Breaches, hacks and intrusions: what was taken, how attackers got in, and what defenders should check.
On 29 Oct 2026 attackers got Binance’s hot-wallet signing systems to sign withdrawals on ten chains, taking about $6.3B, reportedly via a DevOps laptop.
Charite said attackers breached the web server hosting its website and contact forms.
Chainalysis says it detected “an external actor using offensive agentic techniques to gain unauthorized access to Chainalysis systems” in October.
The US Justice Department announced a 42-month sentence for Ahmad Umar Agha (“Th3Pr0”), who DOJ says hijacked the Associated Press Twitter account on 23...
29 Oct 2026. Polymarket put its international platform into cancel-only mode after users reported unauthorized withdrawals.
Kaspersky found one victim in Asia running a “specially customized government-only version” of Windows; it infers Asian government targets.
FLDOE warned that data of nearly five million people, including Social Security numbers, “may have been compromised” after unauthorized access to its...
Microsoft (21 Oct): China state-aligned Storm-0940 used ARTEX, an open-source multi-agent pentest framework, and Microsoft “assesses” it was responsible...
Cursor says a maliciously modified version of Anthropic’s Claude Code extension (Anthropic.claude-code 2.1.312 and 2.1.313, Windows and macOS) was...
DDoSecrets published data on more than 41,000 DHS employees and contractors (names, emails, phone numbers, job titles and group memberships across ICE...
Cisco Talos describes UAT-11473 exploiting CVE-2026-20127 (SD-WAN controller peering auth bypass, Feb 2026) and implanting KeyDrift on controllers to steal...
FPS Finance took MyMinfin and other services offline as a precaution after a cyberattack announced on 28 Oct.
Google GTIG / Mandiant (16 Oct): CVE-2026-102764, an unauthenticated arbitrary file upload in BeyondTrust Remote Support up to 26.2.3, exploited as a...
Amadeus said on 1 Oct 2026 it had found a vulnerability in its “travel booking display environment” that could expose traveler data, and that no payment...
The FBI seized virtualine.net, a Russian-speaking bulletproof host (aliases Secury, Massgod, Spamhouse, Lanedo, Omegatech) that advertised ignoring abuse...
The FEC’s electronic filing system went offline around 22:00 ET on 26 Oct 2026, a week before the 3 Nov midterms.
UNM HSC said IT teams identified the threat around 11:00 on Mon 26 Oct 2026.
Sony said the So-net member database “was accessed by an unauthorized party” on 19 Oct 2026, detected four days later.
GMO detected the intrusion on 20 Oct and told customers to disconnect and shut down their PCs; up to 26,739 customer servers could have had malware installed.
Sansec found that attackers modified the Plausible analytics tracker served from a self-managed Convertr server.
TrendAI (formerly Trend Micro enterprise) describes three cases.
Between 27 Aug and 9 Sep 2026, 155 responses from @cf/zai-org/glm-5.3 contained data from other customers’ recent requests to the same model, all for...
26 Oct 2026. Bloom said about 9,408 SOL (about USD 947K) was taken from 49 wallets belonging to nine users.
On the night of 22 Oct 2026 a number of state digital public services were targeted with about 11 million access requests aimed at unlawfully obtaining...
UCPH confirmed on 23 Oct an attack on a test environment detected 21 Oct (Help Net Security says 20 Oct).
PwC confirmed an incident at a third-party vendor site holding employee learning records, after the Everest group claimed 590 GB on 22 Oct.
File-encrypting malware took the provider’s server infrastructure offline, blocking payments and administrative procedures in municipalities including La...
ENGIE notified French customers that data was taken from a tool its sales partners use for prospecting.
Quest’s Form 8-K says it learned on 21 Oct 2026 of “unauthorized access to its Quanum LSM system”, which certain clients use to place test orders and...
Huntress: between 14 Jul and 22 Sep 2026 an actor captured tokens via adversary-in-the-middle phishing (plus device-code phishing) and replayed them.
Capcom confirmed unauthorized access on 19 Oct 2026 affecting more than 11.7 million accounts.
Kaspersky: at least three South Korean organizations (construction, software, wire-communication equipment) targeted since at least July 2025.
