Eurail
January 10, 2026
•[ security breach, data leak, unauthorized access ]
Eurail B.V. (also operating as Interrail) confirmed a security breach that resulted in unauthorized access to customer data. Eurail/Interrail publicly posted notice on January 10, 2026 and began emailing affected customers on January 13, 2026, with the investigation described as ongoing. The companys early review stated that impacted data may include customer order and reservation information along with basic identity and contact details. Where provided, it may also include passport information such as passport number, country of issuance, and expiry date, particularly for customers who received passes through the DiscoverEU program. The report also referenced exposure of bank details and advised customers to remain vigilant for fraud attempts while Eurail monitored for misuse and notified data protection authorities.
Anchorage Police Department via Whitebox Technologies
January 7, 2026
•[ security incident, third-party risk, data migration ]
Anchorage Police Department reported it took immediate containment actions after being alerted on January 7, 2026 to a security incident affecting one of its technology service providers, Whitebox Technologies (a data migration firm). According to reporting cited in the post, the Citys IT department shut down the relevant Anchorage Police Department servers and disabled the vendors access along with all third-party service provider access while incident response work continued. As of the report date, no ransomware group had publicly claimed responsibility and there was no public statement from the vendor. Public reporting did not confirm whether any APD data was accessed or exfiltrated, but it confirms operational disruption via server shutdown and access suspension.
Advanced Family Surgery Center (AFSC)
November 26, 2025
•[ data leak, healthcare, protected health information ]
Threat actors identifying as Genesis claimed they compromised Advanced Family Surgery Center (AFSC) in Oak Ridge, Tennessee, and later added the organization to their leak site, asserting that about 100 GB of data had been exfiltrated from company file servers. The reported dataset included healthcare data, personal data, financial data, user folders, and operational files. The reporting outlet reviewed sample files and indicated they contained protected health information such as patient names, dates of birth, full Social Security numbers, dates of service, physician details, and insurance information. At the time of reporting, no official public notification by the provider had been located.
Zendesk
January 18, 2026
•[ spam campaign, email abuse, unsolicited messaging ]
A large-scale spam campaign abused Zendesks support-ticket functionality, where unverified users can submit tickets that trigger automatic confirmation emails to the address provided. Beginning around January 18, 2026, recipients worldwide reported receiving hundreds of emails with unusual or alarming subject lines, generating confusion and disruption. The reports indicated that attackers were leveraging support platforms run by companies that use Zendesk for customer service; the immediate impact was mass unsolicited messaging rather than confirmed data theft.
Crunchbase
January 23, 2026
•[ vishing, social engineering, credential theft ]
Reporting on an Okta SSO vishing (voice-phishing) campaign, ShinyHunters reportedly confirmed to a researcher that it conducted the campaign and launched a new dark web leak site. According to the report, ShinyHunters claimed that multiple victims had their data posted after refusing extortion demands, naming Crunchbase, SoundCloud, and Betterment as initial examples. The incident reflects social-engineering-driven credential theft leading to unauthorized access and data theft, followed by extortion and publication of alleged victim data.
Waltio
January 24, 2026
•[ data leak, extortion, cryptocurrency ]
French crypto tax platform Waltio reported being targeted by the ShinyHunters group, which claimed to possess personal data for nearly 50,000 users and threatened to leak users 2024 tax reports unless a ransom was paid. Waltio stated that its services and production systems remained secure and that no sensitive banking credentials or crypto access data was compromised. The incident primarily involves alleged data theft and extortion threats rather than service disruption, with the full scope of stolen fields not detailed in the summary.
Call-On-Doc, Inc., dba Call-On-Doc.com
December 1, 2025
•[ data leak, telehealth breach, patient record exfiltration ]
A threat actor posted a sales listing on a hacking forum claiming that telehealth provider Call-On-Doc was breached in early December 2025 and that 1,144,223 patient records were exfiltrated. The listing reportedly included patient identifiers and contact details, transaction metadata, medical category and condition fields, prescribed services, and payment amounts. The reporting outlet reviewed screenshots and a sample file and assessed the data appeared plausible, but Call-On-Doc had not publicly confirmed the incident at the time of reporting.
Winona County
January 23, 2026
•[ ransomware, forensics, emergency services ]
Winona County, Minnesota reported responding to a ransomware incident that impacted its computer network. The county engaged third-party cybersecurity and forensics specialists and coordinated with local, state, and federal law enforcement. While emergency services such as 911, fire, and emergency response operations were reported to remain operational, the incident was significant enough that county leadership declared a local emergency. Further technical details, including the ransomware variant, extent of disruption across departments, and whether data was stolen, were not provided in the brief public update.
Nike
January 22, 2026
•[ ransomware, data leak, exfiltration ]
A ransomware group calling itself WorldLeaks (reported as a rebrand of Hunters International) claimed it breached Nike and began leaking data online. The groups leak-site posting dated January 22, 2026 alleged exfiltration of more than 1.4TB of files. A review of the leaked directory names suggested the exposed material primarily relates to product development and manufacturing operations, including design specifications and supplier-related operational documents, along with internal presentations and collaboration materials. Nike stated it was investigating the claims.
