Portend Breaches

Valtori (Finnish Government ICT Centre) mobile device management service January 30, 2026 • [ data breach, mobile device management, zero-day vulnerability ] Valtori reported a data breach identified on January 30, 2026 in the mobile device management service it provides to Finlands government shared ICT services. Valtori said the attacker accessed information used to operate the service, including names, work email addresses, phone numbers, and device details, and that investigation later found the scope could involve a substantially larger number of users (about 50,000). Valtori stated no data stored directly on mobile devices was compromised. The root cause was described as exploitation of a zero-day vulnerability in a commercial mobile management product, compounded by the systems failure to permanently delete historical data.

Nippon Medical School Musashi Kosugi Hospital (æ—¥æœ¬åŒ»ç§‘å¤§å¦æ¦è”µå°æ‰ç—…é™¢) February 6, 2026 • [ ransomware, data breach, healthcare ] Japans Nippon Medical School Musashi Kosugi Hospital disclosed it suffered a ransomware attack after nurse-call terminals malfunctioned and investigation found its nurse-call system servers were attacked. The hospital stated patient personal information stored on the nurse-call system servers was stolen and that the intrusion path was tied to a maintenance VPN device. Public reporting in Japan said attackers demanded a large ransom (reported internationally as about $100 million). The hospital stated it would not comply with the ransom demand and reported that clinical services continued while investigation and recovery actions proceeded.

BridgePay Network Solutions (vendor) impacting City of Marietta online payments February 15, 2026 • [ ransomware, third-party risk, payment processing outage ] City officials said Mariettas inability to process some online credit card payments was caused by a nationwide ransomware incident at BridgePay Network Solutions, one of the citys online payment gateway providers. The city stated its own systems and data were not compromised, but the vendor outage disrupted payment processing for municipal services. Officials worked to stand up a secure alternative solution while the vendor coordinated response with federal authorities and incident-response partners.

Atlas Transfer and Storage July 15, 2025 • [ unauthorized access, data breach, PII ] Atlas Transfer & Storages notice states it identified suspicious activity on July 15, 2025 and launched an investigation. The investigation concluded that an unauthorized party copied certain files on the same date. Atlas reviewed the impacted files and stated the affected information varied by individual but could include identifiers and financial/health insurance information such as SSNs, tax IDs, drivers license/state IDs or other government IDs, payment card numbers, health insurance and medical information, and financial account information. Atlas stated it notified individuals and offered complimentary credit monitoring services.

Alpine Lumber December 14, 2025 • [ ransomware, data leak, personally identifiable information ] Alpine Lumbers posted notice states that on December 22, 2025 it determined certain network devices were encrypted with ransomware. The companys investigation found that between December 14 and December 22, 2025 an unauthorized actor viewed and obtained files stored on a file server. Alpine completed its file review and determined on February 5, 2026 that the affected files included employment-purpose information such as names, addresses, Social Security numbers, dates of birth, and health insurance plan enrollment information, and may also have included policy numbers, medical information, government IDs, financial account data, and payment card data. Alpine stated it notified law enforcement and began mailing letters and offering credit monitoring.

Deutsche Bahn February 13, 2026 • [ denial-of-service, DDoS, service outage ] German reporting relayed statements attributed to Germanys BSI leadership describing a massive cyberattack against Deutsche Bahn that overwhelmed systems with exceptionally high request volumes and caused outages to services such as booking. The report characterized the attack as unusually large in scale, consistent with a major denial-of-service event impacting digital service availability. The reporting accessible here does not describe data theft; the primary effect is disruption to online service functionality due to traffic overload.

Figure February 12, 2026 • [ social engineering, data leak, extortion ] Figure Technology Solutions confirmed it suffered a data breach after an employee fell victim to a social engineering attack, with attackers obtaining a limited number of files. SecurityWeek reported that the ShinyHunters group took credit and posted archive files on its leak site; Have I Been Pwned analysis identified roughly 967,000 user records in the leaked data. The exposed information includes names, dates of birth, email addresses, postal addresses, and phone numbers. The reporting frames the incident as data theft/extortion without describing service disruption to Figures lending operations.

Grupo Godo February 16, 2026 • [ DDoS attack, service availability disruption, cybersecurity protocols ] Grupo God reported that the websites of La Vanguardia, Mundo Deportivo, RAC1, and RAC105 experienced a coordinated DDoS attack starting around 06:08 that caused slow loading, intermittent errors, and in some cases total access failures. The group said the attack originated from infrastructure located in Germany and that technical teams activated cybersecurity protocols and mitigation measures to restore services, which returned to normal between approximately 07:30 and 07:40. The company stated that technical analysis found no unauthorized access to personal data and that the incident was limited to saturating systems with massive external traffic, making this a service availability disruption without confirmed data theft.

York City February 10, 2026 • [ ransomware, cyberattack, ransom payment ] Reporting summarized in secondary coverage stated that York Citys cyberattack (described as a major incident that crippled the citys digital infrastructure) led to a $500,000 ransom payment made by the citys insurance company to overseas hackers, according to a former mayor. The report described the payment as roughly half of the initial demand and framed it as necessary to regain control of systems.

