-
Undisclosed U.S. individual
August 21, 2026
•
[ social, finance, government ]
Scammers initially impersonated an American Express representative and then NYPD and FBI personnel, using transfers, real officer names and badge numbers, and a video call to build credibility. The victim ultimately provided personal identification information.
-
The Revel Collective
August 21, 2026
•
[ ransomware, leak, retail ]
The Revel Collective, a UK operator of bars and social venues, was listed on the Direwolf ransomware group's leak site on Aug 21, 2026, claiming about 700 GB of stolen data. The company has not publicly confirmed an incident or notified customers.
-
tinyBuild, Inc. (Secret Neighbor)
August 22, 2026
An unidentified individual obtained administrator credentials for Secret Neighbor's backend systems on August 22, wiped player profiles, progression, and other in-game data, and carried out a coordinated attack against server systems and infrastructure across all supported platforms. The attacker threatened to continue unless the game was removed from sale. Hologryph and tinyBuild subsequently took the game offline as a containment measure and worked with PlayFab to recover deleted data. No personal information was reported compromised.
-
ReliaQuest, LLC
August 22, 2026
•
[ social, phishing, technology ]
ShinyHunters targeted ReliaQuest on August 22, 2026 using voice phishing, a lookalike single-sign-on page, and impersonation of a named ReliaQuest security employee. One employee entered a password and approved an MFA push, allowing the attacker to establish a temporary authenticated identity session and obtain view-only access to the employees Okta dashboard. Device-trust controls blocked every attempt to open business applications, and ReliaQuest terminated the session, expired the password, and reset authentication factors. ShinyHunters later posted screenshots from the identity dashboard, but no customer data or broader internal systems were accessed.
-
TF1 Infos (Groupe TF1)
August 22, 2026
TF1 Infos reportedly suffered unauthorized server access, theft of user account data and replacement of its news website with a black page displaying a pro-Algerian slogan. LunarisSec claimed responsibility, but attribution and the count of exposed records lack independent confirmation; the earlier intrusion date was not published.
-
Qbusoft
August 22, 2026
Attackers exploited an SQL injection flaw in Polish vendor Qbusoft's Medyc medical-records software on Aug 22-23, 2026, exporting a database archive with patient personal data. Qbusoft confirmed the theft; a group called fingerprint claimed it. Police and UODO are investigating.
-
CyrusOne, LLC
August 23, 2026
•
[ ransomware, technology ]
ShinyHunters claimed it stole 12.9 million Salesforce records and approximately 645 GB of SharePoint data from CyrusOne and demanded $13 million. The stolen material reportedly included customer and employee records, contracts, data center engineering drawings, security documentation and access-control information. DataBreach.com indexed 552,494 records from the released data. No operational disruption has been established.
-
Brookview Financial
August 24, 2026
•
[ leak, ransomware, finance ]
DragonForce listed Brookview Financial on its leak site on August 24, 2026 and claimed theft of customer information including credit reports and Social Security numbers. DataBreach.com indexed 254,414 leaked rows containing customer contact information. Brookview Financial is a private mortgage lender headquartered in Hamden, Connecticut. The company has not publicly confirmed the incident, and no operational disruption has been independently established.
-
Norwegian Digitalisation Agency (Digdir)
August 24, 2026
•
[ ddos, government, technology ]
DDoS waves targeted Digdir's ID-porten from August 24 to August 26, 2026, intermittently disrupting shared digital services. Digdir says services were mostly available during the campaign; the attack window is not continuous downtime. Server Killers claimed responsibility, without public official attribution. No personal-data loss was indicated. Some restrictions on foreign logins persisted after the attack ended.
-
Bdjobs
August 24, 2026
Hacker group 'madarax' advertised CVs of 6 million Bangladeshi jobseekers, attributed to Dhaka recruitment platform Bdjobs, for sale on a dark web forum in Aug 2026 at $1,000 per copy. Bdjobs denied any website breach, calling the reports false.
-
HIT d.d. Nova Gorica
August 25, 2026
•
[ hack, retail, technology ]
HIT detected unauthorized access to its information systems on August 25, 2026. The incident forced six casinos to close for roughly three days and caused limited hotel operations, cash-register problems and unavailable gaming and loyalty functions. Casinos began reopening on August 28 with reduced functionality. HIT had not disclosed whether data was stolen, whether a ransom was demanded, or who was responsible as of the source publication.
