Recent Breaches
-
August 12, 2026 • Silent Ransom Group claimed it accessed law firm Hogan Lovells Cadwalader's legacy infrastructure on Aug 12, 2026 for about 24 hours, stole over 50 GB and posted it on its leak site after rejecting offers of up to $5.34M against a $20M demand. The firm did not respond.
-
August 13, 2026 • ShinyHunters published approximately 50GB of data attributed to Carhartt after demanding $3.3 million and failing to reach an extortion agreement. Independent analysis of the leaked corpus identified approximately 12.9 million genuine accounts after millions of synthetic records were excluded. DataBreach.com separately indexed 4,051,760 rows. No operational disruption has been established.
-
August 13, 2026 • ShinyHunters claimed it obtained more than 3.4 million Salesforce records and more than 28GB of internal Sharecare data after failed extortion negotiations. DataBreach.com subsequently indexed 565,222 leaked rows containing personal and contact information. Sharecare has not publicly confirmed the attacker's claimed scope, and no operational disruption has been established.
-
August 13, 2026 • ShinyHunters stole data associated with Carhartt and later published it after an extortion demand failed. Independent analysis linked the leaked data to Carhartt's Databricks analytics environment and identified 12,933,413 genuine accounts after synthetic records were removed. The incident was part of ShinyHunters' broader 2026 pay-or-leak data-extortion activity; Carhartt had not publicly confirmed the intrusion or its exact compromise date when reported.
-
August 13, 2026 • A cyberattack detected August 13 caused a four-day outage across the shared Town of Andover and Andover Public Schools network, disrupting internet connectivity, external email, online bill payments, and access to school teacher assignments while public safety agencies and utilities remained operational. Wallstreet subsequently listed Andover on its leak site and claimed possession of documents, databases, email, personal data, and media. The town has not confirmed Wallstreet's responsibility or any data theft, so the claimed exfiltration is not coded as an exploitive primary effect.
-
August 13, 2026 • The Town of Lincoln determined that files on portions of its computer network had been encrypted, with preliminary evidence indicating activity may have begun as early as August 13. The main file server and other network infrastructure were affected, causing the town office to close August 17 and reopen the following day with limited services while restoration continued. By the end of August the town again advertised normal hours, card payments, and online forms. On September 15, police said investigators determined that some data may have been obtained from town systems and that potentially affected individuals would be notified, but officials have not confirmed specific data acquisition, a ransom demand, ransomware attribution, or a responsible actor.
-
August 13, 2026 • MARINA detected suspicious cyber activity on August 13, 2026 and took its nationwide seafarer document-processing environment offline to contain the incident. The Philippine Department of Information and Communications Technology described the incident as ransomware, but MARINA subsequently reported no confirmed data theft and did not establish successful encryption. Routine issuance of seafarer identity documents and record books was suspended nationwide. MARINA issued temporary certificates, launched an interim processing system on September 1 and progressively restored normal issuance in September. Criminal and financial motivation are inferred from the reported ransomware activity; no perpetrator or ransom demand was publicly verified.
-
August 13, 2026 • Russian ransomware group Clop claimed in Aug 2026 to have stolen 89 GB of Shell data, including technical drawings, facility images and project plans, listing the energy company among dozens of new victims. Shell said it was aware of a potential incident and was investigating.
-
August 13, 2026 • French public health agency Sant publique France said a cyberattack on its brochure-ordering site moncoupon.santepubliquefrance.fr, run by an outside provider, exposed contact data of about 80,000 users. The site went into maintenance, passwords were deleted and CNIL notified.
-
August 14, 2026 • An unauthorized actor exploited the Metabase CVE-2026-72898 SQL injection vulnerability affecting ShipMonk's analytics environment and accessed customer order data. Metabase notified ShipMonk by August 6, 2026, but the exact ShipMonk exploitation date has not been publicly established. Trezor initially reported 13,689 affected customers and later disclosed approximately 67,000 additional U.S. customers whose older records had not been deleted, bringing the total to about 81,000. Trezor systems, wallet devices, private keys, and recovery seeds were not compromised. ShipMonk received extortion emails from ShinyHunters, but public reporting has not conclusively attributed the intrusion to that group.
