Perm parking payment system
March 9, 2026
•[ DDoS attack, service disruption, cyberattack ]
The Record reported that the Russian city of Perm restored its parking payment system after a cyberattack the prior week knocked the service offline for several days, temporarily making parking free. Local officials said the disruption was caused by a large-scale DDoS attack that overwhelmed the citys automated parking payment infrastructure. No data theft was described; the primary effect was service availability disruption.
The City of Arab
March 9, 2026
•[ phishing, BEC, social engineering ]
GovTech reported that the City of Arab, Alabama was hit by a socially engineered phishing/BEC-style fraud in which perpetrators impersonated a legitimate officer of the contractor (FITE Construction) and induced the city to issue a fraudulent payment of $432,739.21 to an unauthorized entity. City leaders stated the fraud was detected internally and triggered a broader investigation. The report focuses on financial loss via social engineering rather than system disruption or data theft.
Undisclosed U.S. organization
February 1, 2026
•[ cyber espionage, APT, backdoor ]
HackRead reported that researchers linked a campaign observed in early February 2026 to Iran-aligned APT MuddyWater, described as operating under Irans Ministry of Intelligence and Security. The report stated attackers infiltrated networks of several U.S. organizations across sectors (including banking and aviation) and an Israeli software development services operation, maintaining persistence and using a new custom backdoor called Dindoor to remotely issue commands and sustain access. The article describes espionage tradecraft and persistence but does not list specific victims or confirm specific data stolen.
Undisclosed Qatari organization
March 1, 2026
•[ DLL hijacking, PlugX, backdoor malware ]
HackRead summarized Check Point Research describing a China-linked campaign beginning March 1, 2026 that used conflict-themed lures and DLL hijacking to install PlugX backdoor malware against targets in Qatar. The report described lures disguised as war news and a separate energy-sector lure delivering a Rust loader and ultimately Cobalt Strike, with the goal of espionage against Qatars military and oil/gas interests.
Department of Homeland Security (DHS)
March 1, 2026
•[ hacktivism, data leak, government contracts ]
DataBreaches summarized reporting that hacktivists calling themselves Department of Peace claimed to have hacked DHS and leaked allegedly stolen documents. The transparency collective DDoSecrets published data described as relating to contracts between DHS, ICE, and more than 6,000 companies (including major defense contractors and large technology firms). The report attributes the source to DHSs Office of Industry Partnership procurement unit; DHS confirmation and the exact intrusion method were not provided in the DataBreaches excerpt.
Denmark School District
March 1, 2026
•[ ransomware, cyber incident, connectivity outage ]
Reporting stated the Denmark School District in Denmark, Wisconsin, lost internet access for five school days due to a cyber incident, forcing paper-based workarounds. DataBreaches noted a ransomware tracking site listed the district domain as a claimed victim by INC Ransom with a discovery date of March 1, 2026, but emphasized that listing alone is not confirmation of ransomware or data theft. The confirmed primary effect described is a weeklong connectivity outage impacting school operations.
Insight Hospital and Medical Center
August 22, 2025
•[ unauthorized network access, data leak, medical records breach ]
Insight Hospital and Medical Center issued a substitute notice stating it detected unusual network activity in September 2025 and determined an unauthorized individual accessed its network between August 22 and September 11, 2025. The notice stated affected individuals would be notified after completion of a file review and listed potentially involved data types, including identifiers (name, SSN, DOB), government IDs, financial account information, and treatment/insurance-related information. The DataBreaches post notes the incident after data was reported as leaked/appearing online.
OCAT, LLC dba Evoke Wellness at Hilliard
July 7, 2024
•[ insider threat, data breach, healthcare ]
DataBreaches reported that Evoke Wellness at Hilliard updated its breach reporting about an insider-related patient-data incident. The post notes law enforcement investigated a former employee accused of misusing access to obtain patient information and sell or misuse it, with the employee working there from 2021 to July 2024 and the case surfacing after police found suspicious documents in 2024. Evokes amended patient notice listed many possible exposed data elements (including SSNs and detailed treatment/insurance information) and the post highlights inconsistencies in public filings about discovery dates and affected counts.
Tehran traffic cameras
March 3, 2026
•[ hacking, surveillance, espionage ]
DataBreaches summarized reporting alleging Israeli intelligence hacked or accessed a very large portion of Tehrans traffic camera network over multiple years to track senior Iranian officials, including Ayatollah Ali Khamenei. The reporting claimed real-time camera data (including cameras around Khameneis compound) was encrypted and transmitted to servers in Israel and used to build pattern of life intelligence, such as where security teams parked vehicles.
FBI surveillance system
March 6, 2026
•[ data breach, surveillance system, law enforcement sensitive information ]
Reporting stated the White House was working with the FBI, NSA, and CISA to respond to an apparent breach of an FBI surveillance system disclosed to Congress. The system is unclassified but contains law-enforcement sensitive information, including returns from legal process such as pen register and trap-and-trace surveillance returns, and personally identifiable information about subjects of FBI investigations. The report did not identify the attacker, intrusion vector, or the full scope/timeline of access.
