Multiple Crypto Users
August 9, 2025
•[ financial, hack, malware ]
Malicious updates to popular npm packages deployed credential/wallet-stealing malware impacting crypto/DeFi users; community advisories urged halting transactions and rotating secrets; maintainers removed tainted packages; early losses ~$900$1,043 total.
City of Stockholm
August 25, 2025
•[ leak, government ]
Vendor Miljdata was breached, exposing PII (names, personal ID numbers, phone, email, employment IDs) for >40,000 City of Stockholm employees; detected late August; disclosed Sept 9; authorities and Truesec investigating; protected-identity individuals not included
Movement “Другaя Украина”
September 9, 2025
•[ hack, ddos ]
DDoS attack against the Other Ukraine movements website limited access; technical teams working to restore availability; no attribution or data breach reported.
Plex Inc
August 9, 2025
•[ hack, leak, technology ]
Plex reported an intrusion into one database leading to theft of a subset of customer authentication data (emails, usernames, securely hashed passwords). Plex urged password resets, recommended signing out all devices, and enabling 2FA; no credit-card data was affected.
Somerset County Children & Youth Services
June 26, 2025
•[ hack, healthcare ]
Email accounts of Somerset County CYS were breached during a fourday period; exposed data includes Social Security and insurance IDs, medical dates, condition/treatment info, sometimes paternity testing info; no confirmed misuse yet; County working with forensics, notifying affected, improving email security and staff training.
University of Southeastern Philippines
August 9, 2025
•[ hack, leak, education ]
Unauthorized access to student records system; ~175,000 records including student ID, name, email, enrollment status, academic monitoring records; data put up for sale; USeP responded by suspending system, migrating servers, enhancing security
Multiple Russian Entitites
July 9, 2025
•[ financial, ddos, technology ]
A DDoS attack by Ukrainian military intelligence disabling fuel payment services (fuel cards), taking down infrastructure of Rostelecom, Lukoil, KCorp, etc., causing disruption in fuel card functionality; over 700 switches and 13 servers in two data centers disabled; financial damage estimated at US$13 million.
Government of Pakistan
August 9, 2025
•[ leak, government ]
A leak of sensitive personal data of thousands of Pakistanis including government officials; data includes identity cards, mobile phone addresses, call logs, travel details; being sold online; probe ordered.
Gamigo[91][368]
January 1, 2012
•[ hack, technology ]
hacked
Discord
January 1, 2025
•[ hack, technology ]
third-party customer support services hacked
Adpost
February 14, 2025
•[ leak ]
In February 2025, data allegedly obtained from an earlier Adpost breach surfaced. The dataset contained 3.3M records including email addresses, usernames, and display names. Multiple attempts to contact Adpost regarding the incident received no response.
Artists&Clients
August 31, 2025
•[ ransomware, leak, technology ]
In August 2025, the "marketplace that connects artists to prospective clients" Artists&Clients, suffered a data breach and subsequent ransom demand of US$50k. The data was subsequently leaked publicly and included 95k unique email addresses alongside usernames, IP addresses and bcrypt password hashes.
Latest Pilot Jobs
August 14, 2022
•[ hack, leak, technology ]
In August 2022, the Latest Pilot Jobs website suffered a data breach that later appeared on a popular hacking forum before being redistributed as part of a larger corpus of data. The data included 119k unique email addresses along with names, usernames and unsalted MD5 password hashes.
HomeRefill
April 2, 2020
•[ leak, retail ]
In April 2020, now defunct Brazilian e-commerce platform HomeRefill suffered a data breach that was later redistributed as part of a larger corpus of data. The data included 187k unique email addresses along with names, phone numbers, dates of birth and salted password hashes.
Cultura
September 6, 2024
•[ hack, retail ]
In September 2024, French retailer Cultura was the victim of a cyber attack they attributed to an external IT service provider. The resultant data breach included almost 1.5M unique email addresses along with names, phone numbers, physical addresses and orders. Cultura advised that all affected customers had been notified about the incident.
Bouygues Telecom
August 4, 2025
•[ hack, technology ]
In August 2025, the French telecommunications company Bouygues Telecom detected a cyber attack against their services. The incident resulted in a data breach that exposed almost 6.4M customer records, including 5.7M unique email addresses. The breach also exposed names, physical addresses, phone numbers, dates of birth and IBANs (International Bank Account Numbers). Bouygues Telecom advised that all affected customers had been notified about the incident.
Animeify
October 14, 2021
•[ leak, technology ]
In October 2021, the now defunct Arabic language Anime website Animeify suffered a data breach that was later redistributed as part of a larger corpus of data. The data included 808k unique email addresses along with names, usernames, genders and plain text passwords.
FreeOnes
February 16, 2017
•[ leak ]
In February 2017, the forum for the adult website FreeOnes suffered a data breach that was later redistributed as part of a larger corpus of data. The data included 960k unique email addresses alongside usernames, IP addresses and salted MD5 password hashes.
Miljödata
August 25, 2025
•[ ransomware, leak, malware ]
In August 2025, the Swedish system supplier Miljdata was the victim of a ransomware attack. Following the attack, data was subsequently published on the dark web and included 870k unique email addresses across various compromised files. Data also included names, phone numbers, physical addresses, dates of birth and government-issued personal identity numbers.
Parliament of Aruba
July 25, 2025
•[ hack, government ]
Parliamentary email systems in Aruba were hacked in late July 2025, compromising official accounts. The attack affected email communications but did not disrupt broader parliamentary operations. No attribution or data theft has been confirmed.