-
Boston Scientific Corporation
August 25, 2026
•
[ hack, healthcare, manufacturing ]
Boston Scientific identified unauthorized activity on August 25, 2026 that caused a global network outage affecting certain on-premises and internal-facing systems. Manufacturing, order processing, shipping, and new LATITUDE remote-monitoring activations were disrupted. The company reported no indication of related unauthorized activity after August 25 and fully restored manufacturing, order fulfillment, and shipping on September 9. As of September 15, no credible cybercrime or ransomware group has publicly claimed responsibility and Boston Scientific has not attributed the attack.
-
National Kidney Registry
August 25, 2026
DireWolf listed the National Kidney Registry on its extortion site on August 25 and claimed to have exfiltrated approximately 253 GB across roughly 180,000 files, including potential kidney donor names, medical information, transplant-suitability information, and internal documents. BankInfoSecurity reported the attack and DireWolf told DataBreaches.net that the operation involved data theft without disruption to NKR's IT operations. A corporate credential associated with the National Kidney Registry had also appeared in infostealer telemetry on August 22, although no evidence establishes that credential as DireWolf's access vector. The organization later disappeared from DireWolf's victim list, potentially indicating negotiations, but no reason was confirmed.
-
Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF)
August 26, 2026
•
[ ransomware, government, leak ]
ATF publicly confirmed on August 26, 2026 that an unauthorized actor had compromised a standalone system containing information about targets of ATF investigations. The system was quickly disconnected and was separate from ATF's enterprise network, eForms, laboratory, and case-management systems. Qilin claimed responsibility the same day and later published approximately 6.3 GB of purported data from the CALEA environment. ATF has not publicly authenticated the full leak or confirmed Qilin's attribution, and mission operations were unaffected.
-
Nutex Health Inc.
August 26, 2026
•
[ leak, healthcare, financial ]
Nutex Health disclosed that an unauthorized third party accessed and exfiltrated information from company servers. The company publicly disclosed the incident on August 24 but has not published the intrusion date; under the coding guide the SecurityWeek publication date is used because the compromise date remains undetermined. Nutex later confirmed that patient, employee, credentialed-provider, business, and financial information was involved. The Gentlemen claimed the incident on August 31, and Nutex said on September 10 that data purportedly obtained in the event had been published. Nutex reported no material operational impact.
-
Undisclosed Philippine marine engineering and shipbuilding company
August 26, 2026
•
[ espionage, manufacturing, technology ]
Website data was stolen following administrator compromise, by 13 August 2026. Espionage motive is inferred from the broader targeted collection. Intrusion date is unknown; event_date uses the publication-date fallback.
-
Undisclosed Philippine marine engineering and shipbuilding company
August 26, 2026
•
[ financial, hack, manufacturing ]
Injected code displayed fake verification content using Amatera-linked delivery infrastructure. Financial intent is inferred; visitor infections and linkage to the separate data theft are unconfirmed. Onset is unknown; event_date uses the publication-date fallback.
-
Canva Pty Ltd
August 26, 2026
•
[ hack, ransomware, technology ]
Sydney design platform Canva said attackers using vendor Canny's link to its Salesforce account accessed limited enterprise customer contact and contract data in late Aug 2026. The Seven Deadly Sins claimed the theft, said it exported far more and listed Canva for extortion.
-
Greenberg Traurig
August 26, 2026
•
[ ransomware, leak, finance ]
Silent Ransom Group accessed U.S. law firm Greenberg Traurig's work devices in Aug 2026 and leaked stolen files with about 126,000 SSNs on Sept 2 after ransom talks stalled. The firm confirmed limited document access, notified regulators and reported 150,000 affected in Oregon.
-
City of Circleville
August 27, 2026
•
[ ransomware, government ]
The City of Circleville confirmed ransomware activity affecting portions of its municipal technology environment. Affected systems were isolated and rebuilt from clean environments or recovered through established procedures, and the city did not pay a ransom. Circleville has not disclosed the incident or detection date; an August 14 date circulated in secondary reporting but could not be independently corroborated. Officials reported no evidence establishing that sensitive information was exfiltrated, and no ransomware or extortion group has publicly claimed responsibility.
