Full List

Search

Recent Breaches

• Undisclosed Arizona dermatology clinic May 18, 2026 • [ healthcare data breach, medical data, HHS breach tracker ] A small dermatology clinic in Arizona was reported in the HHS breach tracker as having suffered a healthcare data breach. The initial public figure of 3 million affected individuals was later corrected in the HHS tracker to 500 individuals; the clinic name, breach method, exposed data fields, and threat actor were not reported.
• Western Orthopaedics September 17, 2025 • [ data leak, ransomware, personal information ] Western Orthopaedics confirmed that an unauthorized actor accessed files between September 17 and September 25, 2025, exposing personal, health insurance, medical billing, and financial information for 113,330 individuals. PEAR claimed responsibility and reportedly leaked the stolen data after ransom was not paid.
• Coastal Carolina Health Care March 21, 2025 • [ unauthorized access, data breach, Social Security numbers ] Coastal Carolina Health Care identified suspicious activity that disrupted access to some systems and later determined that an unauthorized actor accessed and acquired information from its network between March 21 and March 27, 2025. The exposed information included names and Social Security numbers for approximately 110,000 individuals.
• Florida Physician Specialists November 27, 2025 • [ unauthorized access, data breach, personal information ] Florida Physician Specialists said unauthorized access to its network occurred between approximately November 27 and November 29, 2025. A review completed on April 6, 2026 determined that personal, financial, medical, and health insurance information may have been removed from the network, affecting 276,498 individuals.
• Erie Family Health Centers December 10, 2025 • [ unauthorized access, data leak, medical records ] Erie Family Health Centers detected unauthorized access in January 2026 and later determined that an unauthorized third party accessed its network between December 10, 2025 and January 27, 2026, exposing personal, financial, credential, medical, and health insurance information for approximately 570,000 individuals.
• NYC Health + Hospitals November 25, 2025 • [ third-party breach, healthcare data, biometric data ] Unauthorized actors accessed NYC Health + Hospitals systems through a third-party vendor between approximately November 25, 2025 and February 2026, exposing personal, medical, health insurance, biometric, and financial information of approximately 1.8 million individuals.
• Developers using compromised Lightning and Intercom packages April 29, 2026 • [ software supply-chain attack, malware, credential harvesting ] TeamPCP conducted a Mini Shai-Hulud software supply-chain attack by injecting credential-stealing malware into Lightning Python versions 2.6.2 and 2.6.3, intercom-client npm versions 7.0.4 and 7.0.5, and intercom-php 5.0.2. The malware harvested secrets from developer and CI/CD environments and created more than 1,800 GitHub repositories containing stolen credentials.
• Undisclosed major user-generated content platform April 15, 2026 • [ DDoS, HTTP DDoS campaign, Cybercrime ] In mid-April 2026, cybercriminals launched a fragmented HTTP DDoS campaign against an undisclosed major user-generated content platform, generating approximately 2.45 billion malicious requests over five hours and peaking at 205,344 requests per second. The traffic originated from more than 1.2 million unique IP addresses across 16,402 autonomous systems.
• Undisclosed Polish defense-sector organization April 30, 2026 • [ espionage, web shells, ShadowPad ] Shadow-Earth-053, a China-aligned espionage cluster, was reported to have compromised an undisclosed Polish defense-sector organization by exploiting unpatched Microsoft Exchange and IIS servers, deploying web shells and ShadowPad, collecting credentials, and exporting mailbox contents.
• Undisclosed Taiwanese government entity April 30, 2026 • [ espionage, state-sponsored, web shells ] Shadow-Earth-053, a China-aligned espionage cluster, was reported to have compromised an undisclosed Taiwanese government environment by exploiting unpatched Microsoft Exchange and IIS servers, deploying web shells and ShadowPad, collecting credentials, and exporting mailbox contents.
• Undisclosed Sri Lankan government entity April 30, 2026 • [ cyber espionage, Shadow-Earth-053, unpatched servers ] Shadow-Earth-053, a China-aligned espionage cluster, was reported to have compromised an undisclosed Sri Lankan government environment by exploiting unpatched Microsoft Exchange and IIS servers, deploying web shells and ShadowPad, collecting credentials, and exporting mailbox contents.
