Full List

Search

Recent Breaches

• CarGurus February 13, 2026 • [ data breach, social engineering, vishing ] TechRadar reported that ShinyHunters claimed to have breached CarGurus and stolen about 1.7 million corporate records, threatening to release the data by a stated deadline. The report linked the claim to a broader wave of social-engineering vishing attacks used to obtain employee credentials/MFA codes and then access SSO dashboards (Okta/Entra/Google) and downstream applications. At the time of reporting in the article, CarGurus had not publicly confirmed the breach details, the precise intrusion window, or exactly what categories of data were taken beyond the actors claim, so this record reflects an alleged data-theft event pending independent confirmation.
• youX February 15, 2026 • [ unauthorized access, data leak, exfiltration ] youX (Australian finance technology platform) confirmed unauthorized access by a third party after a threat actor released data it claimed to have obtained during the incident. Public reporting said youX had flagged an IT security incident about a week earlier and that personal information may have been compromised. External threat reporting associated the incident with a large-scale exfiltration claim (hundreds of gigabytes) affecting borrowers and broker organizations, consistent with data-theft extortion behavior. The companys public statements centered on incident response actions, engagement with external experts, and regulatory notification while it worked to determine the precise scope and which individuals and organizations were impacted.
• Advantest Corporation February 19, 2026 • [ ransomware, unauthorized access, incident response ] Advantest disclosed it detected unusual activity in its IT environment on February 15, 2026 (JST) and activated incident response, isolating affected systems and engaging external cybersecurity experts. Preliminary findings indicated an unauthorized third party may have accessed parts of the companys network and deployed ransomware. Advantest stated the investigation was ongoing and it had not yet confirmed whether customer or employee data was affected; it said it would notify impacted persons if data exposure is confirmed. The public reporting focused on containment and restoration actions and did not describe prolonged manufacturing shutdowns or downstream customer impacts.
• OpenClaw / ClawHub ecosystem (AI assistant skills) – multi-victim campaign February 19, 2026 • [ infostealer, AI assistant security, credential theft ] This TecMundo report describes security researchers warning about OpenClaw, a malware operation that, for the first time, is reported to specifically steal secrets tied to an AI assistant ecosystem (tokens/APIs/other assistant-related data). The article frames the activity as a broad distribution campaign (malicious skills/add-ons and infostealer behavior) that can compromise a victims digital identity by extracting authentication artifacts and credentials used to access accounts and services.
• French national bank accounts database (FICOBA) / Ministry of Economy and Finance January 18, 2026 • [ data leak, stolen credentials, unauthorized access ] Frances Ministry of Economy and Finance stated that part of the national database listing bank accounts in France was illegally accessed, exposing information linked to about 1.2 million accounts. The ministry said that starting in late January 2026, a malicious actor used stolen credentials belonging to an official to access part of the database. The exposed data includes bank details (RIB/IBAN), identity and address of the account holder, and in some cases a tax identification number. Authorities said they restricted access, stopped the intrusion, and notified banks to warn customers to be vigilant.
• 40 Danish websites (ministries, municipalities, businesses; incl. Ministry of Foreign Affairs and Rejsekort named in reporting) January 7, 2026 • [ DDoS, Russian hacker groups, politically motivated disruption ] Reporting cited by Denmarks CPH Post said Russian hacker groups carried out DDoS attacks over the prior month against around 40 Danish websites belonging to ministries, municipalities, and companies. The attacks aimed to overload systems and made several sites inaccessible for hours. The report referenced affected entities including Denmarks Ministry of Foreign Affairs and Rejsekort, consistent with politically motivated disruption rather than data theft.
• Boniface Mwangi (Kenyan activist) July 1, 2025 • [ spyware, surveillance, data extraction ] An AFP/Digital Journal report said Kenyan activist Boniface Mwangi feared for his life after learning spyware was installed on his phone while it was in police custody following his July 2025 arrest. The article cited Citizen Lab findings that a surveillance tool linked to Cellebrite technology enabled Kenyan police to access extensive content on the device, including messages, private files, financial information, passwords, and other sensitive data. The report describes state-enabled device compromise/data extraction rather than an enterprise network breach.
• Teixeira Cândido (Angolan journalist) / Syndicate of Angolan Journalists context May 3, 2024 • [ spyware, Predator, mobile infection ] Amnesty Internationals Security Lab reported forensic confirmation that Intellexas Predator spyware successfully infected the iPhone of Angolan journalist and press freedom activist Teixeira Cndido on May 4, 2024 after he opened a malicious link sent via WhatsApp. Amnesty said the attacker could have gained wide access to device data (including messages and files) and that the infection appears to have been removed after the phone was restarted later that day. The investigation described multiple additional infection links sent afterward that did not appear to succeed. Attribution to a specific government customer was not made in the public report.
• Washington Hotel chain (Fujita Kanko) February 13, 2026 • [ ransomware, unauthorized access, point-of-sale system issues ] A ransomware incident impacted the Washington Hotel chain in Japan, with Fujita Kanko reporting that unauthorized access to some servers was detected on February 13, 2026. The company said it took protective measures to cut off attacker access, formed an internal task force, and engaged police and outside cybersecurity experts. The company confirmed unauthorized access to business data on servers, while stating customer information tied to the external Washington Net system was believed unaffected at the time. Some hotels experienced point-of-sale system issues, but the company reported no major business disruption overall.
• LIGA.net February 12, 2026 • [ DDoS, intrusion attempts, vulnerability probing ] Ukrainian outlet LIGA.net reported it was experiencing massive DDoS attacks and ongoing intrusion attempts for five days. The organization said attacks originated primarily from China, Russia, and Vietnam and that attackers were systematically probing for vulnerabilities to access internal site management systems. LIGA.net stated no unauthorized access to internal systems occurred and that readers might encounter additional verification steps or temporary difficulty accessing the site due to heightened defenses.
