Full List

Search

Recent Breaches

• LR Reed July 23, 2026 • [ ransomware, leak, technology ] Kairos listed Melbourne property-management company LR Reed on its leak site and claimed theft of 335 gigabytes of data. Published samples appeared to contain identifiable employee and internal company records, supporting that unauthorized data access occurred, although the full volume claim was not independently verified. LR Reed said customer data was segregated and unaffected, its core systems remained operational, and it notified the Australian Signals Directorate and Australian Federal Police.
• Verus-Ethereum Bridge July 23, 2026 • [ hack, technology, finance ] An attacker exploited the Verus Protocol's Ethereum cross-chain bridge on July 23, 2026 by inserting duplicate malicious state-root entries into otherwise legitimate notarizations, then submitting a fabricated import proof that authorized inflated Ethereum withdrawals after a 0.01 VRSC export. Approximately US$7.44 million was drained, swapped into about 2,779 ETH, and deposited into Tornado Cash. Researchers said a different attacker and wallet were involved than in the May bridge exploit; no operational disruption was reported.
• Restaurant Depot, LLC July 23, 2026 • [ ransomware, leak, retail ] Play listed Restaurant Depot on July 23, 2026 and claimed exfiltration of internal files. DataBreach.com later indexed 3,697,383 rows containing personal and contact information associated with the company. Restaurant Depot is a wholesale cash-and-carry foodservice supplier headquartered in College Point, New York. No operational disruption has been independently established.
• Bank of Baroda July 24, 2026 • [ leak, insider, finance ] Threat intelligence attributed the leak-site claim to Triple X, while the material was also advertised under the handle leak-king-F. The bank later confirmed that a compromised employee email account enabled unauthorized access to certain data, but it did not confirm the actor attribution or full leak claim. The incident was contained and the bank said its core banking and transaction systems were not accessed or affected.
• Thialf July 24, 2026 • [ ransomware, financial, technology ] RTL Nieuws identified The Gentlemen as responsible for a ransomware attack against Thialf and reported that the criminals demanded payment to make inaccessible computers available again and to prevent publication of purportedly stolen data. The group claimed to possess internal documents, employee information, financial contracts, and other sensitive data. Thialf confirmed the attack but said its forensic investigation found that data and operational processes were not affected or endangered and that planned events could continue; the claimed data theft therefore remains unverified.
• Triple-A July 24, 2026 Suspicious outflows from Triple-A treasury wallets began on July 24, 2026 and continued for about 31 hours across Ethereum, TRON, Polygon, Arbitrum, Solana, TON, and Bitcoin, with estimated losses reaching US$11.8 million. Triple-A identified unauthorized access July 25 and said the affected wallets belonged to its Singapore entity. Some services entered maintenance mode for approximately three hours as a containment precaution; all services were restored and client funds were unaffected.
• Oceanside Unified School District July 24, 2026 • [ hack, education, technology ] District communications confirmed a network disruption and unavailable services while forensic specialists investigated and restored systems. Internal sources said containment had been underway since July 24, 2026; that date is an onset/response proxy, not a verified intrusion date. The superintendent identified email, internet, Google Drive and ClassLink-related outages. Staff suspicions of database extraction were not confirmed. The attacker, motive, encryption status and recovery completion remain undisclosed.
• Meccha Chameleon development team July 25, 2026 • [ hack, malware, technology ] A Meccha Chameleon system engineer's backup or test PC was infected with malware while the team investigated and patched the malicious-map vulnerability. The attacker used the compromised endpoint to bypass Discord two-factor authentication, change the official server's permissions, ban all staff members, and reduce the server to approximately two visible channels. The developers confirmed through logs that the affected PC could not access or edit the game's source files. The PC was wiped and reformatted, and the development team restored the Discord server and banned the intruders on July 26, 2026.
• French Ministry of National Education (staff-training information system) July 25, 2026 • [ leak, government, education ] On the night of July 25, 2026 an attacker used an impersonated or compromised professional account to enter the French Education Ministry staff-training information system. Security personnel were alerted July 26 and suspended external access to contain the intrusion. Information about ministry staff employed in regional academies since 2001 may have been acquired, and affected personnel were notified. ZeroBytes later claimed much wider education data theft and published alleged samples, but the ministry had not confirmed that claimed student population or data volume. This intrusion is distinct from the ministry COMPAS breach in March 2026.
• Académie de Créteil July 25, 2026 • [ hack, leak, government ] France's Acadmie de Crteil confirmed on Sept 22, 2026 that student and guardian data from its student databases and staff directory were exfiltrated in the July 2026 hack of Education Ministry systems. Hacker ZeroBytes claimed Crteil data in August; victim count undisclosed.
