My Lovely AI
April 7, 2026
•[ data breach, NSFW, AI-generated content ]
In April 2026, the NSFW AI girlfriend platform My Lovely AI suffered a data breach that exposed over 100k users. The data included user-created prompts and links to the resulting AI-generated images, along with a small number of Discord and X usernames.
SongTrivia2
April 2, 2026
•[ data breach, data leak, password hashes ]
In April 2026, the music trivia platform SongTrivia2 suffered a data breach that was subsequently published to a public hacking forum. The data contained a total of 291k unique email addresses sourced from either Google OAuth logins or accounts created on the site, the latter also containing bcrypt password hashes. The data also included names, usernames and avatars.
Axios Javascript Client Library
March 31, 2026
•[ supply chain attack, account takeover, malware ]
A threat actor hijacked the npm account of Axios's lead maintainer and published malicious versions 1.14.1 and 0.30.4 with a hidden dependency that deployed a RAT on systems that installed the packages; the poisoned versions were later removed.
Town of Pepperell
March 31, 2026
•[ cyberattack, public safety, municipal systems ]
A cyberattack impacted Pepperell's employee computer systems and public safety departments, knocking out certain business phone lines and disrupting some municipal and dispatch-related systems while 911 service remained operational.
Eholo Health
March 30, 2026
•[ data leak, vulnerability exploitation, medical records ]
XP95 claimed it stole 165 GB of data from Eholo Health, including more than 1.1 million medical notes and personal information tied to 601,308 users, after exploiting a vulnerability in the company's systems.
Statistics South Africa
March 29, 2026
•[ cyber breach, data theft, ransomware ]
Stats SA said a cyber breach affected one HR database used for online job applications, while XP95 claimed it stole 453,362 files totaling 154 GB and demanded ransom.
Scotia-Glenville Central School District Facebook page
March 29, 2026
•[ Account Takeover, Social Media Hijacking, Unauthorized Access ]
A malicious actor gained administrative control of the Scotia-Glenville Central School District Facebook page through a hacked non-district account used by its communications specialist and posted inappropriate videos and replies while posing as the district; the district said its internal servers and data systems were not compromised.
FBI Director Kash Patel's personal Gmail
March 27, 2026
•[ data leak, email breach, state-sponsored attack ]
Iran-linked group Handala claimed it breached FBI Director Kash Patel's personal Gmail account and published historical emails, photographs, and files; the FBI said the exposed material did not involve government information.
Jackson County Sheriff's Office
March 27, 2026
•[ ransomware, cyberattack, operational disruption ]
A ransomware attack crippled the Jackson County Sheriff's Office in Indiana, taking computers, Wi-Fi, and reporting systems offline and forcing staff to use temporary manual workarounds.
Goodwill of Greater Grand Rapids
March 27, 2026
•[ ransomware, extortion, data theft ]
Goodwill of Greater Grand Rapids said an attack disrupted part of its network environment and affected store operations, forcing locations across its West Michigan service area to operate on a cash-only basis, while outside reporting tied the incident to an Interlock ransomware extortion claim alleging theft of 80 GB of data.
BreachForums Version 5
March 26, 2026
•[ data leak, hacking forum, credential leak ]
In March 2026, a breach of one of the many iterations of the BreachForums hacking forum known as "Version 5" was publicly disclosed. The incident exposed 340k unique email addresses along with usernames and argon2 password hashes.
The Left Party
March 26, 2026
•[ ransomware, data leak, employee data ]
Die Linke said its federal headquarters IT systems were hit by a ransomware attack on March 26, 2026, causing partial disruption, while outside reporting tied the incident to Qilin and a claim of stolen internal and employee data.
Omax Autos
March 26, 2026
•[ ransomware, cyber security incident, IT infrastructure ]
Omax Autos said its IT department initially suspected a cyber security incident on March 26, 2026, which was later confirmed as a ransomware attack on the company's IT infrastructure; the company said core systems and operations were not impacted.
Sound Radix
March 25, 2026
•[ data leak, credential exposure ]
In March 2026, the audio production tools company Sound Radix disclosed a data breach that they subsequently self-submitted to HIBP. The incident impacted 293k unique email addresses and names. Sound Radix advised that it is possible that additional data including hashed passwords may have been exposed, and that no financial or credit card information was impacted.
Former Mossad Chief Tamir Pardo
March 25, 2026
•[ data leak, espionage, email breach ]
Handala published material from the personal Gmail account of former Mossad chief Tamir Pardo, and later reporting said the leak included business correspondence and a draft letter addressed to a CIA chief.
Ajax FC
March 25, 2026
•[ data leak, unauthorized access, PII ]
Ajax said a hacker unlawfully gained access to parts of its systems and viewed the email addresses of a few hundred people, as well as names, email addresses, and dates of birth for fewer than 20 people with stadium bans.
Undisclosed Israeli firm #50
March 24, 2026
•[ cyberattack, data wiping, security cameras ]
Bloomberg reported an Israeli official said Iran-linked hackers stepped up cyberattacks on Israel, wiping the data of more than 50 small businesses in recent weeks and compromising dozens of security cameras. The official stated critical infrastructure such as energy grids, banks, and hospitals was not infiltrated or disrupted, and that most targeted companies had existing cybersecurity vulnerabilities while stronger-defended companies were not affected. Victim names and specific camera locations were not provided in the report.
LiteLLM
March 24, 2026
•[ supply chain attack, malware, credential theft ]
TeamPCP used compromised release access to publish malicious LiteLLM versions to PyPI, embedding code that exfiltrated secrets and established persistence on systems that installed the poisoned packages.
Aroostook Mental Health Center
March 24, 2026
•[ ransomware, data leak, network disruption ]
Aroostook Mental Health Center said a recent network disruption affected some business operations and temporarily interrupted connectivity, while outside reporting linked the incident to the Qilin ransomware group and a related leak-site extortion claim.
At least one TikTok Business account
March 24, 2026
•[ phishing, adversary-in-the-middle, credential theft ]
Threat actors used adversary-in-the-middle phishing pages impersonating TikTok for Business and Google Careers to capture credentials and session cookies and hijack at least one TikTok Business account while bypassing 2FA.