21 Oct 2026: Polkadot issued a security notice that Fearless Wallet browser extension versions 3.0.1, 3.0.3, 3.0.4 and 3.0.5 sent users’ private keys to an...
21 Oct 2026: analysts flagged about 15.99M USDT moving from a CoinDCX-linked wallet.
Nikkei said unauthorized access on 7 Oct 2026 exposed 1.83 million records (about 150,000 with identifiers such as names, emails, addresses, phone numbers...
23:42 UTC 17 Oct to 01:26 UTC 18 Oct 2026: about 2.94 trillion QU (about USD 1.3M to 1.4M) drained from 1,404 wallets.
Seven application identities with Microsoft 365 permissions were used against 162 tenants (Huntress) or 173 (The Hacker News).
Burger King Japan said a server holding official-app user data was accessed between 2 and 7 Oct 2026.
The judiciary said a cybersecurity incident at BAE Systems, which operates the BNC, halted production and distribution of bankruptcy notices for all...
COPC discovered on 25 Aug 2026 that a criminal actor using social engineering “aimed at soliciting a financial response” gained access to files with names...
14 Oct 2026: about 39.8M ARRR (roughly 20% of the 200M cap) was created without authorization and moved into the Sapling shielded pool.
DOJ: between 21 and 25 Sep the FBI searched or acted at more than 40 Texas residences suspected of hosting laptop farms.
Ledger opened an investigation on 9 Oct 2026, confirmed a hardware implant on 10 Oct, and described it on 13 Oct.
13 Oct 2026. Founder Felix Romer acknowledged just over USD 3M lost.
Arcadia’s cloud mass-notification service for disaster information (875 contracts, used by municipalities, companies and organisations) was accessed...
Overnight on 11 Oct attackers took over refrigeration controllers and set them to defrost at roughly 250 to 350 French stores (Carrefour, Monoprix...
The national family allowance fund (Cnaf) said a leak of Vacaf beneficiaries’ data was reported on 9 Oct 2026.
Daiichi Kosho said Nippon Columbia Group (NCG), the contractor handling its customer data, found malware on an employee’s computer on 5 Oct 2026.
FBI, CISA, NSA, NCSC-UK, ASD’s ACSC, Canada’s Cyber Centre, Japan NPA and NCO, NCSC-NZ and Spain’s CNI say China-based Integrity Tech enables actors (TTPs...
7 Oct 2026, BNB Chain: an address holding OPERATOR_ROLE pulled about 2.01M 79AU from the 79AU/USDT pool in seven transactions and sold it, about 16,249 BNB...
ShinyHunters announced on 22 Sep that it breached the FBI’s jobs site.
ASOS said an unauthorized party gained access to an employee account by “impersonating a trusted contact” to obtain login credentials, then accessed...
UIC said “some College of Medicine systems were temporarily unavailable” and hackers stole some information from college servers.
From about 1 to 5 Oct, attackers changed exit policies so SSH traffic went to 12 interception servers that harvested passwords when users accepted a new...
The Danish Ministry of Higher Education and Science (responsible for CPR.
Attackers compromised DTU user profiles and used them to access DTUBasen, the identity and access management system, downloading “a large amount of data”.
Proofpoint (via Help Net Security): China-aligned TA419 impersonated a senior Anthropic employee in Feb 2026 (“Request for Feedback on Military Integration...
Alabama Power says it discovered unauthorized access through monitoring affecting a restricted group of account holders.
FELG Software confirmed an incident and gave a preliminary estimate of about 2 million patient records (attackers claim 2.4 million).
Hamburg police and prosecutors led the operation; on 30 Sep a 16-year-old (suspected administrator) was arrested in Alicante, Spain, plus a 24-year-old in...
JAEA confirmed unauthorized access on 25 Sep 2026 to a cloud-hosted research support site for external users of the JRR-3 research reactor (Tokai).
OpenAI said it notified more than 100 organizations that “misaligned models” may have accessed their systems (notification does not mean data was accessed).
A vulnerability in a Defense Manpower Data Center file-sharing system let a “small number of unauthorized users” reach a server with unencrypted PII...
Attackers reached HelloBetter’s business intelligence system and associated database on the evening of 6 Sep 2026.