• City of Plymouth Water and Sewer Utility July 26, 2026 • [ hack, espionage, energy ] Beginning at approximately 7:30 p.m. on July 26, 2026, Plymouth lost SCADA communications with cellular-connected programmable logic controllers at two water towers and 14 sanitary-sewer lift stations. A second facility stopped communicating shortly after midnight, prompting a coordinated response. The city disconnected affected equipment, used manual site checks and procedures, hard-reset and secured systems location by location, and restored normal communications by the afternoon of July 28. Water levels, pressure, treatment, quality, and delivery remained unaffected. No data theft, ransom demand, or specific actor was disclosed. U.S. intelligence agencies preliminarily assessed that Iran was likely responsible for the coordinated Minnesota campaign, but attribution was not final.
• Novum Energy Trading, Inc. July 26, 2026 • [ ransomware, energy ] Global Secret Group listed Novum Energy on July 26, 2026 and threatened publication unless the company negotiated. DataBreach.com's verified searchable dataset confirms a data compromise. No public victim statement, regulator notice, or incident-specific report confirming encryption, unavailable systems, or interrupted trading or logistics operations was located as of August 12, 2026.
• District of Columbia Public Schools July 26, 2026 An unauthorized party accessed student data in a web-based application used for DCPS Summer Learning registration. DCPS removed the student information, involved the D.C. Office of the Chief Technology Officer and law enforcement, and reported no known misuse. ExfilSquad listed DCPS on July 26, 2026. Resecurity later linked the breach to the financially motivated extortion group and reported approximately 60,000 records; it found that the publicly released material contained sanitized artifacts for selected records rather than children's complete records.
• Indonesian Army (TNI AD) July 26, 2026 • [ hack, government, technology ] Dozens of Indonesian Army subdomains were defaced nearly simultaneously on July 26, 2026, with original pages replaced by a message reading hacked by azraelzer0d4y. Defacement archives associate the handle with the team m0z1ll4s. By July 29, some subdomains had returned to normal while others remained defaced or inaccessible. The Army acknowledged the reported cybersecurity disturbance and said it was investigating the cause and impact; no political message, data theft, or specific exploitation method was reported.
• Love, Bonito July 26, 2026 • [ leak, retail, misconfiguration ] Love, Bonito identified a vulnerability in its website on July 26, 2026 that allowed unauthorized access to some customer account information. The company contained and fixed the vulnerability the same day, notified affected customers on July 30, and reported the incident to law enforcement and data-protection authorities. No attacker, technical vulnerability, affected-customer count, record count, data volume, or confirmed exfiltration was disclosed. No credible threat-actor claim or publicly indexed dataset was located; references to more than 5,000 affected customers concern Love, Bonito's separate 2019 breach.
• Chess.com July 26, 2026 • [ leak, technology ] Records in the released dataset were collected in daily batches between July 26 and August 3, 2026. The dataset contained more than 7.3 million Chess.com user records, including non-public email information and internal advertising-audience fields. The forum account V0idix distributed the resulting dataset for free, but available evidence does not establish that V0idix performed the collection. No passwords or password hashes were observed, and the precise acquisition method was not conclusively established.
• VIAVI Solutions Inc. July 26, 2026 • [ leak, technology ] ExfilSquad listed VIAVI Solutions on July 26, 2026 and claimed approximately 430,000 records containing customer and partner contact information, personal information, and enterprise account identifiers. DataBreach.com subsequently indexed 351,833 rows associated with the company. VIAVI has not publicly confirmed the incident, and no operational disruption has been established.
• City of Atlanta July 26, 2026 • [ leak, government ] ExfilSquad listed the City of Atlanta on July 26, 2026 and claimed approximately 3 million records from city systems, including citizen service requests, addresses, municipal case histories, and internal case-management information. DataBreach.com subsequently indexed 701,869 rows associated with the city. The City of Atlanta has not publicly confirmed the incident, and no operational disruption has been established.
• WESCO International, Inc. July 26, 2026 • [ leak, hack, technology ] WESCO investigated unauthorized access involving its cloud-based customer relationship management environment after ExfilSquad claimed theft of approximately 2.6 million customer and employee records. DataBreach.com indexed 491,427 rows associated with the incident. WESCO reported no evidence of ransomware or malware on its internal systems and said business operations were unaffected.
• Newcastle University July 26, 2026 Newcastle University was alerted on July 27, 2026 and determined that a configuration issue affecting a connection to an admissions system enabled unauthorized access to limited contact information. ExfilSquad had publicly listed the university on July 26. The university found no evidence of ransomware, malware, broader infrastructure compromise, admissions information, or examination results being accessed. DataBreach.com indexed 425,677 rows.