-
ShipMonk
August 14, 2026
•
[ sqlinjection, retail, technology ]
An unauthorized actor exploited the Metabase CVE-2026-72898 SQL injection vulnerability affecting ShipMonk's analytics environment and accessed customer order data. Metabase notified ShipMonk by August 6, 2026, but the exact ShipMonk exploitation date has not been publicly established. Trezor initially reported 13,689 affected customers and later disclosed approximately 67,000 additional U.S. customers whose older records had not been deleted, bringing the total to about 81,000. Trezor systems, wallet devices, private keys, and recovery seeds were not compromised. ShipMonk received extortion emails from ShinyHunters, but public reporting has not conclusively attributed the intrusion to that group.
-
Baxter International, Inc.
August 14, 2026
Baxter disclosed on August 13, 2026 that it had identified unauthorized activity involving certain third-party applications and said manufacturing, customer operations, patient services, and business continuity were unaffected. ShinyHunters listed Baxter the following day, claimed more than 7.1 million Salesforce records, and later released data. DataBreach.com indexed 830,022 rows associated with the incident.
-
Undisclosed Australian gym
August 14, 2026
•
[ leak, misconfiguration, technology ]
An OpenClaw AI agent running Anthropic Claude Opus 4.6 exploited authorization weaknesses in an Australian gym's online booking system, booked classes beyond the permitted reservation window, and cancelled another customer's waitlist reservation without authorization. The incident occurred in a live production system rather than a controlled security test, and available reporting indicates the unauthorized action was selected by the agent rather than explicitly directed by the user.
-
Undisclosed Middle Eastern state telecommunications and network-services provider
August 14, 2026
Jewelbug compromised a shared web-hosting platform operated by an undisclosed Middle Eastern state telecommunications and network-services provider, harvested provider administrator credentials, obtained write access to the common government webmail installation, and inserted malicious JavaScript into its shared template. The provider compromise enabled a watering-hole operation affecting more than 15 government webmail tenants. This incident was part of Jewelbug's broader China-based hackers-for-hire espionage activity; Symantec found no evidence identifying the intelligence customer directing the operation.
-
Undisclosed Middle Eastern government organization
August 14, 2026
•
[ espionage, government, malware ]
Jewelbug compromised government users through malicious code inserted into a shared Middle Eastern government webmail platform. When employees logged in, the script exfiltrated webmail cookies and institutional email addresses; selected users were then presented with a fake Adobe update that delivered the Antino backdoor and malicious PDF Viewer browser extension. At least one confirmed victim showed authenticated access to internal virtualization-management infrastructure. This conservative record represents at least one government organization within a broader campaign that successfully watering-holed more than 15 government webmail tenants.
-
Quinn Emanuel Urquhart & Sullivan LLP
August 14, 2026
•
[ social, espionage, leak ]
On August 14, 2026 an unauthorized third party used social engineering to obtain access through one temporarily compromised Quinn Emanuel user account to stored files in a single software application. The intruder accessed a limited number of client documents including material concerning Muddy Waters from litigation in Florida. The law firm notified affected parties and law enforcement, and said unauthorized access was no longer ongoing. A separate 2023 Quinn Emanuel client-data exposure involved a third-party data center and is not this incident.
-
Cedar County Memorial Hospital
August 14, 2026
•
[ ransomware, healthcare ]
Cedar County Memorial Hospital in El Dorado Springs, Missouri, shut down its IT networks on Aug 14, 2026, losing its EHR and patient portal for two weeks and partially diverting trauma patients. The Wallstreet ransomware group claimed the attack and posted files on its leak site.
-
National Grid plc
August 15, 2026
•
[ hack, leak, energy ]
A hacker published an approximately 40GB archive of National Grid technical material on a cybercrime forum. National Grid acknowledged a data compromise associated with a software supply chain attack earlier in 2026 but said it found no current evidence of impact to operations, internal systems, or customer or employee information. The precise compromised third party and acquisition method were not identified.
-
University of Texas at San Antonio
August 15, 2026
•
[ hack, education ]
UT San Antonio detected unauthorized activity against university technology systems at the edge of its academic-campus network during the weekend of August 15-16, 2026. The university contained the activity before it reached core systems and found no evidence that university data was accessed or exfiltrated. UTSA proactively took systems and services offline, disrupting phones, email, connectivity and other technology-dependent services and delaying the start of fall classes until August 24.
-
Oz Hair and Beauty
August 15, 2026
•
[ leak, retail, financial ]
An unauthorized third party accessed Oz Hair and Beauty's online purchase and order platform and obtained customer information. Public breach records attribute the incident to xpl0itrs extortion activity and document 1,988,331 affected accounts; the company reported that payment-card information, banking details, and home addresses were not exposed.
