company determined that an unauthorized actor acquired files from its network after suspicious activity was detected. Once an attacker can move from presence to acquisition, the system has failed at more than prevention; it has failed to constrain what unauthorized access can do. Good security assumes compromise happens and designs the blast radius accordingly.
Real Estate and Construction
California AG breach notification
Initial attack type not disclosed · Impact data theft confirmed
Minnesota State OfficialsJul 2026
Not yet quantified
AAttested
Minnesota officials disclosed a coordinated cyberattack targeting more than 30 community water systems between July 26 and July 27, 2026. Several communities, including Braham, Plymouth, South St. Paul and Maple Plain, reported disruptions to operational technology supporting water treatment, although officials stated there was no impact to drinking water quality or public safety. In Braham, the attack temporarily shut down the city's water treatment plant until operators restored service using manual processes. The incident is one of the largest coordinated cyberattacks against U.S. municipal water systems publicly disclosed to date and underscores the continued targeting of critical infrastructure.
Public Sector and Education
Authorities investigating a coordinated cyberattack against Minnesota water systems
Initial attack type not disclosed · Impact operational outage confirmed
UnitelJul 2026
Not yet quantified
AAttested
Angola's largest telecommunications provider suffered a cyberattack that disrupted nationwide voice, mobile data, and internet services just one day before its planned stock market listing. The incident affected more than 21 million subscribers, forcing the company to activate incident response and recovery efforts while services remained degraded. Unitel has not disclosed the attack vector, threat actor, or whether customer data was compromised, but did proceed with their public offering.
Telecommunications
Angola's Unitel hit by cyberattack ahead of stock market debut
Initial attack type not disclosed · Impact operational outage confirmed
SPay Inc dba Stack SportsMay 2026
Not yet quantified
VVerified
Stack Sports discovered unauthorized code inside its Sports Affinity payment platform that captured payment-card information entered during checkout. The company operates registration and payment systems used by youth and amateur sports leagues, meaning affected transactions may involve parents paying participation fees for children. The malicious code was reportedly present from May 8 until June 8, 2026, creating a month-long payment-card skimming window. The number of affected customers remains undisclosed, but the platform’s role across youth sports organizations gives the incident a potentially broad consumer impact.
Technology and Software
California AG breach notification
Initial attack type not disclosed · Impact data theft confirmed + financial theft or fraud
JRK Property Holdings, Inc.Mar 2026
Not yet quantified
VVerified
JRK Property Holdings reported unauthorized activity in its IT environment and potential access to sensitive files, with the event tied in public reporting to extortion activity. The extortion is the business model layered on top of the real failure: the attacker obtained enough access to make stolen data useful as leverage. Once unauthorized access can become durable access, the attacker gets to decide what the incident becomes next.
Real Estate and Construction
Washington AG breach notification
Initial attack type not disclosed · Impact data extortion inferred
Bank of BarodaJul 2026
Not yet quantified
AAttested
State-owned Bank of Baroda (BoB) on Monday, July 27, confirmed a security incident that led to unauthorised access to “certain data” by threat actors. The incident involved comprise of an employee’s email account, Bank of Baroda said. Reports suggest that the exfiltrator dumped 1TB on the internet, for free.
Financial Services
Bank of Baroda confirms data breach, says employee email account compromised in hack
Initial attack type compromised credentials confirmed · Impact data theft confirmed
Triple-AJul 2026
Not yet quantified
AAttested
Triple- A, a Singapore-based company said it unauthorized access on July 25th, 2026 and temporarily placed certain services into maintenance mode for about three hours while it secured the affected infrastructure. Triple-A did not disclose the amount lost or explain how the wallets were compromised. Onchain investigator Specter previously estimated the losses at about $11.8 million.
Financial Services
Triple-A Confirms Treasury Wallet Breach After Reported $11.8M Loss
Initial attack type not disclosed · Impact financial theft or fraud confirmed + operational outage
Eyemart Express, LLCFeb 2026
Not yet quantified
VVerified
Eyemart Express confirmed a February cyberattack that exposed customer information ranging from identity data to vision and insurance records.
Healthcare and Life Sciences
Washington AG breach notification
Initial attack type not disclosed · Impact data theft confirmed
Bridgeway Benefit Technologies LLCMar 2026
Not yet quantified
VVerified
Bridgeway traced the incident to a suspected employee email compromise that opened access to its systems from March to May. Benefit-plan participant data, including Social Security numbers for some people, may have been involved. Email identity was the security boundary. When that identity failed, the access lasted far longer than the initial deception.
Healthcare and Life Sciences
Washington AG breach notification
Initial attack type phishing or social engineering inferred · Impact data theft confirmed
Devereux FoundationNov 2025
Not yet quantified
VVerified
Devereux Advanced Behavioral Health disclosed a ransomware attack involving information belonging to patients, employees, family members, donors and business partners. The potentially exposed data included combinations of Social Security numbers, financial information, government identification, medical information and health insurance information. Devereux provides behavioral health and developmental disability services across multiple states, giving the incident a broad geographic footprint. The attack highlights the impact ransomware is having on organizations serving vulnerable patient populations.
Healthcare and Life Sciences
California AG breach notification
Initial attack type not disclosed · Impact ransomware confirmed + data theft
UPBOUND GROUP, INC.Jul 2026
$13M
Spent responding & recovering
Direct expense
Upbound rated the stolen customer information non-sensitive, right up until it was enough to open roughly $13 million in fraudulent Acima leases and walk the merchandise out the door. The breach turned lease-to-own approval into a front door for anyone holding the right paperwork: identity verification that trusted data the company itself had graded as low value. No group has claimed it and no customer count has surfaced, leaving the theft measured only by the fraud it financed.
Verified: the linked document states this figure.
Professional and Business Services
SEC 8-K, Item 8.01
Initial attack type not disclosed · Impact data theft confirmed + financial theft or fraud
Quantified 9 days after disclosure.
What the company has said it cost
The company’s own disclosed figure, as it changed over time. The loss on the record is this same figure, typed and categorized.
2026-07-31$13MVVerifiedSEC 10-Q ↗
FIVE BELOW, INCJul 2026
Not yet quantified
VVerified
Five Below traced the intrusion to a single employee's company laptop, reached not by an exploit but by a threat actor who talked the person into granting access, and files were exfiltrated before the anomaly was ever flagged. The company's comfort is the blast radius: one machine, no PII, nothing else touched, a tidy story about a perimeter that turned out to be one talked-past employee. Who took the files, and how many, the filing does not say.
Retail and Consumer
SEC 8-K, Item 8.01
Initial attack type phishing or social engineering confirmed · Impact data theft confirmed
Chick-Fil-AJun 19
Not yet quantified
AAttested
According to the notification letter sent to affected customers, hackers launched an automated attack against Chick-fil-A's website and mobile application between June 17 and June 19 using credentials obtained from a third-party source. Chik-Fil-A has not disclosed the number of customers impacted and has filed incident notifications with several State AG offices around the US.
Retail and Consumer
Newsweek
Initial attack type compromised credentials confirmed · Impact data theft inferred
NichireiJul 2026
Not yet quantified
AAttested
The ransomware attack caused widespread chaos, directly impacting approximately 5,000 corporate clients. The breach paralyzed cold storage warehouse logistics and frozen food shipments nationwide, forcing major retailers to scramble.
Wholesale and Distribution
Company announcement
Initial attack type not disclosed · Impact ransomware confirmed + operational outage
Origin EnergyJul 2026
Not yet quantified
AAttested
Origin Energy confirmed that full bank account details belonging to 60 customers were accessed in a July breach. While 60 may seem small compared to the 900,000 Australian customers impacted by this massive breach, it isn't small for each one of those 60 people who took the hit for Origin Energy's lack of stewardship.
Energy and Utilities
Origin Energy says bank account details of 60 customers accessed in July data breach
Initial attack type not disclosed · Impact data theft confirmed
SunoJul 2026
Not yet quantified
IInferred
404 Media disclosed that Suno was breached in Nov 2025, as confirmed by HaveIBeenPwnd. Suno has not yet publicly disclosed the cyberattack or notified individuals that their information was taken, and has refused to answer reporter questions on this matter.
Technology and Software
Security analyst report
Initial attack type not disclosed · Impact data theft inferred
PaidworkJul 2026
Not yet quantified
AAttested
Gig-work platform Paidwork disclosed that a breach exposed the personal and financial information of approximately 23 million users after a stolen database surfaced publicly. The leaked data reportedly includes names, email addresses, phone numbers, physical addresses, dates of birth, banking and payout information, device details, IP addresses, and bcrypt-hashed passwords.
Technology and Software
Paidwork data breach reportedly exposes 23M accounts and bank data
Initial attack type not disclosed · Impact data theft confirmed
EcopetrolJul 2026
Not yet quantified
IInferred
The Colombian state-controlled ‌energy company Ecopetrol announced on Friday that a cyberattack resulted in the theft of data tied to about 3,300 user accounts ​and that it could not "guarantee" the breach would ​not have a "material adverse" financial impact.
Energy and Utilities
News: Reuters
Initial attack type not disclosed · Impact data theft confirmed
CLOVER HEALTH INVESTMENTS, CORP. /DEJul 2026
Not yet quantified
VVerified
Clover Health says social engineering compromised three employee accounts with access to member PII and PHI, although claims and corporate financial systems were not accessed. Four putative class actions followed, and Clover says it cannot yet reasonably estimate the possible loss or range of loss. Three identities were enough to create a regulated-data event and litigation exposure; that is the problem with treating identity as proof of trust instead of something that has to be continuously verified.
Financial Services
SEC 8-K, Item 8.01
Initial attack type phishing or social engineering confirmed · Impact data theft confirmed
The Estée Lauder CompaniesAug 2025
breach at Oracle
Not yet quantified
VVerified
Estée Lauder determined that an unauthorized third party gained access to its Oracle E-Business Suite environment and obtained employee-related personal information. The data set reportedly included the identity, financial, health and employment ingredients attackers leverage for future fraud and social engineering campaigns.
Retail and Consumer
Washington AG breach notification
Initial attack type not disclosed · Impact data theft confirmed
ZenPatient, Inc.Dec 2025
Not yet quantified
VVerified
ZenPatient found that an unauthorized actor had access to or copied data over a period lasting more than two months. The notice does not explain how the actor entered or why the activity persisted that long. The important fact is not that an attacker was patient; it is that the environment allowed patience to work.
Healthcare and Life Sciences
Washington AG breach notification
Initial attack type not disclosed · Impact data theft confirmed
AbbottJul 2026
Not yet quantified
IInferred
Abbott did not disclose what kind of information was accessed. The company declined to respond further to MedTech Dive’s request for comment regarding when the attack was discovered and what kind of information was accessed.
Healthcare and Life Sciences
News: MedTech Dive
Initial attack type not disclosed · Impact data theft inferred
Coca Cola CompanyJul 2026
breach at Fairlife
Not yet quantified
VVerified
The Coca-Cola Company disclosed that Fairlife, a dairy subsidiary, experienced a ransomware event. The filing does not establish when the attack occurred or what it may cost, so the incident is recorded against its July 16, 2026 disclosure date.
Manufacturing
SEC 8-K, Item 8.01
Initial attack type not disclosed · Impact ransomware confirmed
Corroborating records
Coca-ColaIInferredNews: CBS News ↗
DentaQuest LLCMay 2026
Not yet quantified
VVerified
Between May 17 and May 20 attackers accessed and exfilitrated names, addresses, Social Security numbers, member identification numbers, Medicaid and Medicare numbers, diagnosis, treatment details and billing information for as many as 23.4 million patients. Notifications have been sent to at least 4.5 million people.
Healthcare and Life Sciences
California AG breach notification
Initial attack type not disclosed · Impact data theft confirmed
Corroborating records
DentaQuest, LLCVVerifiedWashington AG breach notification ↗
DentaQuestAAttestedDentaQuest Starts Notifying 15 Million+ Individuals About May 2026 Cyber Incident ↗
StadlerJul 2026
Not yet quantified
IInferred
Stadler refuses to pay ransom to the Everest hacking group, claims core IT systems were not hacked. ENISA warned that the railway sector’s growing strategic importance was outpacing its ability to manage cyber risks. Findings point to weaknesses highlighted by the Stadler breach. Only 35% of railway companies surveyed regularly assessed the effectiveness of their cybersecurity controls, while 50% did so on an ad hoc basis. Just 25% regularly tested business-continuity and disaster-recovery arrangements.
Transportation and Logistics
Media report
Initial attack type not disclosed · Impact data extortion inferred · Actor Everest
Ernst & YoungJul 2026
Not yet quantified
AAttested
EY says it detected unusual activity on April 23 and determined that the attacker accessed the platform between March 28 and April 12, downloading multiple documents. The ShinyHunters extortion gang added Ernst & Young to its data leak site, claiming it conducted the attack and threatened to release the allegedly stolen data if the company does not contact the group by July 31, 2026. E&Y took more than 3 months to disclose the cyber incident.
Professional and Business Services
Ernst & Young data breach claimed by ShinyHunters extortion gang
Initial attack type not disclosed · Impact data theft confirmed + data extortion · Actor ShinyHunters
Madera Community HospitalMay 2025
Not yet quantified
VVerified
Madera Community Hospital determined that an unauthorized party accessed its network and likely removed files containing patient personal and health information on May 28 and 29, 2025. The hospital completed its initial forensic determination in June 2025 but did not begin notifying patients until approximately one year later. The final number of affected patients has not been publicly established in the reporting reviewed.
