-
Delek US Holdings, Inc.
August 19, 2026
•
[ ransomware, leak, energy ]
Helix listed Delek US on its extortion site on August 19, 2026 and claimed possession of customer and employee information. DataBreach.com subsequently indexed 122,079 leaked records containing personal and contact information. Delek US has not publicly confirmed the incident, and no operational disruption has been independently established.
-
Cambrian High School & College
August 19, 2026
•
[ phishing, malware, education ]
Check Point Research confirmed by August 19 that the legitimate website of Cambrian High School & College in Bangladesh had been compromised and was hosting a malicious page at cambrianschoolbd.com/mail/. The page had displayed a fake Spotify-branded security-verification CAPTCHA and was flagged by multiple threat-intelligence sources as an information-stealer and malware-distribution site. The precise intrusion date, responsible actor, and duration of the compromise are unknown. The activity occurred in the context of broader financially motivated cybercriminal phishing and malware campaigns targeting the education sector, but no downstream visitor infection or credential theft was publicly confirmed.
-
Maximum Rock Magazin
August 19, 2026
Check Point Research identified maximumrock.ro, operated by Maximum Rock Magazin, as a compromised WordPress domain used by the StopAndProtect operation. The attackers installed malicious WordPress components that could overlay legitimate site content with a fake CAPTCHA and use compromised websites to host malware, deliver payloads, communicate with infected devices, and store campaign data.
-
Samagra Portal (Samagra Samajik Suraksha Mission, Government of Madhya Pradesh)
August 19, 2026
•
[ hack, government, insider ]
Cyber police opened an investigation after officials discovered that a person's Samagra record had been updated even though authorized district-level officers had not made the change. Officials tightened portal security and referred the matter for investigation.
-
PayUp
August 19, 2026
•
[ ransomware, finance, technology ]
PayUp, an Austin, Texas fintech offering early vendor payments and invoice factoring to property managers, was listed on the Direwolf ransomware group's leak site on Aug 19, 2026, claiming stolen customer records. PayUp has not confirmed the claim.
-
At least one undisclosed Stripe customer
August 20, 2026
HackRead identified 669 merchant folders, 1,033 exposed Stripe API keys, and 688,363 customer records in 33GB of data released by Satanic. The available evidence indicates Stripe itself was not breached and that the exposed credentials belonged to individual merchants. This row captures at least one undisclosed affected merchant.
-
Undisclosed crates.io maintainer
August 20, 2026
•
[ hack, leak, malware ]
On Aug 20, 2026, attackers hijacked a crates.io maintainer's account and published tampered versions of Rust crates arrayref, internment and append-only-vec carrying a credential- and wallet-stealing payload. Wiz linked it to North Korean actors; versions were removed.
-
McKesson Corporation
August 21, 2026
•
[ phishing, healthcare, leak ]
McKesson discovered the intrusion on August 25, 2026. ShinyHunters claimed it used voice phishing against employees to compromise Okta single-sign-on accounts and access Salesforce and Snowflake environments, with approximately 1 TB exfiltrated between August 21 and August 25. McKesson confirmed customer-data exfiltration from third-party applications but has not confirmed the claimed access method, volume, record count, or data categories. Company services remained operational.
-
Interim HealthCare, Inc.
August 21, 2026
•
[ ransomware, healthcare, financial ]
Anubis listed Interim HealthCare, Inc., the Sunrise, Florida-based corporate franchisor, on its extortion site in August 2026 and claimed theft of approximately 530 GB of corporate and franchise-related data. The group described the material as including franchisee financial information, internal and external audit records, operational discussions, and day-to-day business memoranda. Samples and stolen material were subsequently published, supporting that data acquisition occurred, although Interim HealthCare has not publicly confirmed the intrusion, its exact date, or the claimed 530 GB total. This appears separate from Genesis's claim involving Oklahoma and Tulsa franchise operations.
-
Undisclosed U.S. individual
August 21, 2026
•
[ social, finance, government ]
Scammers initially impersonated an American Express representative and then NYPD and FBI personnel, using transfers, real officer names and badge numbers, and a video call to build credibility. The victim ultimately provided personal identification information.
