-
Douglas County Sheriff's Office
August 11, 2026
•
[ ransomware, government, technology ]
Douglas County Sheriff's Office (Lawrence, Kansas) found suspicious network activity around Aug. 11, 2026; its website and booking log went offline and Lawrence police lost shared dispatch/records access for weeks. Eudora's ex-IT admin blamed foreign ransomware spread via VPN.
-
Nine Internet Solutions AG
August 11, 2026
•
[ ddos, technology ]
Zurich hosting provider Nine Internet Solutions was hit by a 500-600 Gbit/s UDP-amplification DDoS on Aug. 11-13, 2026, after a customer was targeted; waves knocked its Deploio apps, website, Cockpit portal and ticketing offline. Nine says no systems were breached.
-
Undisclosed organization
August 11, 2026
•
[ ddos, technology ]
An unnamed customer of Swiss hosting provider Nine was the initial target of a large UDP-amplification DDoS on its Nine-provided internet connection on Aug. 11, 2026; the first wave took about 90 minutes of manual mitigation before the attack spread to Nine's network.
-
City of Eudora
August 11, 2026
The City of Eudora, Kansas, confirmed a network security incident around 11 Aug 2026 that impacted a limited number of systems. Its former IT administrator said ransomware encrypted police department files and ~2% of other city files; the city has not confirmed ransomware.
-
At least one undisclosed Salesforce or ServiceNow customer
August 12, 2026
Reco identified the City-Forum campaign using a custom multi-platform toolset to enumerate and extract information exposed through overly permissive Salesforce Experience Cloud and ServiceNow guest-user configurations. All observed activity traced to one IP address associated with city-forum.com. The infrastructure has existed since March 12, 2025, but Reco explicitly said it cannot determine when the attack activity began. Researchers found similarities with previous ShinyHunters activity but found no evidence sufficient to attribute City-Forum to ShinyHunters or any other known actor.
-
Newfoundland and Labrador Health Services
August 12, 2026
•
[ insider, healthcare ]
A Newfoundland and Labrador Health Services employee accessed a patient's electronic health record without authorization on one occasion. An audit initiated after the patient reported the suspected privacy breach confirmed the access. NL Health Services investigated, contained the breach, notified the affected individual, and took measures intended to prevent recurrence. The privacy commissioner did not disclose the employee's identity, motive, or the date of the unauthorized access.
-
Omskie Kabelnye Seti (Омские кабельные сети)
August 12, 2026
Omskie Kabelnye Seti was targeted by large-scale DDoS traffic beginning by August 12, 2026. Customers experienced intermittent internet outages and degraded speeds; the company website and subscriber services were also disrupted. The regional digital-development ministry confirmed the DDoS campaign was continuing on August 15. The attacker and end date were not identified.
-
Hogan Lovells Cadwalader
August 12, 2026
•
[ ransomware, finance, leak ]
Silent Ransom Group claimed it accessed law firm Hogan Lovells Cadwalader's legacy infrastructure on Aug 12, 2026 for about 24 hours, stole over 50 GB and posted it on its leak site after rejecting offers of up to $5.34M against a $20M demand. The firm did not respond.
-
Carhartt, Inc.
August 13, 2026
•
[ ransomware, retail, leak ]
ShinyHunters published approximately 50GB of data attributed to Carhartt after demanding $3.3 million and failing to reach an extortion agreement. Independent analysis of the leaked corpus identified approximately 12.9 million genuine accounts after millions of synthetic records were excluded. DataBreach.com separately indexed 4,051,760 rows. No operational disruption has been established.
-
Sharecare, Inc.
August 13, 2026
•
[ leak, technology, healthcare ]
ShinyHunters claimed it obtained more than 3.4 million Salesforce records and more than 28GB of internal Sharecare data after failed extortion negotiations. DataBreach.com subsequently indexed 565,222 leaked rows containing personal and contact information. Sharecare has not publicly confirmed the attacker's claimed scope, and no operational disruption has been established.
-
Carhartt, Inc.
August 13, 2026
•
[ leak, retail, technology ]
ShinyHunters stole data associated with Carhartt and later published it after an extortion demand failed. Independent analysis linked the leaked data to Carhartt's Databricks analytics environment and identified 12,933,413 genuine accounts after synthetic records were removed. The incident was part of ShinyHunters' broader 2026 pay-or-leak data-extortion activity; Carhartt had not publicly confirmed the intrusion or its exact compromise date when reported.