Healthcare and Life Sciences
California AG breach notification
Initial attack type not disclosed · Impact data theft confirmed
The Washington PostJul 2025
breach at Oracle
Not yet quantified
VVerified
The Washington Post was compromised through a previously unknown vulnerability in Oracle E-Business Suite, allowing data to be accessed and acquired over roughly six weeks. The software flaw was Oracle's, but the exposure came from the authority and data concentrated behind that application. A shared platform vulnerability became a direct path into each customer's retained records.
Media and Entertainment
Washington AG breach notification
Initial attack type software vulnerability confirmed · Impact data theft confirmed
Centers Lab NJ LLCJul 2026
Not yet quantified
IInferred
Healthcare diagnostics company Centers Laboratory (Centers Lab NJ LLC) has informed the US government that a data breach discovered nearly one year ago affects more than 540,000 individuals.
Healthcare and Life Sciences
News: SecurityWeek
Initial attack type not disclosed · Impact data theft confirmed
FiestaJul 2026
Not yet quantified
AAttested
The Las Vegas-based insurance and tax-services franchisor said it became aware on June 9, 2025, that systems within its network environment had been affected by a cyber incident. Following a forensic investigation and an "extensive data review," it was determined on June 26, 2026, that potentially accessed or acquired files contained personal information. While it took a year for Fiesta to determine that customer data had been exposed, Fiesta violated no disclosure laws as written due to their efforts to notify customers within 17 days of the confirmation that customer data had been impacted.
Financial Services
Fiesta Insurance took a year to identify breached customer data - report
Initial attack type not disclosed · Impact data theft confirmed
River Financial CorpJun 2026
Not yet quantified
VVerified
River Financial said an unauthorized actor got into its network and ransomware was deployed across portions of the server environment. The later update added that data was removed, which pivots this from a disruption story into a theft story too. River Financial publicly stated that ue to the preliminary nature of the forensic investigation and the early stages of the legal proceedings, management is currently unable to predict the ultimate outcome of these matters or reasonably estimate the amount or range of potential financial loss, if any, that may result.
Financial Services
SEC 8-K, Item 1.05
Initial attack type not disclosed · Impact ransomware confirmed + data theft
SR Bancorp, Inc.Jul 2026
Not yet quantified
VVerified
Other Events Mercadien, P.C. CPAs ("Mercadien"), which provides internal audit-related services to SR Bancorp, Inc (the "Company") and Somerset Regal Bank (the "Bank"), has discovered a data security incident in which an unauthorized actor accessed and acquired certain files on Mercadien's computer servers.
Financial Services
SEC 8-K, Item 8.01
Initial attack type not disclosed · Impact data theft confirmed
Columbia Machine, Inc.Mar 2026
Not yet quantified
VVerified
Columbia Machine confirmed unauthorized network access and file theft, then initially concluded that only non-confidential documents were involved. A later review found additional copied files containing personal information. The incident exposed a familiar weakness: the company could see files leave before it could reliably say what those files meant.
Manufacturing
Washington AG breach notification
Initial attack type not disclosed · Impact data theft confirmed
Mount Royal UniversityJul 2026
Not yet quantified
IInferred
Mount Royal University Confirms Data Stolen in Ransomware Attack.
Public Sector and Education
News: SecurityWeek
Initial attack type not disclosed · Impact ransomware confirmed + data theft
AccentureJul 2026
Not yet quantified
IInferred
Accenture faces massive data breach that could put clients at risk.
Professional and Business Services
News: Cybersecurity Dive
Initial attack type not disclosed · Impact data theft confirmed
USA DeBusk LLCJul 2026
Not yet quantified
VVerified
USA DeBusk says an unauthorized third party accessed its systems and obtained a broad mix of identity, financial, credential, and health information. The range of data suggests that compromise of the environment crossed several information boundaries at once. The notice confirms the result but provides little evidence that those data types were meaningfully segmented before the incident.
Professional and Business Services
California AG breach notification
Initial attack type not disclosed · Impact data theft confirmed
1Life Healthcare, Inc. (One Medical, Iora Health)Jun 2026
Not yet quantified
VVerified
One Medical disclosed unauthorized access to a third-party file-storage system containing archived patient information from its legacy Seniors business. Archived data is still data and data is valuable to the adversary. Data outlives applications, vendors and acquisitions; security architectures need to assume that every retained copy remains part of the attack surface.
Healthcare and Life Sciences
Washington AG breach notification
Initial attack type third-party or supply chain inferred · Impact data theft confirmed
AdaptHealth Corp.Jun 2026
Not yet quantified
VVerified
A social-engineering attack compromised a third-party contractor’s user session and gave the attacker access to AdaptHealth cloud applications, patient systems and external EHR portals. Data was exfiltrated, including patient PII/PHI and insurance-billing password data. This is a clean cyber incident: compromised identity, unauthorized access and confirmed data theft.
Healthcare and Life Sciences
SEC 8-K, Item 1.05
Initial attack type phishing or social engineering confirmed · Impact data theft confirmed
Markel InsuranceMar 2026
Not yet quantified
VVerified
Markel Insurance disclosed a cybersecurity incident involving unauthorized access to portions of its environment, although the company has released limited information regarding the overall scope of the breach. Public disclosures have not established the total number of affected individuals or whether policyholder information was involved. As one of the world's largest specialty insurers, any compromise involving underwriting, claims or broker information could have broader implications than a typical employee data breach. Additional details will determine the long-term significance of this incident.
Professional and Business Services
California AG breach notification
Initial attack type not disclosed · Impact data theft inferred
Child Care Resource CenterOct 2016
Not yet quantified
VVerified
The Child Care Resource Center disclosed that an employee allegedly forwarded organizational files to an external email account over a period spanning nearly nine years, from 2016 through 2025. The nonprofit serves thousands of children and families throughout Los Angeles County and administers childcare assistance and family support programs. While the total number of affected individuals has not been publicly established, the incident potentially involves highly sensitive information relating to children, parents, providers and employees. The duration of the unauthorized activity makes this disclosure particularly noteworthy.
Healthcare and Life Sciences
California AG breach notification
Initial attack type insider confirmed · Impact data theft confirmed
MedtronicJul 2026
Not yet quantified
IInferred
Medtronic Notifies 3.8M Individuals About April 2026 Cyberattack.
Healthcare and Life Sciences
News: The HIPAA Journal
Initial attack type not disclosed · Impact data theft inferred
AFLAC INCJun 2026
breach at Aflac Life Insurance Japan Ltd.
Not yet quantified
VVerified
Other Events. On June 30, 2026, Aflac Life Insurance Japan Ltd. ("Aflac Japan"), a wholly owned subsidiary of Aflac Incorporated, a Georgia corporation (the "Company"), issued a press release announcing that, on June 25, 2026, Aflac Japan discovered an unauthorized third-party had unlawfully accessed certain of Aflac Japan systems and data.
Healthcare and Life Sciences
SEC 8-K, Item 8.01
Initial attack type not disclosed · Impact data theft inferred
Monmouth UniversityFeb 2026
Not yet quantified
VVerified
Monmouth University disclosed a ransomware-related incident involving personal, financial and medical information belonging to students, employees and others connected with the institution. The PEAR ransomware group claimed that it removed approximately 16 terabytes of data, although that figure has not been independently confirmed by the university. The intrusion reportedly occurred in February 2026, with the university later facing multiple lawsuits over the exposure. The combination of student records, health information and a potentially enormous volume of stolen data makes this more significant than a routine university breach notice.
Public Sector and Education
California AG breach notification
Initial attack type not disclosed · Impact ransomware confirmed + data theft · Actor PEAR ransomware group
North Los Angeles County Regional CenterNov 2024
Not yet quantified
VVerified
The North Los Angeles County Regional Center disclosed a ransomware attack affecting approximately 298,600 individuals. The compromised information reportedly included combinations of names, Social Security numbers, medical information, health insurance information and other personal data relating to individuals receiving developmental disability services. The organization stated that attackers accessed and copied files before encrypting systems. Given the size of the affected population and the sensitivity of the data, this represents one of the larger healthcare-related disclosures of the year.
Healthcare and Life Sciences
California AG breach notification
Initial attack type not disclosed · Impact ransomware confirmed + data theft
Kubota North America CorporationMar 2026
Not yet quantified
VVerified
Kubota North America disclosed that attackers accessed portions of its network and obtained employee human resources information after maintaining access for several weeks. The compromised information reportedly included Social Security numbers, driver's license information, direct deposit details, benefits information and other employment records affecting employees and their dependents.
Manufacturing
California AG breach notification
Initial attack type not disclosed · Impact data theft confirmed
Sierra Management GroupJun 2026
Not yet quantified
VVerified
Sierra Management Group, a healthcare practice management provider, disclosed a ransomware attack after attackers reportedly accessed its network for several months. Public reporting indicates the incident affected approximately 38,900 individuals, while the ransomware group claimed to have stolen roughly 100 GB of information. Because Sierra provides management services for medical practices, the breach may affect patients across multiple healthcare organizations. The full scope of the impacted practices has not yet been publicly detailed.
Healthcare and Life Sciences
California AG breach notification
Initial attack type not disclosed · Impact ransomware confirmed + data theft
Nissan North America Inc.May 2026
Not yet quantified
VVerified
Nissan North America disclosed a newer incident involving its Oracle PeopleSoft environment, which is used to maintain employee payroll and human-resources information. Potentially exposed records reportedly included Social Security numbers, banking information, tax information and other employment data belonging to current and former workers. This follows Nissan’s separate 2023 breach affecting more than 53,000 people, which resulted in a $1.5 million proposed class-action settlement in 2026.
Manufacturing
California AG breach notification
Initial attack type not disclosed · Impact data theft confirmed
Yellow CorporationMar 2025
Not yet quantified
VVerified
Yellow Corporation disclosed a data breach affecting approximately 13,000 current and former employees and dependents after the company had already entered bankruptcy proceedings. The compromised information reportedly included Social Security numbers, financial account information, government identification and health insurance information. Although the incident is modest in size compared to other breaches, it raises unique challenges because victims are seeking assistance from a company that has largely ceased operations. The disclosure demonstrates that cybersecurity obligations continue even after a company's business has ended.
Transportation and Logistics
California AG breach notification
Initial attack type not disclosed · Impact data theft confirmed
MCBSJul 2026
Not yet quantified
AAttested
MCBS confirmed that there had been unauthorized network access between September 22 and September 25, 2025, and files containing protected health information may have been viewed or exfiltrated from its network. The review of the affected data was completed on May 28, 2026, some 8 months after the network intrusion.
Healthcare and Life Sciences
MCBS Announces Cybersecurity Incident Impacting 1.26M Individuals
Initial attack type not disclosed · Impact data theft confirmed
Mercor.io CorporationMar 2026
Not yet quantified
VVerified
Mercor disclosed a breach tied to the compromise of its LiteLLM environment that reportedly exposed candidate records, interview videos, source code, API keys and internal communications. Public reporting has alleged that hundreds of gigabytes of applicant data and multiple terabytes of interview recordings and other company information were involved, although Mercor has not confirmed those figures. The incident is notable because it potentially impacts both job candidates and the AI supply chain supporting enterprise customers. Multiple class action lawsuits have already been filed.
Technology and Software
California AG breach notification
Initial attack type not disclosed · Impact data theft confirmed
AgelessRxJun 2026
Not yet quantified
VVerified
Ageless RX experienced a data loss through their help desk system after bad actors gained access to it from April 17 to April 22, 2026. Ageless RX reported the breach in late June with no details on how many patient records were exposed. As with many of these incidents in healthcare, the only evidence of the incident beyond the filing are services being offered by the legal community to sue the breached healthcare company.
Healthcare and Life Sciences
California AG breach notification
Initial attack type not disclosed · Impact data theft confirmed
8X8 INCJun 2026
breach at Klue
Not yet quantified
VVerified
8x8 learned on June 13, 2026, that a threat actor exploited the Klue Labs application programming interface plugged into its Salesforce CRM. The filing names the vendor and the integration; it says nothing about what data moved through that connection or how many records. Klue has not said how many of its hundreds of customers are affected. Several companies have come forward to confirm they had data stolen during the attack, including Gong, Jamf, HackerOne, Insurity, OneTrust, Recorded Future, Snyk, Sprout Social, and Tanium.
Technology and Software
SEC 8-K, Item 1.05
Initial attack type third-party or supply chain confirmed · Impact data theft inferred
Tennessee Pathology GroupJul 2026
Not yet quantified
AAttested
An investigation was launched on December 1, 2025, when anomalous activity was identified within its computer network. During the course of the investigation, unauthorized network access was confirmed. It is unclear from the breach notice when the unauthorized access occurred or for how long the network was compromised. The review of the exposed data was completed on April 27, 2026, when it was confirmed that personal and protected health information had been exposed. Notification letters were mailed to the affected individuals on June 23, 2026, and complimentary credit monitoring and identity theft protection services have been offered to certain individuals. Over 169,000 customer and patient records were exposed.
Healthcare and Life Sciences
Tennessee Pathology Group Announces 170K-record Data Breach
Initial attack type not disclosed · Impact data theft confirmed
Xsolis, Inc.Jan 2026
Not yet quantified
VVerified
Healthcare technology provider Xsolis disclosed a phishing-related breach affecting approximately 1.4 million individuals, making it one of the largest healthcare data breaches reported in 2026. The company provides AI-powered utilization management and revenue cycle services to hospitals and health systems, meaning many affected patients had likely never heard of Xsolis despite their information being entrusted to the company by their healthcare providers. The compromised data reportedly included names, dates of birth, Social Security numbers, health insurance information and medical treatment information, impacting patients from organizations including Mayo Clinic, UW Medicine, VHC Health and numerous other healthcare systems.