Keio: “In the early hours of September 26, 2026, we confirmed a ransomware attack on our group’s servers.” Some business systems, reportedly payments and...
Times Car confirmed theft of data on about 6.6 million current and former members plus Times Business Service users.
24 Sep 2026: hot wallets on Ethereum, BNB Chain, Tron and Bitcoin drained.
Bitget disclosed the theft on 24 Sep 2026 and halted withdrawals.
22 Sep 2026: Neutron DAO proposal #9 (“AIATO: AI Agent Takeover.
BigCommerce said credentials for the third-party “Ribon and Ribon 1.5” apps (Be A Part Of / Fastr) were compromised and used between 13 and 17 Sep to...
15 Sep 15:35 UTC to 20 Sep 20:56 UTC: XRPL.to counted 11.75M XRP (about USD 18.7M) taken from 6,678 wallets in six waves.
19 Sep 2026: 8,721,530 FET (about USD 1.55M) withdrawn from the Ethereum TokenConversionManagerV3 contract.
Joint advisory (Japan NPA, FBI, Australia, Germany’s BfV): from Dec 2025 to Jul 2026 WaterPlum infected at least 30,000 devices in 100+ countries and took...
Gyazo (Helpfeel) confirmed a third party accessed its database on 11 Sep 2026.
Joint advisory: “Iranian state cyber actors” have used the Windows malware CHOSEN BRICK since at least 2025 against dissidents, activists and journalists...
Revolut told affected customers an attacker requested PII by email from a government agency’s domain and “it was fulfilled under the reasonable belief that...
CenterPoint’s 8-K says a third party posted online claiming a data set of its customer information, and its investigation found an unauthorized party...
The Digital Agency said a third party breached the shared government IT platform GSS “by exploiting a vulnerability in a network connection device (VPN)”.
IHL said a network security incident affected its offices including the Office of Student Financial Aid.
CISA, NSA and FBI say China-based AI companies, likely with Chinese government awareness, extracted capabilities from US models (variants of Claude, GPT...
15:53:10 UTC 6 Sep 2026 (Liquid block 4,050,336): about 4,000 L-BTC not backed by reserves was created and pegged out through SideSwap’s peg-out...
IDScan’s notice (4 Sep) says an unauthorized party “may” have accessed or copied customer information in accounts on its IDScan.net cloud.
Dropbox notified users that an unauthorized party accessed their accounts between 4 and 21 Aug 2026 because of “an issue with Lenovo’s email verification...
Covers Dec 2025 to Aug 2026.
Luminis Health (Anne Arundel Medical Center, Doctors Community Medical Center) suffered a cybersecurity incident that disrupted many network systems.
Attackers exploited CVE-2026-63077 (TeamCity deserialization, unauthenticated RCE, CVSS 9.8, disclosed by JetBrains 27 Jul) on the Cadence cloud-compute...
30 Aug 2026: the attacker inflated thinly traded TONIC about 100x in about 20 minutes and borrowed across nine markets, USD 120.4M in total per Cronos’s...
McKesson’s 8-K says it discovered “a cybersecurity incident affecting its information systems” on 25 Aug 2026.
27 Aug 2026: losses estimated at about USD 8.7M (CertiK, PeckShield) to USD 9.1M (BlockSec).
MAG said it detected an intrusion, restricted access and contacted impacted customers.
HIBP’s Troy Hunt counted more than 12.9 million real Carhartt accounts (emails, names, phone numbers, physical addresses) plus 15,000+ employee...
DOJ and FBI carried out a court-authorized disruption of QScan and QTRouter by seizing hard-coded domains.
Boston Scientific’s 8-K says it identified an incident on 25 Aug 2026 affecting certain IT systems that caused a “global disruption to the Company’s...
A DDoS attack starting 03:38 on 24 Aug 2026 disrupted ID-porten, Kontakt- og reservasjonsregisteret, Maskinporten, MinID, eFormidling, ELMA, eInnsyn...
20 to 25 Aug 2026: BlockSec estimates about USD 14.8M across the three disclosed chains.
23 Aug 2026: about USD 8.5M (about 2,843 ETH and 1.68M USDC) drained from six Ethereum vaults (PeckShield, CertiK, BlockSec).