-
Town of Andover
August 13, 2026
•
[ ransomware, government, education ]
A cyberattack detected August 13 caused a four-day outage across the shared Town of Andover and Andover Public Schools network, disrupting internet connectivity, external email, online bill payments, and access to school teacher assignments while public safety agencies and utilities remained operational. Wallstreet subsequently listed Andover on its leak site and claimed possession of documents, databases, email, personal data, and media. The town has not confirmed Wallstreet's responsibility or any data theft, so the claimed exfiltration is not coded as an exploitive primary effect.
-
Town of Lincoln
August 13, 2026
•
[ ransomware, government ]
The Town of Lincoln determined that files on portions of its computer network had been encrypted, with preliminary evidence indicating activity may have begun as early as August 13. The main file server and other network infrastructure were affected, causing the town office to close August 17 and reopen the following day with limited services while restoration continued. By the end of August the town again advertised normal hours, card payments, and online forms. On September 15, police said investigators determined that some data may have been obtained from town systems and that potentially affected individuals would be notified, but officials have not confirmed specific data acquisition, a ransom demand, ransomware attribution, or a responsible actor.
-
Maritime Industry Authority (MARINA)
August 13, 2026
•
[ ransomware, financial, government ]
MARINA detected suspicious cyber activity on August 13, 2026 and took its nationwide seafarer document-processing environment offline to contain the incident. The Philippine Department of Information and Communications Technology described the incident as ransomware, but MARINA subsequently reported no confirmed data theft and did not establish successful encryption. Routine issuance of seafarer identity documents and record books was suspended nationwide. MARINA issued temporary certificates, launched an interim processing system on September 1 and progressively restored normal issuance in September. Criminal and financial motivation are inferred from the reported ransomware activity; no perpetrator or ransom demand was publicly verified.
-
Shell
August 13, 2026
•
[ ransomware, energy ]
Russian ransomware group Clop claimed in Aug 2026 to have stolen 89 GB of Shell data, including technical drawings, facility images and project plans, listing the energy company among dozens of new victims. Shell said it was aware of a potential incident and was investigating.
-
Santé publique France
August 13, 2026
•
[ hack, leak, government ]
French public health agency Sant publique France said a cyberattack on its brochure-ordering site moncoupon.santepubliquefrance.fr, run by an outside provider, exposed contact data of about 80,000 users. The site went into maintenance, passwords were deleted and CNIL notified.
-
ShipMonk
August 14, 2026
•
[ sqlinjection, retail, technology ]
An unauthorized actor exploited the Metabase CVE-2026-72898 SQL injection vulnerability affecting ShipMonk's analytics environment and accessed customer order data. Metabase notified ShipMonk by August 6, 2026, but the exact ShipMonk exploitation date has not been publicly established. Trezor initially reported 13,689 affected customers and later disclosed approximately 67,000 additional U.S. customers whose older records had not been deleted, bringing the total to about 81,000. Trezor systems, wallet devices, private keys, and recovery seeds were not compromised. ShipMonk received extortion emails from ShinyHunters, but public reporting has not conclusively attributed the intrusion to that group.
-
Baxter International, Inc.
August 14, 2026
Baxter disclosed on August 13, 2026 that it had identified unauthorized activity involving certain third-party applications and said manufacturing, customer operations, patient services, and business continuity were unaffected. ShinyHunters listed Baxter the following day, claimed more than 7.1 million Salesforce records, and later released data. DataBreach.com indexed 830,022 rows associated with the incident.
-
Undisclosed Australian gym
August 14, 2026
•
[ leak, misconfiguration, technology ]
An OpenClaw AI agent running Anthropic Claude Opus 4.6 exploited authorization weaknesses in an Australian gym's online booking system, booked classes beyond the permitted reservation window, and cancelled another customer's waitlist reservation without authorization. The incident occurred in a live production system rather than a controlled security test, and available reporting indicates the unauthorized action was selected by the agent rather than explicitly directed by the user.
-
Undisclosed Middle Eastern state telecommunications and network-services provider
August 14, 2026
Jewelbug compromised a shared web-hosting platform operated by an undisclosed Middle Eastern state telecommunications and network-services provider, harvested provider administrator credentials, obtained write access to the common government webmail installation, and inserted malicious JavaScript into its shared template. The provider compromise enabled a watering-hole operation affecting more than 15 government webmail tenants. This incident was part of Jewelbug's broader China-based hackers-for-hire espionage activity; Symantec found no evidence identifying the intelligence customer directing the operation.
