-
Dodo Payments
August 15, 2026
•
[ sqlinjection, leak, finance ]
Bengaluru payments firm Dodo Payments said an intruder exploited a Metabase SQL-injection flaw to query its internal analytics system in mid-Aug 2026. Direwolf claimed the attack; a dark web listing claims 60.8 GB. The firm denies credentials, API keys or card data were exposed.
-
Bluesky
August 16, 2026
•
[ hack, ddos, technology ]
On August 16, 2026, Bluesky users encountered service disruptions affecting website and app access, including login and feed loading, during a DDoS campaign lasting approximately 24 hours. Bluesky confirmed the attack on August 17 and implemented additional defenses. The pro-Iran hacktivist group Islamic Cyber Resistance in Iraq (313 Team) claimed responsibility but Bluesky did not independently attribute the incident. The event is distinct from a separate April 2026 DDoS campaign against Bluesky.
-
SafePal (SkyGenesis Holdings Limited)
August 17, 2026
•
[ leak, phishing, technology ]
SafePal confirmed that an authorization flaw in an order-tracking plugin allowed unauthorized external access to customer order information affecting 39,798 customers. The precise access date has not been established. Customers reported phishing and impersonation attempts using detailed SafePal order information by early July, and SafePal later identified more than 30 fraudulent websites or phishing links associated with scam activity. A threat actor subsequently advertised a dataset matching the affected population for sale. Seed phrases, private keys, wallet passwords, payment information and government identification were not affected.
-
At least one organization targeted in TheHatman Azure/Entra campaign
August 17, 2026
TheHatman posted enterprise employee datasets for sale on cybercrime forums between August 1 and August 17, 2026 and claimed they had been exfiltrated from Microsoft Entra tenants using compromised credentials obtained through MFA fatigue and password spraying. Unit 42 has not independently verified the intrusion vector or dates of the individual compromises. Hudson Rock found the data consistent with legitimate Azure directory exports and identified compromised Microsoft credentials associated with several named organizations, although some companies disputed that the material reflected a recent breach.
-
Bits of Gold
August 17, 2026
•
[ hack, finance, technology ]
Hackers gained unauthorized access to a third-party data analytics system used by Bits of Gold and accessed personal information belonging to approximately 200,000 customers. The company said funds, digital assets, passwords, private keys, CVV codes, and scanned identification documents were not affected.
-
Eva AI Limited
August 17, 2026
Eva AI Limited, a UK provider of AI recruitment and workforce-planning software (eva.ai), was listed on the Direwolf ransomware group's leak site on Aug 17, 2026, which claimed about 69 GB of stolen data. The company has not publicly confirmed the incident.
-
Arizona State University
August 17, 2026
•
[ ransomware, leak, education ]
Arizona State University, a public research university in Tempe, was listed on the Direwolf ransomware group's leak site on Aug 17, 2026, claiming stolen university files; about 1.08 million records were later indexed. ASU has not publicly confirmed the breach.
-
Alation, Inc.
August 18, 2026
•
[ hack, technology, misconfiguration ]
Alation confirmed unauthorized activity in one of its systems on August 18. TeamPCP publicly claimed responsibility and alleged theft of 73 GB of data. Independent security telemetry linked Alation to the broader TeamPCP LiteLLM/Trivy supply-chain campaign and identified exposed Alation CI-runner material containing AWS credentials and internal repository references. The exact 73 GB quantity remains a threat-actor claim, and Alation has not confirmed customer-data theft. The separate availability degradation reported the same day is not coded as a disruptive effect because Alation has not established that it was caused by the intrusion.
-
Toast, Inc.
August 18, 2026
Toast identified unauthorized access to a limited number of files associated with the Cl0p campaign targeting PTC Windchill and FlexPLM environments. Toast stated that the files identified to date contained nonsensitive internal documents, that affected systems were isolated the same day the activity was detected, and that the incident was contained. No customer data was identified as affected.
-
Koninklijke Philips N.V.
