University of Nebraska Medical Center
February 3, 2026
•[ vulnerability, unauthorized access, data leak ]
University of Nebraska Medical Center learned in February 2026 that its REDCap application contained a vulnerability and took the application offline. UNMC's investigation determined that its REDCap instance was subject to unauthorized access between September 20, 2023 and February 3, 2026, though it could not determine whether personal information housed in REDCap was actually accessed. The incident potentially affected 26,937 individuals whose data varied by research study.
Taiwan High Speed Rail Corporation
April 5, 2026
•[ radio interference, TETRA communications, software-defined radio ]
A 23-year-old university student identified by the surname Lin allegedly interfered with Taiwan High Speed Rail's TETRA radio communications system using software-defined radio equipment and handheld radios. The unauthorized General Alarm signal triggered emergency braking or emergency stop procedures, affecting four high-speed trains for approximately 48 minutes. Public reporting did not identify data theft, ransomware, or a financial motive.
Caja de Seguro Social (CSS)
March 27, 2026
•[ unauthorized intrusion, data leak, medical records ]
Caja de Seguro Social (CSS), Panama's public social security and healthcare institution, reported a possible unauthorized intrusion on March 27, 2026 while stating that web services remained operational. The Gentlemen later claimed responsibility for the hack and alleged publication or sale of 3 TB of data, including medical histories, pension records, loan documents, signatures, phone numbers, and radiology files, with the group claiming the medical and pension databases covered 80% of Panama's population.
Equity Life Indonesia
April 4, 2026
•[ ransomware, data theft, data encryption ]
The Gentlemen ransomware group claimed responsibility for an attack against Equity Life Indonesia on April 4, 2026, threatening to publish stolen data unless contacted. Independent ransomware trackers listed Equity Life Indonesia under The Gentlemen, and CYFIRMA reported the campaign objective as data theft, data encryption, and financial gain, but public sources did not confirm the exact data volume, affected record count, or operational disruption.
Tessco Technologies
April 30, 2026
•[ ransomware, data exfiltration, data leak ]
On April 30, 2026, the ransomware group PayoutsKing claimed to have exfiltrated and encrypted 615GB of data from Tessco Technologies, a U.S. wireless communications products distributor, including contact information for over 100,000 individuals and Salesforce records for more than 500,000 customers.
Blanchard Training and Development, Inc.
March 3, 2026
•[ unauthorized access, PII, financial information ]
Blanchard Training and Development, Inc. identified unusual activity in its network environment on March 4, 2026, and later determined that an unauthorized individual may have copied certain information between March 3 and March 4. DataBreach indexed 494,404 rows tied to Blanchard, including names, contact information, addresses, and bank account information.
Gastroenterology & Hepatology of CNY
April 14, 2026
•[ ransomware, data-extortion, healthcare ]
Exitium claimed responsibility for a ransomware and data-extortion attack against Gastroenterology & Hepatology of CNY on April 14, 2026, claiming it had encrypted systems and threatened to sell patient records if its demands were not met. DataBreach.com later indexed 196,959 rows associated with the leak, while other public reporting described Exitium's claim as involving approximately 167,303 patient records.
Raise the Bottom
May 15, 2026
•[ substance use disorder treatment, addiction recovery, behavioral health services ]
Raise the Bottom, an Idaho substance use disorder treatment organization, was listed in a breach involving 57,507 indexed rows. DataBreach identified exposed names, email addresses, and phone numbers; BreachSense attributed the breach to CMD and described Raise the Bottom as an Idaho-based addiction recovery, counseling, and behavioral health services provider.
Undisclosed Vietnamese ministry-level agency 2
May 22, 2026
•[ data breach, cyberattack, unauthorized access ]
Vietnamese cybersecurity authorities said hackers infiltrated one of two ministry-level agency systems containing millions of user records. VNCERT investigated the incidents on May 21-22, 2026, and reported that existing SOC monitoring systems at the affected agencies failed to detect the attacks.
Afghanistan Ministry of Finance
May 29, 2026
•[ spear-phishing, malware, XenoRAT ]
SideCopy, a suspected Pakistan-linked threat group, targeted Afghanistan's Ministry of Finance and provincial revenue and finance directorates with spear-phishing emails containing a malicious ZIP/LNK file in Pashto. When executed, the malware chain installed XenoRAT, enabling long-term remote access, spying on infected computers, and additional malicious activity.