Bitdefender: about 65 infection instances (upper bound), mostly Asia, after a first detection around Oct 2025 at a government body involved in economic...
Sakura said hackers accessed its IT system on 9 Aug 2026 and the incident “may have impacted up to 1,360,563 member accounts” (contract and membership data.
Shared Health said ransomware discovered on 10 Aug 2026 affected central HVAC monitoring (systems kept running under local monitoring) and the access-card...
Frontline identified unauthorized activity on 14 Aug 2026 (last activity 15 Aug) linked to “a vulnerability in a third-party software product” that gave...
The Ministry of Economy said an attacker accessed the DGFiP information system in June and July 2026 and consulted or extracted data on 678,000 individuals...
Berlin’s data protection authority says attackers were active between 7 and 12 Aug 2026 in the networks of the Senate departments for Urban Development...
The court detected the attack around 05:30 on 10 Aug 2026; malicious software encrypted or blocked files and systems and the attackers demanded money.
FBI, CISA, DC3, NSA, US Secret Service and South Korea’s KNPA warn of Gunra (emerged Apr 2025, C/C++, reportedly built from leaked Conti code, RaaS...
Valve told European Steam hardware customers that “certain information about Steam customers, including you, was likely compromised” (names, addresses...
About 13:00 UTC 9 Aug 2026: investigator SpecterAnalyst estimated more than USD 7.9M (BlockWatchdog: about USD 8.07M).
Malicious software compromised city IT systems around 05:45 on 7 Aug 2026, hitting 911 routing, police and fire dispatch and records.
Framework notified “all customers” that attackers took names, emails, phone numbers and physical addresses (no payment data).
Levi’s SEC filing says “certain corporate information was accessed and exfiltrated” after social engineering of three employees compromised their...
FBI, EPA and CISA warned on 30 Jul that attackers remotely accessed water and wastewater systems in at least seven states, “resulting in a loss of...
Drains: about USD 3.14M from 431 accounts on 27 May 2026, about USD 2.55M from 30 May to 13 Jul, and about USD 40K on 20 to 21 Jul.
The government said an unknown perpetrator gained unauthorized access to the VwbP on the night of 30 Jul 2026 and copied data on about 31,000 legal...
The ministry said COLCERT’s preliminary findings show a ransomware infection on Sunday 2 Aug 2026.
PNLD (run by West Yorkshire Police) identified an incident on 26 Jul 2026.
AdaptHealth (home medical equipment provider) reported 4,115,802 affected.
30 Jul 2026: first wave drained about 1,083 BTC from 1,196 addresses in 41 minutes (Galaxy Research).
The attack was detected shortly after 02:00 on 28 Jul 2026, less than 24 hours before Unitel’s IPO.
RingCentral said systems were compromised following a “sophisticated social engineering campaign”, impact limited to a portion of customers, core platform...
Minnesota IT Services (MNIT) said “more than 30 water systems throughout the state were impacted” on 26 and 27 Jul 2026.
First flagged 24 Jul 2026. Losses estimated at about USD 11.8M (Specter), up from USD 9.3M; PeckShield put it above USD 9.7M.
Night of 17 to 18 May 2026: about USD 11.58M (1,625 ETH, about 103 tBTC, 147K USDC) for about USD 10 in fees.
CISA, NSA, FBI and partners: Russian APT LAUNDRY BEAR exploited CVE-2025-66376 in Zimbra Collaboration Suite so that viewing an email in vulnerable webmail...
FBI, CISA, NSA, EPA, DOE, CNMF and Treasury: Iranian-affiliated APT actors seeking disruptive effects connected to exposed Rockwell CompactLogix/Micro850...
Chick-fil-A said attackers ran an automated attack 17 to 19 Jun 2026 “using account credentials ... obtained from a third-party source”, accessing...
22 Jul 2026, Arbitrum: about USD 24.15M USDC drained from AFX’s own custody bridge, moved to Ethereum and swapped to about 12,467 ETH.
Between 14:46 and 14:55 UTC 20 Jul 2026 (detected 21 Jul): about 515M NIGHT tokens drained from the bridge treasury, valued at about USD 9M to 13M.
Upbound’s SEC filing says it “experienced cybersecurity incidents in which certain non-sensitive customer information and other documents were obtained...
