Recent Breaches
-
August 4, 2026 • Chaos listed Healthcare Highways on its leak site on August 4, 2026 and threatened to publish a 235 GB cache of company and client records if the company did not make contact. The data was subsequently published and was reported to contain protected health information, health insurance claims, and internal corporate documents. Healthcare Highways has not publicly confirmed the incident or independently verified the reported scope of the data.
-
August 4, 2026 • An attacker used a compromised maintainer token to alter the Keyv, Cacheable and Ecto repositories and publish poisoned releases on 4 August 2026. Attacker-associated account activity began by 08:34:57 UTC and the first confirmed malicious package was published at 09:35 UTC.
-
August 4, 2026 • ChainDrop harvested publishing credentials associated with Deliveroo and used them to publish malicious versions of two npm packages during the automated propagation wave on 4 August 2026. The first malicious publication occurred at approximately 10:33 UTC.
-
August 4, 2026 • ChainDrop harvested publishing credentials associated with Ornikar and used them to publish malicious versions across 42 @ornikar package names during the automated propagation wave on 4 August 2026. Malicious publication activity began at approximately 10:19 UTC.
-
August 4, 2026 • ChainDrop harvested publishing credentials associated with OneReach.ai and used them to publish malicious releases across the @onereach and @or-sdk namespaces on 4 August 2026. Malicious publication activity began at approximately 10:39 UTC.
-
August 4, 2026 • ChainDrop harvested publishing credentials associated with Picsart and used them to publish malicious versions of two npm packages during the automated propagation wave on 4 August 2026. Malicious publication activity began at approximately 10:37 UTC.
-
August 4, 2026 • ChainDrop harvested Qlik-associated publishing credentials and used them to publish malicious releases across at least 28 @qlik and 22 @nebula.js package names on 4 August 2026. Additional Qlik-associated unscoped packages were reported but are not included in the minimum scope count.
-
August 4, 2026 • ChainDrop harvested publishing credentials associated with ServiceTitan and used them to publish malicious releases across 141 @servicetitan package names during the automated propagation wave on 4 August 2026.
-
August 4, 2026 • ChainDrop harvested publishing credentials associated with HubSync and used them to poison the @hubsync/web-sdk-react package during the automated propagation wave on 4 August 2026. Malicious publication activity began at approximately 10:12 UTC.
-
August 4, 2026 • North Carolina Ports detected a cyberattack late on August 4, 2026. Affected IT systems forced manual processing and delayed gate openings at three facilities. Normal gate schedules resumed August 6 while manual processing continued. August 4 is the reported disruption and detection date; initial access is unknown. The authority did not disclose the technical mechanism, attacker, ransom demand, encryption or data theft.
-
August 4, 2026 On August 4, 2026, an Akira ransomware affiliate accessed an undisclosed organization through a SonicWall SSL VPN after password spraying, with a successful login logged at 03:52 UTC. The attacker accessed a domain controller, enumerated Active Directory, archived internal file shares with WinRAR and uploaded stolen data to an attacker-controlled S3 bucket using s5cmd. The operator then rebooted a host into Safe Mode to disable security software, but the Akira encryptor failed due to memory errors and no successful encryption was demonstrated. The victim identity, industry and country were not disclosed.
-
August 4, 2026 • San Francisco cloud storage firm Dropbox said ~5,000 user accounts were accessed without authorization from 4 to 21 Aug 2026 via a flaw in a legacy Lenovo ID login integration; files were viewed or downloaded in under a third. It cut Lenovo ID sessions and notified regulators.
-
August 4, 2026 After the August 2 DDoS had ended and services recovered, Norsk Tipping experienced a new attack on August 4. Customers reported login failures and service errors. The company said its mitigation stopped the attack shortly after 22:00. No theft of records was reported. Neither an operator nor an extortion demand was identified, so Sabotage is an inference from the achieved disruption of a state-owned gambling service.
-
August 4, 2026 • Thailand's Department of Land Transport and cybersecurity authorities investigated unauthorized vehicle-registry searches through accounts associated with three government agencies. The DLT confirmed that displayed data were genuine and that access had occurred, while officials said the core registry was not directly hacked. Other reporting describes illegal paid lookup services and sale of government data, supporting a limited Criminal/Financial inference despite the political prominence of some exposed people. Initial access date is unknown; August 4 is the public-discovery proxy.
-
August 5, 2026 • The City of Coweta experienced a system-wide ransomware attack on August 5, 2026. Local reporting identified the ransomware as Anubis. City computers and files became inoperable, while the website, third-party billing portal, and separately hosted police, fire, and 911 systems remained available. The City restored systems from off-site backups, and most systems and normal day-to-day operations had returned by August 18. The City said it had no evidence at that time that personal information was accessed or acquired.
-
August 5, 2026 • Zenith Bank disclosed unauthorized access to limited customer information, including email addresses and phone numbers, as part of what it described as a broader global cyberattack affecting organizations across multiple sectors. The bank activated its incident-response procedures and said its banking systems, digital channels, customer funds, credentials, and financial information remained secure and operational.
-
August 5, 2026 • An unauthorized third party exploited a previously unknown Metabase vulnerability on August 5, 2026 and accessed Lego Certified Stores South Africa customer data held in a Metabase reporting tool used internally by loyalty provider Marsello. No payment card information or account passwords were involved.
-
August 6, 2026 • Uber Freight confirmed unauthorized access to portions of its systems and data repositories. The Helix extortion group listed Uber Freight on its leak site August 6, 2026, claiming nearly one million stolen files from cloud storage, email and logistics/accounting records. An external breach index separately reported approximately 5.44 million data rows, but Uber Freight did not verify the posted data or the scale of theft. Google links Helix infrastructure to the financially motivated UNC6671 cluster; company-specific attribution remains claim-based. Uber Freight said the incident was contained and remediated without operational disruption. The actual date of the initial intrusion or data extraction was not established; August 6 is the earliest documented public-leak date, not the verified intrusion date.
-
August 6, 2026 • Arctic Wolf researchers identified LightSpy victims in at least 13 countries, including the United States, and documented a wider campaign in which the spyware infected multiple device types and network routers. This conservative record represents at least one unidentified United States victim; the victim's device type, organization or individual status, and exact data acquired were not disclosed. Researchers linked the latest LightSpy activity to a Chinese contractor after identifying one of the spyware operators through the platform's administrative infrastructure.
-
August 6, 2026 • An unidentified attacker deliberately obtained unauthorized access to MyDr's systems no later than August 6, 2026 after overcoming or bypassing technical security controls. Polish prosecutors confirmed access to patient information stored on MyDr infrastructure, and subsequent forensic findings communicated to healthcare customers determined that an unauthorized third party accessed the environment and copied the contents of a cloud-hosted database containing historical patient information. Authorities said the incident may affect approximately 18.8 million people and more than 12,000 medical facilities. Central Polish e-health services and ongoing healthcare delivery were not disrupted.