Pitney Bowes
April 8, 2026
•[ phishing, extortion, data leak ]
Pitney Bowes identified unauthorized access to certain records in its Salesforce customer relationship management environment on April 9, 2026, after a phishing attack compromised an employee email account the previous night. ShinyHunters claimed to have obtained Pitney Bowes data as part of a broader extortion campaign and later released data containing 8.2 million unique email addresses, names, phone numbers, physical addresses, and some employee job-title records. Irish reporting separately confirmed that 137 Revenue Commissioners employees were affected through the Pitney Bowes supplier breach, with professional contact details exposed but no Revenue passwords or taxpayer data stolen.
Mt. Spokane Pediatrics
January 1, 2026
•[ ransomware, data leak, healthcare ]
Mt. Spokane Pediatrics experienced unauthorized access to certain systems in its network environment on or about January 1, 2026, and files containing patient information were removed. LockBit 5.0 claimed responsibility on January 3, 2026 and threatened to leak the stolen data. The clinic's forensic investigation determined on April 22, 2026 that exfiltrated files contained personal and protected health information for 32,021 individuals, including 29,410 Washington accounts.
At least one Russian government agency or aviation company
September 1, 2025
•[ phishing, malicious advertising, malware ]
HeartlessSoul has targeted Russian government agencies, aerospace firms, aviation companies, and drone operators since at least September 2025 using phishing emails with infected attachments, malicious advertising, fake aviation-software download sites, fake SourceForge projects, and malware disguised as legitimate software. Public reporting indicates the campaign was successful against one or more victims and resulted in the exfiltration of GIS, satellite, GPS, terrain, digital geographic relief, and other proprietary geospatial data.
THORChain
May 15, 2026
•[ cryptocurrency theft, vulnerability exploit, private key reconstruction ]
THORChain said a malicious newly churned node operator exploited a vulnerability in the GG20 threshold signature scheme on May 15, 2026, reconstructed a vault private key, and drained approximately $10.7 million from one vault across multiple blockchains. THORChain halted trading and signing operations as a defensive response after the exploit was identified. Public reporting did not identify the perpetrator by name or country.
Chime Financial, Inc.
April 1, 2026
•[ cyberattack, data theft, server outage ]
Islamic Cyber Resistance in Iraq (313 Team), also referenced as Team 313 or 313 Team, allegedly claimed responsibility online for attacking Chime's servers on April 1, 2026, causing a widespread outage that prevented customers from accessing accounts through the application and website. Lawsuits alleged that the incident also involved theft of sensitive customer information from Chime systems, but public reporting did not confirm the exact data volume, technical vector, or whether Chime independently confirmed the data-theft allegations.
Government of Guam
May 2, 2026
•[ zero-day vulnerability, cyber incident response, website disruption ]
The Government of Guam activated its cyber incident response on May 2, 2026 after hackers exploited a critical zero-day vulnerability affecting globally used cPanel-hosted websites. Multiple GovGuam websites were disrupted, prompting a government-wide assessment and response. Officials said emergency services remained unaffected; public reporting did not identify the actor, confirm data theft, or quantify the disruption duration.
Udemy, Inc.
April 24, 2026
•[ data leak, extortion, ShinyHunters ]
ShinyHunters listed Udemy in a pay-or-leak extortion attempt on April 24, 2026 and subsequently leaked data containing 1.4 million unique email addresses belonging to customers and instructors, along with names, physical addresses, phone numbers, employer information, and instructor payout methods. Public reporting did not confirm encryption, deletion, or operational disruption.
Aman Resorts
April 18, 2026
•[ extortion, data leak, PII ]
ShinyHunters named Aman Resorts in an April 2026 pay-or-leak extortion campaign and claimed compromise of over 500,000 Salesforce CRM records containing PII. DataBreach indexed 294,871 rows, while Have I Been Pwned reported over 200,000 unique email addresses and said the leaked data also included names, phone numbers, physical addresses, dates of birth, nationalities, spouse names, and VIP status codes. Public sources did not confirm encryption, data destruction, or operational disruption.
Adelante Soluciones Financieras
March 1, 2026
•[ data leak, unauthorized access, PII ]
Addi identified unauthorized activity on its platform in March 2026 and advised customers that personal information may have been compromised. ShinyHunters later claimed responsibility and published a large trove of personal data allegedly obtained from Addi. DataBreach indexed 67,979,172 rows tied to the breach, while HIBP reported approximately 34 million exposed email addresses and credit-related data points. Public sources did not confirm encryption, data destruction, operational disruption, or a precise intrusion vector.
Cushman & Wakefield
May 3, 2026
•[ vishing, PII, data leak ]
Cushman & Wakefield confirmed a vishing-related security breach in May 2026 after ShinyHunters and Qilin separately listed the company. ShinyHunters claimed theft of more than 500,000 Salesforce records containing PII and internal corporate data and later reportedly published a 50GB Salesforce-linked dataset after negotiations failed. DataBreach indexed 2,198,033 rows associated with the breach. Public sources did not confirm encryption or operational disruption.