KSeF February 1, 2026 • [ DDoS attack, service disruption, e-invoicing ] Polish reporting quoted Finance and Economy Minister Andrzej Domaski stating that early access problems with the KSeF e-invoicing system were due in part to a DDoS attack against the login system, alongside heavy legitimate login attempts. The minister said the DDoS traffic came from 17 countries, which contributed to overload and user access difficulties, and that the situation was brought under control. The reporting does not describe data theft; the primary effect is temporary disruption/degradation of system accessibility due to external traffic flooding.

Langley Twigg Law January 11, 2026 • [ cyberattack, data breach, malware ] Langley Twigg Law (Napier, New Zealand) stated it was hit by a cyberattack on January 11, 2026. The firm said digital forensics and cyber specialists confirmed a malicious third-party launched a virus on its IT network, which was not protected by its cybersecurity software at the time. The firm reported the attacker extracted a portion of data from its file server containing internal operational information and some client documents. Langley Twigg said it disconnected its network from the internet, notified the Privacy Commissioner and police, and was working to determine exactly what information was affected before contacting impacted clients.

At least one 7-Zip user January 26, 2026 • [ malware distribution, proxy botnet, domain impersonation ] Toms Hardware reported that the unofficial domain 7-zip.com (not the official 7-zip.org) served malware-laden downloads for roughly ten days, from January 12 to January 22. The site initially displayed legitimate links, but after 2030 seconds a script swapped download links to a malicious executable, likely to evade basic automated scanning. The malwares primary described function was to install a proxy service, turning victims PCs into nodes in a proxy botnet that criminals could route traffic through to obscure their origins. This is a malware distribution campaign impacting end users rather than a single named victim organizations breach.

Cuero Chamber of Commerce January 26, 2026 • [ malware, social engineering, ClickFix ] The Cuero Chamber of Commerce reported a malware/social engineering incident affecting its web properties after a customer noticed suspicious activity in an email sent January 26. The chamber said users registering for an event were shown a CAPTCHA prompt and then instructed to press Windows+R and paste/run contentbehavior consistent with ClickFix social engineering designed to trick victims into executing malicious commands on their own devices. The chamber stated that the Cuero Development Corporation website was the only confirmed security breach and that significant data loss occurred, and it believed the malware was introduced via a third-party platform (Shopify) used for event registration. The chamber said it could not determine how many people or organizations were affected and implemented additional safeguards.

Precipio Inc. November 23, 2025 • [ unauthorized access, data leak, protected health information ] Precipio posted a Notice of Data Event stating it learned on or about November 25, 2025 that an unauthorized user accessed an employees cloud-based storage account. The companys investigation (with third-party cybersecurity specialists) determined the unauthorized access occurred on or around November 23, 2025 and that certain files in the account were copied without authorization. Precipio stated the impacted information varies by person but may include identifiers and protected health information such as names, addresses, MRNs, DOB, clinical/treatment and procedure information, provider name, prescription information, and health insurance information. The notice said law enforcement was notified and that additional notifications would follow after file review completion.

EyeCare Partners January 1, 2025 • [ email compromise, unauthorized access, data breach ] EyeCare Partners disclosed that an unauthorized third party accessed certain ECP-managed email accounts between December 3, 2024 and January 28, 2025. The accessed files may have contained personal identifiers and limited health-related information, including addresses, dates of birth, Social Security numbers, drivers license numbers, health plan information, and limited clinical information; the notice emphasized that full medical records and detailed clinical information were not impacted. The organization reported the incident to Massachusetts regulators on February 4, 2026 and began outreach and remediation steps consistent with an email-system compromise.

La Comisiï¿½n Nacional de Seguros y Fianzas (CNSF) February 6, 2026 • [ data leak, security incident, PII ] In the case of the National Insurance and Bonding Commission (CNSF) , the regulator reported that on January 30th it registered an information security incident that exposed intermediary identification documents containing data such as name, CURP (Unique Population Registry Code), RFC (Federal Taxpayer Registry), and photograph.

Sociedad Hipotecaria Federal January 21, 2026 • [ ransomware, data leak, encryption ] Sociedad Hipotecaria Federal was listed by LockBit, which claimed to have stolen 277 GB of data and published it after a ransom deadline expired; reporting also cited encryption of critical systems and operational disruption.

Beacon Mutual Insurance Co. February 6, 2026 • [ ransomware, data breach, workers' compensation ] Insurance Journal reported that Rhode Island-based workers compensation insurer Beacon Mutual experienced a ransomware attack and was working to determine what information and which individuals may have been affected. The report indicates an active investigation and response effort, but does not provide a confirmed data-type list, count of affected individuals, or a detailed timeline of intrusion and restoration in the excerpt available.

Another Ukraine February 6, 2026 • [ DDoS, availability disruption ] Russian state media reported that the website of the movement Another Ukraine was hit by another DDoS attack, according to the groups Telegram channel. The organization said the site returned to normal operation after the attack. No data theft was described; the reported impact was short-term disruption of availability.

Rinku Singh's Facebook account February 5, 2026 • [ account takeover, hacking, social media breach ] Indian media reported that cricketer Rinku Singhs Facebook account was hacked, with police stating the cybercrime unit was investigating. The report indicated it was not yet known whether the compromise resulted in financial fraud or other misuse beyond unauthorized access/control of the account. The confirmed effect is account compromise and loss of control of a social media profile; additional impacts were not established in the reporting.

Recent Breaches