St. Joseph County
April 1, 2026
•[ data breach, cloud security, fax server ]
St. Joseph County confirmed a breach of an external cloud-based fax server while disputing Handalas broader 2 TB data-theft claim.
The Canada Life Assurance Company
April 17, 2026
•[ unauthorized access, data leak, personal information ]
The Canada Life Assurance Company confirmed unauthorized access through an employee account that exposed personal information for up to 70,000 people.
Kent District Library
April 24, 2026
•[ ransomware, cyberattack, service disruption ]
Kent District Library closed all branches after a ransomware attack disrupted computer systems and network-dependent services.
Unnamed taxpayer (IRIS profile)
October 1, 2025
•[ unauthorized access, tax fraud, data manipulation ]
Unauthorized individuals accessed a taxpayers IRIS profile and altered an October 2025 sales tax return to insert fake supplies worth Rs. 415.6 million.
Venezuelan Ministry of Foreign Affairs
January 1, 2026
•[ espionage, state-sponsored attack, data breach ]
The same China-linked espionage campaign that compromised the Cuban Embassy in Washington D.C. also reportedly exploited Microsoft Exchange servers used by Venezuelas Ministry of Foreign Affairs and accessed officials email communications during the same January 2026 regional campaign.
Cuban Embassy in Washington D.C.
January 1, 2026
•[ cyberespionage, data exfiltration, email breach ]
China-linked hackers exploited long-unpatched Microsoft Exchange vulnerabilities on the Cuban Embassy in Washington D.C.s email servers beginning in January 2026, accessing and exfiltrating the full inboxes of 68 diplomatic officials, including the ambassador and deputy chief of mission.
City of Ardmore
April 8, 2026
•[ ransomware, phishing, data leak ]
On April 8, 2026, ransomware encrypted Ardmore police/internal servers after a phishing email; the incident was contained within hours, and information tied to criminal complaints and investigations, including names, addresses, and phone numbers, may have been exposed.
Individual Filipino pensioner
April 28, 2026
•[ vishing, phishing, malware ]
A 68-year-old Filipino pensioner received a fraudulent call claiming to be from the Social Security System and was sent a Viber link to a fake app. After installation, malware hijacked his Android phone, froze the screen and power button, and allowed thieves to drain three bank accounts and two e-wallets, stealing more than 1 million.
Gelatissimo
April 27, 2026
•[ data leak, ransomware, financial data ]
DragonForce listed Australian gelato franchiser Gelatissimo on its leak site around April 27, 2026 and claimed to have stolen more than 350 GB of data, with other reporting specifying 352.24 GB. The claimed data included sensitive employee data, financial details, operational information, and executive contact details, and the group threatened publication unless the company responded; reviewed reporting did not confirm encryption or operational disruption.
ADT Inc.
April 20, 2026
•[ vishing, social engineering, data breach ]
ShinyHunters compromised an ADT employee Okta SSO account through vishing, used the account to access ADTs Salesforce instance, and stole personal information later assessed by Have I Been Pwned as affecting 5.5 million individuals.
University of Cambridge
April 17, 2026
•[ phishing, credential theft, account compromise ]
Students and staff received phishing emails appearing to come from compromised University of Cambridge accounts; related messages contained links designed to steal login credentials and enable further account compromise.
Duo Info
January 1, 2025
•[ hacking, matchmaking service, personal information ]
A Duo employee's work computer was hacked in January 2025, compromising personal information of 427,464 matchmaking service clients, including identifiers, contact details, and detailed personal profile information.
Remita Payment Services Ltd
March 31, 2026
•[ data exfiltration, KYC documents, database leak ]
Remita Payment Services Ltd was named in Nigerian data-protection investigations after ByteToBreach claimed to have exfiltrated approximately 3 TB of data from Remita-linked systems, including KYC documents, databases, logs, backups, source code, password hashes, and customer and employee records. The Nigeria Data Protection Commission served notices of investigation on April 1, 2026, and the claimed data theft remains under investigation.
Sterling Bank Plc
March 18, 2026
•[ CVE-2025-55182, remote code execution, data leak ]
ByteToBreach exploited CVE-2025-55182 in Sterling Banks internet-facing pilot infrastructure on March 18, 2026, gaining unauthenticated remote code execution, conducting internal reconnaissance, and publishing artefacts that Web Security Lab assessed as technically substantiating compromise of customer and employee records.
Ministry of Higher Education, Research and Space (Parcoursup data-management module)
October 1, 2025
•[ unauthorized access, credential compromise, data leak ]
Fraudulent access using legitimate credentials to a Parcoursup data-management module for the Occitanie academic region in October 2025 resulted in unauthorized exfiltration of personal data for about 705,000 candidates from the 2023 and 2025 sessions.
Banco Rendimento
April 21, 2026
•[ security incident, unauthorized access, banking ]
Banco Rendimento identified and contained a security incident on April 21, 2026 affecting some client-access channels and accounts; the bank isolated the threat, restored operations the following day, and reported the incident to Brazilian authorities.
Yau Yat Chuen Garden City Club
October 31, 2025
•[ ransomware, data breach, personal data ]
A ransomware attack encrypted files stored on the server supporting Yau Yat Chuen Garden City Club's club management system, rendering the system inoperable and affecting personal data of current and former members and supplementary card holders.
Finance, Planning and Economic Development Ministry
January 1, 2026
•[ hacking, financial fraud, payment diversion ]
In January 2026, hackers targeted Sri Lanka's Finance, Planning and Economic Development Ministry and diverted $2.5 million from a payment intended for Australia; officials later disclosed another missing payment while investigations continued.
Rituals
April 1, 2026
•[ data breach, unauthorized access, PII ]
Rituals confirmed that an unauthorized download of My Rituals membership data occurred in April 2026, affecting customers in Europe, the United Kingdom, and the United States. The downloaded data included names, dates of birth, gender, postal and email addresses, phone numbers, preferred store locations, and account types; Rituals did not disclose the exact number of affected members, and reporting stated that passwords and payment data were not accessed.
Anthropic
April 21, 2026
•[ unauthorized access, third-party vendor breach, data leak ]
A private online group reportedly gained unauthorized access to Anthropics limited-release Claude Mythos Preview model through a third-party vendor environment.
