-
Boston Scientific Corporation
August 25, 2026
•
[ hack, healthcare, manufacturing ]
Boston Scientific identified unauthorized activity on August 25, 2026 that caused a global network outage affecting certain on-premises and internal-facing systems. Manufacturing, order processing, shipping, and new LATITUDE remote-monitoring activations were disrupted. The company reported no indication of related unauthorized activity after August 25 and fully restored manufacturing, order fulfillment, and shipping on September 9. As of September 15, no credible cybercrime or ransomware group has publicly claimed responsibility and Boston Scientific has not attributed the attack.
-
National Kidney Registry
August 25, 2026
DireWolf listed the National Kidney Registry on its extortion site on August 25 and claimed to have exfiltrated approximately 253 GB across roughly 180,000 files, including potential kidney donor names, medical information, transplant-suitability information, and internal documents. BankInfoSecurity reported the attack and DireWolf told DataBreaches.net that the operation involved data theft without disruption to NKR's IT operations. A corporate credential associated with the National Kidney Registry had also appeared in infostealer telemetry on August 22, although no evidence establishes that credential as DireWolf's access vector. The organization later disappeared from DireWolf's victim list, potentially indicating negotiations, but no reason was confirmed.
-
Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF)
August 26, 2026
•
[ ransomware, government, leak ]
ATF publicly confirmed on August 26, 2026 that an unauthorized actor had compromised a standalone system containing information about targets of ATF investigations. The system was quickly disconnected and was separate from ATF's enterprise network, eForms, laboratory, and case-management systems. Qilin claimed responsibility the same day and later published approximately 6.3 GB of purported data from the CALEA environment. ATF has not publicly authenticated the full leak or confirmed Qilin's attribution, and mission operations were unaffected.
-
Nutex Health Inc.
August 26, 2026
•
[ leak, healthcare, financial ]
Nutex Health disclosed that an unauthorized third party accessed and exfiltrated information from company servers. The company publicly disclosed the incident on August 24 but has not published the intrusion date; under the coding guide the SecurityWeek publication date is used because the compromise date remains undetermined. Nutex later confirmed that patient, employee, credentialed-provider, business, and financial information was involved. The Gentlemen claimed the incident on August 31, and Nutex said on September 10 that data purportedly obtained in the event had been published. Nutex reported no material operational impact.
-
Undisclosed Philippine marine engineering and shipbuilding company
August 26, 2026
•
[ espionage, manufacturing, technology ]
Website data was stolen following administrator compromise, by 13 August 2026. Espionage motive is inferred from the broader targeted collection. Intrusion date is unknown; event_date uses the publication-date fallback.
-
Undisclosed Philippine marine engineering and shipbuilding company
August 26, 2026
•
[ financial, hack, manufacturing ]
Injected code displayed fake verification content using Amatera-linked delivery infrastructure. Financial intent is inferred; visitor infections and linkage to the separate data theft are unconfirmed. Onset is unknown; event_date uses the publication-date fallback.
-
Canva Pty Ltd
August 26, 2026
•
[ hack, ransomware, technology ]
Sydney design platform Canva said attackers using vendor Canny's link to its Salesforce account accessed limited enterprise customer contact and contract data in late Aug 2026. The Seven Deadly Sins claimed the theft, said it exported far more and listed Canva for extortion.
-
Greenberg Traurig
August 26, 2026
•
[ ransomware, leak, finance ]
Silent Ransom Group accessed U.S. law firm Greenberg Traurig's work devices in Aug 2026 and leaked stolen files with about 126,000 SSNs on Sept 2 after ransom talks stalled. The firm confirmed limited document access, notified regulators and reported 150,000 affected in Oregon.
-
City of Circleville
August 27, 2026
•
[ ransomware, government ]
The City of Circleville confirmed ransomware activity affecting portions of its municipal technology environment. Affected systems were isolated and rebuilt from clean environments or recovered through established procedures, and the city did not pay a ransom. Circleville has not disclosed the incident or detection date; an August 14 date circulated in secondary reporting but could not be independently corroborated. Officials reported no evidence establishing that sensitive information was exfiltrated, and no ransomware or extortion group has publicly claimed responsibility.
