Full List

Search

Recent Breaches

• Iberia Airlines January 7, 2026 • [ infostealer, malware, credential theft ] TechRadar and HackRead summarized Hudson Rock research describing a campaign in which an actor using the alias Zestix (aka Sentap) leveraged credentials harvested by infostealer malware (e.g., RedLine, Lumma, Vidar) to access corporate cloud instances where multi-factor authentication was not enforced. Reporting stated the attacker obtained and attempted to auction or sell large volumes of sensitive corporate files from roughly 50 enterprises worldwide, with at least one victim reportedly losing on the order of 139GB of data. Specific victim impacts vary by organization, and the timing of initial credential theft was not fully specified.
• Nissan Motor Corporation (Nissan Motor Co., Ltd.) January 10, 2026 • [ ransomware, data leak, extortion ] HackRead reported that the Everest ransomware group claimed it breached Nissan Motor Corporation and stole about 900GB of internal data. The article said the group posted the allegation on its leak site on January 10, 2026 and shared screenshots and directory listings suggesting access to internal operational documents, data extracts, and dealership-related records. Everest reportedly threatened to publish the data if Nissan did not respond within a set timeframe. Nissan had not publicly confirmed the claim at the time of reporting.
• At least one US government official January 19, 2026 • [ spearphishing, espionage, DLL sideloading ] HackRead summarized Acronis research describing an espionage-oriented spearphishing campaign targeting U.S. government entities using Venezuela-related news as bait. The described chain used a lure archive and DLL sideloading to load a backdoor dubbed LOTUSLITE, enabling remote access actions such as file collection and command execution on compromised systems. The article stated the researchers attributed the activity with moderate confidence to the China-backed group Mustang Panda (aka HoneyMyte).
• McDonald's India January 20, 2026 • [ ransomware, data leak, data exfiltration ] HackRead reported that on January 20, 2026 the Everest ransomware group claimed it breached McDonalds India and exfiltrated 861 GB of customer data and internal documents. The report described screenshots purportedly showing internal financial reports (20232026), audit trails, cost tracking, ERP migration files, pricing data, and other internal communications, as well as a Contact Database spreadsheet with investor/business-partner contact details and store-level manager contact information. Everest reportedly issued a short deadline and threatened to leak data; the article noted the claim was unverified at the time.
• Leduc County December 25, 2025 • [ ransomware, cybersecurity incident, IT systems outage ] Leduc County in Alberta reported that it became aware on December 25, 2025 of a deliberate cybersecurity incident later identified as a ransomware attack. The county said the activity disabled some of its IT systems, and that other systems were proactively taken offline during an ongoing forensic investigation and recovery. Reporting noted that law enforcement and key stakeholders (including insurance and banking providers) were notified. Public reporting did not specify confirmed data theft, the number of affected endpoints, or a restoration date.
• WhiteDate January 2, 2026 • [ hacktivism, data leak, data destruction ] Reporting describes a hacktivist using the pseudonym Martha Root who infiltrated an extremist dating website and related sites and later demonstrated deleting them live on stage during the Chaos Communication Congress. The coverage indicates the actor used automated tools/AI chatbots to extract and download user profile information and then published the acquired dataset. As described, the incident combined disruptive impact (site/service deletion) with unauthorized access and data acquisition affecting site users.
• Global-e January 7, 2026 • [ data exposure, third-party compromise, unauthorized access ] Reporting aggregated by DataBreaches.Net indicates Ledger was impacted by a data exposure incident involving its third-party payment processor, Global-e. The report describes an email notification stating that an unauthorized party accessed Global-es cloud system and obtained Ledger customers personal details, including names and contact information associated with orders. The notification did not specify when the access occurred, how many Ledger customers were affected, or whether additional data types (e.g., payment details) were involved. The incident is treated as a third-party compromise affecting Ledger customer data.
• Methodist Homes of Alabama and Northwest Florida October 2, 2024 • [ unauthorized access, healthcare data breach, network incident ] Methodist Homes of Alabama and Northwest Florida reported an incident involving unauthorized access to its network between October 2 and October 14, 2024. The organization notified HHS on January 30, 2025 that 908 patients were affected, and later notified the Maine Attorney Generals Office in October 2025 that the incident affected 25,579 individuals in total.
• Undisclosed Taiwanese healthcare organization #5 January 12, 2026 • [ ransomware, cyber intrusion, data exfiltration ] The CrazyHunter ransomware group conducted a cyber intrusion against a healthcare organization in Taiwan by exploiting application-layer access, resulting in unauthorized access and data exfiltration. Security reporting confirms the victim as one of multiple Taiwanese healthcare entities affected, though specific organizational details were not publicly disclosed.
• Armenian Government January 13, 2026 • [ Data Leak, Cybercrime, Alleged Breach ] Reporting stated that a forum user using the alias dk0m offered for sale what was described as a large dataset of Armenian government-related data, allegedly obtained by accessing a government notification system used to distribute official communications (legal and administrative notices). The seller advertised the dataset for $2,500 and claimed it contained about 8 million records related to official notifications, including communications involving police and judicial bodies. Armenian officials opened an investigation, while a government-linked communications body publicly denied that government email infrastructure was breached and suggested any access may have involved another state platform. Because the incident is described as an allegation under investigation without independent confirmation of access or data theft, it is recorded as an alleged event rather than a confirmed cyberattack.