-
The Revel Collective
August 21, 2026
•
[ ransomware, leak, retail ]
The Revel Collective, a UK operator of bars and social venues, was listed on the Direwolf ransomware group's leak site on Aug 21, 2026, claiming about 700 GB of stolen data. The company has not publicly confirmed an incident or notified customers.
-
tinyBuild, Inc. (Secret Neighbor)
August 22, 2026
An unidentified individual obtained administrator credentials for Secret Neighbor's backend systems on August 22, wiped player profiles, progression, and other in-game data, and carried out a coordinated attack against server systems and infrastructure across all supported platforms. The attacker threatened to continue unless the game was removed from sale. Hologryph and tinyBuild subsequently took the game offline as a containment measure and worked with PlayFab to recover deleted data. No personal information was reported compromised.
-
ReliaQuest, LLC
August 22, 2026
•
[ social, phishing, technology ]
ShinyHunters targeted ReliaQuest on August 22, 2026 using voice phishing, a lookalike single-sign-on page, and impersonation of a named ReliaQuest security employee. One employee entered a password and approved an MFA push, allowing the attacker to establish a temporary authenticated identity session and obtain view-only access to the employees Okta dashboard. Device-trust controls blocked every attempt to open business applications, and ReliaQuest terminated the session, expired the password, and reset authentication factors. ShinyHunters later posted screenshots from the identity dashboard, but no customer data or broader internal systems were accessed.
-
TF1 Infos (Groupe TF1)
August 22, 2026
TF1 Infos reportedly suffered unauthorized server access, theft of user account data and replacement of its news website with a black page displaying a pro-Algerian slogan. LunarisSec claimed responsibility, but attribution and the count of exposed records lack independent confirmation; the earlier intrusion date was not published.
-
Qbusoft
August 22, 2026
Attackers exploited an SQL injection flaw in Polish vendor Qbusoft's Medyc medical-records software on Aug 22-23, 2026, exporting a database archive with patient personal data. Qbusoft confirmed the theft; a group called fingerprint claimed it. Police and UODO are investigating.
-
CyrusOne, LLC
August 23, 2026
•
[ ransomware, technology ]
ShinyHunters claimed it stole 12.9 million Salesforce records and approximately 645 GB of SharePoint data from CyrusOne and demanded $13 million. The stolen material reportedly included customer and employee records, contracts, data center engineering drawings, security documentation and access-control information. DataBreach.com indexed 552,494 records from the released data. No operational disruption has been established.
-
Brookview Financial
August 24, 2026
•
[ leak, ransomware, finance ]
DragonForce listed Brookview Financial on its leak site on August 24, 2026 and claimed theft of customer information including credit reports and Social Security numbers. DataBreach.com indexed 254,414 leaked rows containing customer contact information. Brookview Financial is a private mortgage lender headquartered in Hamden, Connecticut. The company has not publicly confirmed the incident, and no operational disruption has been independently established.
-
Norwegian Digitalisation Agency (Digdir)
August 24, 2026
•
[ ddos, government, technology ]
DDoS waves targeted Digdir's ID-porten from August 24 to August 26, 2026, intermittently disrupting shared digital services. Digdir says services were mostly available during the campaign; the attack window is not continuous downtime. Server Killers claimed responsibility, without public official attribution. No personal-data loss was indicated. Some restrictions on foreign logins persisted after the attack ended.
-
Bdjobs
August 24, 2026
Hacker group 'madarax' advertised CVs of 6 million Bangladeshi jobseekers, attributed to Dhaka recruitment platform Bdjobs, for sale on a dark web forum in Aug 2026 at $1,000 per copy. Bdjobs denied any website breach, calling the reports false.
-
HIT d.d. Nova Gorica
August 25, 2026
•
[ hack, retail, technology ]
HIT detected unauthorized access to its information systems on August 25, 2026. The incident forced six casinos to close for roughly three days and caused limited hotel operations, cash-register problems and unavailable gaming and loyalty functions. Casinos began reopening on August 28 with reduced functionality. HIT had not disclosed whether data was stolen, whether a ransom was demanded, or who was responsible as of the source publication.
