Full List

Search

Recent Breaches

• McGraw Hill April 10, 2026 • [ data breach, extortion, misconfiguration ] In April 2026, education company McGraw Hill confirmed a data breach following an extortion attempt. Attributed to a Salesforce misconfiguration, the company stated the incident exposed "a limited set of data from a webpage hosted by Salesforce on its platform". More than 100GB of data was later publicly distributed, containing 13.5M unique email addresses across multiple files, with additional fields such as name, physical address and phone number appearing inconsistently across some records.
• Amtrak April 3, 2026 • [ data leak, ransomware, ShinyHunters ] In April 2026, the hacking group ShinyHunters claimed they had breached Amtrak. The group typically compromises organisations' Salesforce instances before demanding a ransom and later, if not paid, dumping the data publicly. The exposed data contained over 2M unique email addresses along with names, physical addresses and customer support records.
• Hallmark March 31, 2026 • [ data leak, extortion, support tickets ] In March 2026, Hallmark suffered an alleged breach and subsequent extortion after attackers gained access to data stored within Salesforce. The data was later published after the extortion deadline passed, exposing 1.7M unique email addresses across both Hallmark and the Hallmark+ streaming service, along with names, phone numbers, physical addresses and support tickets.
• Centrum Medyczne Eskulap March 24, 2026 • [ ransomware, medical records, encryption ] Centrum Medyczne Eskulap reported that a ransomware attack on March 24, 2026 encrypted servers dedicated to patient services and blocked access to medical data and medical histories; reporting also said there was a high probability patient data may have been obtained before encryption, but no theft was confirmed.
• Neukölln district heating plant March 20, 2026 • [ ransomware, internal IT systems, accounting ] Berlin police confirmed a ransomware attack against the Neuklln district heating plant that had been known since March 20, 2026; reporting said internal IT systems including accounting and internal communications were affected, while technical systems and heat supply remained unaffected.
• Scotia-Glenville Central School District Facebook page March 29, 2026 • [ Account Takeover, Social Media Hijacking, Unauthorized Access ] A malicious actor gained administrative control of the Scotia-Glenville Central School District Facebook page through a hacked non-district account used by its communications specialist and posted inappropriate videos and replies while posing as the district; the district said its internal servers and data systems were not compromised.
• Undisclosed Israeli individual smartphone March 1, 2026 • [ malware, phishing, spyware ] A trojanized fake Red Alert app delivered through spoofed SMS messages targeted Israeli users and, when installed, enabled theft of messages, contacts, location data, and other device information from affected smartphones.
• Omax Autos March 26, 2026 • [ ransomware, cyber security incident, IT infrastructure ] Omax Autos said its IT department initially suspected a cyber security incident on March 26, 2026, which was later confirmed as a ransomware attack on the company's IT infrastructure; the company said core systems and operations were not impacted.
• Shwapno August 19, 2025 • [ ransomware, data breach, customer database ] Shwapno said attackers accessed its customer database in August 2025, and outside reporting said Qilin claimed a $1.5 million ransom demand.
• Hong Kong Correctional Services Department March 24, 2026 • [ unauthorized access, data breach, personal data leak ] Hong Kong's Correctional Services Department said a hacker illegally accessed its internal Knowledge Management System on March 24, 2026 and then accessed another system containing personal data of about 6,800 current and former staff.
• The Left Party March 26, 2026 • [ ransomware, data leak, employee data ] Die Linke said its federal headquarters IT systems were hit by a ransomware attack on March 26, 2026, causing partial disruption, while outside reporting tied the incident to Qilin and a claim of stolen internal and employee data.
• IntraCare March 20, 2026 • [ unauthorized access, extortion, data breach investigation ] IntraCare disclosed unauthorized access to its network on March 20, 2026, while outside reporting linked the incident to a The Gentlemen extortion claim; the organization said it was still investigating what information, if any, was impacted.
• At least one individual March 18, 2026 • [ phishing, malware, social engineering ] Cyber fraudsters in Navi Mumbai impersonated Mahanagar Gas Limited officials and sent malicious WhatsApp files or links that compromised victims' phones and enabled unauthorized access to their bank accounts.
• Le Centre national des œuvres universitaires et scolaires March 23, 2026 • [ data leak, data exfiltration, personal information ] The Cnous said data was exfiltrated from its mesrdv.etudiant.gouv.fr appointment platform, exposing personal information from student social-services and housing appointments taken over the past ten years.
• US Mortgage May 13, 2025 • [ ransomware, unauthorized access, data breach ] US Mortgage disclosed that an unauthorized third party gained access to a portion of its computer network in May 2025 in a ransomware event, and outside reporting tied the incident to SAFEPAY.
• Stockton Cardiology Medical Group December 15, 2025 • [ unauthorized access, data leak, extortion ] Stockton Cardiology Medical Group disclosed that an unauthorized individual accessed and removed files from its systems in December 2025, and some of the files were later publicly disclosed; outside reporting tied the incident to a Genesis extortion claim.
• Russell Cellular March 23, 2026 • [ data leak, customer records, employee credentials ] Russell Cellular was reported to be the source of a dataset offered for sale containing alleged customer records and employee credentials.
• TheBurntPeanut March 23, 2026 • [ DDoS attack, streaming ] TheBurntPeanut was forced off a Sea of Thieves stream after a reported DDoS attack interrupted the session shortly after it began.
• Liberty March 23, 2026 • [ unauthorized access, data leak, personal information ] Liberty notified customers that unauthorized access to personal information had occurred and said the exposed data included names, surnames, and identity numbers, while policies, investments, and services remained secure and operational.
• An undisclosed U.S. healthcare organization February 24, 2026 • [ ransomware, healthcare, encryption ] Beazley Security and Halcyon reported that Pay2Key maintained access to a compromised administrative account at an undisclosed U.S. healthcare organization for several days before deploying ransomware in late February 2026 and encrypting the environment within three hours; no data exfiltration or ransom demand was reported.