Unimed
April 14, 2026
•[ unauthorized access, data theft, ransomware ]
Unknown attackers gained unauthorized access to parts of Unimed's IT infrastructure on April 14, 2026 and stole patient billing data processed for German hospitals and clinics. Affected institutions included university hospitals in Cologne, Freiburg, Heidelberg, Tbingen, Ulm, Dsseldorf, Mainz, Saarland, Oldenburg, Hannover, Gttingen, and others. Reporting indicated the attackers intended broader system encryption, but this was stopped; hospitals said their clinical systems and patient care were not affected.
Almerys
May 22, 2026
•[ data breach, healthcare, personally identifiable information ]
Almerys, a French third-party health payments processor, suffered a May 2026 breach involving its online coverage authorization portal used by healthcare professionals and facilities. Reporting said hackers gained access to the portal and that a threat actor later advertised more than 44 million Almerys-linked records and more than 15 million unique French Social Security numbers for sale. Almerys reportedly took the affected portal offline as a containment measure; no named actor, encryption, data destruction, or attacker-caused operational disruption was confirmed.
Chelan County Government
May 24, 2026
•[ malware, cyberattack, network shutdown ]
Chelan County, Washington reported that malware was detected on county government systems around 10 a.m. on May 24, 2026, affecting all county departments. As a precaution, the county voluntarily shut down network access, computers, and telephone systems across departments while IT staff worked with security partners to restore systems; 911 and emergency services remained available. Public reporting did not identify the threat actor, confirm ransomware, report data theft, or confirm whether any personal data was compromised.
Chanhassen Dinner Theatres
May 15, 2026
•[ cyberattack, operational disruption, system outage ]
Chanhassen Dinner Theatres experienced a cyberattack affecting part of its computer network on May 15, 2026 and took systems offline while working with outside experts to restore operations. The incident disrupted internet, phone, customer-service, and operational functions and contributed to rescheduled or canceled performances, alongside a separate cast illness/norovirus disruption. Public reporting did not confirm encryption, data theft, a ransom demand, or a responsible actor.
Gas station operators
May 15, 2026
•[ operational technology, critical infrastructure, cyberattack ]
Iranian hackers reportedly accessed internet-connected automatic tank gauge systems at gas stations in multiple U.S. states. Automatic tank gauges are OT systems used to monitor physical fuel tanks, but reporting indicates the attackers altered displayed readings rather than changing actual fuel volumes or physically manipulating fuel operations.
Unnamed third-party software services vendor used by The Oncology Institute
November 19, 2024
•[ third-party breach, unauthorized access, healthcare data ]
On May 20, 2026, Kroll, acting as third-party administrator for an unnamed vendor used by The Oncology Institute, notified the company that the vendor had detected unauthorized third-party access to certain vendor information systems, including systems affecting The Oncology Institute patient data. The vendor was not publicly named, though reporting identified TriZetto Provider Solutions as a possible candidate. If the incident is TriZetto-related, unauthorized access began on November 19, 2024 and the broader TriZetto breach affected 3,433,965 individuals; the number of affected The Oncology Institute patients was not publicly reported. The Oncology Institute said its own systems were not subject to unauthorized access.
Los Angeles County Metropolitan Transportation Authority
March 16, 2026
•[ unauthorized access, infrastructure disruption, state-sponsored ]
Los Angeles County Metropolitan Transportation Authority detected unauthorized activity on March 16, 2026 and restricted parts of its internal network while reviewing and restoring systems. Rail and bus service continued, but some customer-facing services, including arrival information displays and TAP card reload functions, were disrupted. Ababil of Minab claimed responsibility, and Gambit Security linked the operation to Iranian state-associated infrastructure.
MediCopy Services, Inc.
January 13, 2026
•[ unauthorized access, data leak, healthcare ]
An unauthorized actor accessed MediCopy Services' cloud-based file-sharing platform on January 13, 2026, and downloaded files related to release-of-information requests for certain Deaconess patients, including patients of Deaconess Henderson Hospital, Deaconess Union County Hospital, and surrounding clinics. Deaconess stated that its own IT systems and electronic medical record system were not impacted.
Florida East Coast Railway
April 30, 2026
•[ data-extortion, data leak, PII ]
PayoutsKing claimed responsibility for a data-extortion attack against Florida East Coast Railway on April 30, 2026 and threatened to leak sensitive data unless negotiations were initiated. DataBreach.com later indexed 16,668 rows associated with the breach, including names, email addresses, and phone numbers. Public sources did not confirm successful encryption or operational disruption.
WholeHealth Chicago
May 15, 2026
•[ data leak, PII, cyberattack ]
Cmdorganization claimed responsibility for a cyberattack against WholeHealth Chicago on May 15, 2026. DataBreach later indexed 36,409 rows allegedly tied to the breach, including dates of birth, email addresses, phone numbers, and names. Public sources did not confirm file encryption, operational disruption, or a precise intrusion vector.
