-
Chat Jurídico
August 10, 2026
Chat Jurdico, a So Paulo, Brazil, WhatsApp CRM platform for law firms, was claimed by the Direwolf ransomware group on Aug. 10, 2026, which threatened a full leak; a 198,294-row dataset linked to the firm later surfaced. The company has not confirmed.
-
Quirónsalud
August 10, 2026
•
[ ransomware, healthcare ]
Quirnsalud, Spain's largest private hospital group, was claimed by the Direwolf ransomware group on Aug. 10, 2026, which threatened to release sensitive healthcare data; 160,181 records were later indexed by DataBreach.com. Quirnsalud has not commented.
-
Health Carousel
August 10, 2026
•
[ ransomware, healthcare, leak ]
Health Carousel, a Cincinnati-based healthcare staffing firm, was listed on the Direwolf ransomware group's leak site on Aug 10, 2026, which claimed it stole critical business data and threatened a full leak. A 952,222-record dataset was later indexed; no company response.
-
Osmo Wallet
August 10, 2026
•
[ ransomware, finance, technology ]
Osmo Wallet, a Guatemala City-based fintech and bitcoin remittance app, was listed on the Direwolf ransomware group's leak site on August 10, 2026, with a threat to publish stolen data unless the company made contact. No company confirmation.
-
Mathspace
August 10, 2026
•
[ leak, technology, education ]
Sydney-based maths learning platform Mathspace said an attacker exploited an unpatched Metabase flaw from 10 Aug 2026 and on 27 Aug downloaded records of 1,079,819 students, parents, teachers and staff in Australia and NZ. Regulators were notified; no passwords were taken.
-
Zakład Ubezpieczeń Społecznych (ZUS)
August 10, 2026
•
[ hack, ddos, government ]
On August 10, 2026, a volumetric DDoS attack overwhelmed Poland's Social Insurance Institution web services, disrupting the website, mobile app and PUE/eZUS portal. Polish reporting places service problems shortly after 09:00, with restoration around 13:00. ZUS confirmed customers' personal information remained safe. No actor claimed the attack and no financial demand was reported. Sabotage is inferred from the targeting of public benefits-service availability, not from verified political sponsorship.
-
Sogang University
August 11, 2026
•
[ hack, brute-force, education ]
An unidentified external attacker accessed Sogang University's integrated login system from an unauthorized overseas IP address on August 11, 2026 using brute-force activity. The university detected the incident on August 14 and confirmed that approximately 180,000 records relating to students, alumni, former students, staff, and other account holders were leaked.
-
Threema GmbH (Threema hosted messaging service)
August 11, 2026
•
[ ddos, technology ]
A sustained DDoS campaign targeted Threema and its colocation provider Nine on August 11-12, 2026. The hosted messaging service was unavailable from 19:30 to 23:30 CEST on August 11, followed by intermittent failures on August 12 until 12:23 CEST when normal service resumed. The operator changed traffic patterns as Threema adapted its defenses. OnPrem deployments continued functioning; no intrusion into messaging content or data theft was reported. The attacker and motive remain unidentified.
-
Douglas County Sheriff's Office
August 11, 2026
•
[ ransomware, government, technology ]
Douglas County Sheriff's Office (Lawrence, Kansas) found suspicious network activity around Aug. 11, 2026; its website and booking log went offline and Lawrence police lost shared dispatch/records access for weeks. Eudora's ex-IT admin blamed foreign ransomware spread via VPN.
-
Nine Internet Solutions AG
August 11, 2026
•
[ ddos, technology ]
Zurich hosting provider Nine Internet Solutions was hit by a 500-600 Gbit/s UDP-amplification DDoS on Aug. 11-13, 2026, after a customer was targeted; waves knocked its Deploio apps, website, Cockpit portal and ticketing offline. Nine says no systems were breached.
-
Undisclosed organization
August 11, 2026
•
[ ddos, technology ]
An unnamed customer of Swiss hosting provider Nine was the initial target of a large UDP-amplification DDoS on its Nine-provided internet connection on Aug. 11, 2026; the first wave took about 90 minutes of manual mitigation before the attack spread to Nine's network.