August 18, 2026
•
[ ransomware, technology, healthcare ]
Philips identified and contained unauthorized activity affecting a specific enterprise server used to store internal data and isolated the affected server. Philips reported no impact to customer environments. In a September 14 update, Philips said incident-response activities were complete and investigation findings supported closure of the incident, while additional analysis of a subset of downloaded data remained ongoing. Cl0p claimed approximately 13.5 GB of drawings, diagrams, and blueprints.
-
City of Fort Scott
August 18, 2026
•
[ ransomware, government, technology ]
A ransomware attack detected on 18 Aug 2026 closed Fort Scott, Kansas, City Hall and forced the city network offline; IT staff restored systems within six days, with about a week of data lost on two machines. The attackers were not identified.
-
Seyfarth Shaw LLP
August 18, 2026
•
[ social, phishing, leak ]
Chicago law firm Seyfarth Shaw said an attacker posing as its IT help desk tricked an employee on Aug. 18, 2026, into emailing client documents with names and SSNs to an outside account. It says its network was not entered; it notified state AGs and offered credit monitoring.
-
Undisclosed Mexican company
August 18, 2026
An unnamed Mexican company, in a case investigated by Kaspersky, had attackers inside its network for over a month who stole confidential, personal and strategic data, then printed ransom notes on its office printers demanding about US$5,000. Reported Aug 18, 2026.
-
Undisclosed organization
August 18, 2026
An undisclosed organization had data exfiltrated to AWS cloud storage with s5cmd by a ransomware affiliate that also planted a backdoor account and Remotely RAT. GuidePoint, reporting in Aug 2026, tied the intruder with medium confidence to the 'Ransom Busters' extortion persona.
-
Mutuelle générale de prévoyance
August 18, 2026
•
[ financial, leak, healthcare ]
French mutual insurer Mutuelle gnrale de prvoyance (MGP) confirmed an intrusion via a third-party provider in August 2026; a hacker claim cited about 200,000 people and 133,000 IBANs. MGP could not confirm the scope, began notifying members Aug 17 and filed a complaint.
-
Delek US Holdings, Inc.
August 19, 2026
•
[ ransomware, leak, energy ]
Helix listed Delek US on its extortion site on August 19, 2026 and claimed possession of customer and employee information. DataBreach.com subsequently indexed 122,079 leaked records containing personal and contact information. Delek US has not publicly confirmed the incident, and no operational disruption has been independently established.
-
Cambrian High School & College
August 19, 2026
•
[ phishing, malware, education ]
Check Point Research confirmed by August 19 that the legitimate website of Cambrian High School & College in Bangladesh had been compromised and was hosting a malicious page at cambrianschoolbd.com/mail/. The page had displayed a fake Spotify-branded security-verification CAPTCHA and was flagged by multiple threat-intelligence sources as an information-stealer and malware-distribution site. The precise intrusion date, responsible actor, and duration of the compromise are unknown. The activity occurred in the context of broader financially motivated cybercriminal phishing and malware campaigns targeting the education sector, but no downstream visitor infection or credential theft was publicly confirmed.
-
Maximum Rock Magazin
August 19, 2026
Check Point Research identified maximumrock.ro, operated by Maximum Rock Magazin, as a compromised WordPress domain used by the StopAndProtect operation. The attackers installed malicious WordPress components that could overlay legitimate site content with a fake CAPTCHA and use compromised websites to host malware, deliver payloads, communicate with infected devices, and store campaign data.
-
Samagra Portal (Samagra Samajik Suraksha Mission, Government of Madhya Pradesh)
August 19, 2026
•
[ hack, government, insider ]
Cyber police opened an investigation after officials discovered that a person's Samagra record had been updated even though authorized district-level officers had not made the change. Officials tightened portal security and referred the matter for investigation.
-
PayUp
August 19, 2026
•
[ ransomware, finance, technology ]
PayUp, an Austin, Texas fintech offering early vendor payments and invoice factoring to property managers, was listed on the Direwolf ransomware group's leak site on Aug 19, 2026, claiming stolen customer records. PayUp has not confirmed the claim.
