-
Contact Group
July 31, 2026
Tasmanian building services firm Contact Group confirmed a cyberattack on part of its IT environment. CMD Organization claimed 3 TB stolen, auctioned it from late July 2026 and posted drivers' licences and addresses. Operations were not disrupted; the OAIC was notified.
-
Manchester Airports Group
August 1, 2026
•
[ leak, technology ]
Manchester Airports Group confirmed on August 27, 2026 that attackers obtained customer data related to parking, lounges, Fast Track and airport Wi-Fi. HIBP records approximately 8.8 million affected email addresses and attributes the publication to FulcrumSec. Airport operations were unaffected and payment details were not held in the accessed system. The exact intrusion day is unknown; August 1 is the month-only coding convention, not an observed attack date.
-
Lumenis Ltd.
August 1, 2026
•
[ hack, leak, healthcare ]
ShinyHunters claimed it compromised Lumenis and obtained more than 1.1 million customer and employee records along with more than 176GB of internal corporate data, threatening publication unless the company engaged by August 4. DataBreach.com subsequently indexed 592,328 leaked rows. The larger attacker-claimed figures have not been independently confirmed, and no operational disruption has been established.
-
Questel SAS
August 1, 2026
•
[ phishing, technology, leak ]
Questel confirmed that a voice-phishing call resulted in unauthorized access to part of its Microsoft 365 environment, specifically a Sales SharePoint site. ShinyHunters subsequently published data after an unsuccessful extortion attempt. Independent analysis identified 1,226,209 unique email addresses in the released corpus. Questel said its production tools and intellectual-property platforms were not accessed and operations continued normally.
-
Alcon Inc.
August 1, 2026
ShinyHunters named Alcon in an August 2026 pay-or-leak campaign and claimed access to more than 25 million Salesforce records and internal files. Data was subsequently published, and independent breach repositories identified approximately 218,000 unique email addresses with names, phone numbers, and physical addresses. Alcon has not publicly confirmed the attacker's broader claimed scope.
-
City of Norcross
August 1, 2026
The City of Norcross identified a ransomware incident on August 1, 2026 and reported that certain municipal computer systems were affected. Most systems and services were operational by August 28, although limited disruptions remained possible. Officials had not disclosed the intrusion start, whether files were encrypted or copied, a ransom demand, or the responsible operation. The specific disruptive subtype remains undetermined.
-
Undisclosed Indiana MyChart user
August 1, 2026
•
[ phishing, financial, healthcare ]
An Indiana MyChart user reported to the Federal Trade Commission that a phishing email impersonating MyChart offered a free Medicare first-aid kit in exchange for completing a survey and paying $9.95 shipping. After the victim submitted payment information, the card was charged $9.95 and then immediately charged another $29.95 by a separate scam company. The complaint confirms successful acquisition and fraudulent use of payment data within the broader coordinated MyChart impersonation campaign. MyChart and Epic were not themselves breached.
-
Hyundai Motor Türkiye Otomotiv AŞ
August 1, 2026
•
[ sqlinjection, leak, automotive ]
An attacker exploited a SQL injection vulnerability in a web application used by Hyundai Motor Trkiye, obtaining personal data belonging to employees and job applicants. Hyundai detected the breach on August 1, 2026, and its data processor confirmed it on August 3. CRPx0 later claimed Hyundai among its victims and offered associated data for sale; the claimed assessment data is consistent with the categories disclosed to Trkiye's data protection authority.
-
Direction générale des Finances publiques (DGFiP)
August 1, 2026
•
[ leak, misconfiguration, government ]
A third, distinct incident affected the DGFiP portal for unclaimed/vacant estates. DGFiP identified a technical vulnerability in this portal on August 17, 2026 and confirmed that an unauthorized party had extracted data; the intrusion may have predated discovery. The exact access date, identity of this intruder, and number of records obtained were not established; the government described the affected information as publicly available.
-
Uttarakhand Information Technology Development Agency (ITDA) / State Data Centre
August 1, 2026
•
[ hack, malware, misconfiguration ]
On August 1, 2026, the Uttarakhand Information Technology Development Agency detected malware on government web servers and temporarily disconnected multiple state department websites to contain the suspected attack. Initial reports identified approximately 10 affected departmental portals, including the Chief Minister Relief Fund website; services returned over the following hours. The agency subsequently said no unauthorized data access or theft was found, and attributed some application failures to configuration errors rather than malware. No ransomware encryption, extortion demand or perpetrator was confirmed. This incident is distinct from the October 2024 Uttarakhand State Data Centre attack.
-
Ambition DX Holdings Co., Ltd.
August 1, 2026
•
[ ransomware, retail ]
The SETTRA ransomware group claimed in August 2026 to have stolen 437 GB of data from Ambition DX Holdings, a Tokyo-based real estate leasing and property management company. The company's response was not reported.
-
Cartrack
August 1, 2026
The Dire Wolf ransomware group claimed to have stolen 100 GB of data from Cartrack, a South African fleet management and vehicle tracking software provider, listing it on its leak site in early September 2026. Cartrack's response was not reported.
-
Ministry of Ecological Transition
August 1, 2026
•
[ hack, leak, government ]
France's Ministry of Ecological Transition confirmed a sophisticated late-Aug 2026 attack on its messaging tools; email services and regional sites were disrupted. An actor called 'mondial' claimed theft of 22,000+ records. A complaint was filed and ANSSI is investigating.
-
Zenith Technology Corporation Limited
August 1, 2026
Zenith Technology (ZenTech), a Dunedin, New Zealand clinical-trial research firm, had files stolen in an August 2026 attack claimed by ransomware group ZaWoo, which posted samples online. ZenTech and Health NZ confirmed the incident; police are investigating.
-
Baltaş Grubu
August 1, 2026
Turkish HR assessment firm Balta Grubu (Baltas Online) was hacked; actor WInQ7wk9sA3a claimed in late July 2026 to have stolen 500+ GB over 47 days of root access, incl. data on 700,000+ candidates of 750+ client firms, for sale on the dark web. BTK reportedly fined the firm.
-
Novocure
August 1, 2026
•
[ leak, healthcare, technology ]
Novocure, a cancer treatment device maker, said on 1 Sep 2026 that unauthorized access to some systems in mid-August exposed internal IDs of 1,400+ U.S. patients plus provider and employee contacts. ShinyHunters reportedly leaked a 33GB archive. Systems stayed functional.
-
Anna's Archive
August 1, 2026
•
[ hack, technology, education ]
Shadow library Anna's Archive suffered prolonged outages in August 2026 that it attributed to a coordinated, targeted network attack by an unidentified group. The site recovered, said it took steps to address the attack and credited members extra days for the downtime.
-
Undisclosed Colorado water utility
August 1, 2026
Hackers breached one of two small private Colorado water utilities (each serving under 200 people) in late August 2026, changing equipment settings, disabling remote access and alarms and altering pumping cycles. The governor's office said it was brief and resolved.
-
Davayte
August 1, 2026
Davayte, a fundraiser for Ukrainian civilians run by exiled Russian media, said hackers broke into its Stripe/WooCommerce auction payment integration in mid-August 2026, exposing some donor emails and card details. It disclosed Sept 1, rotated keys, notified a European regulator.
-
You Are Not Alone
August 1, 2026
You Are Not Alone, a fundraiser for Russian political prisoners and their families, said hackers broke into its Stripe/WooCommerce auction payment integration in mid-August 2026, exposing some donor emails and card details. Disclosed Sept 1; actor unknown.
