Del Monte Foods
February 19, 2026
•[ ransomware, data leak ]
PayoutsKING claimed responsibility for an attack on Del Monte Foods, with Ransomware.live listing an estimated attack date of February 19, 2026 and discovery on April 30, 2026. Breachsense reported a 1.2TB leak size, while DataBreach indexed approximately 143,000 rows. Public reporting did not confirm encryption, data destruction, attacker-caused operational disruption, or the exact exposed data fields.
At least one DAEMON Tools user in government, scientific, manufacturing, retail, or education sectors
April 8, 2026
•[ supply chain attack, malware, trojanized installers ]
Threat actors compromised official DAEMON Tools installers distributed from the vendor website beginning April 8, 2026. The trojanized installers executed malware on infected Windows hosts, collected system information, and in selected cases deployed additional backdoor payloads. Reporting identified second-stage payloads on roughly a dozen machines in government, scientific, manufacturing, and retail organizations in Russia, Belarus, and Thailand, and QUIC RAT on one Russian educational institution. The specific perpetrator was not publicly identified.
At least one Facebook Business account owner
April 1, 2026
•[ phishing, account takeover, credential harvesting ]
The AccountDumpling phishing campaign, linked to Vietnamese criminal actors, abused Google AppSheet as a phishing relay to send authenticated phishing emails impersonating Meta/Facebook support. The phishing pages harvested Facebook Business account credentials, recovery information, 2FA codes, and identity documents, enabling account takeover and resale through an illicit storefront. Reporting mapped roughly 30,000 compromised accounts across more than 50 countries.
At least one node-ipc npm package users
May 14, 2026
•[ supply chain attack, malicious package, credential theft ]
Attackers abused a dormant node-ipc npm maintainer account, likely after re-registering an expired maintainer email domain, and published malicious node-ipc versions 9.1.6, 9.2.3, and 12.0.1 on May 14, 2026. The packages contained an obfuscated credential-stealing payload that harvested developer and CI/CD secrets and exfiltrated them through DNS TXT queries.
Mediaworks Hungary Zrt.
April 28, 2026
•[ data extortion, data leak, financial data ]
World Leaks claimed responsibility for a data-extortion attack against Mediaworks Hungary Zrt. and released nearly 8.5 TB of allegedly sensitive internal files on its dark web site. Local media that reviewed the material said it included payroll records, contracts, financial statements, and internal communications; public reporting did not confirm encryption, deletion, or operational disruption.
Murray County Government
May 13, 2026
•[ cyberattack, government, service disruption ]
Murray County, Georgia reported that a cyberattack hit the county government network, forcing several county offices to limit services or close until network systems were restored. The Tax Commissioner, Tax Assessor, Probate Court, and Juvenile Court offices were closed, while other county offices remained open with limited functionality; 911, public safety, and primary voting continued. Public reporting did not identify a threat actor, confirm ransomware or encryption, specify the technical mechanism, report data theft, or provide a final restoration date.
Boyne City, MI
May 12, 2026
•[ cybersecurity incident, municipal computer network, utility bill payments ]
Boyne City, Michigan reported a cybersecurity incident affecting limited portions of its municipal computer network and digital systems. The city worked with IT professionals and cybersecurity specialists to secure affected systems and notified the FBI. Later reporting said city computer systems were operating with limited functionality, online utility bill payments were temporarily disabled, account balance and payment history information was unavailable, the city could not accept utility payments in person, and utility late fees and shutoffs were waived during restoration. Public reporting did not identify a threat actor, confirm ransomware, specify the technical mechanism, report data theft, or confirm whether any data was compromised.
BWH Hotels
October 14, 2025
•[ unauthorized access, guest reservation data, web application vulnerability ]
BWH Hotels disclosed that an unauthorized third party gained access to a web application containing some guest reservation data. The intrusion was discovered on April 22, 2026, and investigation found access dating back to October 14, 2025. BWH Hotels took the compromised application offline after discovery and worked with external security experts. Public reporting did not identify a named cybercrime group, quantify affected individuals or records, or confirm payment-data exposure, encryption, data destruction, or attacker-caused operational disruption.
Škoda Auto
May 11, 2026
•[ data leak, vulnerability exploitation, unauthorized access ]
Attackers exploited a vulnerability in koda Auto's online shop software and gained temporary unauthorized access to the shop system. koda said customer names, addresses, contact details, order details, account information, and password hashes may have been accessed, but credit card data was not stored in the system. The company took the online shop offline for containment, patched the vulnerability, reviewed security controls, notified authorities, and retained external forensic experts; the specific threat actor was not identified.