Goodwin University
December 4, 2025
•[ network disruption, unauthorized access, data breach ]
Goodwin University experienced a network disruption on December 4, 2025 and secured its network environment. Qilin claimed responsibility on December 28, 2025, and the investigation later determined that certain files may have been acquired without authorization. DataBreach indexed 209,218 rows tied to the breach, while outside reporting says Goodwin later confirmed 56,156 impacted individuals. Public sources did not confirm encryption or the precise disruption mechanism.
Telecare Corporation
February 19, 2026
•[ ransomware, data leak, healthcare ]
Qilin claimed responsibility for an attack on Telecare Corporation on February 19, 2026 and threatened to release sensitive healthcare data unless negotiations began. DataBreach indexed 275,644 rows and listed exposed fields including Social Security numbers, dates of birth, email addresses, phone numbers, names, and street addresses. Public reporting did not confirm encryption, data destruction, attacker-caused operational disruption, or the exact intrusion vector.
Powell Electronics
May 7, 2026
•[ data breach, Personally Identifiable Information (PII), extortion ]
PayoutsKING claimed responsibility for an attack on Powell Electronics and threatened to release sensitive data unless the company negotiated. DataBreach indexed 198,676 rows with names, email addresses, phone numbers, and street addresses. Later breach-notification reporting said Powell began notifying affected individuals that data including Social Security numbers and driver's license information had been accessed. Public reporting did not confirm encryption, data destruction, or attacker-caused operational disruption.
Expert MRI
August 14, 2025
•[ data breach, healthcare, data leak ]
Expert MRI determined that an unauthorized actor accessed and copied files between August 14 and August 24, 2025. PEAR later claimed responsibility and reportedly posted samples of stolen data, claiming 617GB of data. The official healthcare breach count was 209,560 affected individuals, while DataBreach indexed 442,753 rows. Public reporting did not confirm encryption, data destruction, or attacker-caused operational disruption.
The McLamb Group, Inc.
April 6, 2026
•[ data leak, PII, Social Security numbers ]
PEAR claimed The McLamb Group, Inc. on its leak site with an estimated attack date of April 6, 2026. DataBreach indexed 124,203 rows and listed exposed fields including Social Security numbers, dates of birth, email addresses, phone numbers, names, and street addresses. Public reporting did not confirm encryption, data destruction, attacker-caused operational disruption, or the exact intrusion vector.
Del Monte Foods
February 19, 2026
•[ ransomware, data leak ]
PayoutsKING claimed responsibility for an attack on Del Monte Foods, with Ransomware.live listing an estimated attack date of February 19, 2026 and discovery on April 30, 2026. Breachsense reported a 1.2TB leak size, while DataBreach indexed approximately 143,000 rows. Public reporting did not confirm encryption, data destruction, attacker-caused operational disruption, or the exact exposed data fields.
At least one DAEMON Tools user in government, scientific, manufacturing, retail, or education sectors
April 8, 2026
•[ supply chain attack, malware, trojanized installers ]
Threat actors compromised official DAEMON Tools installers distributed from the vendor website beginning April 8, 2026. The trojanized installers executed malware on infected Windows hosts, collected system information, and in selected cases deployed additional backdoor payloads. Reporting identified second-stage payloads on roughly a dozen machines in government, scientific, manufacturing, and retail organizations in Russia, Belarus, and Thailand, and QUIC RAT on one Russian educational institution. The specific perpetrator was not publicly identified.
At least one Facebook Business account owner
April 1, 2026
•[ phishing, account takeover, credential harvesting ]
The AccountDumpling phishing campaign, linked to Vietnamese criminal actors, abused Google AppSheet as a phishing relay to send authenticated phishing emails impersonating Meta/Facebook support. The phishing pages harvested Facebook Business account credentials, recovery information, 2FA codes, and identity documents, enabling account takeover and resale through an illicit storefront. Reporting mapped roughly 30,000 compromised accounts across more than 50 countries.
At least one node-ipc npm package users
May 14, 2026
•[ supply chain attack, malicious package, credential theft ]
Attackers abused a dormant node-ipc npm maintainer account, likely after re-registering an expired maintainer email domain, and published malicious node-ipc versions 9.1.6, 9.2.3, and 12.0.1 on May 14, 2026. The packages contained an obfuscated credential-stealing payload that harvested developer and CI/CD secrets and exfiltrated them through DNS TXT queries.
Mediaworks Hungary Zrt.
April 28, 2026
•[ data extortion, data leak, financial data ]
World Leaks claimed responsibility for a data-extortion attack against Mediaworks Hungary Zrt. and released nearly 8.5 TB of allegedly sensitive internal files on its dark web site. Local media that reviewed the material said it included payroll records, contracts, financial statements, and internal communications; public reporting did not confirm encryption, deletion, or operational disruption.