Notice: “We became aware of a cybersecurity issue involving a vulnerability in the Oracle E-Business Suite system”; compromise on or around 9 Aug 2025.
HIBP (added 19 Jul 2026): 23.3 million email addresses with names, addresses, dates of birth, bank account numbers, payout and transaction histories...
Nichirei’s systems were hit on 13 Jul 2026 and disconnected; operations at Nichirei Logistics Group refrigerated warehouses and Nichirei Foods shipping...
Hugging Face disclosed that internal datasets and service credentials were compromised and urged users to rotate tokens and keys stored on the platform.
EY’s notice: an unauthorized party accessed a third-party support ticket system used by EY IT staff between 28 Mar and 12 Apr 2026 and downloaded documents.
Coca-Cola announced unauthorized access to part of fairlife’s systems, “including production-related systems”, in connection with a ransomware event.
15 Jul 2026, Arbitrum: about USD 23.75M drained from the OLP vault in eight payouts (BlockSec).
The attack froze ANCPI email and the e-Terra cadastre application, blocking mortgage registrations, building-permit applications and cadastral requests...
Microsoft (13 Jul 2026) identifies three paths: vishing to get malicious connected apps approved, OAuth tokens stolen from vendors, and misconfigured...
Lidl said “unknown individuals briefly gained access to a separately stored file containing customer data” (salutation, name, phone, email, date of birth...
NSA, CISA, FBI, DC3 and 15 allied agencies attribute router targeting across communications, DIB, energy, finance, government and healthcare to Russian FSB...
11 Jul 2026: about USD 9M lost (6.63M USDC and 34.5M wrapped HBAR borrowed against 250 SAUCE worth a few dollars).
Maine AG filing: 6,998,886 people. Data: names, contact info, policy and claims information, driver and vehicle information and driver’s licence numbers.
Accenture confirmed a security incident and said it had remediated the source of an “isolated matter” with no operational impact; it did not describe the data.
6 Jul 2026: about USD 6M in DAI drained (PeckShield).
6 Jul 2026, Solana: about 4.43T BONK (about USD 20.5M per Hypernative; USD 21.2M per QuillAudits) moved from the community treasury.
C-Track Canada found unauthorized activity on 30 Jun 2026; an unauthorized party had obtained certain files in March 2026 from systems serving the Court of...
Reported to HHS OCR in July 2026 (HIPAA Journal): Aesto, LLC 9,540,683 individuals (at least 39 healthcare clients.
Aflac’s SEC filing (30 Jun) says a third party “unlawfully accessed certain of Aflac Japan’s systems” from 15 to 25 Jun 2026.
KDDI said attackers breached an email system it operates for itself and five ISPs (STNet, JCOM, Chubu Telecommunications, NIFTY, BIGLOBE) on 16 May 2026.
Confirmed 25 Jun 2026: about USD 2.94M taken from at least 11 user wallets (Specter); Bubblemaps counted fewer than 15 accounts.
Europol-coordinated action: 326 servers and 142 domains actioned, over EUR 41M (about $47M) in crypto flagged and restricted, 27M stolen credentials...
Xsolis (utilization management software) reported 1,396,519 individuals: a phishing email in Jan 2026 gave the actor four days of access.
Between 23:41 on 19 Jun and 01:23 on 20 Jun 2026, someone outside the civil defence system triggered 10 unauthorized alerts through the national Defesa...
Klue said it found “unauthorized activity affecting a portion of Klue’s integration infrastructure” on 12 Jun.
Kodak confirmed an unauthorized party gained “temporary access” to a limited amount of company data and said it is “confident there is no threat to our...
Unauthorised activity was identified on 9 Jun 2026 in the Campus Solutions (PeopleSoft) student records platform, run in an isolated third-party-maintained...
ServiceNow notified affected customers of “anomalous activity” in which an unauthenticated access flaw in an API endpoint was used to query data from...
Meta’s Maine AG filing and statements: 20,225 Instagram accounts were hijacked through the AI-assisted “High Touch Support” recovery tool.
8 to 9 Jun 2026: about USD 36M lost. About 141M H drained from the Ethereum bridge lockbox, and more than 122B H minted on BNB Smart Chain against a prior...
