-
Undisclosed Philippine marine engineering and shipbuilding company
August 26, 2026
•
[ financial, hack, manufacturing ]
Injected code displayed fake verification content using Amatera-linked delivery infrastructure. Financial intent is inferred; visitor infections and linkage to the separate data theft are unconfirmed. Onset is unknown; event_date uses the publication-date fallback.
-
Canva Pty Ltd
August 26, 2026
•
[ hack, ransomware, technology ]
Sydney design platform Canva said attackers using vendor Canny's link to its Salesforce account accessed limited enterprise customer contact and contract data in late Aug 2026. The Seven Deadly Sins claimed the theft, said it exported far more and listed Canva for extortion.
-
Greenberg Traurig
August 26, 2026
•
[ ransomware, leak, finance ]
Silent Ransom Group accessed U.S. law firm Greenberg Traurig's work devices in Aug 2026 and leaked stolen files with about 126,000 SSNs on Sept 2 after ransom talks stalled. The firm confirmed limited document access, notified regulators and reported 150,000 affected in Oregon.
-
City of Circleville
August 27, 2026
•
[ ransomware, government ]
The City of Circleville confirmed ransomware activity affecting portions of its municipal technology environment. Affected systems were isolated and rebuilt from clean environments or recovered through established procedures, and the city did not pay a ransom. Circleville has not disclosed the incident or detection date; an August 14 date circulated in secondary reporting but could not be independently corroborated. Officials reported no evidence establishing that sensitive information was exfiltrated, and no ransomware or extortion group has publicly claimed responsibility.
-
Undisclosed Czech healthcare organization
August 27, 2026
•
[ leak, healthcare, financial ]
ComSource detected a data leak from an unnamed Czech healthcare organization on 27 August 2026. DataBastard offered the stolen database for sale for $1,400. The exact initial-access and exfiltration dates were not reported, so event_date uses the first documented detection of the leak.
-
Hungry Lion
August 27, 2026
•
[ ransomware, retail, financial ]
MedusaLocker listed South African fast-food chain Hungry Lion on its leak site on 27 Aug 2026, claiming POS data covering 111 locations in seven countries and threatening a full leak. The claim is unverified; the company did not comment.
-
Freelom.net s.r.o.
August 28, 2026
•
[ hack, leak, sqlinjection ]
ComSource reported that Space Bears attacked a Czech internet-service provider, first announcing the victim on 22 August 2026 and releasing data six days later. Outside leak-site tracking identifies the victim as Freelom.net s.r.o. and says Space Bears claimed SQL data containing client personal information. Freelom has not publicly confirmed the compromise; event_date reflects the reported data leak rather than the unknown initial-access date.
-
Mercury Technologies
August 28, 2026
•
[ leak, finance, technology ]
San Francisco fintech Mercury's client email list, stored by feedback-software vendor Canny, was exported and sold, according to The Seven Deadly Sins, which claimed to have breached Canny in late Aug 2026. Mercury has not commented and the claim is unconfirmed.
-
ProxyScrape
August 28, 2026
Belgian proxy-service provider ProxyScrape's client email list, stored by feedback-software vendor Canny, was exported and sold, according to The Seven Deadly Sins, which claimed to have breached Canny in late Aug 2026. ProxyScrape has not commented and the claim is unconfirmed.
-
McDermott Will & Schulte
August 28, 2026
U.S. law firm McDermott Will & Schulte reported to the Vermont attorney general in late Aug 2026 that a social-engineering attack on a single user exposed a limited number of documents containing Social Security numbers and health data. It says the matter is resolved.
-
Canny
August 28, 2026
Feedback-software firm Canny confirmed unauthorized access to its systems in late August 2026 and notified clients; it exposed Canva enterprise customer data. TSDS claimed it spent two weeks inside, exported Canny's Salesforce and client integrations, and demanded ransom.
-
Nigerian Army (Headquarters)
August 29, 2026
•
[ social, government, technology ]
On August 29, 2026, unauthorized memecoin-promotional posts appeared on the Nigerian Army official X account (@NigeriaArmyInfo), reportedly beginning around 3:50 p.m. The Army acknowledged attempted unauthorized account access around 5 p.m., activated security measures to regain exclusive control and told users to disregard unverified posts. The account-access mechanism and the operator were not identified, and no theft of information or intrusion into other Army systems was established. This was a separate social-media account and incident from the August 15 Defence Headquarters hijacking.
-
Neogen Corporation
August 29, 2026
•
[ ransomware, technology, manufacturing ]
Neogen Corporation, a Lansing, Michigan maker of food and animal safety products, was listed on ShinyHunters' leak site on August 29, 2026 with a warning to make contact by September 1 before its data is leaked. Neogen had not commented and the claim remains unverified.
-
DistributionNOW (DNOW Inc.)
August 29, 2026
•
[ ransomware, technology ]
Houston-based industrial distributor DNOW Inc. was listed in late August 2026 by the Falcon extortion group, which claimed about 344 GB of corporate, payroll, employee and industrial-control files. DNOW has not publicly confirmed the claim.
-
Avelogic
August 30, 2026
•
[ ransomware, technology, government ]
Ransomware hit Singapore vendor Avelogic's SmartHRMS HR and payroll system on 30-31 Aug 2026, used by MUIS-overseen mosques and madrasahs, forcing manual payroll. Avelogic found no evidence of bulk data theft, paid no ransom, filed a police report and notified the PDPC.
-
Undisclosed consumer-goods or luxury organization
August 31, 2026
An Aurora affiliate stole a wildcard TLS certificate private key and other data from an unnamed consumer-goods or luxury organization. This confirmed victim-specific theft was one incident in a larger Aurora ransomware campaign; ransomware encryption at this victim is not established.
-
Undisclosed Claude user
August 31, 2026
•
[ hack, malware, technology ]
A criminal operator used commodity infostealer malware on an affected user's computer to steal an active Claude login session and replay it to access the victim's Claude account and consume paid usage. This record represents a confirmed victim within a broader campaign affecting multiple Claude users; Anthropic's own systems were not breached.
-
Undisclosed organization investigated by Sygnia
August 31, 2026
•
[ espionage, technology, government ]
Fire Ant compromised Cisco IOS XR routers, TACACS authentication systems, and Linux management hosts at an undisclosed organization, using the infrastructure to capture network traffic and administrative credentials, maintain covert access, and suppress security telemetry. The incident was part of a broader China-nexus espionage campaign with strong behavioral and tooling overlap with UNC3886. Fire Ant used the compromised environment to probe connected high-value and critical-infrastructure networks, but Sygnia observed only scanning and connection attempts against those downstream environments rather than confirmed compromise.
-
Super Systems Inc
August 31, 2026
•
[ ransomware, manufacturing, technology ]
Super Systems Inc (SSi), a Cincinnati, Ohio maker of heat-treating controls and software, was listed on the Interlock ransomware group's leak site on Aug 31, 2026, which claimed about 390 GB of stolen data. SSi has not confirmed or denied the claim.
-
Hayward Holdings
August 31, 2026
•
[ ransomware, manufacturing, technology ]
Hayward Holdings, a Charlotte, NC pool and spa equipment maker (NYSE: HAYW), was listed by the Falcon extortion group on Aug 31, 2026, which claimed 848 GB of stolen corporate and customer data. The company has not confirmed the claim; a law firm opened an investigation.