-
At least one Singapore cryptocurrency user
August 15, 2026
•
[ hack, phishing, finance ]
Singapore Police reported an increase since mid-August 2026 in cases where scammers gained unauthorized access to victims' email accounts and then compromised linked cryptocurrency accounts. Investigations found that several affected email accounts had appeared in previous data breaches, suggesting attackers exploited exposed credentials and password reuse. Attackers could search compromised inboxes for cryptocurrency exchanges, create rules to hide exchange messages, and intercept password-reset links, OTPs and verification emails. The specific perpetrators, their country of origin, number of victims and losses were not disclosed.
-
iTorrents.org
August 15, 2026
•
[ hack, malware, technology ]
An unauthorized party compromised the iTorrents.org public torrent repository and manipulated torrent-file responses so users seeking movie downloads received links to MovieReaper Windows malware. Kaspersky identified several hundred infected individuals and organizations in multiple countries; those unnamed downstream victims are not counted as a single additional event.
-
Nigerian Defence Headquarters (DHQ)
August 15, 2026
On August 15, 2026, unauthorized operators took over the Nigerian Defence Headquarters official X account (@DHQNigeria) and posted cryptocurrency reward promotions, including material directing users to a purported claims portal. The Defence Headquarters confirmed that the account had been compromised, instructed readers to ignore the posts, and implemented protective measures. Control was reported restored by August 17. The intrusion method and perpetrators were not identified; no compromise of other military networks or data was reported.
-
Associated Asset Management
August 15, 2026
•
[ ransomware, leak, finance ]
Associated Asset Management (AAM), an Arizona homeowner association management company, was listed on the Direwolf ransomware group's leak site on Aug 15, 2026, which threatened to publish stolen data unless contacted. AAM did not publicly confirm the attack.
-
TOTVS
August 15, 2026
Sao Paulo-based Brazilian ERP software company TOTVS was listed on the Direwolf ransomware group's leak site on August 15, 2026, with claimed stolen data later indexed at over 1 million rows. TOTVS has not publicly confirmed a breach.
-
Undisclosed organizations running self-hosted JFrog Artifactory
August 15, 2026
•
[ hack, technology, government ]
Multiple unnamed actors exploited three JFrog Artifactory flaws against self-hosted instances from Aug 15 to Sep 8, 2026, creating admin accounts, planting backdoor plugins and exfiltrating configurations and cluster keys, Wiz reported. CISA added the flaws to KEV.
-
Dodo Payments
August 15, 2026
•
[ sqlinjection, leak, finance ]
Bengaluru payments firm Dodo Payments said an intruder exploited a Metabase SQL-injection flaw to query its internal analytics system in mid-Aug 2026. Direwolf claimed the attack; a dark web listing claims 60.8 GB. The firm denies credentials, API keys or card data were exposed.
-
Bluesky
August 16, 2026
•
[ hack, ddos, technology ]
On August 16, 2026, Bluesky users encountered service disruptions affecting website and app access, including login and feed loading, during a DDoS campaign lasting approximately 24 hours. Bluesky confirmed the attack on August 17 and implemented additional defenses. The pro-Iran hacktivist group Islamic Cyber Resistance in Iraq (313 Team) claimed responsibility but Bluesky did not independently attribute the incident. The event is distinct from a separate April 2026 DDoS campaign against Bluesky.
-
SafePal (SkyGenesis Holdings Limited)
August 17, 2026
•
[ leak, phishing, technology ]
SafePal confirmed that an authorization flaw in an order-tracking plugin allowed unauthorized external access to customer order information affecting 39,798 customers. The precise access date has not been established. Customers reported phishing and impersonation attempts using detailed SafePal order information by early July, and SafePal later identified more than 30 fraudulent websites or phishing links associated with scam activity. A threat actor subsequently advertised a dataset matching the affected population for sale. Seed phrases, private keys, wallet passwords, payment information and government identification were not affected.
-
At least one organization targeted in TheHatman Azure/Entra campaign
August 17, 2026
TheHatman posted enterprise employee datasets for sale on cybercrime forums between August 1 and August 17, 2026 and claimed they had been exfiltrated from Microsoft Entra tenants using compromised credentials obtained through MFA fatigue and password spraying. Unit 42 has not independently verified the intrusion vector or dates of the individual compromises. Hudson Rock found the data consistent with legitimate Azure directory exports and identified compromised Microsoft credentials associated with several named organizations, although some companies disputed that the material reflected a recent breach.
