Recent Breaches
-
June 1, 2016 • Russian national Searzhudin Aktulaev, extradited from Cyprus, was indicted for messaging ~80,000 users of a California freelance platform (June 2016-Nov 2017) with malicious Excel files that installed TVRAT/DarkVNC, infecting thousands of computers and stealing credentials.
-
May 1, 2018 • An AT&T store worker in Portland, Oregon used his access to AT&T systems from May 2018 to Nov 2019 to SIM-swap customers' numbers to co-conspirators' devices, letting them intercept login codes and access bank accounts (~$600,000 intended losses). He got 16 months in prison.
-
June 1, 2019 Israel indicted ex-CISO Michael Bar of Ashkelon on Sept 10, 2026 for allegedly planting AI-built malware from 2019 until his August 2026 arrest in 26 companies, two kibbutzim and individuals, stealing passwords, correspondence and business data and recording via webcams.
-
October 4, 2020 • J.C. Cannistraro discovered unusual activity in its computer network on October 4, 2020 and determined that the network had been encrypted by ransomware. The company notified personnel on October 7 and later learned that personal information had been disclosed to an unauthorized party; regulatory reporting lists 1,660 affected individuals, and a former employee later received an alert that his Social Security number was on the dark web. Avaddon listed J.C. Cannistraro on its leak site in November 2020, supporting group attribution, although the company did not publicly confirm the actor. The technical source of the stolen data is not established, so the exploitive subtype remains undetermined.
-
June 24, 2021 • During June 24-25, 2021, attackers encrypted files held by a French enterprise-software hosting provider and demanded ransom for decryption. The company restored hosted applications but could not recover certain data belonging to 14 customers because adequate off-site backups were absent. The case became public through reporting of a 2026 insurance judgment. Criminal/Financial is supported by the explicit ransomware demand; theft of files was not established. Software is a litigation pseudonym rather than the company's verified legal name.
-
September 1, 2021 • Scattered Spider crew members phished credentials at 12+ companies (entertainment, telecom, tech, BPO, IT, cloud, crypto) in 2021-2023, stole company data and millions in crypto from 29 victims. Ahmed Elbadawy's guilty plea surfaced Sept 2026 via a forfeiture filing.
-
May 21, 2022 • Turkish kebab chain Baydner was breached on May 21, 2022: malware on its IT manager's computer exposed web-service passwords, and attackers copied data on 505,337 people, then messaged an executive. Turkey's KVKK fined the chain 1M TL in 2026.
-
July 29, 2022 • An unauthorized actor accessed portions of Order Express's network between July 29 and September 7, 2022. Order Express discovered server connectivity problems on September 7 and shut down its network; investigators later determined that ransomware had encrypted just over half of its servers and that customer data had been accessed and exfiltrated. State breach filings identify 63,220 affected individuals. Contemporaneous public reporting attributed the incident to Cl0p, although Order Express itself described the attacker as unknown.
-
October 21, 2022 • Citizen Lab found with high confidence that former Greek MEP Stelios Kouloglou's iPhone was successfully infected with NSO Group's Pegasus on October 21, 2022 and again on March 6-7, 2023 using the PWNYOURHOME zero-click exploit. The infections occurred during sensitive PEGA Committee work. Researchers did not attribute the operation to a government, found no indication Greece was responsible, and assessed that the first infection overlapped with an operator previously targeting Russian- and Belarusian-speaking journalists and activists.
-
April 1, 2023 • The university's CIO/CISO dates LockBit's entry to April 1, 2023, using compromised employee credentials. About 13 days later, attackers encrypted servers and destroyed an onsite backup. They demanded US$1.25 million; the university did not pay. Stolen files were published around June 12. Cached server credentials were compromised. April 1 dates initial access, not encryption or confirmed extraction; the August 2026 interview describes a 2023 incident.