Healthcare and Life Sciences
California AG breach notification
Initial attack type phishing or social engineering confirmed · Impact data theft confirmed
iRhythm Holdings, Inc.Jun 2026
$700K
Spent responding & recovering
Direct expense
Unauthorized activity struck iRhythm Holdings' data inside 'certain third-party-hosted business applications' on June 8, 2026, a phrase that names no vendor, no entry point, and no data type. The filing quantifies the damage at $700K before it quantifies what was actually taken. Outsourcing the application does not outsource the exposure; the perimeter is wherever the vendor's login page sits. A breach description this vague is not discretion; it is a structural admission that nobody yet knows the shape of the failure.
Verified: the linked document states this figure.
Healthcare and Life Sciences
SEC 8-K, Item 1.05
Initial attack type third-party or supply chain inferred · Impact data theft inferred + financial theft or fraud
Quantified 52 days after disclosure.
What the company has said it cost
The company’s own disclosed figure, as it changed over time. The loss on the record is this same figure, typed and categorized.
2026-08-06$700KVVerifiedSEC 10-Q ↗
Nelson UniversityMar 2025
Not yet quantified
VVerified
Nelson University determined that an unauthorized actor had access to its systems for roughly two weeks, with sensitive identity and financial information implicated and later reporting connecting the event to ransomware. The lesson is not that universities need another awareness campaign; it is that unauthorized access was able to persist long enough to become consequential. Systems built around static trust are always giving attackers time they did not earn.
Public Sector and Education
Washington AG breach notification
Initial attack type not disclosed · Impact data theft confirmed + ransomware
Lumexa ImagingMar 2026
Not yet quantified
VVerified
Lumexa Imaging disclosed that unauthorized access to a third-party vendor environment resulted in patient information being exposed. Lumexa operates more than 180 imaging centers across 13 states, making the potential downstream impact significant even though the total number of affected patients has not yet been publicly confirmed. The compromised information reportedly included patient documents associated with diagnostic imaging services. The incident illustrates the continuing cybersecurity risks posed by third-party service providers in healthcare.
Healthcare and Life Sciences
Washington AG breach notification
Initial attack type third-party or supply chain confirmed · Impact data theft confirmed
Columbia Pacific Advisors, LLCNov 2025
Not yet quantified
VVerified
Columbia Pacific Advisors experienced a breach and data exfiltration event that may include a combination of certain individuals’ names, Social Security number, date of birth, driver’s license, passport number, US alien registration number, financial account information, taxpayer identification, number, system access information, health insurance information, and medical information. The numbers of patient records and the methods through which Columbia Pacific Advisors were breached have not been disclosed.
Healthcare and Life Sciences
Washington AG breach notification
Initial attack type not disclosed · Impact data theft confirmed
Popular, IncJun 2026
breach at Evertec
Not yet quantified
VVerified
Popular, Inc. was pulled into a cybersecurity incident through Evertec, the third-party provider it relies on for core financial transaction processing and IT services. The compromise affected data belonging to Banco Popular de Puerto Rico, illustrating a familiar problem: outsourcing the technology does not outsource the exposure. The attack did not need to breach Popular directly; compromising a trusted provider was enough to reach the bank’s data.
Financial Services
SEC 8-K, Item 8.01
Initial attack type third-party or supply chain confirmed · Impact data theft inferred
EVERTEC, Inc.Jun 2026
Not yet quantified
VVerified
Evertec reported potential unauthorized access to customer data. This is the second breach in less than 12 months for Evertec, this time impacting Puerto Rico and their respective customers instead of Brazil. Rather than reporting this as a 1.05 material incident, Evertec reported it as an 8.01 (other event), even though their Pixa breach just resulted in a 10Q financial disclosure of losses associated to the 2025 Pixa event.
Financial Services
SEC 8-K, Item 8.01
Initial attack type not disclosed · Impact data theft confirmed
Lansing Community CollegeFeb 2025
Not yet quantified
VVerified
Lansing Community College disclosed that hackers used compromised credentials to access systems containing information on approximately 174,307 people. The affected population included current and former students, prospective students, employees, vendors and others whose information had accumulated in college systems. Exposed data reportedly included names, addresses, dates of birth, Social Security numbers and driver’s-license information. The college discovered the incident in February 2025 but did not begin broad notification until more than a year later.
Public Sector and Education
California AG breach notification
Initial attack type compromised credentials confirmed · Impact data theft confirmed
Mariner Wealth Advisors, LLCNov 2025
Not yet quantified
VVerified
Mariner Wealth Advisors disclosed that approximately 8,995 individuals were affected after attackers gained access to cloud-based accounts used by several employees. The exposed information reportedly included names, Social Security numbers, dates of birth and certain financial account information, although the firm stated that its core investment platforms were not compromised. Notifications were issued several months after suspicious activity was first detected.
Financial Services
California AG breach notification
Initial attack type not disclosed · Impact data theft confirmed
Oncology Institute, Inc. (TOI, DFPH, TOIIW)May 2026
Not yet quantified
VVerified
The Oncology Institute's patient data never lived only at the Oncology Institute; it sat inside a shared claims clearinghouse that reporting ties to Cognizant's TriZetto, where an intruder had been reading records since late 2024 before anyone noticed. Route a hundred clinics and two million patients through one vendor, and that vendor becomes the front door. TOI has not said how many were exposed or what left, only that Kroll is mailing the notices: the silence is now the disclosure.
Healthcare and Life Sciences
SEC 8-K, Item 1.05
Initial attack type not disclosed · Impact data theft inferred
Inotiv, Inc.May 2026
Not yet quantified
VVerified
Inotiv's databases and internal applications went dark together in early August, because one ransomware intrusion sat close enough to both the lab work and the personnel files to take them at once. Qilin, a ransomware-as-a-service franchise rather than a lone genius, claims 176 gigabytes across roughly 162,000 files; the 9,542 people notified were mostly Inotiv's own employees and their families. How the door was first opened has gone unnamed. A firm that models drug safety could not partition its own blast radius.
Professional and Business Services
SEC 8-K, Item 8.01
Initial attack type not disclosed · Impact ransomware confirmed + data theft · Actor Qilin
West Pharmaceutical ServicesMay 2026
$7M est.
Orders & sales lost
Business interruption
Material attack. Data exfiltrated, systems encrypted, global operations disrupted.
Verified: the linked document states this figure.
Healthcare and Life Sciences
SEC 8-K, Item 1.05
Initial attack type not disclosed · Impact ransomware confirmed + data theft
Filing history
May 2026Item 1.05 ↗headline
May 2026Item 1.05 ↗
CB Financial ServicesMay 2026
Not yet quantified
VVerified
Determined material. Customer names, Social Security numbers and dates of birth disclosed.
Financial Services
SEC 8-K, Item 1.05
Initial attack type not disclosed · Impact data theft confirmed
Filing history
May 2026Item 1.05 ↗headline
May 2026Item 1.05 ↗
ITRON, INC.Apr 2026
Not yet quantified
VVerified
Itron sits inside the grid itself: smart meters and the software behind them across more than 8,000 utilities, hundreds of millions of endpoints. On April 13, 2026, an unauthorized third party reached its internal IT network, and the account stops there, naming no actor, no vector, and no data confirmed taken. No ransomware crew has claimed it, which in this field reads less like safety than like an investigation that has not finished. When the vendor is this deep in the utilities' plumbing, silence about how the front door opened is not reassurance; it is the part worth watching.
Manufacturing
SEC 8-K, Item 8.01
Initial attack type compromised credentials inferred · Impact data theft inferred
ADT Inc.Apr 2026
Not yet quantified
VVerified
The break-in ran through ADT's Salesforce instance, reached not by an exploit but by phoning an employee out of their Okta login: identity treated as the perimeter folds the moment someone answers politely. What left was names, phone numbers, and addresses, with dates of birth and partial Social Security numbers for some; ShinyHunters claims over 10 million records against the roughly 5.5 million accounts others counted. A home security firm can arm every door it sells and still leave its customer list open to a phone call.
Professional and Business Services
SEC 8-K, Item 8.01
Initial attack type phishing or social engineering confirmed · Impact data theft confirmed · Actor ShinyHunters
RCI HOSPITALITY HOLDINGS, INC.Apr 2026
breach at RCI Internet Services, Inc.
Not yet quantified
VVerified
RCI Internet Services left an insecure direct object reference on its public-facing IIS web server, so the application checked who was logged in but never whether the record requested was actually theirs. Changing a number in the URL was enough to walk out with contractor files on about 40,178 people, Social Security and driver's license numbers included. Its remediation, adding multifactor authentication and cutting external access, names the wall that was never there. Authorization was not breached here; it was never enforced past the login screen.
Retail and Consumer
SEC 8-K, Item 8.01
Initial attack type software vulnerability confirmed · Impact data theft confirmed
Bitcoin Depot Inc. (BTM, BTMWW)Mar 2026
$3.665M est.
Bitcoin Depot disclosed that attackers compromised internal systems and stole approximately $3.665 million in Bitcoin from company-controlled corporate wallets. The company stated that the incident involved its internal settlement accounts and, based on its investigation, did not impact customer wallets or customer cryptocurrency holdings.
Verified: the linked document states this figure.
Financial Services
SEC 8-K, Item 1.05
Initial attack type not disclosed · Impact financial theft or fraud confirmed
Quantified -2 days after disclosure.
What the company has said it cost
The company’s own disclosed figure, as it changed over time. The loss on the record is this same figure, typed and categorized.
2026-04-06$3.665MVVerifiedSEC 8-K, Item 1.05 ↗
HASBRO, INC.Apr 2026
$10.8M
Spent responding & recovering
Direct expense
Hasbro spent weeks taking orders and shipping product by hand while it rebuilt the network an intruder walked into on March 28, and the $10.8 million cleanup measures the recovery, not the loss. What got in, how, and whether anything left stays unnamed: no vector, no actor, no record count, just "unauthorized access to the Company's network" and a consumer-products operation limping along on business-continuity workarounds. A breach described only by its cost is one whose architecture nobody wants to draw.
Verified: the linked document states this figure.
Manufacturing
SEC 8-K, Item 8.01
Initial attack type not disclosed · Impact operational outage confirmed
Quantified 120 days after disclosure.
What the company has said it cost
The company’s own disclosed figure, as it changed over time. The loss on the record is this same figure, typed and categorized.
2026-07-30$10.8MVVerifiedSEC 10-Q ↗
Corroborating records
Hasbro$10.8MAAttestedToy-making giant Hasbro disclose data breach affecting employees ↗
CareCloud, Inc. (CCLD, CCLDO)Mar 2026
$100K
Total reported cost
Total incident cost
CareCloud restored functionality within eight hours and called March 16 a temporary network disruption, but the outage was the symptom, not the breach. An unauthorized party had been inside one of its AWS environments since March 10, six days copying databases before anything showed. The count settled at 3.76 million people, Social Security numbers, financial and medical records, up from an initial 345,000. A cloud environment that registers a week of theft as an eight-hour outage was the front door all along.
Losses on the record
See the full accounting
Total incident cost · realized$100K · A
Source:
Shown individually, never summed across measures.
Attested: a published report credits an identifiable source for this figure.
Technology and Software
SEC 8-K, Item 1.05
Initial attack type not disclosed · Impact data theft confirmed + operational outage
Quantified 132 days after disclosure.
What the company has said it cost
The company’s own disclosed figure, as it changed over time. The loss on the record is this same figure, typed and categorized.
2026-08-06$100KVVerifiedSEC 10-Q ↗
HERITAGE FINANCIAL CORPMar 2026
Not yet quantified
VVerified
Heritage Bank kept the intrusion out of its customer systems, but customer data was never only there: it sat on an internal file share, the drive where employees pile names, Social Security numbers, and account details until 182,793 people live in one folder. An unnamed party copied those files, and how anyone reached a server marked internal, the bank has not said. A file share is not a filing cabinet; it is a database no one agreed to secure.
Financial Services
SEC 8-K, Item 8.01
Initial attack type not disclosed · Impact data theft confirmed
TRIO-TECH INTERNATIONALMar 2026
Not yet quantified
VVerified
Trio-Tech International's Singapore subsidiary had its files encrypted on March 11, and management filed the ransomware away as immaterial, a judgment made while the attacker still held a copy of the data. A week later the Gunra group began publishing that data on its leak site, and the non-material call rewrote itself. Materiality is not a verdict the victim keeps when the extortionist owns the appeal. How the intruders got into a chip-testing network, and how much walked out, the company has not yet said.
Manufacturing
SEC 8-K, Item 1.05
Initial attack type not disclosed · Impact ransomware confirmed + data extortion · Actor Gunra
Stryker CorpMar 2026
Not yet quantified
VVerified
Material incident disclosed; operations since restored. Cost disclosure pending.