7 Jun 2026: about 5B SYS (about USD 9M to 10M) released without authorization on the UTXO side.
DentaQuest announced in early June 2026 that it was investigating an incident in a limited part of its network.
Drain 29 May 2026, first statement 30 May: about 4.35M USDC, 434K USDT, 274 WETH and 14.16 PAXG (about USD 5.4M) from Ethereum custody.
29 May 2026, BNB Chain: about USD 7.3M from about 1,400 legacy liquidity locks.
HIBP found about 4.9 million unique email addresses (names, phone numbers, physical addresses) plus about 85,000 internal employee-directory records with...
Carnival’s Maine filing: 5,995,277 people.
unimed detected the attack on 14 Apr 2026; attackers tried and failed to encrypt systems but took data from a limited area, including billing-dispute...
Reported 19 May 2026 by PeckShield and Lookonchain: about 1,000 eBTC minted (notional about USD 76.7M).
7-Eleven’s notification letters (sent 1 May 2026) say an unauthorized third party accessed systems used to store franchisee documents on 8 Apr 2026...
15 May 2026: about USD 10.7M (first estimated USD 7.4M) drained from one of five Asgard vaults.
Lumexa first reported 2,994 affected to HHS OCR and later updated the count to 5,830,949, making it the largest healthcare breach of H1 2026 per HIPAA Journal.
Texas Cyber Command detected an incident on 13 May 2026 at the vendor that sells TPWD hunting and fishing licenses.
OpenAI said two employees’ devices were impacted and it found unauthorized access to, and theft of “only limited credential material” from, a limited set...
Foxconn confirmed “Some of Foxconn’s factories in North America suffered a cyberattack” and said they were resuming normal production.
Inditex confirmed unauthorized access to databases hosted by a third-party technology provider (not named) in April 2026.
West detected an intrusion on 4 May 2026 and on 7 May determined it had a “material cybersecurity attack”: data was exfiltrated and certain systems encrypted.
7 May 2026: about USD 5.87M on-chain (TrustedVolumes’ own accounting about USD 6.7M) drained from its inventory vault in one transaction.
Trellix said it “recently identified unauthorized access to a portion of our source code repository,” found no evidence that release or distribution was...
DigiCert’s incident report (Mozilla Bug 2033170): an attacker posing as a customer sent a malicious ZIP containing a .scr file through support chat on 2...
Braintrust, an AI evaluation and observability platform, confirmed unauthorized access to one of its AWS accounts that held org-level AI provider API keys...
Instructure detected unauthorized activity in Canvas on 29 Apr 2026 and disclosed it on 1 May.
07:36 to about 07:50 UTC (reported 30 Apr to 1 May 2026): about USD 5M from Ethereum, Base and Blast (estimates USD 4.5M to 5.9M).
Pitney Bowes said it “identified unauthorized access to certain records in our Salesforce customer relationship management environment” on 9 Apr 2026...
ADT detected unauthorized access on 20 Apr 2026 and said “the information involved was limited to names, phone numbers, and addresses”, with dates of birth...
UK Biobank said it found de-identified participant data offered for sale on a consumer website operated by Alibaba.
Rituals said member data was downloaded from its “My Rituals” database: name, email, phone, date of birth, gender and home address depending on the customer.
Bloomberg, about 21 Apr 2026: a private Discord group had used Mythos since roughly 7 Apr, through a contractor’s still-valid credentials and guessing of...
Vercel’s bulletin: an attacker compromised Context.ai, a third-party AI tool used by a Vercel employee, used it to take over the employee’s Google...
18 Apr 2026: about 116,500 rsETH (about USD 292M) released from KelpDAO’s LayerZero bridge contract on Ethereum against a burn on Unichain that never happened.
HIBP (added 17 Apr 2026): 2.1M affected email addresses with names, physical addresses and support tickets.
08:22 to 09:42 UTC 16 Apr 2026: about USD 18.4M (early reports said USD 7.6M).
Theft around 15 Apr 2026, announced 16 Apr: about USD 15M (more than 1B roubles) per TRM; Grinex said about 1B roubles (about USD 13.7M).
Basic-Fit confirmed unauthorized access to a system that tracks member visits, exposing membership information, names, addresses, emails, phone numbers...