Munson Healthcare (via Cerner legacy systems)
January 22, 2025
•[ data leak, third party breach, healthcare data ]
Munson Healthcare confirmed that an unauthorized third party gained access to and obtained data maintained by its electronic health record vendor, Cerner, on legacy Cerner systems used by Munson. The investigation indicated access occurred at least as early as January 22, 2025, and could have exposed patient identifiers and clinical information, including Social Security numbers and medical record data. Munson and Cerner reported taking steps to secure the affected systems and notified impacted individuals with options for identity-protection services.
Viafier
January 22, 2026
•[ malware, data leak, unauthorized access ]
The Swiss rail operator Viafier Retica shut down its Vereina car-shuttle online ticket shop after discovering malware on the system. The organization stated that attackers likely accessed the web shop database, which may contain customer and employee contact details and hashed passwords. Users were advised to change passwords used on other services. The incident caused service disruption to online ticket sales while containment and investigation actions were undertaken.
Danish Booksellers' Commission Foundation
December 15, 2025
•[ ransomware, data leak, IT disruption ]
A Danish business foundation that distributes books to many bookstores reported being hit by ransomware during the busy Christmas period. The incident disrupted IT operations and prompted an investigation. The organization warned that attackers may have accessed internal files, including employee salary information and other personal data related to staff and potentially customers and former employees. Details on the initial access vector, the ransomware strain, and the total number of impacted individuals were not publicly provided.
At least one customer of Canada Computers
December 26, 2025
•[ Magecart, card skimming, data leak ]
Canada Computers acknowledged a web-based data security incident affecting its online store after a Magecart-style card-skimming script was found embedded on the checkout page. According to reporting, a shopper identified the suspicious script on January 18, 2026, and the malicious code was removed after the findings were publicized. Archived versions of the checkout page suggested the skimmer may have been active since at least late December 2025, meaning payment-form data entered by customers during that window could have been captured. Canada Computers customer notice said an unauthorized user may have accessed customer information such as names, email addresses, and possibly credit card numbers; customers were advised to monitor statements and consider replacing cards.
American Vanguard
January 10, 2026
•[ data leak, data exfiltration, unauthorized access ]
The Osiris threat group gained unauthorized access to American Vanguard systems in early January 2026 and exfiltrated corporate and financial data. Security reporting and attacker leak listings indicate data theft, though no explicit confirmation of file encryption was reported. Operational impacts appear linked to incident response and remediation activities.
Jupiter Medical Center (via third party health records vendor)
January 1, 2025
•[ data breach, healthcare, third party risk ]
Jupiter Medical Center issued a warning/notice describing a data breach tied to a data security incident dating back to January 2025. The report indicates the healthcare organization investigated the incident and proceeded with notification and remediation steps in 2026. Because the accessible source context here does not provide a clear affected-individual count or a detailed breakdown of data elements, the customer-data fields are coded as undetermined.
Veenkoloniaal Museum (Veendam)
January 7, 2026
•[ ransomware, unauthorized access, data theft ]
The Veenkoloniaal Museum in Veendam experienced a ransomware incident discovered on January 7, 2026, in which the LockBit group gained unauthorized access to systems. Data was stolen and files were rendered inaccessible, affecting digital records and image archives. Individuals whose personal data was involved were notified. The museum restored systems from backups and declined to negotiate with the attackers.
Local Government Services Portal (KOVTP)
January 22, 2026
•[ cyberattack, denial-of-service, service disruption ]
A Russian-language summary report stated that the portal for local government services (KOVTP) was subjected to a large-scale cyberattack that disrupted availability. The incident was presented as a service disruption affecting public access, consistent with an external denial-of-service scenario. The available summary did not provide exact downtime, traffic characteristics, or evidence of data theft, so the record is coded as disruptive with undetermined duration and scope details.
PcComponentes
January 22, 2026
•[ data breach, investigation, customer data ]
TechRadar reported that the PC-components retailer PcComponentes was looking into online claims of a breach while the company denied that a confirmed customer data breach had occurred. The article focused on the investigation and the companys public position. In the accessible page text used here, there was no definitive disclosure of an attacker, a verified data set, or a confirmed number of affected customers, so the impact to customer data is coded as undetermined.
TELEPORT.RF
January 22, 2026
•[ DDoS attack, availability disruption, denial-of-service ]
The Russian-language news outlet Teleport RF reported that its website (teleport2001.ru) was subjected to a DDoS attack. The report described disruptions to site availability consistent with a traffic-flooding denial-of-service, affecting readers ability to access content. No claims of data theft or system compromise beyond availability disruption were described in the article.
City of Trier's website
January 8, 2025
•[ DDoS, hacktivism, availability attack ]
Open reporting described the municipal website for the City of Trier as being targeted by a pro-Russian hacktivist group in an availability attack, consistent with a DDoS campaign. The reporting linked the activity to NoName057(16), a group frequently associated with politically motivated denial-of-service actions against public-sector entities. The incident was characterized as a disruption of access to the public-facing website rather than a confirmed data theft. Specific metrics such as downtime length, traffic volume, and whether any internal systems were affected were not confirmed in the accessible sources used here.
