-
OneReach.ai
August 4, 2026
•
[ hack, malware, technology ]
ChainDrop harvested publishing credentials associated with OneReach.ai and used them to publish malicious releases across the @onereach and @or-sdk namespaces on 4 August 2026. Malicious publication activity began at approximately 10:39 UTC.
-
Picsart
August 4, 2026
•
[ hack, technology ]
ChainDrop harvested publishing credentials associated with Picsart and used them to publish malicious versions of two npm packages during the automated propagation wave on 4 August 2026. Malicious publication activity began at approximately 10:37 UTC.
-
Qlik Technologies Inc.
August 4, 2026
•
[ hack, malware, technology ]
ChainDrop harvested Qlik-associated publishing credentials and used them to publish malicious releases across at least 28 @qlik and 22 @nebula.js package names on 4 August 2026. Additional Qlik-associated unscoped packages were reported but are not included in the minimum scope count.
-
ServiceTitan Inc.
August 4, 2026
•
[ hack, malware, technology ]
ChainDrop harvested publishing credentials associated with ServiceTitan and used them to publish malicious releases across 141 @servicetitan package names during the automated propagation wave on 4 August 2026.
-
HubSync
August 4, 2026
•
[ hack, technology, malware ]
ChainDrop harvested publishing credentials associated with HubSync and used them to poison the @hubsync/web-sdk-react package during the automated propagation wave on 4 August 2026. Malicious publication activity began at approximately 10:12 UTC.
-
North Carolina State Ports Authority
August 4, 2026
•
[ hack, technology, government ]
North Carolina Ports detected a cyberattack late on August 4, 2026. Affected IT systems forced manual processing and delayed gate openings at three facilities. Normal gate schedules resumed August 6 while manual processing continued. August 4 is the reported disruption and detection date; initial access is unknown. The authority did not disclose the technical mechanism, attacker, ransom demand, encryption or data theft.
-
Undisclosed organization investigated by Huntress
August 4, 2026
On August 4, 2026, an Akira ransomware affiliate accessed an undisclosed organization through a SonicWall SSL VPN after password spraying, with a successful login logged at 03:52 UTC. The attacker accessed a domain controller, enumerated Active Directory, archived internal file shares with WinRAR and uploaded stolen data to an attacker-controlled S3 bucket using s5cmd. The operator then rebooted a host into Safe Mode to disable security software, but the Akira encryptor failed due to memory errors and no successful encryption was demonstrated. The victim identity, industry and country were not disclosed.
-
Dropbox
August 4, 2026
•
[ hack, technology, misconfiguration ]
San Francisco cloud storage firm Dropbox said ~5,000 user accounts were accessed without authorization from 4 to 21 Aug 2026 via a flaw in a legacy Lenovo ID login integration; files were viewed or downloaded in under a third. It cut Lenovo ID sessions and notified regulators.
-
Norsk Tipping AS
August 4, 2026
After the August 2 DDoS had ended and services recovered, Norsk Tipping experienced a new attack on August 4. Customers reported login failures and service errors. The company said its mitigation stopped the attack shortly after 22:00. No theft of records was reported. Neither an operator nor an extortion demand was identified, so Sabotage is an inference from the achieved disruption of a state-owned gambling service.
-
Department of Land Transport (DLT), Thailand
August 4, 2026
•
[ financial, leak, insider ]
Thailand's Department of Land Transport and cybersecurity authorities investigated unauthorized vehicle-registry searches through accounts associated with three government agencies. The DLT confirmed that displayed data were genuine and that access had occurred, while officials said the core registry was not directly hacked. Other reporting describes illegal paid lookup services and sale of government data, supporting a limited Criminal/Financial inference despite the political prominence of some exposed people. Initial access date is unknown; August 4 is the public-discovery proxy.
-
City of Coweta
August 5, 2026
•
[ ransomware, government ]
The City of Coweta experienced a system-wide ransomware attack on August 5, 2026. Local reporting identified the ransomware as Anubis. City computers and files became inoperable, while the website, third-party billing portal, and separately hosted police, fire, and 911 systems remained available. The City restored systems from off-site backups, and most systems and normal day-to-day operations had returned by August 18. The City said it had no evidence at that time that personal information was accessed or acquired.
