Full List

Search

Recent Breaches

• CareCloud, Inc. March 16, 2026 • [ unauthorized access, network disruption, electronic health records ] CareCloud experienced unauthorized access and a temporary network disruption on March 16, 2026 that partially affected functionality and data access to one of its six electronic health record environments for approximately eight hours.
• Undisclosed organization December 1, 2025 • [ email bombing, Microsoft Teams impersonation, Snow malware ] UNC6692 used email bombing and Microsoft Teams helpdesk impersonation to deliver the Snow malware suite, moved laterally through the victim environment, reached domain controllers, extracted the Active Directory database and registry hives with FTK Imager, and exfiltrated the files using LimeWire.
• Medtronic April 17, 2026 • [ data leak, unauthorized access, personal records ] ShinyHunters listed Medtronic on its leak site on April 17, 2026, claiming theft of more than 9 million personal records and terabytes of corporate information; Medtronic confirmed unauthorized access to corporate IT systems but had not confirmed data theft.
• Nacogdoches Memorial Hospital January 15, 2026 • [ unauthorized access, personal health information, internal network breach ] A threat actor accessed Nacogdoches Memorial Hospitals internal network and information systems between January 15 and January 31, 2026, likely accessing personal and health information of 257,073 individuals.
• DocketWise September 1, 2025 • [ unauthorized access, third-party breach, credential theft ] DocketWise discovered unauthorized access to a third-party partner repository used in a data migration pipeline; an unauthorized actor used valid credentials to clone repositories containing law-firm customer records and personal information of their clients.
• At least one Chrome user April 14, 2026 • [ malicious extensions, credential theft, session hijacking ] A coordinated campaign used 108 malicious Chrome extensions published under five developer identities to route stolen credentials, user identities, browsing data, Google account information, and Telegram Web session data to shared command-and-control infrastructure. The extensions collectively had about 20,000 Chrome Web Store installs and could inject ads or arbitrary JavaScript into visited pages and open arbitrary URLs through browser-level abuse.
• Guesty April 15, 2026 • [ ransomware, extortion, data theft ] Vect claimed it stole 700GB of Guesty data and was negotiating with the company after a ransomware-related extortion listing.
• Anodot April 4, 2026 • [ data breach, token theft, unauthorized access ] ShinyHunters allegedly breached Anodot, causing its data connectors to stop working and enabling downstream customer cloud-data access through stolen tokens.
• Alamo Heights Independent School District March 23, 2026 • [ ransomware, network attack ] Alamo Heights ISD suffered a ransomware-related network attack that left the district without Internet access for nearly a week.
• Undisclosed United States organization April 7, 2026 • [ ransomware, cybercrime, data exfiltration ] Microsoft reported that Storm-1175, a financially motivated cybercrime actor linked to Medusa ransomware, heavily impacted organizations in Australia, the United Kingdom, and the United States by exploiting vulnerable web-facing systems, exfiltrating data, and deploying ransomware. This row represents the undisclosed United States victim component of the country-level coding approach.
• Undisclosed United Kingdom organization April 7, 2026 • [ ransomware, data exfiltration, cybercrime ] Microsoft reported that Storm-1175, a financially motivated cybercrime actor linked to Medusa ransomware, heavily impacted organizations in Australia, the United Kingdom, and the United States by exploiting vulnerable web-facing systems, exfiltrating data, and deploying ransomware. This row represents the undisclosed United Kingdom victim component of the country-level coding approach.
• Undisclosed Australian organization April 7, 2026 • [ ransomware, Medusa ransomware, data exfiltration ] Microsoft reported that Storm-1175, a financially motivated cybercrime actor linked to Medusa ransomware, heavily impacted organizations in Australia, the United Kingdom, and the United States by exploiting vulnerable web-facing systems, exfiltrating data, and deploying ransomware. This row represents the undisclosed Australian victim component of the country-level coding approach.
• Świętokrzyskie Rehabilitation Center March 31, 2026 • [ ransomware, encryption, personal data ] witokrzyskie Rehabilitation Center reported a ransomware attack that encrypted personal-data files and may have exposed data.
• Bonifraterskie Medical Center March 13, 2026 • [ ransomware, data leak, personal data ] Bonifraterskie Medical Center reported a ransomware attack that encrypted part of its server infrastructure and likely exposed personal data.
• Vercel April 19, 2026 • [ unauthorized access, OAuth compromise, third-party risk ] Vercel confirmed unauthorized access to internal systems after a compromised third-party AI OAuth app was used to access a Vercel employee Google Workspace account.
• South Korean Ministry of Foreign Affairs April 17, 2026 • [ DDoS attack, service disruption, cyberattack ] South Koreas Ministry of Foreign Affairs website was briefly disrupted by a DDoS attack and restored the same day.
• Adumo (Lesaka unit) April 16, 2026 • [ source code leak, payment system data, dark web ] Adumo investigated claims that technical payment-system data and source code were offered for sale on a dark-web forum.
• Bluesky April 15, 2026 • [ DDoS attack, service disruption, 313 Team ] Bluesky experienced a roughly 24-hour DDoS attack that intermittently disrupted core platform features; 313 Team claimed responsibility.
• Le Desk (media outlet) April 14, 2026 • [ DDoS attack, cyberattack, media outlet ] Le Desk was targeted by a large DDoS attack that generated 26.69 billion HTTP requests over 42 hours.
• Morocco’s Office of Vocational Training and Employment Promotion (OFPPT) April 12, 2026 • [ data leak, compromised account, user data ] OFPPT disclosed that data from about 100,000 MyWay platform users was leaked after likely misuse of a compromised account.