-
ProxyScrape
August 28, 2026
Belgian proxy-service provider ProxyScrape's client email list, stored by feedback-software vendor Canny, was exported and sold, according to The Seven Deadly Sins, which claimed to have breached Canny in late Aug 2026. ProxyScrape has not commented and the claim is unconfirmed.
-
McDermott Will & Schulte
August 28, 2026
U.S. law firm McDermott Will & Schulte reported to the Vermont attorney general in late Aug 2026 that a social-engineering attack on a single user exposed a limited number of documents containing Social Security numbers and health data. It says the matter is resolved.
-
Canny
August 28, 2026
Feedback-software firm Canny confirmed unauthorized access to its systems in late August 2026 and notified clients; it exposed Canva enterprise customer data. TSDS claimed it spent two weeks inside, exported Canny's Salesforce and client integrations, and demanded ransom.
-
Nigerian Army (Headquarters)
August 29, 2026
•
[ social, government, technology ]
On August 29, 2026, unauthorized memecoin-promotional posts appeared on the Nigerian Army official X account (@NigeriaArmyInfo), reportedly beginning around 3:50 p.m. The Army acknowledged attempted unauthorized account access around 5 p.m., activated security measures to regain exclusive control and told users to disregard unverified posts. The account-access mechanism and the operator were not identified, and no theft of information or intrusion into other Army systems was established. This was a separate social-media account and incident from the August 15 Defence Headquarters hijacking.
-
Neogen Corporation
August 29, 2026
•
[ ransomware, technology, manufacturing ]
Neogen Corporation, a Lansing, Michigan maker of food and animal safety products, was listed on ShinyHunters' leak site on August 29, 2026 with a warning to make contact by September 1 before its data is leaked. Neogen had not commented and the claim remains unverified.
-
DistributionNOW (DNOW Inc.)
August 29, 2026
•
[ ransomware, technology ]
Houston-based industrial distributor DNOW Inc. was listed in late August 2026 by the Falcon extortion group, which claimed about 344 GB of corporate, payroll, employee and industrial-control files. DNOW has not publicly confirmed the claim.
-
Avelogic
August 30, 2026
•
[ ransomware, technology, government ]
Ransomware hit Singapore vendor Avelogic's SmartHRMS HR and payroll system on 30-31 Aug 2026, used by MUIS-overseen mosques and madrasahs, forcing manual payroll. Avelogic found no evidence of bulk data theft, paid no ransom, filed a police report and notified the PDPC.
-
Undisclosed consumer-goods or luxury organization
August 31, 2026
An Aurora affiliate stole a wildcard TLS certificate private key and other data from an unnamed consumer-goods or luxury organization. This confirmed victim-specific theft was one incident in a larger Aurora ransomware campaign; ransomware encryption at this victim is not established.
-
Undisclosed Claude user
August 31, 2026
•
[ hack, malware, technology ]
A criminal operator used commodity infostealer malware on an affected user's computer to steal an active Claude login session and replay it to access the victim's Claude account and consume paid usage. This record represents a confirmed victim within a broader campaign affecting multiple Claude users; Anthropic's own systems were not breached.
-
Undisclosed organization investigated by Sygnia
August 31, 2026
•
[ espionage, technology, government ]
Fire Ant compromised Cisco IOS XR routers, TACACS authentication systems, and Linux management hosts at an undisclosed organization, using the infrastructure to capture network traffic and administrative credentials, maintain covert access, and suppress security telemetry. The incident was part of a broader China-nexus espionage campaign with strong behavioral and tooling overlap with UNC3886. Fire Ant used the compromised environment to probe connected high-value and critical-infrastructure networks, but Sygnia observed only scanning and connection attempts against those downstream environments rather than confirmed compromise.
-
Super Systems Inc
August 31, 2026
•
[ ransomware, manufacturing, technology ]
Super Systems Inc (SSi), a Cincinnati, Ohio maker of heat-treating controls and software, was listed on the Interlock ransomware group's leak site on Aug 31, 2026, which claimed about 390 GB of stolen data. SSi has not confirmed or denied the claim.
-
Hayward Holdings
August 31, 2026
•
[ ransomware, manufacturing, technology ]
Hayward Holdings, a Charlotte, NC pool and spa equipment maker (NYSE: HAYW), was listed by the Falcon extortion group on Aug 31, 2026, which claimed 848 GB of stolen corporate and customer data. The company has not confirmed the claim; a law firm opened an investigation.
-
Taipei City Police Department
August 31, 2026
•
[ insider, government, financial ]
Taipei prosecutors on Aug 31, 2026 indicted a retired Taipei police detective (Cheng) and a suspended officer (Liu) for pulling hundreds of individuals' call records without authorization since 2018 and selling them to syndicate-linked money lenders for about NT$7.2 million.
-
TSC
September 1, 2026
TSC, a Latvian appliance and device repair firm in the LMT group, found in early Sept. 2026 that a hacker exploited a website flaw and exported its customer repair-order database, then demanded payment. Latvian police arrested a 23-year-old suspect in Riga on Sept. 15.
-
Westfield Public Schools
September 1, 2026
Westfield Public Schools (Union County, NJ) suffered a district-wide network outage from Sept. 1, 2026. INC Ransom claimed it, said it encrypted systems and posted files incl. employee W-2s. The district first cited hardware failure, then said the cause is under investigation.
-
IDScan.net
September 1, 2026
•
[ leak, technology ]
IDScan.net, a New Orleans ID verification firm, confirmed hackers may have copied customer data from its cloud after Nexus, a dark-web service advertised on Russian forum Exploit, sold 153M+ U.S./Canadian license scans in Sept 2026. FBI investigating; credit monitoring offered.
-
Springfield Public Schools
September 1, 2026
•
[ ransomware, education ]
Springfield Public Schools (Massachusetts) detected malicious traffic Sept. 1, 2026; its network crashed and schools closed for about a week. The FBI said student and staff data was made public; Interlock claimed the attack. District offered staff credit monitoring.
-
Luminis Health
September 1, 2026
•
[ hack, healthcare ]
Luminis Health (Annapolis, Maryland) was hit on Sept 1, 2026 by what it called an unauthorized criminal actor, taking systems offline at Anne Arundel Medical Center and Doctors Community Medical Center; phones were down over two weeks, MyChart until Sept 29, with ER diversions.
-
City of Vienna (Stadt Wien)
September 3, 2026
•
[ leak, government ]
From September 3 to 11 2026 an intruder used a web access vulnerability to copy documents from a municipal internal-documentation platform; city systems and accounts were not controlled. Vienna confirmed about 26000 pages or documents totaling 9 GB were acquired, affecting 2083 employees, 2885 residents, and 856 contractors. No publication or extortion was established.
-
Weverse Company Inc. (Weverse)
September 3, 2026
•
[ leak, technology, misconfiguration ]
An unauthorized party obtained information through a security flaw in a Weverse service API. South Korean authorities notified Weverse of the issue on September 3, 2026, and the operator subsequently confirmed exposure of 422,584 account-level entries containing internal account identifiers and purchase-related data. Weverse restricted access to its payment-information processing API and filed a breach report with KISA on September 4. The initial extraction date and actor remain undetermined; September 3 is the discovery proxy.