Healthcare and Life Sciences
SEC 8-K, Item 1.05
Initial attack type not disclosed · Impact operational outage confirmed
Filing history
Mar 2026Item 1.05 ↗headline
Mar 2026Item 1.05 ↗
UFP TECHNOLOGIES INCFeb 2026
Not yet quantified
VVerified
UFP Technologies runs a medical-device operation where the same IT plumbing prints invoices and product labels, so when ransomware arrived on February 14, 2026, billing and shipping stalled together. Payouts King, an outfit assembled from former Black Basta affiliates, claims it carried off 620 gigabytes; UFP has confirmed only that data left, not how anyone got in. When one flat network runs both the money and the labels, a single intrusion becomes a supply-chain event, and the door it used stays unnamed.
Healthcare and Life Sciences
SEC 8-K, Item 1.05
Initial attack type not disclosed · Impact ransomware confirmed + data theft · Actor Payouts King
Coupang, Inc.Dec 2025
$410M
Spent responding & recovering
Direct expense
The engineer who built Coupang's alternative authentication system left at the end of 2024 with the signing key that anchored it, then spent 2025 forging his own tokens. Investigators say he cycled through member IDs, hitting the delivery-address page some 148 million times to harvest names, phones, and addresses on roughly 37 million people, then mailed sample records back as extortion. A signing key the builder can still mint is not access control; it is a master key offboarding forgot to change.
Verified: the linked document states this figure.
Retail and Consumer
SEC 8-K, Item 1.05
Initial attack type insider confirmed · Impact data theft confirmed + data extortion
Regulatory penalty
Quantified 218 days after disclosure.
What the company has said it cost
The company’s own disclosed figure, as it changed over time. The loss on the record is this same figure, typed and categorized.
2026-08-04$410MVVerifiedSEC 10-Q ↗
Corroborating records
Coupang$410MVVerifiedSouth Korean Personal Information Protection Commission ↗
Phoenix Education Partners, Inc.Dec 2025
breach at The University of Phoenix, Inc.
$5.1M
Spent responding & recovering
Direct expense
The break-in came through Oracle's E-Business Suite, the back-office platform Phoenix shared with a hundred other victims, where a single zero-day in the reporting engine handed the Cl0p group the run of the place. Over ten days in August the attackers left with names, Social Security numbers, and bank routing numbers for roughly 3.5 million students, alumni, and staff; the university noticed in November. A shared enterprise platform is not infrastructure; it is one lock that opens a hundred doors.
Verified: the linked document states this figure.
Public Sector and Education
SEC 8-K, Item 8.01
Initial attack type software vulnerability confirmed · Impact data theft confirmed + data extortion · Actor Cl0p
Quantified 224 days after disclosure.
What the company has said it cost
The company’s own disclosed figure, as it changed over time. The loss on the record is this same figure, typed and categorized.
2026-07-14$5.1MVVerifiedSEC 10-Q ↗
BayFirst Financial Corp.Oct 2025
Not yet quantified
VVerified
BayFirst's customer data left through Marquis Software Solutions, the marketing vendor whose SonicWall firewall opened to a ransomware crew. Names, dates of birth, and Social Security numbers sat there because one contractor holds them for more than 700 banks and credit unions: a single breach reached 74 institutions and over 780,000 people. How many banked at BayFirst the filing does not say. A bank can lock every system it owns and still lose its customers through a vendor's front door.
Financial Services
SEC 8-K, Item 1.05
Initial attack type third-party or supply chain confirmed · Impact data theft confirmed + ransomware
JEWETT CAMERON TRADING CO LTDOct 2025
Not yet quantified
VVerified
Jewett-Cameron woke on October 15 to intruders that had settled into its corporate IT, running their own encryption and monitoring software to watch the fencing and pet-supply maker's meetings and screens from the inside. What they carried off was the financial detail being assembled for the company's annual report, the disclosure stolen before it could be disclosed. No known ransomware crew has claimed it or listed the company on a leak site, which leaves the extortion loud and its author blank.
Retail and Consumer
SEC 8-K, Item 1.05
Initial attack type not disclosed · Impact data theft confirmed + ransomware
F5, INC.Oct 2025
$26.5M
Spent responding & recovering
Direct expense
The stolen files were not customer records but F5's blueprints: BIG-IP source code and the vulnerabilities it had not yet patched, taken from the vendor whose appliances sit at the edge of 48 of the Fortune 50. Reporting ties the intrusion to a China-nexus group that held persistent access for at least a year before F5 noticed. When the vendor guarding everyone's front door keeps its unfixed flaws in one place, the perimeter and the arsenal are the same building.
Verified: the linked document states this figure.
Technology and Software
SEC 8-K, Item 1.05
Initial attack type not disclosed · Impact data theft confirmed · Actor China-nexus group
Quantified 113 days after disclosure.
What the company has said it cost
The company’s own disclosed figure, as it changed over time. The categorized loss on the record carries its own source.
2026-02-05$17.5MVVerifiedSEC 10-Q ↗
2026-05-05$23.5MVVerifiedSEC 10-Q ↗
BK Technologies CorpOct 2025
Not yet quantified
VVerified
BK Technologies builds the radios police and the military carry, yet its military contracts, NDAs, and employee records sat in the same corporate custody a single intruder walked through in September. Akira claims 25 gigabytes of it, though the company confirms neither the haul nor how the door was opened. When the crown jewels and the payroll sit behind one lock, the breach is not a radio problem; it is an architecture that never separated what it could not afford to lose.
Manufacturing
SEC 8-K, Item 8.01
Initial attack type not disclosed · Impact data theft inferred · Actor Akira
RTX CorpSep 2025
Not yet quantified
VVerified
The ransomware hit Collins Aerospace's MUSE platform, the shared check-in backbone that roughly 170 airports rent instead of running their own, so a single intrusion grounded Heathrow, Brussels, and Berlin at once. Access came through the vMUSE backend's FTP credentials, harvested by an earlier infostealer and never rotated: a legacy file transfer left standing as the door to the passenger layer. Everest claims a 50GB haul of more than 1.5 million passenger records; the airports had not built a hundred systems to breach, only one.
Manufacturing
SEC 8-K, Item 8.01
Initial attack type compromised credentials confirmed · Impact ransomware confirmed + data theft · Actor Everest
PROSPER MARKETPLACE, INCSep 2025
$600K
VVerified
Prosper's breach was the database answering as designed: someone inside its systems queried the tables holding customer and applicant records and left with Social Security numbers, bank accounts, passports, and tax files on 17.6 million people. Network access was treated as permission to read the one warehouse where a lender keeps its most sensitive identity data, and months of quiet queries passed as ordinary traffic. No group has claimed the theft, leaving the adversary unnamed and the harvest complete.
Financial Services
SEC 8-K, Item 8.01
Initial attack type not disclosed · Impact data theft confirmed
Quantified 57 days after disclosure.
What the company has said it cost
The company’s own disclosed figure, as it changed over time.
2025-11-13$600KVVerifiedSEC 10-Q ↗
DATA I/O CORPSep 2025
$388K
Spent responding & recovering
Direct expense
Data I/O's intrusion came through the firewall itself, a vulnerability in a commercial third-party appliance, the box sold to be the perimeter serving instead as the door. The August 16 ransomware froze shipping, manufacturing, and communications at a company that programs chips for Apple and Bosch, and cost roughly $388,000 before systems returned by September 4. No group has claimed it and no customer data theft has surfaced, leaving the entry point named and the intruder anonymous.
Verified: the linked document states this figure.
Manufacturing
SEC 8-K, Item 1.05
Initial attack type software vulnerability confirmed · Impact ransomware confirmed + operational outage
Quantified 218 days after disclosure.
What the company has said it cost
The company’s own disclosed figure, as it changed over time. The loss on the record is this same figure, typed and categorized.
2026-04-16$388KVVerifiedSEC 10-K ↗
EVERTEC, Inc.Aug 2025
breach at Sinqia S.A.
$37.7M
Spent responding & recovering
Direct expense
The money moved through Sinqia's Pix environment on credentials stolen from its own IT vendors, which is what happens once a payment connector treats a supplier's login as its trust boundary. Roughly R$710 million in unauthorized transactions cleared before processing halted, aimed mostly at HSBC, with about half later frozen. Sinqia is the third Brazilian firm wired between banks and the central rail to be looted this way in a year: the soft spot in real-time payments is not the bank but the plumbing that reaches it.
Verified: the linked document states this figure.
Technology and Software
SEC 8-K, Item 8.01
Initial attack type compromised credentials confirmed · Impact financial theft or fraud confirmed
Quantified 66 days after disclosure.
What the company has said it cost
The company’s own disclosed figure, as it changed over time. The loss on the record is this same figure, typed and categorized.
2025-11-07$37.7MVVerifiedSEC 10-Q ↗
WYTEC INTERNATIONAL INCAug 2025
Not yet quantified
VVerified
Wytec International's website was defaced, restored from backups, and defaced again, which is what a restore buys when it returns the content but not the hole the intruder came through. No group claimed the attack, no data theft surfaced, and no motive ever emerged, so the damage landed as operations rather than exfiltration, down to a canceled September seminar. A backup copies the site, not the way in.
Telecommunications
SEC 8-K, Item 1.05
Initial attack type not disclosed · Impact operational outage confirmed
Filing history
Aug 2025Item 1.05 ↗headline
Aug 2025Item 1.05 ↗
Ingram Micro Holding CorpJul 2025
$6.17M
Spent responding & recovering
Direct expense
The intrusion came through Ingram Micro's GlobalProtect VPN, reached with valid credentials because a gateway that trusts a password is the entire perimeter, and SafePay moved from there across a distributor wired into thousands of vendors and resellers. About 42,521 people lost names, Social Security numbers, and passport data; the group claims 3.5 terabytes and published the files, which is what a refused ransom looks like. A VPN login is a front door, not a boundary.
Verified: the linked document states this figure.
Wholesale and Distribution
SEC 8-K, Item 8.01
Initial attack type compromised credentials confirmed · Impact data theft confirmed + data extortion · Actor SafePay
Quantified 239 days after disclosure.
What the company has said it cost
The company’s own disclosed figure, as it changed over time. The loss on the record is this same figure, typed and categorized.
2026-03-03$6.17MVVerifiedSEC 10-K ↗
2026-07-30$3.17MVVerifiedSEC 10-Q ↗
2026-07-30$1.12MVVerifiedSEC 10-Q ↗
QantasJul 2025
Not yet quantified
AAttested
An unnamed threat actor impersonating "Qantas IT help" contacted the airline's call centre. The agent was tricked into connecting a customised version of Salesforce's Data Loader tool to the customer relationship management platform used by Qantas, which enabled mass data extraction. 5.67 mm customer records were exposed. The cost of cyber losses and recovery has never been disclosed, with Qantas executives agreeing to forfeit $800k AUD in bonuses due to the incident.
Transportation and Logistics
Company statement
Initial attack type phishing or social engineering confirmed · Impact data theft confirmed
ALASKA AIR GROUP, INC.Jun 2025
breach at Hawaiian Airlines
Not yet quantified
VVerified
Hawaiian Airlines lost ground on June 23, 2025, to intruders who did not break the perimeter so much as phone the IT help desk and get believed. Reporting ties it to Scattered Spider, though the mechanism is the story: an identity system where whoever resets passwords is the softest wall in the building. What left stays unstated, customer names and addresses possibly reached, payment data reportedly not, the affected count never surfaced. A help desk trained to be helpful is a perimeter trained to open.
Transportation and Logistics
SEC 8-K, Item 8.01
Initial attack type phishing or social engineering confirmed · Impact data theft inferred · Actor Scattered Spider
UNITED NATURAL FOODS INCJun 2025
$50M
Total reported cost
Total incident cost
Of that, about $50M was lost profit.
United Natural Foods pulled its own network offline to stop the June 5, 2025 intrusion, freezing the order and fulfillment systems that feed some 30,000 grocery stores, Whole Foods included. The company never named the attack or the actor, and no group claimed it; what mattered was not who got in but what a single intrusion could reach. When one distributor is the spine for a continent of shelves, the damage is counted not in stolen records but in the $350 to $400 million of orders that never shipped.
Losses on the record
$400M est.
Orders & sales lost
Business interruption
These measure different things and are never added together.
$50M
Insurance received
A recovery, shown for context. Not subtracted from the losses.
See the full accounting
Total incident cost · realized$50M · V
Business interruption · estimated$400M · V
Business interruption · estimated$50M · V
Operational charge · realized$35M · V
Direct expense · realized$15M · V
Insurance recovery · realized$50M · V
Shown individually, never summed across measures.
Verified: the linked document states this figure.
Wholesale and Distribution
SEC 8-K, Item 1.05
Initial attack type not disclosed · Impact operational outage confirmed
Quantified 445 days after disclosure.
What the company has said it cost
The company’s own disclosed figure, as it changed over time. The categorized losses on the record carry their own sources.
2026-09-14$24MVVerifiedSEC 10-K ↗
AFLAC INCJun 2025
Not yet quantified
VVerified
Aflac contained the intrusion within hours, and by then attackers had already talked their way into employee accounts and left with data on about 22.6 million people: Social Security numbers, claims, health details. The break-in was a phone call, not an exploit; reporting ties it to Scattered Spider, though the lever was social engineering, not any flaw in the network. Fast containment is worth little when the theft finishes before the alarm does.
Healthcare and Life Sciences
SEC 8-K, Item 8.01
Initial attack type phishing or social engineering confirmed · Impact data theft confirmed · Actor Scattered Spider
Zoomcar Holdings, Inc. (ZCAR, ZCARW)Jun 2025
Not yet quantified
VVerified
Zoomcar learned it had been breached the way too many companies do: an extortion note landed in its employees' inboxes announcing the data was already gone, roughly 8.4 million users' names, addresses, phone numbers, and car registrations. No monitoring caught the intrusion, no group has claimed it, and the vector stays unnamed. When the breach notification arrives from the intruder, the security program was never watching the systems, only the paperwork.
