Braintrust
May 4, 2026
•[ unauthorized access, API keys, cloud security ]
Braintrust confirmed unauthorized access to an internal AWS account on May 4, 2026 that likely exposed customer org-level AI-provider API keys used to access cloud-based AI models. Braintrust locked down the compromised account, audited and restricted related systems, rotated internal secrets, and instructed customers to rotate affected keys.
Advanced Diagnostic Imaging
April 30, 2026
•[ ransomware, electronic medical records, healthcare ]
Columbia Surgical Partners said it was unable to access electronic medical records after its parent company, Advanced Diagnostic Imaging, was hit by a reported ransomware attack. Available reporting confirms EHR-access disruption at Columbia Surgical Partners, but does not publicly confirm a responsible ransomware group, data theft, ransom demand, restoration timeline, or whether other ADI systems or sites were affected.
RubyGems.org
May 12, 2026
•[ malicious packages, supply chain attack, bot accounts ]
RubyGems.org temporarily suspended new account registrations after threat actors used bot accounts to push more than 500 junk or malicious packages, including packages carrying exploits. Existing packages were not compromised, and gem installs and pushes for existing users were unaffected while maintainers tightened account-creation rate limiting and WAF protections.
American Lending Center
July 24, 2025
•[ ransomware, internal network compromise, data breach ]
American Lending Center experienced a ransomware attack between July 24 and July 30, 2025, in which a threat actor compromised its internal network, executed ransomware, and accessed files that may have contained personal and sensitive information. No named ransomware group, confirmed encryption details, outage duration, or specific disrupted systems were publicly reported.
Grafana Labs
May 11, 2026
•[ source code leak, extortion, compromised credentials ]
Grafana Labs confirmed that a cybercrime group used a compromised GitHub token to access its GitHub repositories and download its codebase and internal GitHub repository content. The attackers demanded ransom to prevent disclosure, but Grafana said customer production systems, Grafana Cloud, customer operations, customer data, and personal information from production systems were not compromised.
SailPoint, Inc.
April 20, 2026
•[ unauthorized access, source code leak, third-party vulnerability ]
SailPoint disclosed unauthorized access to a subset of its GitHub repositories on April 20, 2026. The company said the unauthorized activity was quickly terminated, a vulnerability in a third-party application was remediated, and there was no evidence that customer data in production or staging environments was accessed or that services were interrupted. SailPoint did not publicly name the threat actor or disclose the type or volume of repository data that may have been compromised.
DigiCert, Inc.
April 2, 2026
•[ social engineering, malicious ZIP file, EV code-signing certificates ]
A threat actor used DigiCert's customer support channel on April 2, 2026 to deliver a malicious ZIP file disguised as a customer screenshot, compromising two DigiCert support analyst systems. The attacker used analyst-level access to pivot into DigiCert's internal support portal and obtain initialization codes for approved EV code-signing certificate orders across specific customer accounts. DigiCert revoked 60 associated certificates by April 17, including 27 explicitly linked to the threat actor and 11 reported as used to sign Zhong Stealer malware; the specific perpetrator was not publicly identified.
At least one unnamed victim organization
January 1, 2026
•[ social engineering, credential theft, MFA manipulation ]
MuddyWater, an Iran-linked APT associated with Iran's Ministry of Intelligence and Security (MOIS), used Microsoft Teams social engineering against an unnamed victim organization in early 2026. The attackers established remote access, stole credentials, manipulated MFA protections, deployed AnyDesk and DWAgent for persistence, moved laterally, harvested VPN configuration files and other sensitive data, and exfiltrated information. The attackers later sent extortion emails referencing Chaos ransomware and directed the victim to a Chaos leak site, but reporting said no file-encrypting ransomware was deployed, indicating the ransomware framing was likely a false flag for espionage activity.
7-Eleven
April 8, 2026
•[ unauthorized access, data leak, ransom ]
7-Eleven discovered on April 8, 2026 that an unauthorized third party accessed systems used to store franchisee documents. ShinyHunters claimed responsibility, claimed theft of more than 600,000 Salesforce records, and leaked a 9.4 GB archive after ransom demands were not met; Have I Been Pwned identified 185,300 exposed individuals in the leaked data.
Hutt City Council
March 1, 2026
•[ phishing, unauthorized access, email compromise ]
Hutt City Council experienced a malicious phishing attack in March 2026 that resulted in unauthorized access to a number of email accounts. The council determined that five individuals had identity information compromised and 732 people may have had financial information exposed through email correspondence.
