Athénée Royal d'Izel
April 9, 2026
•[ ransomware, encryption, service disruption ]
The local server of Athne Royal d'Izel was encrypted during a ransomware attack on the morning of April 9, 2026, affecting the online school platform for meal payments and attendance; quick isolation prevented personal data theft and restoration from backups was underway.
Grinex
April 15, 2026
•[ cyberattack, cryptocurrency, asset theft ]
Grinex, a Kyrgyzstan-based cryptocurrency exchange linked to Russia, suspended operations after a cyberattack in which assets worth 1 billion roubles, about $13.10 million, were stolen.
Undisclosed critical infrastructure organization
April 6, 2026
•[ Chinese-nexus intrusions, critical infrastructure, lateral movement ]
Darktrace reported Chinese-nexus intrusions affecting critical infrastructure organizations, with some high-value intrusions involving lateral movement before data exfiltration.
Vimeo
April 28, 2026
•[ unauthorized access, data leak, stolen data ]
Vimeo confirmed that an unauthorized actor accessed certain user and customer data through the Anodot breach; ShinyHunters later leaked 106GB of stolen data affecting 119,200 email addresses.
Council of Engineers Thailand
April 15, 2026
•[ data breach, personal information, database security ]
A hacker breached the Council of Engineers Thailand member database while data was being transferred between servers, stealing personal information of approximately 350,000 engineers.
Mile Bluff Medical Center
April 21, 2026
•[ ransomware, data encryption, system disruption ]
Mile Bluff Medical Center experienced system disruptions after a security event that encrypted data, affecting phone and computer systems; clinical teams operated under downtime procedures while the organization investigated and engaged third-party partners.
Southern Illinois Dermatology
November 28, 2025
•[ unauthorized access, protected health information, PHI ]
Southern Illinois Dermatology discovered unauthorized access to its network on November 28, 2025, resulting in the exposure of personal and protected health information of approximately 160,312 individuals.
Saint Anthony Hospital
February 6, 2025
•[ unauthorized access, email account compromise, healthcare data breach ]
Saint Anthony Hospital reported that on February 6 2025 an unauthorized party accessed two employee email accounts, exposing personal and health information of approximately 146,108 patients; the breach was confirmed in February 2026 and notifications were sent in March 2026.
North Texas Behavioral Health Authority
October 13, 2025
•[ network intrusion, data exfiltration, Social Security numbers ]
North Texas Behavioral Health Authority detected a network intrusion in October 2025; investigators found that unauthorized individuals accessed and exfiltrated files containing personal information, including Social Security numbers, affecting 285,000 individuals.
BePrime
April 20, 2026
•[ unauthorized access, missing MFA, credential leak ]
BePrime, a managed cybersecurity services provider in Mexico, was breached in April 2026 after attackers accessed administrator accounts lacking MFA, exfiltrating 12.6 GB of data that included plaintext credentials, client penetration testing reports, Cisco Meraki API keys controlling 1,858 network devices, and live surveillance camera feeds from client offices.
Minidoka Memorial Hospital
April 5, 2026
•[ cyber attack, healthcare, operational disruption ]
A cyber incident on Easter morning limited imaging services at Minidoka Memorial Hospital in Rupert, Idaho, leading to temporary emergency patient transfers; internal systems were affected but patient care continued, and imaging was fully restored by midnight on April 19, 2026.
Itron, Inc.
April 13, 2026
•[ unauthorized access, corporate systems, energy management ]
Itron, a provider of energy and water management solutions, detected unauthorized access to some corporate systems on April 13 2026; operations continued and no further unauthorized activity or customer impact was observed.
Patriot Regional Emergency Communications Center
March 31, 2026
•[ cyberattack, service disruption, emergency services ]
A cyberattack disrupted non-emergency and business telephone lines for police, fire, and EMS departments in Pepperell, Dunstable, Townsend, and Ashby; 911 service remained functional and no private user information was reported compromised.
Maryland Department of Assessments and Taxation
April 14, 2026
•[ suspicious activity, web application security, incident response ]
The Maryland Department of Information Technology detected suspicious activity on servers running the State Department of Assessments and Taxations Real Property Search website application on April 14, 2026 and took the site offline; no private data was reported compromised.
Undisclosed Mongolian government entity
January 1, 2025
•[ cyber espionage, backdoor, data exfiltration ]
In January 2025, China-aligned GopherWhisper deployed Go-based backdoors and an exfiltration tool on roughly a dozen systems at an undisclosed Mongolian government institution, using Discord, Slack, Microsoft 365 Outlook, and File.io for command-and-control and data exfiltration.
National Health Insurance Company (CNAM)
April 1, 2026
•[ cyberattack, data exfiltration, health insurance ]
CNAM confirmed a cyberattack that may have resulted in limited data exfiltration from Moldovas health insurance database.
eBay Inc
April 26, 2026
•[ DDoS attack, service disruption, hacktivism ]
eBay experienced a widespread service disruption beginning April 26, 2026, affecting search, listings, checkout, and API functionality worldwide; the hacktivist group 313 Team claimed responsibility for a DDoS attack, but eBay did not confirm the cause.
Signature Healthcare Brockton Hospital
April 6, 2026
•[ cyberattack, data theft, healthcare ]
A cyberattack detected on April 6, 2026 affected information systems at Signature Healthcare and Signature Healthcare Brockton Hospital, triggering downtime procedures, ambulance diversion, chemotherapy cancellations, EHR and patient portal outages, pharmacy prescription-fill disruption, lab delays, and medical-record request disruption; Anubis claimed it stole 2 TB of data, but Signature Healthcare did not confirm data theft.
McGraw Hill
April 14, 2026
•[ misconfiguration, data leak, extortion ]
McGraw Hill confirmed that a Salesforce-hosted webpage misconfiguration exposed limited contact data, while ShinyHunters claimed millions of Salesforce records and attempted extortion.
At least one critical infrastructure provider
March 1, 2026
•[ advanced persistent threat, critical infrastructure, programmable logic controllers ]
Iran-affiliated advanced persistent threat actors accessed internet-exposed Rockwell Automation/Allen-Bradley programmable logic controllers at one or more U.S. critical infrastructure providers, manipulated project files and HMI/SCADA displays, resulting in operational disruption and financial loss.