-
April 1, 2023 • Ex-U.S. Army soldier Cameron Wagenius ('kiberphant0m') and co-conspirators stole credentials and data, incl. call detail records, from at least 10 organizations incl. U.S. and foreign telecoms (Apr 2023-Dec 2024), sold and leaked data and sought $1M+ via extortion; 70-month term.
-
May 10, 2023 • A RedLine infostealer infected a senior officer's Windows computer used by the Syrian National Army Military Police Investigation Section in Suluk on May 10, 2023. Hudson Rock recovered a stealer log timestamped 09:39 showing the unit-named Windows account and theft of saved passwords, browser cookies, a live Telegram session, and 14 desktop files, including seven active detainee interrogation records. Five recovered Office lock files indicate some records were open when the malware ran. The log subsequently circulated in criminal markets. The individual RedLine affiliate responsible has not been identified. RedLine is commodity malware-as-a-service designed for credential and financial-data theft and resale, supporting Criminal actor type and Financial motive.
-
June 7, 2023 • Unauthorized access between June 7 July 12 2023 led to acquisition of sensitive personal and health information of 10,833 individuals. No service disruption; services remained operational. No perpetrator identified. Incident discovered July 12 2023; disclosure publicized via Yahoo on August 30 2025.
-
August 1, 2023 • Cameron Curry, a contract data analyst, used his access to Brightly Software's payroll information and corporate data to remove sensitive files between August and December 2023. Beginning in December, he used the alias Loot to demand $2.5 million in cryptocurrency and threatened to publish the stolen information.
-
September 1, 2023 • In September 2023, UNC6508 compromised a REDCap server belonging to an undisclosed North American medical research university. Three months later, the actor deployed the INFINITERED backdoor, harvested credentials, persisted through REDCap upgrades, obtained domain-administrator access, and created a Google Workspace content-compliance rule that silently forwarded selected emails to an actor-controlled account. Activity continued through November 2025. Google also identified additional organizations in the United States and Canada compromised with INFINITERED, but this row represents the detailed September 2023 university victim.
-
November 1, 2023 • Russian web developer Sergei Filimonov, extradited from Georgia, pleaded not guilty in Atlanta to charges he used fake bank login pages from Nov. 2023 to Oct. 2025 to steal U.S. customers' credentials and drain accounts. FBI counts 19+ victims and about $14.6M lost.
-
December 23, 2023 • On 2023-12-23, law enforcement informed St. George Fire Protection District No. 2 that threat actors had infiltrated its network. A later lawsuit alleged that compromised remote-access credentials used by the district's managed service provider enabled the intrusion and that attackers used legitimate administrative tools while inside the environment. The district's domain controllers were compromised, and it subsequently rebuilt servers, switches, domain controllers, firewalls, and backup infrastructure. No data theft, affected-person count, actor, motive, or service interruption was publicly reported.
-
January 22, 2024 • Black Basta ransomware group attacked UK water supplier Southern Water in January 2024, encrypting several IT systems and stealing customer and corporate data. The company later reported approximately 45 million in total expenses related to recovery, legal fees, and customer notification. The breach exposed nearly half a million customer records, and operations were temporarily disrupted though water services continued. Southern Water confirmed data exfiltration via its internal investigation and regulator notifications.
-
February 27, 2024 • Between February 27, 2024, and December 5, 2025, one or more unnamed suspected China-linked operators maintained PlugX, ShadowPad, and Cobalt Strike command-and-control activity involving Balochistan Police network appliances and web servers. In late 2024, an operator uploaded malicious cms_plugin.exe variants to the police Complaint Management System, including a Rust stager and a .NET implant that loaded AsyncRAT, creating a malware-delivery path to police and public users. SentinelLabs did not name the actor and warned that the shared or commodity tooling may represent more than one operator; no theft of the records stored on the affected systems was confirmed.
-
May 15, 2024 • Amazon confirms a data breach involving employee information after data allegedly stolen during the May 2023 MOVEit attacks is leaked on a hacking forum.