-
Uttarakhand Information Technology Development Agency (ITDA) / State Data Centre
August 1, 2026
•
[ hack, malware, misconfiguration ]
On August 1, 2026, the Uttarakhand Information Technology Development Agency detected malware on government web servers and temporarily disconnected multiple state department websites to contain the suspected attack. Initial reports identified approximately 10 affected departmental portals, including the Chief Minister Relief Fund website; services returned over the following hours. The agency subsequently said no unauthorized data access or theft was found, and attributed some application failures to configuration errors rather than malware. No ransomware encryption, extortion demand or perpetrator was confirmed. This incident is distinct from the October 2024 Uttarakhand State Data Centre attack.
-
Ambition DX Holdings Co., Ltd.
August 1, 2026
•
[ ransomware, retail ]
The SETTRA ransomware group claimed in August 2026 to have stolen 437 GB of data from Ambition DX Holdings, a Tokyo-based real estate leasing and property management company. The company's response was not reported.
-
Cartrack
August 1, 2026
The Dire Wolf ransomware group claimed to have stolen 100 GB of data from Cartrack, a South African fleet management and vehicle tracking software provider, listing it on its leak site in early September 2026. Cartrack's response was not reported.
-
Ministry of Ecological Transition
August 1, 2026
•
[ hack, leak, government ]
France's Ministry of Ecological Transition confirmed a sophisticated late-Aug 2026 attack on its messaging tools; email services and regional sites were disrupted. An actor called 'mondial' claimed theft of 22,000+ records. A complaint was filed and ANSSI is investigating.
-
Zenith Technology Corporation Limited
August 1, 2026
Zenith Technology (ZenTech), a Dunedin, New Zealand clinical-trial research firm, had files stolen in an August 2026 attack claimed by ransomware group ZaWoo, which posted samples online. ZenTech and Health NZ confirmed the incident; police are investigating.
-
Baltaş Grubu
August 1, 2026
Turkish HR assessment firm Balta Grubu (Baltas Online) was hacked; actor WInQ7wk9sA3a claimed in late July 2026 to have stolen 500+ GB over 47 days of root access, incl. data on 700,000+ candidates of 750+ client firms, for sale on the dark web. BTK reportedly fined the firm.
-
Novocure
August 1, 2026
•
[ leak, healthcare, technology ]
Novocure, a cancer treatment device maker, said on 1 Sep 2026 that unauthorized access to some systems in mid-August exposed internal IDs of 1,400+ U.S. patients plus provider and employee contacts. ShinyHunters reportedly leaked a 33GB archive. Systems stayed functional.
-
Anna's Archive
August 1, 2026
•
[ hack, technology, education ]
Shadow library Anna's Archive suffered prolonged outages in August 2026 that it attributed to a coordinated, targeted network attack by an unidentified group. The site recovered, said it took steps to address the attack and credited members extra days for the downtime.
-
Undisclosed Colorado water utility
August 1, 2026
Hackers breached one of two small private Colorado water utilities (each serving under 200 people) in late August 2026, changing equipment settings, disabling remote access and alarms and altering pumping cycles. The governor's office said it was brief and resolved.
-
Davayte
August 1, 2026
Davayte, a fundraiser for Ukrainian civilians run by exiled Russian media, said hackers broke into its Stripe/WooCommerce auction payment integration in mid-August 2026, exposing some donor emails and card details. It disclosed Sept 1, rotated keys, notified a European regulator.
-
You Are Not Alone
August 1, 2026
You Are Not Alone, a fundraiser for Russian political prisoners and their families, said hackers broke into its Stripe/WooCommerce auction payment integration in mid-August 2026, exposing some donor emails and card details. Disclosed Sept 1; actor unknown.
