Addi
March 25, 2026
•[ fintech, data breach, extortion ]
In March 2026, the Colombian fintech company Addi identified unauthorised activity on its platform and advised customers that "it is possible that your personal information may have been compromised". The "pay or leak" extortion group ShinyHunters subsequently claimed responsibility and published a large trove of personal data allegedly obtained from Addi. The data included 34M unique email addresses from credit scoring requests, credit bureau records, customer identity records and email validation logs. It also contained government issued IDs (Cdula de Ciudadana), estimated income, socioeconomic levels, purchases and other credit-related data points.
Canada Life
April 20, 2026
•[ extortion, data leak, phishing ]
In April 2026, Canada Life was the victim of a "pay or leak" extortion campaign by the ShinyHunters group. The group subsequently published the data which contained over 200k unique email addresses along with names, phone numbers, physical addresses and, in some cases, customer support tickets. In their disclosure notice, Canada Life advised that "it is a small proportion of our customers who may have been impacted". In the wake of the incident, Canada Life also published an alert cautioning customers to be wary of phishing attacks, a pattern often seen after the public release of breached data.
Abrigo
April 14, 2026
•[ extortion, data leak, fintech ]
In April 2026, the fintech software company Abrigo was targeted in a "pay or leak" extortion attempt by the ShinyHunters group. Shortly after, data allegedly taken from the company's Salesforce instance was published publicly and contained over 700k unique email addresses belonging to both Abrigo staff and external contacts. Whilst separate from Abrigo's Salesforce compromise via the Drift application connector the previous year, the data fields described in that incident are consistent with the ShinyHunters data, namely that it was "business contact information" including "institution name, employee name, email addresses, and phone numbers".
Dígitro Tecnologia
April 8, 2026
•[ database leak, source code leak, internal files ]
CTIR Gov warned that databases, source-code repositories, and internal files from Dgitro Tecnologia were published by DDoSecrets.
Commune d'Anderlues
April 8, 2026
•[ cyberattack, data theft, IT shutdown ]
Anderlues suffered a municipal cyberattack resulting in data theft and a broad shutdown of communal IT systems.
Coral Bay Nickel Corporation
April 2, 2026
•[ ransomware, server encryption, cyberattack ]
Coral Bay Nickel suffered ransomware encryption of two servers, but production systems remained unaffected and operations continued.
Saver
April 9, 2026
•[ ransomware, personal data, operational disruption ]
Saver was hit by ransomware on April 9, disrupting systems and phone lines while attackers accessed servers containing personal data.
Matsuyama Municipal Housing Management Center
February 3, 2026
•[ ransomware, data leak, resident information ]
Resident information for Matsuyama municipal housing was leaked after a ransomware attack affected servers used by the housing-management contractor.
TEIN
October 30, 2025
•[ ransomware, encryption, ransom note ]
TEIN found encrypted server files and a ransom note after a U.S. subsidiary reported it could not access an internal server.
Pricon Microelectronics, Inc.
April 17, 2026
•[ ransomware, data theft, LockBit 5.0 ]
Pricon Microelectronics suffered a ransomware attack affecting some servers; LockBit 5.0 later claimed data theft.
Hosokawa Micron Corporation
February 2, 2026
•[ unauthorized access, cloud storage breach, data leak ]
Hosokawa Micron confirmed unauthorized access to one cloud storage account and leakage of personal data stored there.
Awa Bank
March 25, 2026
•[ unauthorized access, data leak, test environment exposure ]
Awa Bank confirmed that unauthorized access to an OA system test environment caused leakage of 27,745 customer, shareholder, and related-party records.
Omi Kenshi Co., Ltd
March 16, 2026
•[ unauthorized access, system failure, operational disruption ]
On March 16, 2026, Omi Kenshi Co., Ltd. experienced unauthorized external access that caused system failure and suspension of core systems, delaying financial closing procedures.
Medica Publishing Co., Ltd
March 13, 2026
•[ ransomware, data leak, personal information ]
A ransomware attack encrypted Medica Publishings systems on March 13, 2026, halting order processing, shipping, and customer inquiries, and the company later confirmed leakage of some personal and transaction-related information.
Siam Okamura International Co., Ltd.
December 23, 2025
•[ unauthorized access, data leak, server breach ]
Siam Okamura International identified suspected unauthorized access to certain servers on December 23, 2025, and later found information suspected to have been leaked online; the details and extent remained under investigation.
Murata Manufacturing Co., Ltd.
February 28, 2026
•[ unauthorized access, data leak, IT environment breach ]
Murata Manufacturing confirmed unauthorized third-party access to its IT environment and improper access to data, with later updates identifying possible leakage of employee, associated-person, customer, supplier, stakeholder, and business partner information.
Kelp DAO
April 19, 2026
•[ DDoS, RPC poisoning, Cryptocurrency theft ]
NGB 3rd Technical Surveillance Bureau (TraderTraitor) compromised and poisoned LayerZero RPC infrastructure, launched a DDoS to force failover to the poisoned nodes, and delivered a malicious instruction that drained 116,500 rsETH, worth roughly $292 million, from Kelp DAO.
Seiko USA
April 18, 2026
•[ defacement, ransomware, data theft ]
The Seiko USA websites Press Lounge section was defaced with a ransom message claiming attackers had accessed the companys Shopify backend and stolen its customer database; the claimed data theft was not confirmed.
Fusion Superplex
March 2, 2026
•[ ransomware, server infrastructure, internal operations ]
Fusion Superplex said a ransomware attack temporarily affected server infrastructure, internal operations, its IMAX system, and online ticketing.
Dialogue Logique
April 12, 2026
•[ intrusion, datacenter infrastructure, data protection ]
Dialogue Logique detected an intrusion in its datacenter infrastructure on April 12, 2026 and isolated its infrastructure from the internet to contain the incident and protect customer data.
