Radiology Associates of Richmond
July 25, 2025
•[ data breach, unauthorized access, protected health information (PHI) ]
An unauthorized actor accessed Radiology Associates of Richmond's network environment on or about July 25, 2025, and files containing protected health information were acquired. RAR began notifying affected individuals on May 21, 2026; filings reported 266,183 affected individuals.
Central Board of Secondary Education
May 21, 2026
•[ unauthorized access, payment gateway vulnerability, price manipulation ]
The CBSE revaluation portal's payment system was hit by an unauthorized malicious attack linked to the HDFC payment gateway integration when the portal went live. Approximately 50 students gained unauthorized access or were affected after displayed fee amounts were manipulated, causing payable amounts in some cases to range from Re 1 to nearly Rs 67,000-68,000. Public reporting did not identify the individuals or confirm theft of student data.
Village of Chase
May 19, 2026
•[ Business Email Compromise (BEC), Fraud, Financial Loss ]
A vendors email account was compromised, causing the Village of Chase to send a payment to fraudulent bank details, resulting in a loss of $44,536; most of the funds were recovered and the loss was covered by prioryear surplus.
MyPillow
May 25, 2026
•[ ransomware, data leak, financial data ]
Play claimed it breached MyPillow and stole private company, employee, financial, and client documents. After CEO Mike Lindell denied the breach, the group published approximately 9.8GB of internal files, reportedly including payroll records, tax forms, bank statements, audit files, and client invoices.
Windows93 / Myspace93
January 1, 2021
•[ data leak, plaintext passwords, credential theft ]
In January 2021, trusted members of the Windows93 Discord community allegedly abused access to a Myspace93 beta application to exploit and download server files, including an unencrypted credential store. The compromised data was later leaked in June 2021 and contained 46,105 Myspace93 accounts with usernames, plaintext passwords, email addresses, and IP addresses.
The European House – Ambrosetti spa
April 1, 2024
•[ technical vulnerability, data exfiltration, unprotected passwords ]
Unauthorized access to The European House Ambrosetti systems through a technical vulnerability in April 2024 resulted in exfiltration of account data for 61,670 people, including employees of client companies and internal staff using online services. Italy's data protection authority later fined the company for inadequate security, unprotected passwords, and delayed notification to affected individuals.
Delano Public Schools
May 18, 2026
•[ ransomware, network compromise, service disruption ]
Delano Public Schools experienced a network compromise discovered after unauthorized activity caused ransom messages to print throughout the district. The district shut down internet access while experts tested systems and canceled classes on May 20, 2026. Public reporting did not confirm data theft or successful encryption.
GitHub
May 18, 2026
•[ poisoned extension, data breach, internal repositories ]
GitHub confirmed that attackers compromised an employee device through a poisoned Visual Studio Code extension and exfiltrated approximately 3,800 internal repositories. TeamPCP claimed responsibility and reportedly offered the stolen data for sale, while GitHub said customer repositories and external enterprise customer data were not impacted.
Clínica Hospital Panamericano
May 2, 2026
•[ data leak, healthcare, patient database exposure ]
Ch-panamericana.com was listed among the Panamanian incidents in a Vecert Analyzer intelligence report cited by La Estrella de Panam. The domain appears to correspond to Clnica Hospital Panamericano, a healthcare provider in Panam Oeste, and outside monitoring referenced alleged patient database exposure from ch-panamericano.com. The incident was dated May 2, 2026. Outside OSINT reporting linked the leak to ohmydays and Waxx Org., but public reporting did not confirm encryption, data destruction, or operational disruption.
Parque Eólico Toabré
March 31, 2026
•[ cyberattack, data leak, ransomware ]
Everest claimed responsibility for a cyberattack against Parque Elico Toabr on March 31, 2026 and threatened to release sensitive data. La Estrella de Panam later listed Parque Elico Toabr among Panamanian technology incidents dated May 9, 2026, and other dark-web monitoring reported an alleged 175GB database leak. Public reporting did not confirm encryption, data destruction, operational disruption, or compromise of wind-farm control systems.
Red Radimagen
May 3, 2026
•[ data leak, health-sector, medical records ]
Red Radimagen was listed among the Panamanian health-sector entities directly affected by data exposure in a Vecert Analyzer intelligence report cited by La Estrella de Panam. The incident was dated May 3, 2026. Outside OSINT reporting attributed the Radimagen leak to ohmydays, linked the actor to Waxx Org., and referenced exposed medical or patient-related records from an unsecured server, but public reporting did not confirm encryption, data destruction, or operational disruption.
