-
Undisclosed consumer-goods or luxury organization
August 31, 2026
An Aurora affiliate stole a wildcard TLS certificate private key and other data from an unnamed consumer-goods or luxury organization. This confirmed victim-specific theft was one incident in a larger Aurora ransomware campaign; ransomware encryption at this victim is not established.
-
Undisclosed Claude user
August 31, 2026
•
[ hack, malware, technology ]
A criminal operator used commodity infostealer malware on an affected user's computer to steal an active Claude login session and replay it to access the victim's Claude account and consume paid usage. This record represents a confirmed victim within a broader campaign affecting multiple Claude users; Anthropic's own systems were not breached.
-
Undisclosed organization investigated by Sygnia
August 31, 2026
•
[ espionage, technology, government ]
Fire Ant compromised Cisco IOS XR routers, TACACS authentication systems, and Linux management hosts at an undisclosed organization, using the infrastructure to capture network traffic and administrative credentials, maintain covert access, and suppress security telemetry. The incident was part of a broader China-nexus espionage campaign with strong behavioral and tooling overlap with UNC3886. Fire Ant used the compromised environment to probe connected high-value and critical-infrastructure networks, but Sygnia observed only scanning and connection attempts against those downstream environments rather than confirmed compromise.
-
Super Systems Inc
August 31, 2026
•
[ ransomware, manufacturing, technology ]
Super Systems Inc (SSi), a Cincinnati, Ohio maker of heat-treating controls and software, was listed on the Interlock ransomware group's leak site on Aug 31, 2026, which claimed about 390 GB of stolen data. SSi has not confirmed or denied the claim.
-
Hayward Holdings
August 31, 2026
•
[ ransomware, manufacturing, technology ]
Hayward Holdings, a Charlotte, NC pool and spa equipment maker (NYSE: HAYW), was listed by the Falcon extortion group on Aug 31, 2026, which claimed 848 GB of stolen corporate and customer data. The company has not confirmed the claim; a law firm opened an investigation.
-
Taipei City Police Department
August 31, 2026
•
[ insider, government, financial ]
Taipei prosecutors on Aug 31, 2026 indicted a retired Taipei police detective (Cheng) and a suspended officer (Liu) for pulling hundreds of individuals' call records without authorization since 2018 and selling them to syndicate-linked money lenders for about NT$7.2 million.
-
TSC
September 1, 2026
TSC, a Latvian appliance and device repair firm in the LMT group, found in early Sept. 2026 that a hacker exploited a website flaw and exported its customer repair-order database, then demanded payment. Latvian police arrested a 23-year-old suspect in Riga on Sept. 15.
-
Westfield Public Schools
September 1, 2026
Westfield Public Schools (Union County, NJ) suffered a district-wide network outage from Sept. 1, 2026. INC Ransom claimed it, said it encrypted systems and posted files incl. employee W-2s. The district first cited hardware failure, then said the cause is under investigation.
-
IDScan.net
September 1, 2026
•
[ leak, technology ]
IDScan.net, a New Orleans ID verification firm, confirmed hackers may have copied customer data from its cloud after Nexus, a dark-web service advertised on Russian forum Exploit, sold 153M+ U.S./Canadian license scans in Sept 2026. FBI investigating; credit monitoring offered.
-
Springfield Public Schools
September 1, 2026
•
[ ransomware, education ]
Springfield Public Schools (Massachusetts) detected malicious traffic Sept. 1, 2026; its network crashed and schools closed for about a week. The FBI said student and staff data was made public; Interlock claimed the attack. District offered staff credit monitoring.
-
Luminis Health
September 1, 2026
•
[ hack, healthcare ]
Luminis Health (Annapolis, Maryland) was hit on Sept 1, 2026 by what it called an unauthorized criminal actor, taking systems offline at Anne Arundel Medical Center and Doctors Community Medical Center; phones were down over two weeks, MyChart until Sept 29, with ER diversions.
-
City of Vienna (Stadt Wien)
September 3, 2026
•
[ leak, government ]
From September 3 to 11 2026 an intruder used a web access vulnerability to copy documents from a municipal internal-documentation platform; city systems and accounts were not controlled. Vienna confirmed about 26000 pages or documents totaling 9 GB were acquired, affecting 2083 employees, 2885 residents, and 856 contractors. No publication or extortion was established.
-
Weverse Company Inc. (Weverse)
September 3, 2026
•
[ leak, technology, misconfiguration ]
An unauthorized party obtained information through a security flaw in a Weverse service API. South Korean authorities notified Weverse of the issue on September 3, 2026, and the operator subsequently confirmed exposure of 422,584 account-level entries containing internal account identifiers and purchase-related data. Weverse restricted access to its payment-information processing API and filed a breach report with KISA on September 4. The initial extraction date and actor remain undetermined; September 3 is the discovery proxy.
-
America's Food Basket
September 3, 2026
America's Food Basket, a cooperative of independent grocery stores in New York and other eastern states, was listed on the Wallstreet ransomware group's leak site on September 3, 2026 as a data theft victim. The company had not confirmed the claim as of late September 2026.
-
Florida Department of Highway Safety and Motor Vehicles
September 4, 2026
•
[ hack, leak, government ]
FLHSMV discovered unauthorized access to its DAVID database on September 4, 2026, through compromised credentials belonging to one Plant City police employee. September 4 is a discovery proxy; ShinyHunters' claimed September 3 collection start was not independently confirmed. The group claimed responsibility and later released an archive inspected by Straight Arrow News. The agency did not publicly verify the named operator or its advertised victim count. No encryption or operational disruption was established.
-
Healing Paper
September 4, 2026
•
[ hack, healthcare, technology ]
Healing Paper, the Seoul-based operator of cosmetic-surgery platform Gangnam Unni, said an unidentified attacker abused its consultation-records API on Sept 4, 2026, exposing data of 219,665 users in Korea, Japan and Taiwan. It blocked the route and notified users.
-
Undisclosed South Korean automotive and media organizations
September 4, 2026
Rapid7 reported Sept. 2026 that North Korea-linked hackers breached two South Korean automotive and media organizations via an edge server, planting a backdoor in their HAProxy load balancer and an SSH keylogger for long-term spying on traffic and credentials.
-
Blanco & Etcheverry
September 4, 2026
•
[ ransomware, leak ]
Gunra ransomware added Montevideo law firm Blanco & Etcheverry to its leak site on Sept. 4, 2026, claiming to have leaked 300 GB of data. The firm has not confirmed the attack or commented.
-
DriveWealth
September 4, 2026
•
[ social, finance, technology ]
Jersey City, N.J., brokerage DriveWealth said unknown attackers using social engineering accessed its network on Sept. 4-5, 2026, and took retained personal data of customers of partner apps Revolut, Stake and Hatch. No trades were affected; customers were notified.
-
HBO Max (Warner Bros. Discovery) official Reddit account
September 6, 2026
•
[ hack, malware, social ]
An unauthorized operator took over verified Reddit account u/hbomax and ran 108 deceptive paid advertisements over about 48 hours. Links impersonated HBO Max and software products and directed users to ClickFix command-pasting instructions that delivered malware. The malicious advertisements were paused after they were reported.