• Southold November 24, 2025 • [ cyberattack, service disruption, government ] Southold, New York suspended public access to its Laserfiche online record-keeping system for more than six weeks following a cyberattack reported to have breached town servers on November 24, 2025. According to reporting cited in the post, the town planned approximately $500,000 in security upgrades funded via a bond before restoring public access to Laserfiche, and officials stated they could not provide a timeline for restoration as of January 12, 2026. The confirmed impact described is prolonged loss of public access to the online records system while remediation and security hardening continued; public reporting in the cited excerpt did not confirm data theft or enumerate affected records.
• Eurail January 10, 2026 • [ security breach, data leak, unauthorized access ] Eurail B.V. (also operating as Interrail) confirmed a security breach that resulted in unauthorized access to customer data. Eurail/Interrail publicly posted notice on January 10, 2026 and began emailing affected customers on January 13, 2026, with the investigation described as ongoing. The companys early review stated that impacted data may include customer order and reservation information along with basic identity and contact details. Where provided, it may also include passport information such as passport number, country of issuance, and expiry date, particularly for customers who received passes through the DiscoverEU program. The report also referenced exposure of bank details and advised customers to remain vigilant for fraud attempts while Eurail monitored for misuse and notified data protection authorities.
• Anchorage Police Department via Whitebox Technologies January 7, 2026 • [ security incident, third-party risk, data migration ] Anchorage Police Department reported it took immediate containment actions after being alerted on January 7, 2026 to a security incident affecting one of its technology service providers, Whitebox Technologies (a data migration firm). According to reporting cited in the post, the Citys IT department shut down the relevant Anchorage Police Department servers and disabled the vendors access along with all third-party service provider access while incident response work continued. As of the report date, no ransomware group had publicly claimed responsibility and there was no public statement from the vendor. Public reporting did not confirm whether any APD data was accessed or exfiltrated, but it confirms operational disruption via server shutdown and access suspension.
• Advanced Family Surgery Center (AFSC) November 26, 2025 • [ data leak, healthcare, protected health information ] Threat actors identifying as Genesis claimed they compromised Advanced Family Surgery Center (AFSC) in Oak Ridge, Tennessee, and later added the organization to their leak site, asserting that about 100 GB of data had been exfiltrated from company file servers. The reported dataset included healthcare data, personal data, financial data, user folders, and operational files. The reporting outlet reviewed sample files and indicated they contained protected health information such as patient names, dates of birth, full Social Security numbers, dates of service, physician details, and insurance information. At the time of reporting, no official public notification by the provider had been located.
• Zendesk January 18, 2026 • [ spam campaign, email abuse, unsolicited messaging ] A large-scale spam campaign abused Zendesks support-ticket functionality, where unverified users can submit tickets that trigger automatic confirmation emails to the address provided. Beginning around January 18, 2026, recipients worldwide reported receiving hundreds of emails with unusual or alarming subject lines, generating confusion and disruption. The reports indicated that attackers were leveraging support platforms run by companies that use Zendesk for customer service; the immediate impact was mass unsolicited messaging rather than confirmed data theft.
• Crunchbase January 23, 2026 • [ vishing, social engineering, credential theft ] Reporting on an Okta SSO vishing (voice-phishing) campaign, ShinyHunters reportedly confirmed to a researcher that it conducted the campaign and launched a new dark web leak site. According to the report, ShinyHunters claimed that multiple victims had their data posted after refusing extortion demands, naming Crunchbase, SoundCloud, and Betterment as initial examples. The incident reflects social-engineering-driven credential theft leading to unauthorized access and data theft, followed by extortion and publication of alleged victim data.
• Waltio January 24, 2026 • [ data leak, extortion, cryptocurrency ] French crypto tax platform Waltio reported being targeted by the ShinyHunters group, which claimed to possess personal data for nearly 50,000 users and threatened to leak users 2024 tax reports unless a ransom was paid. Waltio stated that its services and production systems remained secure and that no sensitive banking credentials or crypto access data was compromised. The incident primarily involves alleged data theft and extortion threats rather than service disruption, with the full scope of stolen fields not detailed in the summary.
• Call-On-Doc, Inc., dba Call-On-Doc.com December 1, 2025 • [ data leak, telehealth breach, patient record exfiltration ] A threat actor posted a sales listing on a hacking forum claiming that telehealth provider Call-On-Doc was breached in early December 2025 and that 1,144,223 patient records were exfiltrated. The listing reportedly included patient identifiers and contact details, transaction metadata, medical category and condition fields, prescribed services, and payment amounts. The reporting outlet reviewed screenshots and a sample file and assessed the data appeared plausible, but Call-On-Doc had not publicly confirmed the incident at the time of reporting.
• Winona County January 23, 2026 • [ ransomware, forensics, emergency services ] Winona County, Minnesota reported responding to a ransomware incident that impacted its computer network. The county engaged third-party cybersecurity and forensics specialists and coordinated with local, state, and federal law enforcement. While emergency services such as 911, fire, and emergency response operations were reported to remain operational, the incident was significant enough that county leadership declared a local emergency. Further technical details, including the ransomware variant, extent of disruption across departments, and whether data was stolen, were not provided in the brief public update.
• Nike January 22, 2026 • [ ransomware, data leak, exfiltration ] A ransomware group calling itself WorldLeaks (reported as a rebrand of Hunters International) claimed it breached Nike and began leaking data online. The groups leak-site posting dated January 22, 2026 alleged exfiltration of more than 1.4TB of files. A review of the leaked directory names suggested the exposed material primarily relates to product development and manufacturing operations, including design specifications and supplier-related operational documents, along with internal presentations and collaboration materials. Nike stated it was investigating the claims.