ChipSoft
April 7, 2026
•[ ransomware, data breach, healthcare ]
ChipSoft was hit by a ransomware attack on April 7, 2026, causing hosted patient-facing and provider-facing digital services to be disconnected or taken offline while the company investigated and restored systems. ChipSoft later confirmed that personal and medical patient data from some Dutch healthcare customers had been stolen and said the stolen data was destroyed and not published.
At least one Ukrainian government organization
March 1, 2026
•[ spear-phishing, malware, cyber espionage ]
Ghostwriter, also tracked as FrostyNeighbor, UNC1151, UAC-0057, TA445, PUSHCHA, Storm-0257, and related names, conducted a March 2026 spear-phishing campaign against Ukrainian government organizations. The campaign used malicious PDF lures impersonating Ukrtelecom, geofenced delivery to Ukrainian IP addresses, JavaScript PicassoLoader, host fingerprinting, and selective delivery of Cobalt Strike Beacon. Although no specific Ukrainian government agency was publicly named, reporting described successful compromise activity against Ukrainian government targets; no stolen data volume was reported.
Standard-Examiner
May 2, 2026
•[ ransomware, data leak, cyberattack ]
Qilin listed Standard-Examiner on its leak site on May 2, 2026 and claimed responsibility for a cyberattack, threatening to release sensitive data. Separate reporting noted earlier April production difficulties at the newspaper, but the Standard-Examiner had not publicly confirmed ransomware, data theft, or a connection between the printing disruption and Qilin's claim.
West Pharmaceutical Services
May 4, 2026
•[ ransomware, data exfiltration, encryption ]
West Pharmaceutical Services detected a ransomware intrusion on May 4, 2026. The company reported that attackers exfiltrated data and encrypted systems, prompting containment actions and disrupting manufacturing, shipping, and receiving operations across multiple global facilities. Public reporting did not identify the threat actor or specify the volume or type of exfiltrated data.
Foxconn North American operations
May 11, 2026
•[ cyberattack, data theft, operational disruption ]
Nitrogen claimed responsibility for a cyberattack against Foxconn and alleged theft of roughly 8TB of data spanning more than 11 million files. Foxconn confirmed that some North American factories suffered a cyberattack and said affected factories were resuming normal production. Public reporting supports operational disruption and alleged large-scale data theft, but does not confirm file encryption, data destruction, or the specific disruption mechanism.
Trellix
May 5, 2026
•[ source code leakage, unauthorized access, cyberattack ]
Trellix disclosed unauthorized access to a portion of its source code repository in May 2026. RansomHouse later claimed responsibility and published screenshots as proof of access. Trellix said it had found no evidence that its source-code release or distribution process was affected or that its source code had been exploited. Public reporting did not confirm encryption, data destruction, operational disruption, or customer data exposure.
Fidelity Brokerage Services LLC
August 17, 2024
•[ unauthorized access, fraudulent requests, internal database ]
An unauthorized third party accessed and obtained information from Fidelity's computer network between August 17 and August 19, 2024, using two recently established customer accounts to submit fraudulent requests to an internal database that housed document images. Massachusetts regulators later fined Fidelity Brokerage Services LLC $1.25 million over cybersecurity-control and notification failures tied to the breach.
Pine Bluff School District
December 17, 2025
•[ business email compromise, phishing, fraud ]
A compromised Pine Bluff School District email account was used in a business email compromise scheme to insert fraudulent wiring instructions into legitimate vendor correspondence, causing the district to transfer approximately $3.2 million to scammers in December 2025.
Asian Football Confederation
April 27, 2026
•[ data leak, Personally Identifiable Information (PII), passport scans ]
A threat actor published an alleged Asian Football Confederation and Al Nassr FC player and coach database on a cybercrime forum on April 27, 2026, exposing more than 150,000 records including passport scans, contracts, email addresses, AFC registration files, and personal details. The actor credited ShinyHunters, but public reporting did not confirm ShinyHunters carried out the breach.
Kentwood Public Schools
April 30, 2026
•[ malware, insider threat, network disruption ]
A student deployed malicious software that interfered with Kentwood Public Schools network, causing districtwide WiFi connectivity loss, which was later isolated and restored with help from external experts.