Transportation and Logistics
SEC 8-K, Item 1.05
Initial attack type not disclosed · Impact data extortion confirmed + data theft
ERIE INDEMNITY COJun 2025
Not yet quantified
VVerified
Erie Indemnity's website and business ran aground on June 7, 2025, after what the company called an information security event, with no ransomware found and no data theft confirmed. What it could not stop was the litigation: fourteen putative class actions landed within days, over an exposure still unproven. When the outage is public and the facts are not, the lawsuits arrive before the forensics do.
Financial Services
SEC 8-K, Item 8.01
Initial attack type not disclosed · Impact operational outage confirmed
Coinbase Global, Inc.May 2025
breach at Coinbase, Inc.
Not yet quantified
VVerified
Coinbase's breach ran through its own support desk: overseas contractors with legitimate access to account-management tools, paid off by attackers who never needed an exploit because the credentials were already for sale. The stolen file held names, contact details, partial Social Security numbers, and government ID images for roughly 69,000 customers, the identity documents a regulated exchange is obliged to collect and then made someone else's job to guard. Coinbase refused the $20 million demand and posted a $20 million bounty instead, which does nothing to un-copy the data. The perimeter was never the network; it was a payroll, and someone made a better offer.
Financial Services
SEC 8-K, Item 1.05
Initial attack type insider confirmed · Impact data theft confirmed + data extortion
NUCOR CORPMay 2025
Not yet quantified
VVerified
Nucor took steel mills offline across multiple sites after a threat actor reached its corporate IT systems, the wall between office networks and the plant floor apparently thinner than the org chart suggested. The company calls the stolen data limited and the impact immaterial, though no one has said what left, how much, or who took it, and no group has claimed the attack. When an intrusion in the back office can idle a blast furnace, the boundary was never really there.
Manufacturing
SEC 8-K, Item 1.05
Initial attack type not disclosed · Impact operational outage confirmed + data theft
Filing history
May 2025Item 1.05 ↗headline
May 2025Item 1.05 ↗
Global Crossing Airlines Group Inc. (JETBF, JETMF)May 2025
Not yet quantified
VVerified
The way in ran through a developer token that opened onto GlobalX's AWS keys, and from there the whole cloud: passenger manifests, the GitHub repo, even the NAVBLUE console used to message pilots. Hackers claiming affiliation with Anonymous copied months of that data, from January through early May, then defaced the homepage to say so. When one credential is the distance between a public website and every operational system, the perimeter was never the network; it was a token nobody thought to rotate.
Transportation and Logistics
SEC 8-K, Item 8.01
Initial attack type compromised credentials confirmed · Impact data theft confirmed + destructive · Actor Anonymous
CONDUENT IncApr 2025
$25M
Spent responding & recovering
Direct expense
A threat actor sat inside Conduent's environment for nearly three months, from October 2024 until a January 2025 disruption gave it away, long enough to take what SafePay claims was roughly 8 terabytes. Conduent is the back office that governments and health plans outsource to, so one intrusion became a front door to their end-users, a count that has climbed from 10 million toward 60 million as the forensics catch up. When the processor is the perimeter, its dwell time becomes everyone's.
Verified: the linked document states this figure.
Professional and Business Services
SEC 8-K, Item 1.05
Initial attack type not disclosed · Impact data theft confirmed + operational outage · Actor SafePay
Quantified 23 days after disclosure.
What the company has said it cost
The company’s own disclosed figure, as it changed over time. The loss on the record is this same figure, typed and categorized.
2025-05-07$25MVVerifiedSEC 10-Q ↗
Filing history
Apr 2025Item 1.05 ↗headline
Sep 2026Item 8.01 ↗
DAVITA INC.Apr 2025
$25M
Total reported cost
Total incident cost
DaVita's ransomware sat inside its dialysis labs for three weeks before discovery, and the encryption was the loud part; the quiet part was a labs database pooling 2.7 million people's Social Security numbers, dialysis results, and scanned images of their personal checks. A treatment provider had become a warehouse of financial identity, the fate of any database asked to hold everything. Interlock, which claimed the theft and leaked the files, needed no exploit, only the weeks the network gave it.
Losses on the record
See the full accounting
Total incident cost · realized$25M · V
Direct expense · realized$13.5M · V
Source:
Shown individually, never summed across measures.
Verified: the linked document states this figure.
Healthcare and Life Sciences
SEC 8-K, Item 8.01
Initial attack type not disclosed · Impact ransomware confirmed + data theft · Actor Interlock
Quantified 113 days after disclosure.
What the company has said it cost
The company’s own disclosed figure, as it changed over time. Some of the losses on the record are this same figure, typed and categorized; the rest carry their own sources.
2025-08-05$13.5MVVerifiedSEC 10-Q ↗
Sensata Technologies Holding plcApr 2025
Not yet quantified
VVerified
Sensata's business is sensing and measurement, yet an intruder moved through its network for nine days before ransomware announced itself by freezing the shipping and production lines. What left was not customer telemetry but the workforce itself: Social Security numbers, passports, and medical records of roughly 15,630 current and former employees, pooled on the same reachable network as the machinery. No group ever claimed it and the files never surfaced on a leak site, which is theft you cannot negotiate back.
Manufacturing
SEC 8-K, Item 1.05
Initial attack type not disclosed · Impact ransomware confirmed + data theft
NATIONAL PRESTO INDUSTRIES INCMar 2025
Not yet quantified
VVerified
National Presto's outage on March 1, 2025, halted manufacturing, shipping, and receiving together, the predictable result when a company making both pressure cookers and munitions runs them across one shared back office. The intrusion reached National Defense Corporation, its ordnance subsidiary, through that common spine; how the door opened was never disclosed. InterLock claimed the hit and roughly 3 million stolen files, then met a company that declined to pay on the theory a defense maker's data was worthless to anyone.
Manufacturing
SEC 8-K, Item 1.05
Initial attack type not disclosed · Impact operational outage confirmed + data theft · Actor InterLock
NIOCORP DEVELOPMENTS LTD (NB, NIOBW)Feb 2025
$506K est.
NioCorp's intruders needed no exploit, just a foothold in its email, because the mining company's vendor payment process trusted whatever the inbox told it. About $500,000 walked out to a fraudulent account before anyone caught the reroute: an invoice redirected by a plausible message, not a breached network. No group has been named and no personal records were said to leave; the whole loss was the price of letting email stand in for a signed authorization.
Verified: the linked document states this figure.
Mining and Minerals
SEC 8-K, Item 8.01
Initial attack type phishing or social engineering inferred · Impact financial theft or fraud confirmed
Quantified 78 days after disclosure.
What the company has said it cost
The company’s own disclosed figure, as it changed over time. The categorized loss on the record carries its own source.
2025-05-08$10KVVerifiedSEC 10-Q ↗
LEE ENTERPRISES, IncFeb 2025
$10.5M
Orders & sales lost
Business interruption
Lee Enterprises ran its 72 newspapers on shared core systems, so when ransomware encrypted them on February 3, 2025, distribution, billing, collections, and vendor payments stopped at once. The 350GB that left, by the attackers' count, held Social Security numbers and health details belonging mostly to Lee's own current and former employees, not its readers. Qilin claimed the theft and recovery ran about $2 million: one intrusion, and no internal boundary anywhere to slow it.
Attested: a published report credits an identifiable source for this figure.
Media and Entertainment
SEC 8-K, Item 1.05
Initial attack type not disclosed · Impact ransomware confirmed + data theft · Actor Qilin
Quantified 444 days after disclosure.
What the company has said it cost
The company’s own disclosed figure, as it changed over time. The loss on the record is this same figure, typed and categorized.
2026-05-08$10.5MVVerifiedSEC 10-Q ↗
ENGLOBAL CORPNov 2024
Not yet quantified
VVerified
ENGlobal, a small engineering contractor woven into the energy sector and the federal supply chain, spent roughly six weeks locked out of its own financial systems after a threat actor encrypted its files and reached the personal data held in the same IT estate. Neither the entry vector nor the number of people exposed was ever named, and no ransomware group claimed the intrusion. For a firm whose product is trust across critical infrastructure, a flat internal network is not a footnote; it is the whole exposure.
Professional and Business Services
SEC 8-K, Item 1.05
Initial attack type not disclosed · Impact ransomware confirmed + data theft
LKQ CORPDec 2024
Not yet quantified
VVerified
LKQ contained the November intrusion the only way a sprawling parts conglomerate can, by walling off the single Canadian business unit whose IT systems attackers had reached, and operations there stalled for weeks. No group claimed it and no tally of what left was ever offered, which is its own kind of disclosure. Containment by amputation is not resilience; it is an admission the segment was already standing alone.
Wholesale and Distribution
SEC 8-K, Item 8.01
Initial attack type not disclosed · Impact operational outage confirmed
Krispy Kreme, Inc.Dec 2024
$11M est.
Orders & sales lost
Business interruption
Of that, about $10M was lost profit.
The outage that halted online doughnut orders was the visible damage; the real loss was the identity file of roughly 161,000 people, almost all of them staff and their families, holding Social Security numbers, passports, biometrics, and military IDs. Play claimed the intrusion and leaked 184 gigabytes after the ransom went unpaid, though how the systems were first entered was never stated. A doughnut seller kept an HR intelligence dossier on the people who fry them, and that is the file the breach walked out with.
Losses on the record
$7.4M
Spent responding & recovering
Direct expense
$5M est.
Orders & sales lost
Business interruption
These measure different things and are never added together.
See the full accounting
Business interruption · estimated$11M · V
Business interruption · estimated$10M · V
Business interruption · estimated$5M · V
Direct expense · realized$7.4M · V
Source:
Shown individually, never summed across measures.
Verified: the linked document states this figure.
Retail and Consumer
SEC 8-K, Item 1.05
Initial attack type not disclosed · Impact ransomware confirmed + data theft · Actor Play
Quantified 148 days after disclosure.
What the company has said it cost
The company’s own disclosed figure, as it changed over time. The categorized losses on the record carry their own sources.
2025-05-08$4.4MVVerifiedSEC 10-Q ↗
ARTIVION, INC.Dec 2024
$4.6M
Total reported cost
Total incident cost
Artivion, a maker of heart-surgery devices, was breached in a single day: an intruder copied files on November 20 and was gone by the 21st, ahead of the alarm. What left was not device blueprints but the back office, its own employees' Social Security numbers, passports, and direct deposit details, the HR store guarded like an afterthought. No group ever claimed the intrusion and the company never named the way in, so the tally surfaced one state at a time: 5,608 in Texas, thousands more counted elsewhere.
Losses on the record
See the full accounting
Total incident cost · realized$4.6M · V
Direct expense · realized$3.5M · V
Source:
Shown individually, never summed across measures.
Verified: the linked document states this figure.
Healthcare and Life Sciences
SEC 8-K, Item 8.01
Initial attack type not disclosed · Impact data theft confirmed
Quantified 436 days after disclosure.
What the company has said it cost
The company’s own disclosed figure, as it changed over time. Some of the losses on the record are this same figure, typed and categorized; the rest carry their own sources.
2026-02-18$3.5MVVerifiedSEC 10-K ↗
iLearningEngines, Inc. (AILE, AILEW)Nov 2024
Not yet quantified
VVerified
iLearningEngines lost $250,000 not to an exploit but to its own inbox: a threat actor moved through the company's email, redirected a wire, and deleted the messages that would have shown the switch. No ransomware crew claimed it and the company named no actor, which is business email compromise working as designed. When the mailbox is the authorization for a payment, the money goes wherever the mailbox says, and this money was never recovered.
Technology and Software
SEC 8-K, Item 1.05
Initial attack type not disclosed · Impact financial theft or fraud confirmed
NEWPARK RESOURCES INCOct 2024
Not yet quantified
VVerified
Newpark Resources kept its plants and rigs running on manual downtime procedures while ransomware took the internal systems that keep the books, a reminder that in an oilfield supplier the office network and the shop floor are two separate failure domains, wired as one. What never surfaced is the rest of it: no group claimed the intrusion, no files reached a leak site, no count of affected records was ever put on the record. The silence is not reassurance; it is the sound of no one having finished counting.
Professional and Business Services
SEC 8-K, Item 8.01
Initial attack type not disclosed · Impact ransomware confirmed + operational outage
Karat Packaging Inc.Oct 2024
Not yet quantified
VVerified
Karat Packaging activated its cybersecurity response plan on October 18, 2024, after unauthorized third-party access reached its information systems, and that is very nearly the whole of the public account. No vector, no named actor, no count of the people behind the records: the filing offers a plan and a contained threat and leaves the architecture unlit. A breach that can be closed out without ever explaining how the door opened is not a resolved incident; it is a disclosure that discloses nothing.
Manufacturing
SEC 8-K, Item 8.01
Initial attack type not disclosed · Impact data theft inferred
HEALTHCARE SERVICES GROUP INCOct 2024
Not yet quantified
VVerified
Healthcare Services Group handles the dining, laundry, and housekeeping for healthcare facilities, yet it held the Social Security numbers, financial accounts, and insurance records of 624,496 patients and employees across 48 states. Intruders moved through its systems for a week before anyone noticed on October 7, and the company still has not said how they got in. The ransomware group Underground claims 1.1 terabytes, a figure HCSG has not confirmed. When a janitorial contractor becomes a warehouse of medical identity, the breach was in the org chart long before it was in the network.
