Kinsmen Foundation
May 22, 2026
•[ unauthorized access, data leak, contact information ]
The Kinsmen Foundation, which runs Saskatchewan's TeleMiracle fundraiser, disclosed unauthorized access to certain applications on its systems. The incident was contained, regular operations and services were not affected, and the foundation said contact information and email addresses may have been exposed. The foundation notified law enforcement, engaged third-party experts, and said impacted donors would be contacted through Cyberscout.
Generation Life Limited
April 27, 2026
•[ cyber incident, unauthorized access, third-party service provider ]
Generation Life disclosed a contained cyber incident on April 27, 2026 involving an unauthorized party gaining access to part of its system through a third-party service provider. The company said the incident was quickly contained, core investment systems remained secure, services continued operating normally, and there was no evidence of unauthorized transactions. Qilin later claimed responsibility and alleged access to some Generation Life data, but public reporting did not confirm the scope, data types, encryption, or operational disruption.
Snake River Correctional Institution
July 7, 2025
•[ insider threat, unauthorized access, data breach ]
A former Snake River Correctional Institution Library Coordinator, Demetre Gennette, improperly acquired Oregon Department of Corrections records between July 7, 2025 and early January 2026. The extraction involved more than 7.5GB of data across more than 33,000 files and resulted in unauthorized access to personal information belonging to staff, vendors, adults in custody, and visitors. Gennette was later indicted on charges including computer crime, aggravated theft, official misconduct, supplying contraband, and custodial sexual misconduct.
WhiteDeal
December 28, 2025
•[ hacktivism, data collection, site deletion ]
Hacktivist Martha Root used AI chatbots and a Python script during a Chaos Communication Congress presentation to collect data from white-supremacist platforms and delete WhiteDeal, a marketplace for racist freelance work. Reporting confirms WhiteDeal was one of three distinct sites deleted during the same operation.
WhiteChild
December 28, 2025
•[ hacktivism, data deletion, white supremacy ]
Hacktivist Martha Root used AI chatbots and a Python script during a Chaos Communication Congress presentation to collect data from white-supremacist platforms and delete WhiteChild, a platform associated with white-supremacist sperm and egg donor matching. Reporting confirms WhiteChild was one of three distinct sites deleted during the same operation.
sqgame.net
October 1, 2024
•[ supply chain attack, malware, backdoor ]
ScarCruft/INKY SQUID compromised Windows and Android components of the sqgame.net gaming platform serving ethnic Koreans in China's Yanbian region, trojanizing game files and update components with RokRAT and BirdCall backdoors. ESET estimated the compromise began in late 2024, with Android malware development beginning around October 2024 and Windows update components malicious since at least November 2024.
Salt Mobile SA
May 15, 2026
•[ DDoS attack, service disruption, network security ]
On May 15, 2026, Salt's fixed-line services in Switzerland were disrupted for about 40 minutes by an external distributed denial-of-service attack. Salt said technical teams activated protective measures and restored service; the mobile network was not affected.
ВЗГЛЯД (Vzglyad)
May 9, 2026
•[ DDoS attack, cybersecurity, news media ]
The Russian news site reported a massive DDoS attack on the morning of May 9, 2026, detected at 9:45 Moscow time shortly before the Victory Day parade in Moscow. Technical staff and cybersecurity specialists said the main flow of junk traffic came from servers in the European Union, with peak loads from Germany and the Netherlands. Traffic filtering kept the site operational, with only a short slowdown in homepage updates.
Arbeitsgemeinschaft Wirtschaftlichkeitsprüfung Niedersachsen e.V. (Arwini)
May 5, 2026
•[ ransomware, data exfiltration, health information ]
Kairos ransomware actors attacked Arbeitsgemeinschaft Wirtschaftlichkeitsprfung Niedersachsen e.V. (Arwini), the prescription-review association for statutory health insurance prescriptions in Lower Saxony. Police confirmed Kairos was responsible, that ransomware was used to encrypt data, and that data exfiltration occurred. Potentially affected data included contact, health, and billing information for patients; more than 70,000 records may have been stolen, though the exact scope remained under investigation.
At least one unnamed European celebrity
May 1, 2025
•[ stalkerware, spyware, data leak ]
A researcher discovered a publicly accessible cloud repository containing 86,859 screenshots from an unnamed European celebrity's device. The files appeared to have been collected through Cocospy-linked stalkerware or spyware installed on the victim's endpoint and included private communications, intimate images, phone usage, business conversations, invoices, payment details, phone numbers, partial credit card numbers, emails, receipts, and identity documents. The dataset appeared to span activity from mid-2024 to mid-2025, but the exact installation or compromise date was not reported; the specific perpetrator was not publicly identified.