-
Undisclosed Czech healthcare organization
August 27, 2026
•
[ leak, healthcare, financial ]
ComSource detected a data leak from an unnamed Czech healthcare organization on 27 August 2026. DataBastard offered the stolen database for sale for $1,400. The exact initial-access and exfiltration dates were not reported, so event_date uses the first documented detection of the leak.
-
Hungry Lion
August 27, 2026
•
[ ransomware, retail, financial ]
MedusaLocker listed South African fast-food chain Hungry Lion on its leak site on 27 Aug 2026, claiming POS data covering 111 locations in seven countries and threatening a full leak. The claim is unverified; the company did not comment.
-
Freelom.net s.r.o.
August 28, 2026
•
[ hack, leak, sqlinjection ]
ComSource reported that Space Bears attacked a Czech internet-service provider, first announcing the victim on 22 August 2026 and releasing data six days later. Outside leak-site tracking identifies the victim as Freelom.net s.r.o. and says Space Bears claimed SQL data containing client personal information. Freelom has not publicly confirmed the compromise; event_date reflects the reported data leak rather than the unknown initial-access date.
-
Mercury Technologies
August 28, 2026
•
[ leak, finance, technology ]
San Francisco fintech Mercury's client email list, stored by feedback-software vendor Canny, was exported and sold, according to The Seven Deadly Sins, which claimed to have breached Canny in late Aug 2026. Mercury has not commented and the claim is unconfirmed.
-
ProxyScrape
August 28, 2026
Belgian proxy-service provider ProxyScrape's client email list, stored by feedback-software vendor Canny, was exported and sold, according to The Seven Deadly Sins, which claimed to have breached Canny in late Aug 2026. ProxyScrape has not commented and the claim is unconfirmed.
-
McDermott Will & Schulte
August 28, 2026
U.S. law firm McDermott Will & Schulte reported to the Vermont attorney general in late Aug 2026 that a social-engineering attack on a single user exposed a limited number of documents containing Social Security numbers and health data. It says the matter is resolved.
-
Canny
August 28, 2026
Feedback-software firm Canny confirmed unauthorized access to its systems in late August 2026 and notified clients; it exposed Canva enterprise customer data. TSDS claimed it spent two weeks inside, exported Canny's Salesforce and client integrations, and demanded ransom.
-
Nigerian Army (Headquarters)
August 29, 2026
•
[ social, government, technology ]
On August 29, 2026, unauthorized memecoin-promotional posts appeared on the Nigerian Army official X account (@NigeriaArmyInfo), reportedly beginning around 3:50 p.m. The Army acknowledged attempted unauthorized account access around 5 p.m., activated security measures to regain exclusive control and told users to disregard unverified posts. The account-access mechanism and the operator were not identified, and no theft of information or intrusion into other Army systems was established. This was a separate social-media account and incident from the August 15 Defence Headquarters hijacking.
-
Neogen Corporation
August 29, 2026
•
[ ransomware, technology, manufacturing ]
Neogen Corporation, a Lansing, Michigan maker of food and animal safety products, was listed on ShinyHunters' leak site on August 29, 2026 with a warning to make contact by September 1 before its data is leaked. Neogen had not commented and the claim remains unverified.
-
DistributionNOW (DNOW Inc.)
August 29, 2026
•
[ ransomware, technology ]
Houston-based industrial distributor DNOW Inc. was listed in late August 2026 by the Falcon extortion group, which claimed about 344 GB of corporate, payroll, employee and industrial-control files. DNOW has not publicly confirmed the claim.
-
Avelogic
August 30, 2026
•
[ ransomware, technology, government ]
Ransomware hit Singapore vendor Avelogic's SmartHRMS HR and payroll system on 30-31 Aug 2026, used by MUIS-overseen mosques and madrasahs, forcing manual payroll. Avelogic found no evidence of bulk data theft, paid no ransom, filed a police report and notified the PDPC.
