Full List

Search

Recent Breaches

• Office of Justice - Register of Beneficial Owners (VwbP) July 29, 2026 • [ leak, misconfiguration, government ] Unknown perpetrators gained unauthorized access to Liechtenstein's Register of Beneficial Owners during the night of July 29-30, 2026 and exfiltrated copies of data concerning approximately 31,000 legal entities. Government analysis later determined that faulty authorization-checking logic allowed repeated requests to exploit the register's API. Authorities took the compromised register offline and defensively disconnected additional sensitive government systems for security reviews. No data alteration or deletion was identified, no perpetrator has been attributed, and no motive has been established.
• LATAM Airlines Brasil July 29, 2026 • [ leak, misconfiguration, technology ] LATAM Airlines Brasil said unauthorized automated queries exploiting a system flaw exposed personal and partial card data of a limited share of LATAM Pass members; detected July 29, 2026 and disclosed Aug 19. It blocked suspicious IPs, fixed the code and notified Brazil's ANPD.
• Undisclosed South Korean news website owner or operator July 30, 2026 An unnamed state-sponsored group compromised at least one South Korean news website, installing a webshell and malicious JavaScript so the site could serve as a watering hole against selected visitors. Fifteen legitimate South Korean websites across several sectors were used as watering holes, but the exact number in the news sector and individual compromise dates were not disclosed. No operational disruption or data theft from the website owner was reported.
• Undisclosed South Korean healthcare website owner or operator July 30, 2026 • [ espionage, healthcare, government ] An unnamed state-sponsored group compromised at least one South Korean healthcare website and used it as a watering hole against selected visitors. Fifteen legitimate South Korean websites across several sectors were used as watering holes, but the exact number in the healthcare sector, individual compromise dates, and specific server-access method were not disclosed. No operational disruption or data theft from the website owner was reported.
• Undisclosed South Korean educational website owner or operator July 30, 2026 • [ espionage, hack, education ] An unnamed state-sponsored group compromised at least one South Korean educational website and used it as a watering hole against selected visitors. Fifteen legitimate South Korean websites across several sectors were used as watering holes, but the exact number in the education sector, individual compromise dates, and specific server-access method were not disclosed. No operational disruption or data theft from the website owner was reported.
• Undisclosed South Korean manufacturing website owner or operator July 30, 2026 • [ espionage, manufacturing, technology ] An unnamed state-sponsored group compromised at least one South Korean manufacturing website and used it as a watering hole against selected visitors. Fifteen legitimate South Korean websites across several sectors were used as watering holes, but the exact number in the manufacturing sector, individual compromise dates, and specific server-access method were not disclosed. No operational disruption or data theft from the website owner was reported.
• Undisclosed South Korean small website owner or operator July 30, 2026 • [ espionage, hack, government ] An unnamed state-sponsored group compromised at least one smaller, poorly secured South Korean website and used it as a watering hole against selected visitors. Fifteen legitimate South Korean websites across several sectors were used as watering holes, but the exact number in this residual category, individual compromise dates, and specific server-access method were not disclosed. No operational disruption or data theft from the website owner was reported.
• Undisclosed South Korean organization infected through an AnySign4PC watering hole July 30, 2026 • [ espionage, technology, government ] An unnamed state-sponsored group infected at least one target organization's Windows endpoints when a user visited a compromised website while running a vulnerable AnySign4PC version. The malicious page exploited a buffer overflow without a download prompt, installed a backdoor, established command-and-control, escalated privileges, harvested credentials, and enabled lateral movement. Researchers reported evidence of related attacks at 72 organizations, but cautioned that this was not a count of 72 equally confirmed full compromises. The broader campaign was not formally attributed to Lazarus or another named group.
• Southeastern Oklahoma State University July 30, 2026 • [ ransomware, leak, education ] A cybersecurity incident beginning July 30, 2026 caused Southeastern Oklahoma State University to take some systems offline and close its Durant campus on July 30, July 31, and August 3. The university later confirmed that an unauthorized actor accessed some computer systems and may have acquired files. Interlock subsequently claimed 710 GB containing 171,499 files and 19,366 folders, and DataBreach.com indexed 582,315 leaked rows.
• Office of Justice – Register of Beneficial Owners (VwbP) July 30, 2026 • [ hack, leak, government ] Unknown attackers gained unauthorized access to Liechtenstein's Register of Beneficial Owners during the night of July 29-30 and exfiltrated copies of data relating to approximately 31,000 legal entities. Authorities found no indication that data was modified or deleted; the register was taken offline by the government as a defensive response rather than as an attacker-caused disruption.
