DocketWise
September 1, 2025
•[ unauthorized access, third-party breach, credential theft ]
DocketWise discovered unauthorized access to a third-party partner repository used in a data migration pipeline; an unauthorized actor used valid credentials to clone repositories containing law-firm customer records and personal information of their clients.
At least one Chrome user
April 14, 2026
•[ malicious extensions, credential theft, session hijacking ]
A coordinated campaign used 108 malicious Chrome extensions published under five developer identities to route stolen credentials, user identities, browsing data, Google account information, and Telegram Web session data to shared command-and-control infrastructure. The extensions collectively had about 20,000 Chrome Web Store installs and could inject ads or arbitrary JavaScript into visited pages and open arbitrary URLs through browser-level abuse.
Guesty
April 15, 2026
•[ ransomware, extortion, data theft ]
Vect claimed it stole 700GB of Guesty data and was negotiating with the company after a ransomware-related extortion listing.
Anodot
April 4, 2026
•[ data breach, token theft, unauthorized access ]
ShinyHunters allegedly breached Anodot, causing its data connectors to stop working and enabling downstream customer cloud-data access through stolen tokens.
Alamo Heights Independent School District
March 23, 2026
•[ ransomware, network attack ]
Alamo Heights ISD suffered a ransomware-related network attack that left the district without Internet access for nearly a week.
Undisclosed United States organization
April 7, 2026
•[ ransomware, cybercrime, data exfiltration ]
Microsoft reported that Storm-1175, a financially motivated cybercrime actor linked to Medusa ransomware, heavily impacted organizations in Australia, the United Kingdom, and the United States by exploiting vulnerable web-facing systems, exfiltrating data, and deploying ransomware. This row represents the undisclosed United States victim component of the country-level coding approach.
Undisclosed United Kingdom organization
April 7, 2026
•[ ransomware, data exfiltration, cybercrime ]
Microsoft reported that Storm-1175, a financially motivated cybercrime actor linked to Medusa ransomware, heavily impacted organizations in Australia, the United Kingdom, and the United States by exploiting vulnerable web-facing systems, exfiltrating data, and deploying ransomware. This row represents the undisclosed United Kingdom victim component of the country-level coding approach.
Undisclosed Australian organization
April 7, 2026
•[ ransomware, Medusa ransomware, data exfiltration ]
Microsoft reported that Storm-1175, a financially motivated cybercrime actor linked to Medusa ransomware, heavily impacted organizations in Australia, the United Kingdom, and the United States by exploiting vulnerable web-facing systems, exfiltrating data, and deploying ransomware. This row represents the undisclosed Australian victim component of the country-level coding approach.
Świętokrzyskie Rehabilitation Center
March 31, 2026
•[ ransomware, encryption, personal data ]
witokrzyskie Rehabilitation Center reported a ransomware attack that encrypted personal-data files and may have exposed data.
Bonifraterskie Medical Center
March 13, 2026
•[ ransomware, data leak, personal data ]
Bonifraterskie Medical Center reported a ransomware attack that encrypted part of its server infrastructure and likely exposed personal data.
Vercel
April 19, 2026
•[ unauthorized access, OAuth compromise, third-party risk ]
Vercel confirmed unauthorized access to internal systems after a compromised third-party AI OAuth app was used to access a Vercel employee Google Workspace account.
South Korean Ministry of Foreign Affairs
April 17, 2026
•[ DDoS attack, service disruption, cyberattack ]
South Koreas Ministry of Foreign Affairs website was briefly disrupted by a DDoS attack and restored the same day.
Adumo (Lesaka unit)
April 16, 2026
•[ source code leak, payment system data, dark web ]
Adumo investigated claims that technical payment-system data and source code were offered for sale on a dark-web forum.
Bluesky
April 15, 2026
•[ DDoS attack, service disruption, 313 Team ]
Bluesky experienced a roughly 24-hour DDoS attack that intermittently disrupted core platform features; 313 Team claimed responsibility.
Le Desk (media outlet)
April 14, 2026
•[ DDoS attack, cyberattack, media outlet ]
Le Desk was targeted by a large DDoS attack that generated 26.69 billion HTTP requests over 42 hours.
Morocco’s Office of Vocational Training and Employment Promotion (OFPPT)
April 12, 2026
•[ data leak, compromised account, user data ]
OFPPT disclosed that data from about 100,000 MyWay platform users was leaked after likely misuse of a compromised account.
Police Nationale (France) training platform users
March 17, 2026
•[ data breach, hacking, government ]
01net reported that data relating to French police personnel was stolen after the e-campus training platform was hacked.
Inditex (Zara owner)
April 15, 2026
•[ unauthorized access, third-party breach, customer transaction information ]
Inditex reported unauthorized access to third-party-hosted databases containing customer transaction information; the company said the affected databases did not contain addresses, passwords, or bank card details and that it applied security protocols and notified authorities.
Autovista
April 11, 2026
•[ ransomware, service disruption, containment ]
Autovista reported a ransomware incident identified on April 11, 2026 that affected certain systems in Europe and Australia and caused service disruption for customers. The company implemented containment measures, worked with external forensic experts to validate systems before restoration, and later reported many products and services were partially or fully restored.
Nigeria's Corporate Affairs Commission (CAC)
April 15, 2026
•[ unauthorized access, data exfiltration, data breach ]
Nigerias Corporate Affairs Commission confirmed unauthorized access to limited aspects of its information systems; ByteToBreach claimed it exfiltrated about 25 million documents, roughly 750 GB, from CAC infrastructure, but CAC did not confirm the volume or identify the perpetrator.