Booking.com said it “recently noticed some suspicious activity” in which unauthorized third parties could access some guests’ booking information.
Rockstar Games confirmed “a limited amount of non-material company information was accessed” and said “This incident has no impact on our organization or...
Ransomware was detected on 7 Apr 2026 (attack began 6 Apr per The Record).
CERT-EU: on 19 Mar an attacker used an AWS API key exposed through the compromised Trivy release, created a new access key on an existing user, ran...
Hasbro’s 8-K (Item 8.01) says it identified unauthorized access to its network on 28 Mar 2026 and was still reviewing which files may have been affected.
First withdrawal 16:06:09 UTC 1 Apr 2026: about USD 280M (Drift) to USD 285M (PeckShield) drained in about 12 minutes across 31 transactions.
A hacker accessed the 226-bed hospital’s network from 15 Jan 2026; it was identified on 31 Jan.
Mercor confirmed a security incident and told Fortune it was “one of thousands of companies” affected by the LiteLLM supply-chain attack.
The largest US municipal health system announced on 24 Mar 2026 that it detected suspicious network activity on 2 Feb.
Crunchyroll confirmed the leaked data is legitimate and “primarily limited to customer service ticket data” tied to an incident at a third-party vendor...
From 01:50:59 UTC 22 Mar 2026: about 80M unbacked USR minted against about USD 100K to 200K of deposits, about USD 25M to 26.8M extracted (CertiK).
Unauthorized access ran from 22 Dec 2025 to 15 Jan 2026.
About 900,000 records, mostly names and email addresses from a marketing tool from Circle Media Labs (acquired 2021).
DOJ announced a court-authorized operation with Canada and Germany (Team Cymru adds the Netherlands and Europol’s PowerOFF) against botnets of 3M+ IoT...
NAC detected the incident on 6 Mar 2026 and published a notice on 16 Mar describing “unauthorised access to network infrastructure and administrative accounts”.
Telus confirmed “unauthorized access to a limited number of our systems” and said it was still determining what was taken and which customers were affected.
Stryker confirmed a cyberattack that disrupted its internal Microsoft environment worldwide.
Loblaw’s notice says an unauthorized third party accessed customer information after activity detected around 5 Mar 2026.
Salesforce confirmed a campaign in which attackers mass-scanned public Experience Cloud sites, probed the /s/sfsites/aura endpoint and, where guest user...
HungerRush (POS platform for 16,000+ restaurants) said a third-party vendor’s compromised credentials were used to breach its email marketing service...
LexisNexis confirmed “an unauthorized party accessed a limited number of servers” holding what it called legacy, deprecated data from before 2020, and said...
CIG said a “systematic and sophisticated attack” gave read-only access to some backup systems holding basic account details (names, usernames, contact...
26 Feb 2026: an NTS press release about raids on 124 tax evaders included an unredacted photo of a seized Ledger device and its handwritten recovery phrase.
ManoMano said its investigation found 38 million individuals affected: names, emails, phone numbers and customer service communications.
Wynn said “an unauthorized third party acquired certain employee data” and that the attacker “has stated that the stolen data has been deleted.” Secondary...
Optimizely notified customers that attackers took basic business contact information from certain internal business systems, CRM records and a limited set...
22 Feb 2026 UTC: more than USD 10M lost (1M USDC and 61.2M XLM borrowed).
Have I Been Pwned loaded 12.5 million affected email addresses on 22 Feb 2026.
21 Feb 2026: at least USD 4.4M per IoTeX’s revised write-up (first said about USD 2M; PeckShield estimated over USD 8M including minted assets).
An attacker using commercial AI models compromised over 600 FortiGate devices in 55+ countries through exposed admin ports and reused passwords, not CVEs.
Detected early on 19 Feb 2026. The attack hit UMMC’s network and many IT systems including its Epic EHR.
PayPal told customers that an error in its PayPal Working Capital (PPWC) application exposed business contact details, Social Security numbers and dates of...
HIBP (added 18 Feb 2026): 967.2k affected addresses with names, dates of birth, phone numbers and physical addresses, data dating to January 2026.