• Choisir le Service Public (French civil service recruitment platform) February 4, 2026 • [ data leak, personal data theft, phishing risk ] Frances official civil-service recruitment platform Choisir le Service Public disclosed a security incident that resulted in the theft of personal data for 377,418 registered candidates. The stolen dataset includes standard identifiers (name, address, phone, date of birth, email) and more detailed professional/education profile fields that can enable highly targeted phishing and fraud. The platform stated passwords were not compromised and CVs/attachments were not taken. In response, some features (candidate space access and direct-application functionality) were temporarily disabled for several days, authorities were notified, and a complaint was planned.
• Valtori (Finnish Government ICT Centre) mobile device management service January 30, 2026 • [ data breach, mobile device management, zero-day vulnerability ] Valtori reported a data breach identified on January 30, 2026 in the mobile device management service it provides to Finlands government shared ICT services. Valtori said the attacker accessed information used to operate the service, including names, work email addresses, phone numbers, and device details, and that investigation later found the scope could involve a substantially larger number of users (about 50,000). Valtori stated no data stored directly on mobile devices was compromised. The root cause was described as exploitation of a zero-day vulnerability in a commercial mobile management product, compounded by the systems failure to permanently delete historical data.
• Nippon Medical School Musashi Kosugi Hospital (日本医科大学武蔵小杉病院) February 6, 2026 • [ ransomware, data breach, healthcare ] Japans Nippon Medical School Musashi Kosugi Hospital disclosed it suffered a ransomware attack after nurse-call terminals malfunctioned and investigation found its nurse-call system servers were attacked. The hospital stated patient personal information stored on the nurse-call system servers was stolen and that the intrusion path was tied to a maintenance VPN device. Public reporting in Japan said attackers demanded a large ransom (reported internationally as about $100 million). The hospital stated it would not comply with the ransom demand and reported that clinical services continued while investigation and recovery actions proceeded.
• BridgePay Network Solutions (vendor) impacting City of Marietta online payments February 15, 2026 • [ ransomware, third-party risk, payment processing outage ] City officials said Mariettas inability to process some online credit card payments was caused by a nationwide ransomware incident at BridgePay Network Solutions, one of the citys online payment gateway providers. The city stated its own systems and data were not compromised, but the vendor outage disrupted payment processing for municipal services. Officials worked to stand up a secure alternative solution while the vendor coordinated response with federal authorities and incident-response partners.
• Atlas Transfer and Storage July 15, 2025 • [ unauthorized access, data breach, PII ] Atlas Transfer & Storages notice states it identified suspicious activity on July 15, 2025 and launched an investigation. The investigation concluded that an unauthorized party copied certain files on the same date. Atlas reviewed the impacted files and stated the affected information varied by individual but could include identifiers and financial/health insurance information such as SSNs, tax IDs, drivers license/state IDs or other government IDs, payment card numbers, health insurance and medical information, and financial account information. Atlas stated it notified individuals and offered complimentary credit monitoring services.
• Alpine Lumber December 14, 2025 • [ ransomware, data leak, personally identifiable information ] Alpine Lumbers posted notice states that on December 22, 2025 it determined certain network devices were encrypted with ransomware. The companys investigation found that between December 14 and December 22, 2025 an unauthorized actor viewed and obtained files stored on a file server. Alpine completed its file review and determined on February 5, 2026 that the affected files included employment-purpose information such as names, addresses, Social Security numbers, dates of birth, and health insurance plan enrollment information, and may also have included policy numbers, medical information, government IDs, financial account data, and payment card data. Alpine stated it notified law enforcement and began mailing letters and offering credit monitoring.
• Deutsche Bahn February 13, 2026 • [ denial-of-service, DDoS, service outage ] German reporting relayed statements attributed to Germanys BSI leadership describing a massive cyberattack against Deutsche Bahn that overwhelmed systems with exceptionally high request volumes and caused outages to services such as booking. The report characterized the attack as unusually large in scale, consistent with a major denial-of-service event impacting digital service availability. The reporting accessible here does not describe data theft; the primary effect is disruption to online service functionality due to traffic overload.
• Figure February 12, 2026 • [ social engineering, data leak, extortion ] Figure Technology Solutions confirmed it suffered a data breach after an employee fell victim to a social engineering attack, with attackers obtaining a limited number of files. SecurityWeek reported that the ShinyHunters group took credit and posted archive files on its leak site; Have I Been Pwned analysis identified roughly 967,000 user records in the leaked data. The exposed information includes names, dates of birth, email addresses, postal addresses, and phone numbers. The reporting frames the incident as data theft/extortion without describing service disruption to Figures lending operations.
• Grupo Godo February 16, 2026 • [ DDoS attack, service availability disruption, cybersecurity protocols ] Grupo God reported that the websites of La Vanguardia, Mundo Deportivo, RAC1, and RAC105 experienced a coordinated DDoS attack starting around 06:08 that caused slow loading, intermittent errors, and in some cases total access failures. The group said the attack originated from infrastructure located in Germany and that technical teams activated cybersecurity protocols and mitigation measures to restore services, which returned to normal between approximately 07:30 and 07:40. The company stated that technical analysis found no unauthorized access to personal data and that the incident was limited to saturating systems with massive external traffic, making this a service availability disruption without confirmed data theft.
• York City February 10, 2026 • [ ransomware, cyberattack, ransom payment ] Reporting summarized in secondary coverage stated that York Citys cyberattack (described as a major incident that crippled the citys digital infrastructure) led to a $500,000 ransom payment made by the citys insurance company to overseas hackers, according to a former mayor. The report described the payment as roughly half of the initial demand and framed it as necessary to regain control of systems.