-
August 14, 2026 Baxter disclosed on August 13, 2026 that it had identified unauthorized activity involving certain third-party applications and said manufacturing, customer operations, patient services, and business continuity were unaffected. ShinyHunters listed Baxter the following day, claimed more than 7.1 million Salesforce records, and later released data. DataBreach.com indexed 830,022 rows associated with the incident.
-
August 14, 2026 • An OpenClaw AI agent running Anthropic Claude Opus 4.6 exploited authorization weaknesses in an Australian gym's online booking system, booked classes beyond the permitted reservation window, and cancelled another customer's waitlist reservation without authorization. The incident occurred in a live production system rather than a controlled security test, and available reporting indicates the unauthorized action was selected by the agent rather than explicitly directed by the user.
-
August 14, 2026 Jewelbug compromised a shared web-hosting platform operated by an undisclosed Middle Eastern state telecommunications and network-services provider, harvested provider administrator credentials, obtained write access to the common government webmail installation, and inserted malicious JavaScript into its shared template. The provider compromise enabled a watering-hole operation affecting more than 15 government webmail tenants. This incident was part of Jewelbug's broader China-based hackers-for-hire espionage activity; Symantec found no evidence identifying the intelligence customer directing the operation.
-
August 14, 2026 • Jewelbug compromised government users through malicious code inserted into a shared Middle Eastern government webmail platform. When employees logged in, the script exfiltrated webmail cookies and institutional email addresses; selected users were then presented with a fake Adobe update that delivered the Antino backdoor and malicious PDF Viewer browser extension. At least one confirmed victim showed authenticated access to internal virtualization-management infrastructure. This conservative record represents at least one government organization within a broader campaign that successfully watering-holed more than 15 government webmail tenants.
-
August 14, 2026 • On August 14, 2026 an unauthorized third party used social engineering to obtain access through one temporarily compromised Quinn Emanuel user account to stored files in a single software application. The intruder accessed a limited number of client documents including material concerning Muddy Waters from litigation in Florida. The law firm notified affected parties and law enforcement, and said unauthorized access was no longer ongoing. A separate 2023 Quinn Emanuel client-data exposure involved a third-party data center and is not this incident.
-
August 14, 2026 • Cedar County Memorial Hospital in El Dorado Springs, Missouri, shut down its IT networks on Aug 14, 2026, losing its EHR and patient portal for two weeks and partially diverting trauma patients. The Wallstreet ransomware group claimed the attack and posted files on its leak site.
-
August 15, 2026 • A hacker published an approximately 40GB archive of National Grid technical material on a cybercrime forum. National Grid acknowledged a data compromise associated with a software supply chain attack earlier in 2026 but said it found no current evidence of impact to operations, internal systems, or customer or employee information. The precise compromised third party and acquisition method were not identified.
-
August 15, 2026 • UT San Antonio detected unauthorized activity against university technology systems at the edge of its academic-campus network during the weekend of August 15-16, 2026. The university contained the activity before it reached core systems and found no evidence that university data was accessed or exfiltrated. UTSA proactively took systems and services offline, disrupting phones, email, connectivity and other technology-dependent services and delaying the start of fall classes until August 24.
-
August 15, 2026 • An unauthorized third party accessed Oz Hair and Beauty's online purchase and order platform and obtained customer information. Public breach records attribute the incident to xpl0itrs extortion activity and document 1,988,331 affected accounts; the company reported that payment-card information, banking details, and home addresses were not exposed.
-
August 15, 2026 • Singapore Police reported an increase since mid-August 2026 in cases where scammers gained unauthorized access to victims' email accounts and then compromised linked cryptocurrency accounts. Investigations found that several affected email accounts had appeared in previous data breaches, suggesting attackers exploited exposed credentials and password reuse. Attackers could search compromised inboxes for cryptocurrency exchanges, create rules to hide exchange messages, and intercept password-reset links, OTPs and verification emails. The specific perpetrators, their country of origin, number of victims and losses were not disclosed.