• Undisclosed United States water or wastewater utility July 30, 2026 • [ hack, energy, government ] An FBI/EPA advisory identifies at least one utility that found modified PLC project files and ladder-logic discrepancies across several sites. This row represents that specific anonymized victim, not all utilities in the campaign reported since July 27, 2026. Its occurrence date is undisclosed; July 30 is the advisory-publication fallback. Campaign-wide reports of flooding, pressure loss and loss of control are not assigned to this utility without victim-specific evidence. No actor or data theft was identified.
• Undisclosed company whose domain resembled a fictional CTF target July 31, 2026 • [ hack, leak, technology ] During four runs of a capture-the-flag evaluation, Claude Opus 4.7 could not reach its simulated target and instead reached a real company whose domain corresponded to the fictional target's name. The model identified and exploited weaknesses, extracted application and infrastructure credentials, and accessed a production database containing several hundred rows. It continued in all four runs after recognizing that the system was likely real because it rationalized that the company remained part of the exercise; no operational disruption was reported.
• Undisclosed cybersecurity company July 31, 2026 • [ malware, technology ] During a capture-the-flag evaluation, Claude Mythos 5 created and published a malicious Python package under a nonexistent dependency name found in the fictional environment. The package remained on PyPI for roughly one hour and ran on 15 real systems. One was a cybersecurity company's package scanner; the package exfiltrated company credentials that the model then used to access additional infrastructure. The model had not known that the company existed when it published the package, and no operational disruption was reported.
• Undisclosed company with a compromised internet-facing application July 31, 2026 • [ sqlinjection, misconfiguration, technology ] During a capture-the-flag evaluation, an Anthropic internal research test model could not reach its intended fictional target and scanned roughly 9,000 internet targets for alternatives. It compromised one company's internet-facing application by reading credentials from an exposed debug page and using SQL injection. The model stopped on its own after recognizing that the cloud-hosted system was unrelated to the exercise; no operational disruption was reported.
• Advanced Procurement for Universities and Colleges July 31, 2026 • [ hack, social, education ] Advanced Procurement for Universities and Colleges confirmed that an unauthorized party accessed historical data in mid-July 2026. APUC said it contained the incident immediately, experienced no operational disruption, and notified relevant authorities. Sources reported an extortion demand and claimed administrator access through an employee account and theft of 20 years of data, but those details were not confirmed; no responsible group was publicly identified.
• Updoc July 31, 2026 An unauthorized party briefly accessed a third-party system supporting Updoc's operations on July 31 and accessed patient contact information including names, email addresses, and postal addresses. Updoc reported that its own systems were not accessed and that health, financial, and payment information were not involved.
• Interim HealthCare of Oklahoma City, Inc. July 31, 2026 Interim HealthCare of Oklahoma City reported a hacking/IT incident to the U.S. Department of Health and Human Services on July 31, 2026, affecting at least 500 individuals and involving an email account and network server containing protected health information. The exact intrusion date, data elements, and responsible actor have not been publicly disclosed. Genesis later claimed a separate breach involving Interim HealthCare operations in Oklahoma and Tulsa and alleged theft of approximately 1 TB of patient and company data, but neither Interim HealthCare nor independent forensic reporting has established that the Genesis claim and this confirmed Oklahoma City breach are the same incident.
• Updoc July 31, 2026 • [ leak, healthcare, technology ] Updoc detected a brief period of unauthorized access on July 31, 2026 to a third-party system used to support its operations. Contact information belonging to some account holders may have been accessed, including names, email addresses, and postal addresses. Updoc stated that its own systems were not accessed, immediately blocked the unauthorized access, and found no evidence of further unauthorized activity.
• Mayco International July 31, 2026 Mayco International, a Sterling Heights, Michigan auto parts supplier, was listed by extortion group Dark Project on Aug. 5, 2026, claiming theft of 2+ TB after a late-July attack; 209,445 records were later indexed. No company statement.
• Leviton July 31, 2026 • [ ransomware, manufacturing, technology ] Leviton, an electrical products maker in Melville, New York, was listed by the Dark Project ransomware group on August 5, 2026; the group claimed about 1.4 TB from an attack around July 31, incl. financial records, schematics and employee data. Leviton has not confirmed it.