ADT Inc.
April 20, 2026
•[ vishing, social engineering, data breach ]
ShinyHunters compromised an ADT employee Okta SSO account through vishing, used the account to access ADTs Salesforce instance, and stole personal information later assessed by Have I Been Pwned as affecting 5.5 million individuals.
University of Cambridge
April 17, 2026
•[ phishing, credential theft, account compromise ]
Students and staff received phishing emails appearing to come from compromised University of Cambridge accounts; related messages contained links designed to steal login credentials and enable further account compromise.
Duo Info
January 1, 2025
•[ hacking, matchmaking service, personal information ]
A Duo employee's work computer was hacked in January 2025, compromising personal information of 427,464 matchmaking service clients, including identifiers, contact details, and detailed personal profile information.
Remita Payment Services Ltd
March 31, 2026
•[ data exfiltration, KYC documents, database leak ]
Remita Payment Services Ltd was named in Nigerian data-protection investigations after ByteToBreach claimed to have exfiltrated approximately 3 TB of data from Remita-linked systems, including KYC documents, databases, logs, backups, source code, password hashes, and customer and employee records. The Nigeria Data Protection Commission served notices of investigation on April 1, 2026, and the claimed data theft remains under investigation.
Sterling Bank Plc
March 18, 2026
•[ CVE-2025-55182, remote code execution, data leak ]
ByteToBreach exploited CVE-2025-55182 in Sterling Banks internet-facing pilot infrastructure on March 18, 2026, gaining unauthenticated remote code execution, conducting internal reconnaissance, and publishing artefacts that Web Security Lab assessed as technically substantiating compromise of customer and employee records.
Ministry of Higher Education, Research and Space (Parcoursup data-management module)
October 1, 2025
•[ unauthorized access, credential compromise, data leak ]
Fraudulent access using legitimate credentials to a Parcoursup data-management module for the Occitanie academic region in October 2025 resulted in unauthorized exfiltration of personal data for about 705,000 candidates from the 2023 and 2025 sessions.
Banco Rendimento
April 21, 2026
•[ security incident, unauthorized access, banking ]
Banco Rendimento identified and contained a security incident on April 21, 2026 affecting some client-access channels and accounts; the bank isolated the threat, restored operations the following day, and reported the incident to Brazilian authorities.
Yau Yat Chuen Garden City Club
October 31, 2025
•[ ransomware, data breach, personal data ]
A ransomware attack encrypted files stored on the server supporting Yau Yat Chuen Garden City Club's club management system, rendering the system inoperable and affecting personal data of current and former members and supplementary card holders.
Finance, Planning and Economic Development Ministry
January 1, 2026
•[ hacking, financial fraud, payment diversion ]
In January 2026, hackers targeted Sri Lanka's Finance, Planning and Economic Development Ministry and diverted $2.5 million from a payment intended for Australia; officials later disclosed another missing payment while investigations continued.
Rituals
April 1, 2026
•[ data breach, unauthorized access, PII ]
Rituals confirmed that an unauthorized download of My Rituals membership data occurred in April 2026, affecting customers in Europe, the United Kingdom, and the United States. The downloaded data included names, dates of birth, gender, postal and email addresses, phone numbers, preferred store locations, and account types; Rituals did not disclose the exact number of affected members, and reporting stated that passwords and payment data were not accessed.
Anthropic
April 21, 2026
•[ unauthorized access, third-party vendor breach, data leak ]
A private online group reportedly gained unauthorized access to Anthropics limited-release Claude Mythos Preview model through a third-party vendor environment.
Nordenta
April 20, 2026
•[ ransomware, data leak ]
The Danish dental supplier Nordenta was listed on the Kairos ransomware leak site around April 20, 2026, and Computerworld reported on April 22 that the company had been hit by ransomware. Kairos claimed to have stolen 1.68 TB of data and used the leak-site post to pressure company executives, but the specific data categories and operational impact were not confirmed in the reviewed sources.
Agence nationale des titres sécurisés (ANTS)
April 15, 2026
•[ unauthorized access, data leak, identity document theft ]
On April 15, 2026, ANTS, also known as France Titres, detected unauthorized access to the ants.gouv.fr portal. The agency confirmed a data breach involving citizen identity-document portal data, while breach3d claimed to have stolen up to 19 million records and offered them for sale; ANTS did not specify the total number of affected citizens.
Adaptavist Group
March 31, 2026
•[ unauthorized access, stolen credentials, data theft ]
Adaptavist Group detected unauthorized access to some systems in late March 2026 after an intruder used stolen credentials. Adaptavist said the accessed systems contained typical business data such as contact information, contracts, and NDAs; The Gentlemen claimed responsibility and claimed 24 GB of data theft, allegedly including source code, customer records, internal documents, credentials, and production-system references, but Adaptavist did not confirm the full claim.
Mastodon (mastodon.social)
April 20, 2026
•[ DDoS attack, service disruption, 313 Team ]
Mastodons flagship mastodon.social server was hit by a DDoS attack on April 20, 2026, making the instance unusable at times and causing much of the site to become inaccessible. Mastodon implemented countermeasures by 9:05 a.m. ET and restored access within a couple of hours, while warning that instability could continue as the attack was ongoing; SC Media reported that 313 Team claimed responsibility.
Administration of Kursk region
April 20, 2026
•[ DDoS attack, government, service disruption ]
On April 20, 2026, Kursk regional authorities reported a DDoS attack against regional administration servers that made the live broadcast of a government session unavailable. Officials said the session recording would be published later on official governor and regional government resources, and corroborating reporting said the attack was localized the same day.
Waterloo Regional Health Network
January 13, 2026
•[ personal health information, third-party security incident, data breach ]
Waterloo Regional Health Network notified patients that a third-party security incident affecting its connection to the Health Report Manager service may have exposed personal health information for approximately 150,000 patients who received care between April 2025 and January 2026. WRHN said the incident occurred outside WRHNs internal systems, was contained within hours on January 13, and no misuse was believed likely.
YEDNA
March 30, 2026
•[ DDoS, hacktivism, api outage ]
Pro-Russian hacker groups PalachPro and Noname057(16) claimed a DDoS attack against Ukrainian social network YEDNA less than a day after its March 29 launch. The attack disabled the platform API, leaving the website and social-network functionality unavailable to visitors; no restoration time was reported.
Winona County
April 6, 2026
•[ ransomware, data leak, government ]
Winona County, Minnesota experienced a ransomware attack that began April 6, 2026 and was discovered April 7. Officials took affected systems offline, declared a local emergency, requested Minnesota National Guard assistance, and notified the FBI. Later reporting confirmed cybercriminals released information taken from the county network; emergency services and 911 remained operational, while vital statistics and DMV systems were among those impacted.
Cetera Financial
July 7, 2025
•[ unauthorized access, email compromise, PII ]
Cetera Financial disclosed that an unauthorized person accessed a single employee email account between July 7 and August 21, 2025. A review completed around January 30, 2026 found that client information, including names, Social Security numbers, drivers license numbers, and financial account details, may have been compromised; affected individuals were notified beginning March 25, 2026.