Healthcare and Life Sciences
SEC 8-K, Item 8.01
Initial attack type not disclosed · Impact data theft inferred + data extortion · Actor Underground
ADT Inc.Oct 2024
Not yet quantified
VVerified
ADT's network was reached not through ADT but through a third-party business partner, whose compromised credentials let an unauthorized actor walk in and leave with encrypted internal data on employee accounts. Customer alarm codes were spared this time, though it was ADT's second intrusion in two months. When the trust boundary is drawn to include every partner holding a valid login, the perimeter is only as sound as the weakest vendor's password. ADT named no attacker, and the silence is doing work.
Professional and Business Services
SEC 8-K, Item 8.01
Initial attack type third-party or supply chain confirmed · Impact data theft confirmed
American Water Works Company, Inc.Oct 2024
Not yet quantified
VVerified
American Water pulled its MyWater portal and paused billing to wall off unauthorized activity inside its corporate networks, then reassured 14 million customers that the water itself was never touched. That reassurance is the tell: the intrusion lived in the customer-facing IT stack, while the operational technology that treats the water sat behind a trust boundary that actually held. Months on, the largest water utility in the country had named neither the actor nor the vector, certain of what stayed safe and silent on what got in.
Energy and Utilities
SEC 8-K, Item 8.01
Initial attack type not disclosed · Impact operational outage confirmed
TfL Transport for LondonSep 2024
£29M
Spent responding & recovering
Direct expense
Scattered Spider exfilitrated 15 million lines of user data and then exposed the user data of 10 mm customers. The stolen database included names, contact details, home addresses, and Oyster refund data containing banking details and sort codes for about 5,000 customers
Losses on the record
£10M
Orders & sales lost
Business interruption
These measure different things and are never added together.
See the full accounting
Business interruption · realized£10M · A
Direct expense · realized£29M · A
Shown individually, never summed across measures.
Attested: a published report credits an identifiable source for this figure.
Transportation and Logistics
Company announcement
Initial attack type not disclosed · Impact data theft confirmed · Actor Scattered Spider
What the company has said it cost
The company’s own disclosed figure, as it changed over time. The categorized losses on the record carry their own sources.
undated$49mmAAttestedCompany announcement ↗
Kawasaki Motors EuropeSep 2024
Not yet quantified
AAttested
Kawasaki originally stated that they experienced a cyber attack, but avoided an incident by shutting down and isolating their servers. The action had a direct impact on operations. Ransomhub later dumped 487 GB of data after Kawasaki refused to pay for a ransom, contradicting Kawasaki's initial representations of the breach and its consequences.
Retail and Consumer
Company statements to media
Initial attack type not disclosed · Impact operational outage confirmed + data extortion · Actor Ransomhub
HALLIBURTON COAug 2024
$35M est.
Spent responding & recovering
Direct expense
Halliburton pulled its own applications offline as a precaution, and in doing so showed how thin the wall was between corporate IT and oilfield operations: with production planning and shipment tracking down, customers could not cut a purchase order. Data left the building, though no count of the people behind the records ever followed. Reporting ties the intrusion to RansomHub, and the $35 million booked was the price of a boundary that lived mostly on paper.
Verified: the linked document states this figure.
Energy and Utilities
SEC 8-K, Item 1.05
Initial attack type not disclosed · Impact operational outage confirmed + data theft · Actor RansomHub
What the company has said it cost
The company’s own disclosed figure, as it changed over time. The loss on the record is this same figure, typed and categorized.
2024-11-07$35MVVerifiedSEC 10-Q ↗
DICK'S SPORTING GOODS, INC.Aug 2024
Not yet quantified
VVerified
Dick's Sporting Goods contained the intrusion by locking all of its roughly 55,500 employees out of their own accounts, restoring access only after IT verified identities one video call at a time. When credentials are the perimeter, containment means treating the entire workforce as a suspect. What was taken, who took it, and how many people it reached were never named: an intrusion acknowledged, and almost nothing around it.
Retail and Consumer
SEC 8-K, Item 8.01
Initial attack type not disclosed · Impact data theft inferred
MICROCHIP TECHNOLOGY INCAug 2024
Not yet quantified
VVerified
Microchip Technology's fabs slowed below normal output after intruders disrupted the servers running its business, proof that a semiconductor plant is only as isolated as its weakest office network. The confirmed theft was modest, employee contact details and some hashed passwords, though the Play ransomware group, which claimed it, says it left with payroll, contracts, and IDs. How the access was gained went unnamed: when an IT breach can idle a factory floor, the boundary between the two was drawn as a wish.
Technology and Software
SEC 8-K, Item 8.01
Initial attack type not disclosed · Impact operational outage confirmed + data theft · Actor Play
Filing history
Aug 2024Item 8.01 ↗headline
Sep 2024Item 8.01 ↗
ENZO BIOCHEM INCAug 2024
$7.5M
Fines & legal costs
Regulatory / legal
Enzo Biochem lost the clinical records of roughly 2.47 million people through two employee logins, one left unchanged for a decade and shared among five staff, with no second factor standing between an email password and the lab's patient data. What walked out was names, test results, and about 600,000 Social Security numbers. A credential shared by five people and rotated once a decade is not authentication; it is a group password taped to the door.
Losses on the record
$4.5M
Fines & legal costs
Regulatory / legal
These measure different things and are never added together.
See the full accounting
Regulatory / legal · realized$7.5M · A
Regulatory / legal · realized$4.5M · V
Shown individually, never summed across measures.
Verified: the linked document states this figure.
Attested: a published report credits an identifiable source for this figure.
Healthcare and Life Sciences
SEC 8-K, Item 8.01
Initial attack type compromised credentials confirmed · Impact data theft confirmed
Quantified 76 days after disclosure.
What the company has said it cost
The company’s own disclosed figure, as it changed over time. The categorized losses on the record carry their own sources.
2024-10-29$5.2MVVerifiedSEC 10-K ↗
2024-12-16$3MVVerifiedSEC 10-Q ↗
ADT Inc.Aug 2024
Not yet quantified
VVerified
A company that sells perimeters for a living left its own customer order database reachable, and unauthorized actors walked out with the names, addresses, phone numbers, and purchase histories of roughly 30,000 people. How the door was opened, ADT never said; a forum poster called netnsher claimed the haul at 30,812 records before the filing caught up. The alarm company that watches everyone else's doors heard nothing until its customers were already listed for sale.
Professional and Business Services
SEC 8-K, Item 8.01
Initial attack type not disclosed · Impact data theft confirmed · Actor netnsher
BASSETT FURNITURE INDUSTRIES INCJul 2024
$609K
Spent responding & recovering
Direct expense
Bassett Furniture ran its factories on the same IT estate as its back office, so when a ransomware crew encrypted a portion of its files, containment meant idling every manufacturing floor for four and a half days. No group claimed the attack, and the company named neither the vector nor the actor, leaving the entry point a blank. The plants did not fall to a genius adversary; the only firebreak between the corporate network and the production line was the power switch.
Losses on the record
$1M to $2M est.
Orders & sales lost
Business interruption
These measure different things and are never added together.
See the full accounting
Direct expense · realized$609K · V
Business interruption · estimated$1M to $2M · V
Source:
Shown individually, never summed across measures.
Verified: the linked document states this figure.
Manufacturing
SEC 8-K, Item 1.05
Initial attack type not disclosed · Impact ransomware confirmed + operational outage
Quantified 65 days after disclosure.
What the company has said it cost
The company’s own disclosed figure, as it changed over time. Some of the losses on the record are this same figure, typed and categorized; the rest carry their own sources.
2024-10-10$98KVVerifiedSEC 10-Q ↗
2025-10-08$609KVVerifiedSEC 10-Q ↗
META MATERIALS INC.Jul 2024
Not yet quantified
VVerified
Meta Materials lost its website and email for four days in July 2024, not to an outside intruder but to a former executive who still held the keys and cancelled the renewal on his way out. The company had wired its public presence and stakeholder mail to a single registration one departed insider could revoke, because offboarding never took the credential back. No data theft was claimed, and the executive went unnamed: the failure was an access list that never noticed he had left.
Manufacturing
SEC 8-K, Item 1.05
Initial attack type insider confirmed · Impact operational outage confirmed
Cencora, Inc.Feb 2024
Not yet quantified
VVerified
Cencora distributes drugs, but through its Lash Group patient-support arm it had become the record-keeper for more than a dozen rival drugmakers, so one February intrusion emptied the patient files of Bayer, Novartis, and Bristol Myers Squibb at once. Names, diagnoses, and medications for at least 1.43 million people left through a single back-office unit no one filed as a front door. Reporting ties the theft to Dark Angels and puts the ransom near $75 million, the largest known, which only buys a promise the copy was deleted.
Wholesale and Distribution
SEC 8-K, Item 1.05
Initial attack type not disclosed · Impact data theft confirmed + data extortion · Actor Dark Angels
Crimson Wine Group, LtdJul 2024
First disclosed Jun 2024 · Item 8.01
Not yet quantified
VVerified
Crimson Wine Group pulled its own systems off the internet to stop the intrusion, which tells you the network was flat enough that containment and full shutdown were the same act. What a winery was doing holding Social Security numbers, driver's licenses, and medical records on 26,238 people goes unexplained, as does how the third party got in: no vector, no actor, no group was ever named. The data a business keeps is the data it eventually loses.
Manufacturing
SEC 8-K, Item 1.05
Initial attack type not disclosed · Impact data theft inferred + operational outage
Filing history
Jun 2024Item 8.01 ↗first disclosed
Jul 2024Item 1.05 ↗headline
Cadre Holdings, Inc.Jul 2024
$22.3M est.
Orders & sales lost
Business interruption
Of that, about $6.4M was lost profit.
Cadre Holdings arms police and bomb squads for a living, and its answer to an unauthorized third party inside certain technology systems in July 2024 was to take machines offline and wait. What data left, who took it, and how they got in all went unnamed, by the company and by any group that might have claimed it. A firm built to sell survivability could describe the threat to everyone but itself.
Losses on the record
See the full accounting
Business interruption · estimated$6.4M · V
Business interruption · estimated$22.3M · V
Source:
Shown individually, never summed across measures.
Verified: the linked document states this figure.
Healthcare and Life Sciences
SEC 8-K, Item 8.01
Initial attack type not disclosed · Impact operational outage confirmed
AUTONATION, INC.Jul 2024
$43M
Spent responding & recovering
Direct expense
AutoNation lost no data of its own; it lost CDK Global, the dealer-management system 15,000 dealerships treat as the floor they stand on, taken down through a single phishing email by ransomware that reporting ties to BlackSuit. An always-on VPN had already seated the vendor inside every dealer's network, so one compromise closed an industry from a data center no dealer owned. The $1.50-a-share hit is what vendor concentration charges when the front door belongs to someone else.
Verified: the linked document states this figure.
Retail and Consumer
SEC 8-K, Item 8.01
Initial attack type third-party or supply chain confirmed · Impact operational outage confirmed + ransomware · Actor BlackSuit
Quantified 17 days after disclosure.
What the company has said it cost
The company’s own disclosed figure, as it changed over time. The loss on the record is this same figure, typed and categorized.
2024-08-01$43MVVerifiedSEC 10-Q ↗
2024-10-25$10MVVerifiedSEC 10-Q ↗
REPLIGEN CORPJul 2024
Not yet quantified
VVerified
An unauthorized party reached certain files on Repligen's systems in July 2024, and the company's account stopped there: no count, no vector, no name. The scope surfaced elsewhere, on INC Ransom's leak site, where the group claimed roughly 500 gigabytes. When the most specific figure for a breach lives on the extortion group's directory and not in the filing, the accounting has been outsourced to the party that took the data.
Healthcare and Life Sciences
SEC 8-K, Item 8.01
Initial attack type not disclosed · Impact data extortion inferred + data theft · Actor INC Ransom
AT&T INC.May 2024
breach at Snowflake
Not yet quantified
VVerified
The breach was in a Snowflake data warehouse, not AT&T's network, reached with stolen passwords because no second factor stood in the way, and it held the call and text records of nearly every AT&T customer. Not the words, just who contacted whom, how long, and roughly where: the shape of 110 million lives. AT&T reportedly paid about $370,000 to have the file deleted, which assumes a copy is a thing you can take back.
Telecommunications
SEC 8-K, Item 1.05
Initial attack type compromised credentials confirmed · Impact data extortion confirmed + data theft
SONIC AUTOMOTIVE INCJul 2024
First disclosed Jun 2024 · Item 8.01
Not yet quantified
VVerified
Sonic Automotive could not sell cars for the better part of two weeks, not because its own network fell but because CDK Global, the single vendor running its dealer management system, was ransomwared by a crew reporting ties to BlackSuit. When one SaaS provider is the floor beneath every franchise's sales, inventory, and accounting, its outage is the dealership's outage. Sonic booked a material hit to the quarter over software it did not run and could not bring back.
Retail and Consumer
SEC 8-K, Item 1.05
Initial attack type third-party or supply chain confirmed · Impact operational outage confirmed + ransomware · Actor BlackSuit
Filing history
Jun 2024Item 8.01 ↗first disclosed
Jul 2024Item 1.05 ↗headline
Jul 2024Item 1.05 ↗
HEALTHEQUITY, INC.Jul 2024
Not yet quantified
VVerified
A business partner's personal-use device carried the malware, and the account it compromised reached straight into a SharePoint repository holding data on about 4.3 million people: Social Security numbers, diagnoses, prescriptions. The vendor's laptop sat inside the trust boundary, and the member records sat in a shared drive rather than a guarded system. That access ran from March to late June before anyone noticed, which is less a break-in than a tenancy.