-
Ministerio de Justicia y del Derecho (Colombian Ministry of Justice)
August 2, 2026
•
[ ransomware, government, technology ]
On August 2, 2026 a ransomware infection struck the Colombian Ministry of Justice, disrupting administrative IT and digital services. The ministry isolated affected systems and switched document submission and citizen assistance to in-person, telephone and temporary email channels. By August 15 the cannabis-control licensing platform (MICC) remained unavailable and SICOQ operated only partially; the electronic archive document system (SGDEA) remained out of service on August 20, restricting access to registered petitions. No verified file theft, attacker identity or completed encryption extent was disclosed.
-
Norsk Tipping AS
August 2, 2026
•
[ ddos, hack, government ]
A DDoS attack against Norsk Tipping on August 2 produced public website and mobile-app errors and caused the operator to suspend Oddsen betting around 13:40. The company reported the traffic attack lasted about two hours and betting access had resumed by its afternoon update. No successful intrusion or data theft was found. The attacker and motive were not verified; Sabotage is inferred from the deliberate denial of a state-owned nationwide service.
-
Metabase, Inc. (Metabase Cloud)
August 3, 2026
•
[ hack, leak, technology ]
On August 3, 2026, attackers exploited a previously unknown vulnerability in Metabase Cloud's authentication flow to create unauthorized administrator sessions and API keys on customer analytics instances. They accessed or exported data from affected customer-connected databases, including Framework and Tally. Metabase said fewer than 3% of its cloud customers were compromised and deployed patches by August 6. ShinyHunters publicly claimed responsibility on August 11, but the attribution has not been independently confirmed. This record captures the shared Metabase Cloud compromise, with customer disclosures representing downstream effects rather than separate intrusions into their production networks.
-
JPS Health Network
August 3, 2026
•
[ hack, healthcare ]
JPS Health Network identified suspicious activity in its technology environment early August 3 and took network systems offline to isolate and secure the environment. The resulting controlled network downtime disrupted clinical and administrative technology across its 582-bed hospital and more than 25 community clinics, forcing paper-based and manual procedures, delaying pharmacy and registration workflows, postponing elective procedures, and causing temporary ambulance diversion for trauma, stroke, and serious heart attack patients. JPS restored its core electronic health record on August 14 and MyChart and routine operations by August 16. JPS has not publicly confirmed ransomware, malware, data theft, extortion, or a responsible actor. Because the technical mechanism that produced the malicious activity is undisclosed, the disruptive subtype remains undetermined.
-
Undisclosed organization investigated by QUIRSO
August 4, 2026
•
[ ransomware, technology, hack ]
Attackers exploited a VMware vCenter server at an unnamed organization, terminated running virtual machines and encrypted datastore files with Babuk-derived ransomware on August 4. This documented attack occurred within a larger global vCenter exploitation campaign; ransomware deployment at other victims is unverified.
-
Healthcare Highways, Inc.
August 4, 2026
•
[ ransomware, leak, healthcare ]
Chaos listed Healthcare Highways on its leak site on August 4, 2026 and threatened to publish a 235 GB cache of company and client records if the company did not make contact. The data was subsequently published and was reported to contain protected health information, health insurance claims, and internal corporate documents. Healthcare Highways has not publicly confirmed the incident or independently verified the reported scope of the data.
-
Jared Wray-maintained Keyv, Cacheable and Ecto projects
August 4, 2026
•
[ hack, technology ]
An attacker used a compromised maintainer token to alter the Keyv, Cacheable and Ecto repositories and publish poisoned releases on 4 August 2026. Attacker-associated account activity began by 08:34:57 UTC and the first confirmed malicious package was published at 09:35 UTC.
-
Deliveroo (Roofoods Limited)
August 4, 2026
•
[ hack, technology ]
ChainDrop harvested publishing credentials associated with Deliveroo and used them to publish malicious versions of two npm packages during the automated propagation wave on 4 August 2026. The first malicious publication occurred at approximately 10:33 UTC.
-
Ornikar (Marianne Formation)
August 4, 2026
•
[ hack, malware, technology ]
ChainDrop harvested publishing credentials associated with Ornikar and used them to publish malicious versions across 42 @ornikar package names during the automated propagation wave on 4 August 2026. Malicious publication activity began at approximately 10:19 UTC.