Nova Poshta
May 7, 2026
•[ DDoS attack, IT systems disruption, service availability ]
Nova Poshta reported a DDoS attack on its IT systems on May 7, 2026, warning users of minor temporary difficulties in company services. The company said the situation was under control, IT specialists were countering the attack, and backup service schemes had been activated.
Groupe 3R (Réseau Radiologique Romand)
April 30, 2026
•[ ransomware, data theft, healthcare ]
On April 30, 2026, Groupe 3R (Rseau Radiologique Romand) was hit by a ransomware attack that reduced system availability and caused some patient examinations to be rescheduled. The incident was reported to the Swiss Federal Cybersecurity Office and a criminal complaint was filed. Akira later claimed responsibility and alleged theft of 48 GB of data, including patient information, employee identification documents, payment details, and corporate records.
Advanced Diagnostic Imaging, P.C. d/b/a AdvancedHEALTH
May 16, 2026
•[ data leak, ransomware, healthcare ]
DragonForce listed AdvancedHEALTH on its leak site on May 16, 2026 and claimed to have stolen 390 GB of data, including 2.3 million lines of patient data, partner agreements, management, payroll, and HR files. Public reporting noted that AdvancedHEALTH had not confirmed the full scope of DragonForce's claim.
Hanover County Public Schools
March 11, 2026
•[ ransomware, network data access, personally identifiable information ]
Hanover County Public Schools experienced a March 2026 data-security incident that disrupted internet service and multiple school systems. The district later said a malicious actor gained access to network data and attempted to deploy ransomware to encrypt portions of the network, but the access was terminated soon after detection and successful encryption was not confirmed. The district warned that personally identifiable information may have been viewed or accessed.
Liberty Mutual Insurance
April 30, 2026
•[ data-extortion, data leak, personal information ]
Everest Group claimed responsibility for a data-extortion attack against Liberty Mutual Insurance on April 30, 2026 and began leaking what it claimed was more than 108 GB of stolen data, including policyholder personal, financial, and insurance information. Public reporting did not confirm encryption, deletion, or operational disruption.
Belgrade School District
April 1, 2026
•[ malware, system restoration, data breach investigation ]
Belgrade School District confirmed that malware infected certain network systems, causing technology problems and requiring isolation, removal, security work, and restoration of affected systems. The district said known malware had been removed, but crews were still working to bring affected systems back online and restoration was expected to continue into June. The incident appears distinct from the separate Canvas/Instructure breach because public reporting describes malware in Belgrade School District's own network systems, not unauthorized access to Instructure's Canvas LMS. The district was investigating whether personal information belonging to students or staff was affected, but no confirmed data exposure, encryption, ransomware group, or named perpetrator was reported.
Pitney Bowes
April 8, 2026
•[ phishing, extortion, data leak ]
Pitney Bowes identified unauthorized access to certain records in its Salesforce customer relationship management environment on April 9, 2026, after a phishing attack compromised an employee email account the previous night. ShinyHunters claimed to have obtained Pitney Bowes data as part of a broader extortion campaign and later released data containing 8.2 million unique email addresses, names, phone numbers, physical addresses, and some employee job-title records. Irish reporting separately confirmed that 137 Revenue Commissioners employees were affected through the Pitney Bowes supplier breach, with professional contact details exposed but no Revenue passwords or taxpayer data stolen.
Mt. Spokane Pediatrics
January 1, 2026
•[ ransomware, data leak, healthcare ]
Mt. Spokane Pediatrics experienced unauthorized access to certain systems in its network environment on or about January 1, 2026, and files containing patient information were removed. LockBit 5.0 claimed responsibility on January 3, 2026 and threatened to leak the stolen data. The clinic's forensic investigation determined on April 22, 2026 that exfiltrated files contained personal and protected health information for 32,021 individuals, including 29,410 Washington accounts.
At least one Russian government agency or aviation company
September 1, 2025
•[ phishing, malicious advertising, malware ]
HeartlessSoul has targeted Russian government agencies, aerospace firms, aviation companies, and drone operators since at least September 2025 using phishing emails with infected attachments, malicious advertising, fake aviation-software download sites, fake SourceForge projects, and malware disguised as legitimate software. Public reporting indicates the campaign was successful against one or more victims and resulted in the exfiltration of GIS, satellite, GPS, terrain, digital geographic relief, and other proprietary geospatial data.
THORChain
May 15, 2026
•[ cryptocurrency theft, vulnerability exploit, private key reconstruction ]
THORChain said a malicious newly churned node operator exploited a vulnerability in the GG20 threshold signature scheme on May 15, 2026, reconstructed a vault private key, and drained approximately $10.7 million from one vault across multiple blockchains. THORChain halted trading and signing operations as a defensive response after the exploit was identified. Public reporting did not identify the perpetrator by name or country.