Professional and Business Services
SEC 8-K, Item 8.01
Initial attack type third-party or supply chain confirmed · Impact data theft confirmed
Affirm Holdings, Inc.Jun 2024
Not yet quantified
VVerified
Affirm's systems were never touched; the breach was at Evolve Bank & Trust, the sponsor bank that issues the Affirm Card and holds the customer data a fintech front end never keeps. One malicious link inside Evolve exposed names, Social Security numbers, and account details across its fintech partners, and reporting credits LockBit, which leaked the file when the ransom went unpaid. When the ledger lives at the sponsor bank, a fintech's own security is beside the point: the bank is the single door everyone's data waits behind.
Financial Services
SEC 8-K, Item 8.01
Initial attack type third-party or supply chain confirmed · Impact data theft confirmed + data extortion · Actor LockBit
LITHIA MOTORS INCJun 2024
Not yet quantified
VVerified
Lithia Motors was not breached; the dealer management system it and thousands of other dealerships run sales, financing, and customer records through was. That platform belongs to CDK Global, one vendor that had quietly become the operational nervous system of American car retail, so a single ransomware intrusion, reported to be BlackSuit's, sent roughly 15,000 dealer locations back to pen and paper at once. Outsourcing the entire front office to one platform is efficient right up to the morning it stops answering.
Retail and Consumer
SEC 8-K, Item 8.01
Initial attack type third-party or supply chain confirmed · Impact operational outage confirmed + ransomware · Actor BlackSuit
GROUP 1 AUTOMOTIVE INCJun 2024
$5.9M
Spent responding & recovering
Direct expense
Group 1's U.S. dealerships ran sales, service, and back office through CDK, so when a ransomware crew took the vendor dark, thousands of storefronts went dark with it. The failure was not a breach of Group 1's network but a single point of dependence: the dealer management platform was the business, and someone else owned it. No records are believed to have left, only the uptime; the company booked $10 million in insurance for a spine it had outsourced.
Verified: the linked document states this figure.
Retail and Consumer
SEC 8-K, Item 8.01
Initial attack type third-party or supply chain confirmed · Impact operational outage confirmed + ransomware
Quantified 235 days after disclosure.
What the company has said it cost
The company’s own disclosed figure, as it changed over time. The loss on the record is this same figure, typed and categorized.
2025-02-14$5.9MVVerifiedSEC 10-K ↗
PENSKE AUTOMOTIVE GROUP, INC.Jun 2024
$2.5M
Total reported cost
Total incident cost
Penske's own network held; what went dark was CDK Global, the dealer management software running its Premier Truck Group back office, hit by ransomware that reporting ties to the BlackSuit group. When one vendor is the operating system for roughly 15,000 dealerships, its outage is your outage, and Premier Truck spent the shutdown selling heavy trucks on paper. Concentration is not a convenience here: it is a single point of failure with a logo.
Losses on the record
See the full accounting
Total incident cost · realized$2.5M · V
Source:
Shown individually, never summed across measures.
Verified: the linked document states this figure.
Retail and Consumer
SEC 8-K, Item 8.01
Initial attack type third-party or supply chain confirmed · Impact operational outage confirmed + ransomware · Actor BlackSuit
Quantified 496 days after disclosure.
What the company has said it cost
The company’s own disclosed figure, as it changed over time. The loss on the record is this same figure, typed and categorized.
2025-10-30$2.5MVVerifiedSEC 10-Q ↗
CDKJun 2024
$25M
Spent responding & recovering
Direct expense
CDK's ransomware event drove an immediate payment of $25mm in Bitcoin payments to the BlackSuit ransomware gang. A year before the incident CDK was acquired by a private equity organization, effectively turning it into a private company. Several public companies were impacted, resulting in 8k filings that show in excess of $1bn losses across the automotive industry.
Attested: a published report credits an identifiable source for this figure.
Technology and Software
Company announcement
Initial attack type not disclosed · Impact ransomware confirmed + financial theft or fraud · Actor BlackSuit
What the company has said it cost
The company’s own disclosed figure, as it changed over time. The loss on the record is this same figure, typed and categorized.
undated$25mmAAttestedCompany announcement ↗
GLOBE LIFE INC. (GL, GL-PD)Jun 2024
$3.4 million
Spent responding & recovering
Direct expense
Globe Life's agent web portal ran on access permissions and identity checks that could not tell a real user from an impostor, and that portal was the door out. Because the records sat in databases held by its independent agency owners rather than one hardened store, a single portal flaw reached roughly 850,000 people: names, Social Security numbers, health details. The company named the extortion note that followed, never the attacker behind it. When identity is the only lock, a broken check is the whole breach.
Attested: a published report credits an identifiable source for this figure.
Financial Services
SEC 8-K, Item 8.01
Initial attack type exposed or misconfigured system confirmed · Impact data theft confirmed + data extortion
What the company has said it cost
The company’s own disclosed figure, as it changed over time. The loss on the record is this same figure, typed and categorized.
undated$3.4 millionAAttestedtopclassactions.com ↗
Filing history
Jun 2024Item 8.01 ↗headline
Oct 2024Item 8.01 ↗
Oct 2024Item 8.01 ↗
KEY TRONIC CORPMay 2024
$15M est.
Orders & sales lost
Business interruption
Key Tronic's plants in Washington and Mexico sat idle for two weeks in May 2024, not because a machine broke but because the office IT they run on was encrypted, one trust boundary shared between the business network and the factory floor. Black Basta claimed the intrusion and leaked roughly 530 gigabytes, employee passports and Social Security cards among it, while the company confirmed personal data had left the building. How the access first began was never named. The bill ran to about $17 million, most of it revenue that simply stopped when a breach reached the plant floor.
Losses on the record
$2.3M
Spent responding & recovering
Direct expense
These measure different things and are never added together.
See the full accounting
Direct expense · realized$2.3M · V
Business interruption · estimated$15M · V
Shown individually, never summed across measures.
Verified: the linked document states this figure.
Manufacturing
SEC 8-K, Item 1.05
Initial attack type not disclosed · Impact ransomware confirmed + data theft · Actor Black Basta
Quantified 53 days after disclosure.
What the company has said it cost
The company’s own disclosed figure, as it changed over time. Some of the losses on the record are this same figure, typed and categorized; the rest carry their own sources.
undatedmore than $17 millionAAttestedtherecord.media ↗
2024-08-06$2.3MVVerifiedSEC 8-K/A ↗
KULICKE & SOFFA INDUSTRIES INCMay 2024
Not yet quantified
VVerified
Kulicke and Soffa caught unauthorized access on May 12, 2024, and first concluded no data had left; the group calling itself LockBit claimed it had been inside for months and walked out with roughly 12 million files, source code, engineering drawings, business partner records, and personal information among them. A network that treats detection as the whole of its defense learns the size of the intrusion only after the intruder publishes it. The alarm marked the end of the visit, not the start.
Technology and Software
SEC 8-K, Item 8.01
Initial attack type not disclosed · Impact ransomware inferred + data theft · Actor LockBit
MedisecureApr 2024
Not yet quantified
AAttested
Medisecure experienced a massive ransomware and data exfiltration attack, exposing 6.5 TB of data included names, addresses, Medicare numbers, and sensitive prescription medication and healthcare card details. The costs of this attack in losses and recovery expenses were never disclosed, as Medisecure declared insolvency within weeks of the disclosure of the incident.
Healthcare and Life Sciences
Company announcements
Initial attack type not disclosed · Impact ransomware confirmed + data theft
AscensionDec 2024
$1.3B
Total reported cost
Total incident cost
Ascension stated that an employee at one of its facilities accidentally downloaded a malicious file they believed was legitimate, which the company characterised as an honest mistake. Security reporting also linked the intrusion to the suspected exploitation of CVE-2024-1709, a vulnerability in ConnectWise's ScreenConnect remote-access software. The combination highlights how a single user action and unpatched third-party software can open the door to a major ransomware incident.
Losses on the record
See the full accounting
Total incident cost · realized$1.3B · A
Shown individually, never summed across measures.
Attested: a published report credits an identifiable source for this figure.
Healthcare and Life Sciences
Company PR statements
Initial attack type phishing or social engineering confirmed · Impact ransomware confirmed
What the company has said it cost
The company’s own disclosed figure, as it changed over time. The loss on the record is this same figure, typed and categorized.
undated$1.3BAAttestedCompany PR statements ↗
BRANDYWINE REALTY TRUSTMay 2024
Not yet quantified
VVerified
A third party encrypted part of Brandywine Realty Trust's corporate IT estate on May 1, 2024, the same one that ran financial reporting and held personal files, with nothing between the back office and the data. The encryption was the noise; the theft was the quiet part, files walked out before the locks went on. No group claimed it and no victim count surfaced, an unusual silence for a landlord that could not say who had been in the building.
Real Estate and Construction
SEC 8-K, Item 1.05
Initial attack type not disclosed · Impact ransomware confirmed + data theft
DocGo Inc.May 2024
Not yet quantified
VVerified
A threat actor spent four days inside DocGo's U.S. ambulance operation, long enough to copy names, Social Security numbers, insurance claims, and treatment records. The company called it a limited number of healthcare records; the notification list came to roughly 858,000 people. How the intruder got in was never named, which is its own architecture: a mobile-medical roll-up bolts ambulance services together faster than it maps where the trust boundaries sit.
Healthcare and Life Sciences
SEC 8-K, Item 8.01
Initial attack type not disclosed · Impact data theft confirmed
DROPBOX, INC.Apr 2024
Not yet quantified
VVerified
Dropbox Sign's production environment was reached through a compromised service account, a non-human identity carrying broad standing privileges that nobody was watching, and from there the intruder reached the customer database. Every user's email and username left, and for a subset so did the API keys, OAuth tokens, and MFA material: at a signature company, the very proofs of identity walked out as loot. The actor was never named.
Technology and Software
SEC 8-K, Item 1.05
Initial attack type compromised credentials confirmed · Impact data theft confirmed
UNITEDHEALTH GROUP INCFeb 2024
$3.09B
Total reported cost
Total incident cost
The intrusion reached Change Healthcare through a Citrix portal with no second factor, one stolen credential opening a clearinghouse that routes roughly a third of American medical claims. Nine quiet days later the records of about 192.7 million people were gone, the largest healthcare breach on record, because a country wired its billing through a single chokepoint and guarded it with a password. UnitedHealth paid $22 million to bury the files, then watched a second crew arrive to extort the same data again.
Losses on the record
$867M
Orders & sales lost
Business interruption
FY2024$3.09B
FY2025+ $799M
to date$3.89B
Our sum across non-overlapping fiscal periods; not a single company-stated figure.
These measure different things and are never added together.
See the full accounting
Total incident cost · realized$3.09B · V
Direct expense · realized$2.2B · V
Business interruption · realized$867M · V
Shown individually, never summed across measures.
Verified: the linked document states this figure.
Healthcare and Life Sciences
SEC 8-K, Item 1.05
Initial attack type compromised credentials confirmed · Impact data theft confirmed + data extortion
Quantified 15 days after disclosure.
What the company has said it cost
The company’s own disclosed figure, as it changed over time. Some of the losses on the record are this same figure, typed and categorized; the rest carry their own sources.
2024-05-09$340MVVerifiedSEC 10-Q ↗
2024-08-09$776MVVerifiedSEC 10-Q ↗
2024-08-09$1.4BVVerifiedSEC 10-Q ↗
2024-08-09$290MVVerifiedSEC 10-Q ↗
2024-08-09$630MVVerifiedSEC 10-Q ↗
2024-11-04$341MVVerifiedSEC 10-Q ↗
2024-11-04$1.7BVVerifiedSEC 10-Q ↗
2025-02-27$2.2BVVerifiedSEC 10-K ↗
2025-02-27$640MVVerifiedSEC 10-K ↗
2026-03-02$799MVVerifiedSEC 10-K ↗
Frontier Communications Parent, Inc.Apr 2024
$5.64 million
Spent responding & recovering
Direct expense
Frontier pulled portions of its IT environment offline the day it detected the intruder, which is what containment looks like when one open door reaches the rest of the house. RansomHub, which claimed the theft, put it at more than two million people; Frontier's own notice came to roughly 751,000: names, Social Security numbers, dates of birth. How the access was gained was never stated. The count an extortion crew posts and the count a company files are rarely the same, and only one of them carries a penalty for being wrong.
Attested: a published report credits an identifiable source for this figure.
Telecommunications
SEC 8-K, Item 1.05
Initial attack type not disclosed · Impact data theft confirmed + data extortion · Actor RansomHub
What the company has said it cost
The company’s own disclosed figure, as it changed over time. The loss on the record is this same figure, typed and categorized.
undated$5.64 millionAAttestedclaimdepot.com ↗
ORASURE TECHNOLOGIES INCApr 2024
Not yet quantified
VVerified
OraSure Technologies builds the tests that carry the most sensitive data a person has, HIV results and genetic samples through its DNA Genotek arm, and the intrusion it contained in late March 2024 was described only as files taken from certain systems. The company vouched for its core financial and operational machinery while the real question, whose health data left and how much, went unanswered. No count, no vector, no named data: a breach a company cannot describe is not contained, it is only quiet.
