Full List

Search

Recent Breaches

• CPUID (cpuid.com) April 9, 2026 • [ malware distribution, supply chain attack, api compromise ] CPUID confirmed that a secondary website/API feature was compromised between April 9 and April 10, 2026, causing official download links for CPU-Z, HWMonitor, HWMonitor Pro, and PerfMonitor to redirect to attacker-controlled infrastructure serving malware; CPUID said its signed original files were not modified.
• Rockstar Games April 11, 2026 • [ data breach, third-party breach, SaaS breach ] ShinyHunters claimed it stole nearly 80 million business records from Rockstar Games through a third-party SaaS/Snowflake-related breach; Rockstar said only a limited amount of non-material company information was accessed and that there was no impact on operations or players.
• Shine Aviation April 4, 2026 • [ data leak, employee credentials, employee records ] Anubis claimed on April 4, 2026 that it obtained 57 GB, or more than 68,000 files, from Geraldton-based Shine Aviation, including alleged employee credentials and records, access-card scans, operational documentation, and aircraft-related certificates; the claim was not independently verified.
• Jordan Civil Aviation Commission September 1, 2025 • [ APT35, Charming Kitten, data exfiltration ] KittenBusters/CloudSEK reporting described APT35 activity in which files from Jordans Civil Aviation Commission were silently exfiltrated before Irans February 2026 regional missile and drone campaign; the reporting linked APT35/Charming Kitten to Irans IRGC Intelligence Organization.
• Los Angeles City Attorney’s Office March 20, 2026 • [ data leak, unauthorized access, third-party breach ] World Leaks posted an archive of approximately 7.7 TB / 337,000 files after unauthorized access to a third-party discovery-transfer tool used by the Los Angeles City Attorneys Office; the data included LAPD civil litigation discovery files, personnel and disciplinary records, witness information, medical information, and investigative materials, while LAPD said its own systems were not breached.
• ChipSoft April 7, 2026 • [ ransomware, healthcare, data breach ] Embargo ransomware hit ChipSoft on April 7, 2026, disrupting its website and digital healthcare services, causing hospitals to disconnect or take ChipSoft-connected systems offline, and stealing medical personal data from several Dutch healthcare institutions; ChipSoft later said the stolen data had been destroyed.
• National Supercomputing Center (NSCC) Tianjin February 6, 2026 • [ data breach, military, aerospace ] FlamingChina claimed to have breached the National Supercomputing Center in Tianjin and offered for sale more than 10 petabytes of allegedly stolen data, including claimed military, aerospace, research, and client datasets; the breach was not confirmed by NSCC Tianjin, but experts who reviewed samples said they appeared consistent with data expected from the facility.
• Syracuse Police Department, N.Y. January 10, 2025 • [ unauthorized access, social security numbers, personal information ] Syracuse Police Department detected a security incident on Jan. 11, 2025, shut down its computer system to prevent spread, and later determined that certain digital files were accessed or acquired without authorization between Jan. 10 and Jan. 12; notifications were sent in 2026 to people whose personal information, including Social Security numbers, may have been compromised.
• Williams Hart & Boundas June 30, 2025 • [ phishing, unauthorized access, personal information ] Williams Hart & Boundas discovered that a firm email account had sent and received phishing emails and determined the account had been accessed by an unauthorized individual; review found personal information in the account, and a Texas filing reported 7,844 affected Texas residents.
• Boston Mountain Rural Health Center February 27, 2026 • [ hacking, IT incident, network server ] Boston Mountain Rural Health Center reported a hacking/IT incident involving a network server on February 27, 2026, affecting 4,800 individuals and potentially exposing sensitive personal health information; specific exposed data fields were not publicly reported.
• Undisclosed Mexican Bank #2 February 1, 2026 • [ ransomware, Qilin, electronic channels ] Banco de Mxico reported that an undisclosed bank suffered a February 2026 ransomware incident involving Qilin that affected electronic channels and electronic transfer services; no customer financial impact was reported and the institutions financial impact remained pending.
• Undisclosed Mexican Bank #1 January 1, 2026 • [ ransomware, LockBit, electronic transfer services ] Banco de Mxico reported that an undisclosed bank suffered a January 2026 ransomware incident involving LockBit that affected electronic transfer services; no customer financial impact was reported and the institutions financial impact remained pending.
• Hong Kong Hospital Authority (Kowloon East Cluster) April 3, 2026 • [ data leak, unauthorized retrieval, patient data ] The Hospital Authority detected unauthorized retrieval and leakage of patient data from the Kowloon East Cluster on April 3, 2026, affecting more than 56,000 patients; internal checks did not indicate a cyberattack, and police and privacy regulators were notified.
• City of Minot Water Treatment Plant March 14, 2026 • [ ransomware, critical infrastructure, utilities ] Minot, North Dakota officials confirmed a ransomware event impacted a server at the citys water treatment plant on March 14, 2026. The city said the water treatment plant and broader water system remained operational and safe, with no interruption to water service reported.
• The Northern Ireland Education Authority April 2, 2026 • [ cyberattack, personal information, data breach ] The Northern Ireland Education Authority reported a cyberattack on the C2k school IT network that disrupted access and involved targeted access to confidential personal information.
• Uffizi Galleries February 1, 2026 • [ cyberattack, backup restoration, operational disruption ] Uffizi Galleries confirmed a cyberattack but said nothing was stolen and disruption was limited to restoring backups.
• Sterling Seacrest Pritchard, Inc. August 12, 2025 • [ unauthorized access, email breach, data leak ] Sterling Seacrest Pritchard disclosed unauthorized access to its email environment that may have exposed personal information.
• Hasbro Systems March 28, 2026 • [ unauthorized access, cyberattack, operational disruption ] Hasbro identified unauthorized access to its network on March 28, 2026 and took select systems offline as a containment measure while continuing operations through business-continuity procedures; the company warned that interim measures could cause order-processing, shipping, and invoicing delays while it reviewed potentially impacted files.
• PSK WIND Technologies April 2, 2026 • [ data breach, hacktivism, server compromise ] Handala claimed it breached PSK WIND Technologies servers and deleted sensitive information tied to Israeli air-defense command-and-control systems.
• Uyghur Post March 5, 2026 • [ DDoS attack, availability, website offline ] Uyghur Post was hit by a sustained DDoS attack that knocked the website offline and prevented publication.