Undisclosed Arizona dermatology clinic
May 18, 2026
•[ healthcare data breach, medical data, HHS breach tracker ]
A small dermatology clinic in Arizona was reported in the HHS breach tracker as having suffered a healthcare data breach. The initial public figure of 3 million affected individuals was later corrected in the HHS tracker to 500 individuals; the clinic name, breach method, exposed data fields, and threat actor were not reported.
Western Orthopaedics
September 17, 2025
•[ data leak, ransomware, personal information ]
Western Orthopaedics confirmed that an unauthorized actor accessed files between September 17 and September 25, 2025, exposing personal, health insurance, medical billing, and financial information for 113,330 individuals. PEAR claimed responsibility and reportedly leaked the stolen data after ransom was not paid.
Coastal Carolina Health Care
March 21, 2025
•[ unauthorized access, data breach, Social Security numbers ]
Coastal Carolina Health Care identified suspicious activity that disrupted access to some systems and later determined that an unauthorized actor accessed and acquired information from its network between March 21 and March 27, 2025. The exposed information included names and Social Security numbers for approximately 110,000 individuals.
Florida Physician Specialists
November 27, 2025
•[ unauthorized access, data breach, personal information ]
Florida Physician Specialists said unauthorized access to its network occurred between approximately November 27 and November 29, 2025. A review completed on April 6, 2026 determined that personal, financial, medical, and health insurance information may have been removed from the network, affecting 276,498 individuals.
Erie Family Health Centers
December 10, 2025
•[ unauthorized access, data leak, medical records ]
Erie Family Health Centers detected unauthorized access in January 2026 and later determined that an unauthorized third party accessed its network between December 10, 2025 and January 27, 2026, exposing personal, financial, credential, medical, and health insurance information for approximately 570,000 individuals.
NYC Health + Hospitals
November 25, 2025
•[ third-party breach, healthcare data, biometric data ]
Unauthorized actors accessed NYC Health + Hospitals systems through a third-party vendor between approximately November 25, 2025 and February 2026, exposing personal, medical, health insurance, biometric, and financial information of approximately 1.8 million individuals.
Developers using compromised Lightning and Intercom packages
April 29, 2026
•[ software supply-chain attack, malware, credential harvesting ]
TeamPCP conducted a Mini Shai-Hulud software supply-chain attack by injecting credential-stealing malware into Lightning Python versions 2.6.2 and 2.6.3, intercom-client npm versions 7.0.4 and 7.0.5, and intercom-php 5.0.2. The malware harvested secrets from developer and CI/CD environments and created more than 1,800 GitHub repositories containing stolen credentials.
Undisclosed major user-generated content platform
April 15, 2026
•[ DDoS, HTTP DDoS campaign, Cybercrime ]
In mid-April 2026, cybercriminals launched a fragmented HTTP DDoS campaign against an undisclosed major user-generated content platform, generating approximately 2.45 billion malicious requests over five hours and peaking at 205,344 requests per second. The traffic originated from more than 1.2 million unique IP addresses across 16,402 autonomous systems.
Undisclosed Polish defense-sector organization
April 30, 2026
•[ espionage, web shells, ShadowPad ]
Shadow-Earth-053, a China-aligned espionage cluster, was reported to have compromised an undisclosed Polish defense-sector organization by exploiting unpatched Microsoft Exchange and IIS servers, deploying web shells and ShadowPad, collecting credentials, and exporting mailbox contents.
Undisclosed Taiwanese government entity
April 30, 2026
•[ espionage, state-sponsored, web shells ]
Shadow-Earth-053, a China-aligned espionage cluster, was reported to have compromised an undisclosed Taiwanese government environment by exploiting unpatched Microsoft Exchange and IIS servers, deploying web shells and ShadowPad, collecting credentials, and exporting mailbox contents.
Undisclosed Sri Lankan government entity
April 30, 2026
•[ cyber espionage, Shadow-Earth-053, unpatched servers ]
Shadow-Earth-053, a China-aligned espionage cluster, was reported to have compromised an undisclosed Sri Lankan government environment by exploiting unpatched Microsoft Exchange and IIS servers, deploying web shells and ShadowPad, collecting credentials, and exporting mailbox contents.