At least one Dutch government official
March 9, 2026
•[ social engineering, phishing, state-sponsored hackers ]
Dutch intelligence services warned that Russian state hackers are attempting to gain access to large numbers of Signal and WhatsApp accounts belonging to senior officials, military personnel, and civil servants worldwide. The campaign uses social engineering to trick users into revealing verification and PIN codes, including posing as a Signal support chatbot. The report notes Dutch government employees have also been targeted and, in some cases, compromised. This is campaign/advisory reporting rather than a single discrete victim event.
The Independent Public Regional Hospital
March 7, 2026
•[ cyberattack, ransomware, data encryption ]
A cyberattack hit the Independent Public Regional Hospital in Szczecin, Poland, overnight on 03/0703/08/2026, forcing staff to revert to paper-based operations. Hospital authorities said the attack encrypted parts of hospital data and blocked access to critical digital records, temporarily disrupting digital operations. Officials stated urgent treatments and admissions continued, but administrative processes were slower while IT teams worked to restore system access.
Insightin Health
September 17, 2025
•[ data leak, unauthorized access, zero-day vulnerability ]
Insightin Health disclosed that an unauthorized party gained access to its GoAnywhere file-transfer tool by exploiting an unknown design flaw, potentially accessing data on a subset of servers between 09/17/2025 and 09/23/2025. Insightin said it identified unusual activity on 09/23/2025, stopped further access, and reviewed impacted files. On 02/12/2026, a health plan confirmed some members information was included. The data involved included name, health care provider name, insurance information, and member ID; no Social Security numbers or financial information were reported involved in the notice excerpt.
Telus Digital
March 12, 2026
•[ Data breach, Credential theft, Cloud security ]
Telus Digital confirmed a security incident after ShinyHunters claimed it stole nearly 1 petabyte of data in a multi-month breach. Reporting stated ShinyHunters said it gained initial access using Google Cloud Platform credentials found in data stolen in the Salesloft/Drift breach, and that Telus was not negotiating. At publication, Telus Digital had not been added to the actors leak site in the cited report, and specific data categories and affected individuals were not publicly enumerated in the DataBreaches summary.
Dekalb County
March 13, 2026
•[ ransomware, email disruption, inmate booking systems ]
A ransomware attack hit the DeKalb County Sheriffs Department and jail in Smithville, Tennessee, disrupting email and inmate booking systems. Officials said the booking program suddenly stopped during an intake early Friday morning, and the sheriff indicated the main server controlling departmental email and booking software (and other functions) was affected. The report did not specify the ransomware group, the intrusion vector, whether data was stolen, or how long services would remain disrupted.
Verifone
March 11, 2026
•[ hacktivism, data breach claim, cyber attack ]
Cybernews reported that the pro-Iranian hacktivist group Handala claimed it attacked two US multinationals with ties to Israelpayments firm Verifone and medical technology firm Strykerframing the actions as retaliation. Verifone denied the breach claims. The article describes actor claims and escalation risk, but does not provide independently verified evidence of successful compromise or confirmed stolen data for either company in the reporting.
Ericsson
April 17, 2025
•[ unauthorized access, data security incident, PII ]
Ericsson disclosed a data security incident at a service provider. The provider detected unauthorized access on 04/28/2025 and later determined files may have been accessed between 04/17/2025 and 04/22/2025. Exposed data varied by person and included names and Social Security numbers, with additional filings indicating dates of birth, drivers license/government ID numbers, financial information, and medical information. The review was completed on 02/23/2026, and a Maine filing referenced 15,661 impacted employees and customers; no group publicly claimed responsibility at the time of reporting.
My Lovely AI
April 7, 2026
•[ data breach, NSFW, AI-generated content ]
In April 2026, the NSFW AI girlfriend platform My Lovely AI suffered a data breach that exposed over 100k users. The data included user-created prompts and links to the resulting AI-generated images, along with a small number of Discord and X usernames.
SongTrivia2
April 2, 2026
•[ data breach, data leak, password hashes ]
In April 2026, the music trivia platform SongTrivia2 suffered a data breach that was subsequently published to a public hacking forum. The data contained a total of 291k unique email addresses sourced from either Google OAuth logins or accounts created on the site, the latter also containing bcrypt password hashes. The data also included names, usernames and avatars.
Crunchyroll
March 12, 2026
•[ data breach, data leak, PII ]
In March 2026, the anime streaming service Crunchyroll suffered a data breach alleged to have impacted 6.8M users. The exposed data is reported to have originated from the company's Zendesk support system where "name, login name, email address, IP address, general geographic location and the contents of the support tickets" were exposed. A subset of 1.2M email addresses from an alleged 2M record dataset being sold was later provided to HIBP.