• Undisclosed Malaysian government entity April 30, 2026 • [ espionage, vulnerability exploitation, unpatched software ] Shadow-Earth-053, a China-aligned espionage cluster, was reported to have compromised an undisclosed Malaysian government environment by exploiting unpatched Microsoft Exchange and IIS servers, deploying web shells and ShadowPad, collecting credentials, and exporting mailbox contents.
• Undisclosed Myanmar government entity April 30, 2026 • [ cyber espionage, vulnerability exploitation, web shells ] Shadow-Earth-053, a China-aligned espionage cluster, was reported to have compromised an undisclosed Myanmar government environment by exploiting unpatched Microsoft Exchange and IIS servers, deploying web shells and ShadowPad, collecting credentials, and exporting mailbox contents.
• Undisclosed Indian government entity April 30, 2026 • [ espionage, web shell, ShadowPad ] Shadow-Earth-053, a China-aligned espionage cluster, was reported to have compromised an undisclosed Indian government environment by exploiting unpatched Microsoft Exchange and IIS servers, deploying web shells and ShadowPad, collecting credentials, and exporting mailbox contents.
• Undisclosed Thai government entity April 30, 2026 • [ espionage, vulnerability exploitation, web shells ] Shadow-Earth-053, a China-aligned espionage cluster, was reported to have compromised an undisclosed Thai government environment by exploiting unpatched Microsoft Exchange and IIS servers, deploying web shells and ShadowPad, collecting credentials, and exporting mailbox contents.
• Undisclosed Pakistani government entity April 30, 2026 • [ cyber espionage, Shadow-Earth-053, Microsoft Exchange ] Shadow-Earth-053, a China-aligned espionage cluster, was reported to have compromised an undisclosed Pakistani government environment by exploiting unpatched Microsoft Exchange and IIS servers, deploying web shells and ShadowPad, collecting credentials, and exporting mailbox contents.
• Undisclosed South Korean electronics manufacturer February 20, 2026 • [ espionage, DLL side-loading, reconnaissance ] Ministry of Intelligence and Security (MOIS) (MuddyWater), also tracked as Seedworm, breached a major South Korean electronics manufacturer in February 2026 as part of a broader espionage campaign. The actor spent about one week inside the victim network, abused signed Fortemedia and SentinelOne binaries for DLL side-loading, conducted reconnaissance and credential-access activity, and exfiltrated data through a public file-transfer service.
• At least one Claude Code user April 30, 2026 • [ malware, fake installer, credential harvesting ] A fake Claude Code installer campaign likely affected many users searching for Anthropic's Claude Code tool, though public reporting did not identify specific victims or quantify the total number infected. The campaign delivered a PowerShell payload that extracted decrypted cookies, saved passwords, and payment data from Chromium-based browsers on infected machines. Public reporting did not identify the specific actor, country, volume of stolen data, or any operational disruption.
• GFN.am March 20, 2026 • [ unauthorized access, data leak, PII ] GFN.am, NVIDIA's regional GeForce NOW alliance partner in Armenia, suffered unauthorized access to partner-operated infrastructure between March 20 and March 28, 2026. The breach affected Armenian GeForce NOW users registered before March 9 and exposed personal account information including names, email addresses, phone numbers, dates of birth, usernames, membership status, and two-factor authentication status. NVIDIA said its own infrastructure was not affected. A forum actor using the ShinyHunters name claimed the breach, but reporting indicates the real ShinyHunters group denied involvement, so the specific perpetrator remains unidentified.
• Jabłonna Lacka Water Treatment Plant August 1, 2025 • [ industrial control systems, ICS, critical infrastructure ] Poland's Internal Security Agency reported that attackers breached industrial control systems at multiple water treatment facilities in 2025, including Jabonna Lacka. The attackers gained access to operational systems controlling water treatment processes and in some cases obtained the ability to modify equipment operational parameters, creating a direct risk to operational continuity and public water supply. Public reporting says the August 2025 incident nearly caused a municipality to lose its water supply before authorities intervened. Polish cybersecurity reporting linked several water-facility incidents to a pro-Russian hacktivist group, but no public source identified the specific named perpetrator for the Jabonna Lacka incident.