Healthcare and Life Sciences
SEC 8-K, Item 1.05
Initial attack type not disclosed · Impact data theft confirmed
B. Riley Financial, Inc. (RILY, RILYG, RILYK, RILYL, RILYM, RILYN, RILYP, RILYT, RILYZ)Apr 2024
Not yet quantified
VVerified
Targus shut its own network down to stop the intrusion, a reflex that reveals where the sensitive data sat: not in a hardened vault but in ordinary file servers, where a single foothold reaches everything, Social Security numbers included. How the threat actor got in was never stated, and the count of people affected never arrived at all. Red Ransomware claimed the theft, and Targus took roughly six months to say what had actually left.
Financial Services
SEC 8-K, Item 1.05
Initial attack type not disclosed · Impact data theft inferred · Actor Red Ransomware
MARINEMAX INCMar 2024
$1,018,825.50
Spent responding & recovering
Direct expense
An intruder moved through MarineMax's systems for ten days before the boat retailer noticed, leaving with the personal data of roughly 123,000 customers and employees, driver's licenses and passports included. The company first assured regulators that nothing sensitive lived on the breached systems, then reversed itself two weeks later: it could not map what its own network held. Rhysida claimed the theft and posted a 225 gigabyte archive, and a firm that cannot inventory its data is in no position to dispute the count.
Attested: a published report credits an identifiable source for this figure.
Retail and Consumer
SEC 8-K, Item 1.05
Initial attack type not disclosed · Impact data theft confirmed + data extortion · Actor Rhysida
What the company has said it cost
The company’s own disclosed figure, as it changed over time. The loss on the record is this same figure, typed and categorized.
undated$1,018,825.50AAttestedusesparrow.com ↗
SouthState CorpFeb 2024
$8.3M
Spent responding & recovering
Direct expense
An intrusion reached SouthState's network on February 7, 2024, and the unauthorized party walked into folders holding more than 840,000 people's Social Security numbers and account details, which the class action alleges sat unencrypted. The exposure was not the break-in; it was a bank storing its most sensitive records in a shared drive and trusting the outer edge to hold. SouthState never named the actor or the vector, leaving the count as the only firm fact in the file.
Losses on the record
$1.5 million
Spent responding & recovering
Direct expense
These measure different things and are never added together.
See the full accounting
Direct expense$8.3M · V
Direct expense$1.5 million · A
Source:
Shown individually, never summed across measures.
Verified: the linked document states this figure.
Attested: a published report credits an identifiable source for this figure.
Financial Services
SEC 8-K, Item 1.05
Initial attack type not disclosed · Impact data theft confirmed
Quantified 35 days after disclosure.
What the company has said it cost
The company’s own disclosed figure, as it changed over time. The losses on the record are these same figures, typed and categorized.
undated$1.5 millionAAttestedinjuryclaims.com ↗
2024-05-03$4.4MVVerifiedSEC 10-Q ↗
2024-08-02$7.9MVVerifiedSEC 10-Q ↗
2024-11-01$8MVVerifiedSEC 10-Q ↗
2025-02-21$8.3MVVerifiedSEC 10-K ↗
RADIANT LOGISTICS, INCMar 2024
Not yet quantified
VVerified
Radiant Logistics contained the intrusion by cutting its Canadian operations loose from the rest of the network, a tidy way of admitting the boundary did not exist until the fire forced someone to draw it. Segmentation improvised mid-attack is not architecture; it is triage. What got in, whether data left, and how many people sat behind that suddenly necessary wall all went unsaid, and the only name attached to the breach surfaced later on Akira's leak site, not in Radiant's own telling.
Transportation and Logistics
SEC 8-K, Item 1.05
Initial attack type not disclosed · Impact ransomware inferred + operational outage · Actor Akira
MICROSOFT CORPJan 2024
Not yet quantified
VVerified
The intrusion ran through a legacy test tenant Microsoft had left standing with no multifactor authentication and a guessable password, which a password spray walked straight into. From there the attackers reached an old test OAuth app that still carried full access to corporate mailboxes, and read the email of senior leadership, cybersecurity, and legal. The perimeter that failed was not a network but a forgotten account the security giant never turned off; Microsoft named the actor as Midnight Blizzard, a Russian state group.
Technology and Software
SEC 8-K, Item 1.05
Initial attack type compromised credentials confirmed · Impact data theft confirmed · Actor Midnight Blizzard
Federal Home Loan Bank of New YorkFeb 2024
Not yet quantified
VVerified
The fraud reached the Federal Home Loan Bank of New York through a fourth-party vendor, a supplier of one of its own suppliers, a party the Bank never contracted with yet left a path toward its funds. Its operational controls caught the attempt on February 21, 2024, and no money moved. Neither the compromised firm nor the people behind it was ever named: the trust boundary ran one vendor past anyone the Bank could actually see.
Financial Services
SEC 8-K, Item 1.05
Initial attack type third-party or supply chain confirmed · Impact financial theft or fraud inferred
loanDepot, Inc.Jan 2024
$24.6M
Total reported cost
Total incident cost
loanDepot ran origination, servicing, and its customer portal on ground flat enough that one phished login could encrypt the whole thing and reach roughly 16.6 million people's Social Security numbers, financial accounts, and loan files. ALPHV/BlackCat claimed the intrusion and demanded $10 million; the company refused, then spent three weeks and about $27 million rebuilding what a single email had unlocked. A network with no interior walls is not breached so much as opened.
Losses on the record
See the full accounting
Total incident cost · realized$24.6M · V
Direct expense · realized$1.8M · V
Source:
Shown individually, never summed across measures.
Verified: the linked document states this figure.
Financial Services
SEC 8-K, Item 8.01
Initial attack type phishing or social engineering inferred · Impact ransomware confirmed + data theft · Actor ALPHV/BlackCat
Quantified 380 days after disclosure.
What the company has said it cost
The company’s own disclosed figure, as it changed over time. Some of the losses on the record are this same figure, typed and categorized; the rest carry their own sources.
undated$27 millionAAttestedcybersecuritydive.com ↗
2025-03-13$24.6MVVerifiedSEC 10-K ↗
PRUDENTIAL FINANCIAL INC (PFH, PRH, PRS, PRU)Feb 2024
$4.75 million
Spent responding & recovering
Direct expense
The intruders walked in through employee and contractor accounts, the kind of access that treats a valid login as proof of belonging, and left with names, addresses, and driver's license numbers. Prudential first put the count at roughly 36,000; the final tally was 2,556,210, a blast radius it underestimated by close to seventy to one. ALPHV claimed the theft on its leak site, but the harder number is how long the company took to learn the size of its own breach.
Attested: a published report credits an identifiable source for this figure.
Financial Services
SEC 8-K, Item 1.05
Initial attack type compromised credentials confirmed · Impact data theft confirmed · Actor ALPHV
What the company has said it cost
The company’s own disclosed figure, as it changed over time. The loss on the record is this same figure, typed and categorized.
undated$4.75 millionAAttestedclaimdepot.com ↗
WILLIS LEASE FINANCE CORPFeb 2024
Not yet quantified
VVerified
Willis Lease Finance took systems offline on January 31, 2024, after intruders reached the archive an aircraft-engine lessor quietly accumulates: employee Social Security numbers, passport scans, airline leasing agreements, the NDAs that bind them. How the intrusion happened was never stated; what left was, once Black Basta claimed the theft and posted roughly 910 GB to its leak site. A niche financier is still a warehouse of everyone else's secrets, which is why one break-in spills an entire industry's paperwork.
Financial Services
SEC 8-K, Item 8.01
Initial attack type not disclosed · Impact data theft confirmed + data extortion · Actor Black Basta
Hewlett Packard Enterprise CoJan 2024
Not yet quantified
VVerified
Midnight Blizzard, the crew tied to Russia's SVR, sat inside HPE's cloud email environment for months before anyone noticed, reading the mailboxes of the cybersecurity, marketing, and business teams themselves. How the door opened HPE never said; what it left on the record is a mail tenant treated as the soft interior of the network, where a nation-state could browse the security team's own inbox at its leisure. Dwell time here was measured in seasons, not minutes.
Technology and Software
SEC 8-K, Item 1.05
Initial attack type not disclosed · Impact data theft confirmed · Actor Midnight Blizzard
V F CORPDec 2023
Not yet quantified
VVerified
VF Corporation runs Vans, The North Face, Timberland, and Supreme off one shared operational core, which is why a single December intrusion reached the personal data of about 35.5 million consumers. The company took its systems offline mid-holiday, then noted it retains no card numbers or Social Security numbers, as if the names, addresses, and order histories that did leave were a consolation prize. Reporting ties the attack to the ALPHV/BlackCat crew; how the access was gained VF never said.
Manufacturing
SEC 8-K, Item 1.05
Initial attack type not disclosed · Impact operational outage confirmed + data theft · Actor ALPHV/BlackCat
Fidelity National Financial, Inc.Nov 2023
$2.5 million
Spent responding & recovering
Direct expense
Fidelity National Financial locked its own systems to stop the intrusion and froze the title and escrow work sitting at the center of American home closings: hundreds of sales stalled because one title insurer went dark. Non-self-propagating malware still left with data on about 1.3 million people, names, Social Security numbers, loan numbers, from a network where one foothold reached far more than it should have. ALPHV/BlackCat claimed the attack and quietly pulled FNF from its leak site by mid-December, the usual tell of a ransom paid.
Attested: a published report credits an identifiable source for this figure.
Financial Services
SEC 8-K, Item 8.01
Initial attack type not disclosed · Impact operational outage confirmed + data theft · Actor ALPHV/BlackCat
What the company has said it cost
The company’s own disclosed figure, as it changed over time. The loss on the record is this same figure, typed and categorized.
undated$2.5 millionAAttestedcnbc.com ↗
First American Financial CorpDec 2023
$11M
Spent responding & recovering
Direct expense
First American took its website, email, and much of its network offline in late December 2023 after intruders reached certain non-production servers, copied their contents, and encrypted the rest. The company never named the group, the vector, or the ransom, so the architecture speaks for itself: the names and driver's license numbers of about 44,000 people sat on machines it classified as non-production. Non-production is a label about the server, not the people whose identities lived on it.
Verified: the linked document states this figure.
Financial Services
SEC 8-K, Item 1.05
Initial attack type not disclosed · Impact ransomware confirmed + data theft
Quantified 54 days after disclosure.
What the company has said it cost
The company’s own disclosed figure, as it changed over time. The categorized loss on the record carries its own source.
undated$500,000AAttestedkrebsonsecurity.com ↗
Filing history
Dec 2023Item 1.05 ↗headline
Dec 2023Item 1.05 ↗
HealthplexMar 2023
$2M
Fines & legal costs
Regulatory / legal
Healthplex’s phishing incident exposed the personal and health information of approximately 89,955 people, including nearly 64,000 New York residents. The attacker gained access to an employee mailbox containing more than 100,000 emails accumulated over roughly 20 years, while the company lacked both an effective retention policy and required multifactor authentication. Healthplex ultimately paid $400,000 to the New York attorney general and another $2 million to the New York Department of Financial Services. This is a useful impact example because the consequences are established: tens of thousands of victims, years of unnecessary data retention and $2.4 million in regulatory penalties.
Attested: a published report credits an identifiable source for this figure.
Healthcare and Life Sciences
NYDFS cybersecurity enforcement action
Initial attack type phishing or social engineering confirmed · Impact data theft confirmed
Regulatory penalty
What the company has said it cost
The company’s own disclosed figure, as it changed over time. The loss on the record is this same figure, typed and categorized.
undated$2 millionAAttestedhipaajournal.com ↗
Corroborating records
HealthPlex$2 millionVVerifiedNew York Department of Financial Services ↗
CranewareJul 2020
Not yet quantified
AAttested
Craneware sits inside the billing systems of more than 2,000 US hospitals and roughly 10,000 clinics and pharmacies, so an intrusion into a Scottish software vendor is really an intrusion into American healthcare's revenue plumbing. The company stressed that much of what left was non-sensitive or already public regulatory data, a reassurance that quietly conceded a significant volume had gone, employee records and a subset of customer and partner data among it. Contained is not the same as empty-handed when the files are already gone.
Healthcare and Life Sciences
Cybersecurity incident report
Initial attack type not disclosed · Impact data theft confirmed
HarrodsSep 2025
Not yet quantified
AAttested
Attackers gained access to approximately 430,000 customer records through one of Harrods' third-party provider systems. The stolen data included names and contact details such as email addresses and telephone numbers. Additional information relating to marketing preferences, loyalty tier levels and connections to Harrods co-branded cards was also caught up in the breach.
Retail and Consumer
Media reports
Initial attack type third-party or supply chain confirmed · Impact data theft confirmed
Open CodeOct 2026
Not yet quantified
AAttested
An intruder reached a legacy system OpenCode was already preparing to shut down, exposing the third-party API keys, OpenAI and Anthropic among them, that 1.4% of Console users had saved in their workspaces. The company ties it to a large-scale distillation attack but has not said how anyone got in, how long they stayed, or how many keys were exposed. By choosing to publish a low percentage figure as the "victim" count Open Code is obfuscating the fact that the number of victims is probably in the several thousands and that the exposed keys must be remediated by the same victims that trusted Open Code with their security.
Technology and Software
Company Statement
Initial attack type not disclosed · Impact data theft confirmed
← Back to the index