Full List

Search

Recent Breaches

• Divine Skins March 13, 2026 • [ data breach, unauthorised access, data leak ] In March 2026, the League of Legends custom skins service Divine Skins suffered a data breach. The incident was disclosed via the service's Discord server, where Divine Skins stated that an unauthorised third party accessed part of its systems, deleted all skins from the database and exposed email addresses and usernames. The data also contained a history of purchases made by users.
• Baydöner March 8, 2026 • [ data breach, data leak, plaintext passwords ] In March 2026, the Turkish restaurant chain Baydner suffered a data breach which was subsequently published to a public hacking forum. The incident exposed over 1.2M unique email addresses along with names, phone numbers, cities of residence and plaintext passwords. A small number of records also included Turkish national ID number and date of birth. In their disclosure notice, Baydner stated that payment and financial data was not affected.
• Undisclosed contractor supporting National Bank of Ukraine numismatic online store February 19, 2026 • [ data leak, supply chain attack, cyberattack ] Attackers breached an undisclosed contractor supporting the National Bank of Ukraine's numismatic online store, potentially exposing customer registration and delivery data; the online store was temporarily taken offline while the incident was investigated.
• Air Cote d'Ivoire February 8, 2026 • [ cyberattack, data leak, sensitive files ] Air Cte d'Ivoire confirmed that a cyberattack on February 8, 2026 affected parts of its information system and involved the illegal extraction of sensitive files, prompting business continuity measures and technical support for flights and other operations.
• Catalyst RCM November 8, 2025 • [ unauthorized access, credential misuse, data leak ] Catalyst RCM disclosed that an unauthorized actor used valid credentials to access a secure file management server between November 8 and 9, 2025, and copied data without permission, affecting client data including records tied to Vikor Scientific.
• Olympique de Marseille February 1, 2026 • [ cyberattack, data leak, data breach ] Olympique de Marseille confirmed a cyberattack after a threat actor claimed to have breached club systems earlier in February and leaked samples of staff and supporter data online.
• ManoMano January 1, 2026 • [ data breach, third-party compromise, PII ] ManoMano disclosed that hackers compromised a third-party customer service provider in January 2026 and unlawfully extracted customer account-related personal data and customer service interaction data affecting 38 million individuals.
• UFP Technologies February 14, 2026 • [ unauthorized access, data theft, operational disruption ] UFP Technologies disclosed that threat actors gained unauthorized access to its IT systems around February 14, 2026, disrupting billing and delivery label generation and resulting in the theft or destruction of company or company-related data.
• Livingston HealthCare February 13, 2026 • [ cybersecurity incident, network disruption, system outage ] Livingston HealthCare reported a potential cybersecurity incident that disrupted phone systems and network services and led the hospital to take certain systems offline while recovery continued.
• Cheyenne and Arapaho Tribes December 8, 2025 • [ ransomware, network shutdown, operational disruption ] A ransomware attack forced the Cheyenne and Arapaho Tribes to shut down tribal computer networks, disrupting email and phone service and suspending some operations while systems were restored in phases.
• Grange Dental Care February 19, 2026 • [ phishing, fraudulent invoices, system compromise ] Threat actors compromised Grange Dental Cares system and sent fraudulent invoice emails from the practice before the incident was quickly contained.
• Russian military drone operators February 21, 2026 • [ data leak, monitoring systems, drone operators ] Ukrainian hacktivists from the Fenix cyber analytics center, supported by volunteers of the InformNapalm international intelligence community, compromised accounts of Russian military personnel and gained access to monitoring systems used by attack drone operators.
• Choice Hotels International January 14, 2026 • [ social engineering, unauthorized access, PII leak ] An unauthorized person used social engineering to gain access to a Choice Hotels application containing records on franchisees and franchise applicants, exposing names and Social Security numbers.
• MediMap February 22, 2026 • [ data integrity, unauthorized access, healthcare breach ] MediMap was taken offline after an unauthorized user altered patient records, including names, ages, living status, and facility assignments, disrupting medication management across New Zealand providers. Some of the records were changed to designate the patient as dead or have them name changed to Charlie Kirk.
• Undisclosed Middle East entity February 24, 2026 • [ ransomware, cyberattack, data breach ] Symantec and Carbon Black linked Lazarus to a Medusa ransomware attack against an undisclosed Middle East entity; the same reporting noted an unsuccessful attempt against a U.S. healthcare organization, which is not coded here as a successful event.
• Greater Pittsburgh Orthopaedic Associates August 10, 2025 • [ ransomware, data leak, exfiltration ] Greater Pittsburgh Orthopaedic Associates identified anomalous network activity on August 10, 2025, and later disclosed that patient data was exposed; RansomHouse claimed it encrypted files and exfiltrated data from the network.
• Clalit Health Services February 25, 2026 • [ data leak, healthcare breach, cyber attack ] Handala claimed it breached Clalit Health Services and published patient files and internal documents online; Clalit said it was investigating the incident and that systems were operating normally.
• Dienst Justitiële Inrichtingen February 27, 2026 • [ data leak, vulnerability exploit, internal network access ] Hackers exploited an Ivanti Endpoint Manager Mobile flaw to access the internal network of the Dutch prisons agency and view staff contact details and security certificates; they also gained access to phones, tablets, and laptops.
• LG Uplus July 1, 2025 • [ unauthorized access, data leak, credential theft ] LG Uplus reported illegal access to internal information after a breach affecting company servers. Investigators said exposed information included server lists, server account credentials, and employees names, and later found forensic reconstruction was hindered after key systems were reinstalled or discarded.
• IRNA February 28, 2026 • [ hacktivism, website defacement, political messaging ] IRNA was hacked to display political messages during the same campaign that affected BadeSaba. Reporting says multiple Iranian news websites were compromised, and this row captures IRNA as one named victim.