MiniMed Panamá
May 2, 2026
•[ data exposure, PII, plaintext credentials ]
MiniMed Panam was listed among the Panamanian health-sector platforms directly affected by data exposure in a Vecert Analyzer intelligence report cited by La Estrella de Panam. The incident was dated May 2, 2026, and outside OSINT reporting described roughly 400,000 exposed records associated with MiniMed, including a usersdata table with 74,233 records containing PII and plaintext credentials. Public reporting did not identify the threat actor, encryption, data destruction, or operational disruption.
Sistema Bancario Softbank
May 11, 2026
•[ data leak, source code exposure, dark web ]
Sistema Bancario Softbank was listed among the most severe Panamanian incidents in a Vecert Analyzer intelligence report cited by La Estrella de Panam. The incident was dated May 11, 2026 and described as compromising corporate and financial structures, with exposed data appearing in dark-web forums. Outside OSINT reporting attributed the leak to V0lt4r0x and referenced alleged source-code exposure for a Softbank banking system used in Latin America, but public reporting did not confirm the specific intrusion vector, encryption, data destruction, or operational disruption.
E-Control Systems
May 18, 2026
•[ ransomware, data-extortion, IoT ]
The Gentlemen ransomware group publicly claimed responsibility for a data-extortion attack against E-Control Systems, a California-based IoT-powered wireless temperature-monitoring technology company, on May 18, 2026 and threatened to publish sensitive data unless negotiations began. Public reporting did not confirm encryption, deletion, operational disruption, or the specific data volume.
i.e.Smart Systems
April 23, 2026
•[ ransomware, data-extortion, data leak ]
The Gentlemen ransomware group publicly claimed responsibility for a data-extortion attack against i.e.Smart Systems, a Houston-area technology integrator, on April 23, 2026 and threatened to leak sensitive data if the company did not engage in negotiations. Public reporting did not confirm encryption, deletion, operational disruption, or the specific data volume.
Wamtechnik Sp. z o.o.
January 7, 2026
•[ ransomware, data extortion, data leak ]
The Gentlemen ransomware group claimed responsibility for a data-extortion attack against Wamtechnik Sp. z o.o., a Polish battery and industrial power-systems manufacturer, on January 7, 2026 and threatened to publish a full leak unless the company initiated negotiations. Public reporting did not confirm encryption, deletion, operational disruption, or the specific data volume.
Synergy France
April 8, 2026
•[ ransomware, data leak, cyberattack ]
The Gentlemen ransomware group claimed responsibility for a cyberattack against Synergy France on April 8, 2026 and threatened to publish sensitive data unless the company contacted the group. ComputerWeekly later described The Gentlemen as an emerging ransomware player responsible for a large volume of attacks in 2026.
Presidential Office of the Republic of North Macedonia
May 21, 2026
•[ insider threat, espionage, data theft ]
An unnamed IT administrator in the Presidential Office of the Republic of North Macedonia was reportedly suspected of copying, decrypting, encrypting, and storing confidential state data from presidential administration computer systems, with allegations that the material may have been intended for a foreign intelligence service. Public reporting did not name the administrator, identify the foreign service, quantify the data, or confirm operational disruption.
City of Martinsville
March 25, 2026
•[ data breach, personal information, municipal computer systems ]
The City of Martinsville disclosed that, on or about March 25, 2026, its technology team became aware of disruptions to municipal computer systems and took steps to stop the incident. Early reporting said some services in the city municipal building could be delayed or limited for the rest of the week. The city later said personal information may have been accessed by the perpetrators, but public reporting did not identify the threat actor, confirm ransomware or encryption, specify the disruption mechanism, or quantify the affected data.
Pick n Pay Stores Limited
March 23, 2026
•[ data breach, dark web, customer information ]
Pick n Pay confirmed a data breach involving customer information from an older version of its on-demand delivery platform, first known as Bottles and later Pick n Pay asap!. Reporting said the historical customer dataset had been offered for sale on a dark-web forum since March 23, 2026 and included names, contact details, residential addresses, dates of birth, partial payment-card information, encrypted passwords, and certain banking details. Public reporting did not identify the threat actor, encryption, data destruction, or operational disruption.