-
City of Eudora
August 11, 2026
The City of Eudora, Kansas, confirmed a network security incident around 11 Aug 2026 that impacted a limited number of systems. Its former IT administrator said ransomware encrypted police department files and ~2% of other city files; the city has not confirmed ransomware.
-
At least one undisclosed Salesforce or ServiceNow customer
August 12, 2026
Reco identified the City-Forum campaign using a custom multi-platform toolset to enumerate and extract information exposed through overly permissive Salesforce Experience Cloud and ServiceNow guest-user configurations. All observed activity traced to one IP address associated with city-forum.com. The infrastructure has existed since March 12, 2025, but Reco explicitly said it cannot determine when the attack activity began. Researchers found similarities with previous ShinyHunters activity but found no evidence sufficient to attribute City-Forum to ShinyHunters or any other known actor.
-
Newfoundland and Labrador Health Services
August 12, 2026
•
[ insider, healthcare ]
A Newfoundland and Labrador Health Services employee accessed a patient's electronic health record without authorization on one occasion. An audit initiated after the patient reported the suspected privacy breach confirmed the access. NL Health Services investigated, contained the breach, notified the affected individual, and took measures intended to prevent recurrence. The privacy commissioner did not disclose the employee's identity, motive, or the date of the unauthorized access.
-
Omskie Kabelnye Seti (Омские кабельные сети)
August 12, 2026
Omskie Kabelnye Seti was targeted by large-scale DDoS traffic beginning by August 12, 2026. Customers experienced intermittent internet outages and degraded speeds; the company website and subscriber services were also disrupted. The regional digital-development ministry confirmed the DDoS campaign was continuing on August 15. The attacker and end date were not identified.
-
Hogan Lovells Cadwalader
August 12, 2026
•
[ ransomware, finance, leak ]
Silent Ransom Group claimed it accessed law firm Hogan Lovells Cadwalader's legacy infrastructure on Aug 12, 2026 for about 24 hours, stole over 50 GB and posted it on its leak site after rejecting offers of up to $5.34M against a $20M demand. The firm did not respond.
-
Carhartt, Inc.
August 13, 2026
•
[ ransomware, retail, leak ]
ShinyHunters published approximately 50GB of data attributed to Carhartt after demanding $3.3 million and failing to reach an extortion agreement. Independent analysis of the leaked corpus identified approximately 12.9 million genuine accounts after millions of synthetic records were excluded. DataBreach.com separately indexed 4,051,760 rows. No operational disruption has been established.
-
Sharecare, Inc.
August 13, 2026
•
[ leak, technology, healthcare ]
ShinyHunters claimed it obtained more than 3.4 million Salesforce records and more than 28GB of internal Sharecare data after failed extortion negotiations. DataBreach.com subsequently indexed 565,222 leaked rows containing personal and contact information. Sharecare has not publicly confirmed the attacker's claimed scope, and no operational disruption has been established.
-
Carhartt, Inc.
August 13, 2026
•
[ leak, retail, technology ]
ShinyHunters stole data associated with Carhartt and later published it after an extortion demand failed. Independent analysis linked the leaked data to Carhartt's Databricks analytics environment and identified 12,933,413 genuine accounts after synthetic records were removed. The incident was part of ShinyHunters' broader 2026 pay-or-leak data-extortion activity; Carhartt had not publicly confirmed the intrusion or its exact compromise date when reported.
-
Town of Andover
August 13, 2026
•
[ ransomware, government, education ]
A cyberattack detected August 13 caused a four-day outage across the shared Town of Andover and Andover Public Schools network, disrupting internet connectivity, external email, online bill payments, and access to school teacher assignments while public safety agencies and utilities remained operational. Wallstreet subsequently listed Andover on its leak site and claimed possession of documents, databases, email, personal data, and media. The town has not confirmed Wallstreet's responsibility or any data theft, so the claimed exfiltration is not coded as an exploitive primary effect.