18:01 UTC 15 Feb 2026, when governance proposal MIP-X43 executed: 1,096.317 cbETH liquidated, about USD 1.78M (USD 1,779,044.83) bad debt.
Odido said attackers accessed its customer contact system on 7 Feb 2026 and downloaded data on more than 6.2 million customers (including Ben NL and former...
CSA: UNC3886 targeted M1, SIMBA, Singtel and StarHub, gained limited access to some critical systems and exfiltrated a small amount of mainly...
DAF, which manages national ID cards, passports and biometric data, warned residents of a cyberattack and temporarily suspended operations.
Norway’s Police Security Service (PST) National Threat Assessment 2026 says Salt Typhoon, believed to work for the Chinese government, broke into several...
Flickr said a vulnerability in a system run by one of its third-party email service providers “may have allowed unauthorized access to some Flickr member...
CEO Chris Best said that on 3 Feb Substack found “a problem with our systems that allowed an unauthorized third party to access limited user data”.
The attack on 1 Feb 2026 began with unauthorized access; about 400 physical and virtual servers were involved and data on compromised systems encrypted.
31 Jan 2026 (APAC hours): about 261,854 SOL unstaked and moved.
HIBP loaded 5.1M unique emails from a 14M-record dataset (names, phone numbers, physical addresses).
CERT Polska says coordinated attacks on 29 Dec 2025 hit more than 30 wind and photovoltaic farms, a private manufacturing company and a combined heat and...
CERT Polska (30 Jan): on 29 Dec 2025 attackers damaged RTU firmware at 30+ wind and solar grid connection points (communication with the DSO lost...
Match Group confirmed an incident involving “a limited amount of user data” and is notifying affected users, with “no indication that login credentials...
TriZetto, a healthcare revenue-cycle business associate, identified suspicious activity on 2 Oct 2025 in a web portal its provider clients use.
Mandiant (30 Jan 2026) reported an expanding ShinyHunters-branded campaign that uses voice phishing plus lookalike credential sites (for example...
Detected 25 Jan 2026 on Ethereum, Arbitrum, Base and BSC: SwapNet about USD 13.41M, Aperture about USD 3.67M (two separate incidents, over USD 17M combined).
HIBP (added 21 Jan 2026): about 72.7M email addresses with names, dates of birth, genders, locations and purchase details, leaked on a hacking forum in...
21 Jan 2026: about USD 7M in USDC withdrawn, bridged out and converted to ETH.
Grubhub said “unauthorized individuals ... recently downloaded data from certain Grubhub systems” and that “Sensitive information, such as financial...
Eurail disclosed in mid-January that identity, contact and passport information was compromised after hackers breached its systems on 26 Dec 2025.
AZ Monica detected “a serious disruption in the computer systems” on 13 Jan 2026 and shut down servers at its Antwerp and Deurne campuses.
Betterment detected unauthorized access to internal systems on 9 Jan 2026.
About 23:00 UTC 10 Jan 2026: ZachXBT reported one victim lost about 2.05M LTC and 1,459 BTC (about USD 282M).
8 Jan 2026: about 8,535 ETH (about USD 26.4M to 26.6M) drained.
IDHS found on about 22 Sep 2025 that an internal-only mapping website was publicly accessible.
200+ Salesforce instances.
Disclosed 15 Oct 2025. Long-term access to the BIG-IP development environment.
About 28k internal repos and 570GB stolen, including about 800 customer engagement reports containing credentials and infrastructure details.
Wiz found 550+ secrets in published extensions, including publisher PATs that could push malicious updates.
8 to 18 Aug 2025. Stolen Drift OAuth and refresh tokens were used to bulk-export Salesforce objects, which were then searched for AKIA keys, passwords and...
Legacy Firebase storage was left open: about 72k images including IDs, then 1.1M direct messages.
rose87168 claimed 6M records from 140k+ tenants through an unpatched Oracle Fusion Middleware flaw (CVE-2021-35587) on `login.*.oraclecloud.com`.
21 Feb 2025. A Safe developer’s macOS machine was compromised (TraderTraitor / Lazarus), and the AWS session was used to modify Safe’s S3-hosted front-end...
Unauthenticated ClickHouse on the internet: 1M+ log lines, chat history and API secrets (Wiz).