-
Zenith Bank Plc
August 5, 2026
•
[ hack, finance ]
Zenith Bank disclosed unauthorized access to limited customer information, including email addresses and phone numbers, as part of what it described as a broader global cyberattack affecting organizations across multiple sectors. The bank activated its incident-response procedures and said its banking systems, digital channels, customer funds, credentials, and financial information remained secure and operational.
-
Lego Certified Stores South Africa
August 5, 2026
•
[ hack, leak, retail ]
An unauthorized third party exploited a previously unknown Metabase vulnerability on August 5, 2026 and accessed Lego Certified Stores South Africa customer data held in a Metabase reporting tool used internally by loyalty provider Marsello. No payment card information or account passwords were involved.
-
Uber Freight
August 6, 2026
•
[ ransomware, financial, technology ]
Uber Freight confirmed unauthorized access to portions of its systems and data repositories. The Helix extortion group listed Uber Freight on its leak site August 6, 2026, claiming nearly one million stolen files from cloud storage, email and logistics/accounting records. An external breach index separately reported approximately 5.44 million data rows, but Uber Freight did not verify the posted data or the scale of theft. Google links Helix infrastructure to the financially motivated UNC6671 cluster; company-specific attribution remains claim-based. Uber Freight said the incident was contained and remediated without operational disruption. The actual date of the initial intrusion or data extraction was not established; August 6 is the earliest documented public-leak date, not the verified intrusion date.
-
Undisclosed United States LightSpy victim
August 6, 2026
•
[ espionage, malware, technology ]
Arctic Wolf researchers identified LightSpy victims in at least 13 countries, including the United States, and documented a wider campaign in which the spyware infected multiple device types and network routers. This conservative record represents at least one unidentified United States victim; the victim's device type, organization or individual status, and exact data acquired were not disclosed. Researchers linked the latest LightSpy activity to a Chinese contractor after identifying one of the spyware operators through the platform's administrative infrastructure.
-
MyDr Sp. z o.o.
August 6, 2026
•
[ leak, healthcare, technology ]
An unidentified attacker deliberately obtained unauthorized access to MyDr's systems no later than August 6, 2026 after overcoming or bypassing technical security controls. Polish prosecutors confirmed access to patient information stored on MyDr infrastructure, and subsequent forensic findings communicated to healthcare customers determined that an unauthorized third party accessed the environment and copied the contents of a cloud-hosted database containing historical patient information. Authorities said the incident may affect approximately 18.8 million people and more than 12,000 medical facilities. Central Polish e-health services and ongoing healthcare delivery were not disrupted.
-
City of Mitchell
August 6, 2026
•
[ ransomware, government, financial ]
Mitchell discovered unauthorized activity in part of its municipal network on August 6, 2026, and isolated the affected environment through August 12. Administrative online services were interrupted, while officials said email and emergency services were unaffected. The city subsequently confirmed that information relating to a small number of employees was affected. The Storm extortion group listed Mitchell on its leak site on August 23 with an August 28 deadline and image thumbnails; independent reporting documents that claim, but the city has not verified Storm attribution. Successful encryption, theft of specific files and a ransom demand to the city are not confirmed. Criminal and Financial are supported by the claimed extortion-group context.
-
City of Lancaster, Ohio
August 6, 2026
•
[ ransomware, government ]
Lancaster, Ohio, took city computers offline after ransomware notes appeared on multiple employee machines on Aug 6, 2026, delaying card payments. By Aug 28 about 90% of data and programs were recovered and some may not be restored. No actor or ransom demand disclosed.
-
National Insurance Information System (NSIS; National Insurance Information System JSC)
August 6, 2026
NSIS reported a high-volume DDoS campaign targeting its nationwide insurance information system for almost ten days, peaking at roughly one thousand times ordinary traffic. CEO Nikolai Galushin said access for writing insurance contracts was interrupted for one hour and 50 minutes on the first day and that the purpose appeared to be obstructing contract issuance. No database intrusion was confirmed. The disclosed report did not establish the first attack date, so August 6 is a report-date fallback. Sabotage is inferred from interference with a system serving the national insurance market; actor identity and sponsorship remain unknown.
-
Westland Insurance Group Ltd.
August 7, 2026
•
[ ransomware, leak, finance ]
Helix listed Westland Insurance Group on its extortion site on August 7, 2026 and said negotiations had stalled after Westland received a ransom demand. Helix subsequently claimed the data had been published. DataBreach.com indexed 1,520,799 records containing personal, contact, and vehicle information. Westland has not publicly confirmed the incident, and no operational disruption has been independently established.
