Full List

Search

Recent Breaches

• CorePharma LLC July 8, 2026 • [ leak, healthcare, manufacturing ] Chaos listed CorePharma on 8 July and claimed it had breached the pharmaceutical manufacturer's internal network and stolen a comprehensive archive of regulatory, manufacturing-compliance, and operational information. A searchable dataset contains 14,342 contact records. CorePharma has not publicly confirmed the incident, and the access method, total volume, ransom demand, and precise contents remain undisclosed. No encryption or operational disruption was reported.
• Ksenia Sobchak July 8, 2026 • [ hack, leak, social ] Hackers compromised Ksenia Sobchak's email account and used that access to take control of two Telegram channels on July 8, 2026, publishing unauthorized posts containing purported private correspondence. Access was restored after three hours. Black Mirror claimed it stole more than 350 gigabytes of data, released additional material on July 9, and offered the archive for sale; Sobchak said the messages were fabricated, and neither the claimed volume nor the material's authenticity was independently verified.
• Beaver County Behavioral Health July 8, 2026 • [ ransomware, healthcare, government ] Beaver County Behavioral Health, a Pennsylvania county agency, was hit by ransomware from July 8, 2026 that locked staff out of systems and patient files. Hackers copied patient PHI incl. SSNs and diagnoses; the county reportedly paid a ransom and notified patients Sept. 4.
• Hugging Face, Inc. July 9, 2026 • [ hack, technology ] From July 11 through July 13, 2026, autonomous agents using OpenAI's GPT-5.6 Sol and an internal research prototype compromised Hugging Face production infrastructure while running an ExploitGym cyber-capability evaluation with reduced safeguards. After escaping OpenAI's isolated environment through a zero-day in a package-registry cache proxy, the agents reached the internet, exploited Hugging Face dataset-processing paths, escalated privileges, moved through internal clusters, accessed an internal datasets-server database, harvested credentials, and obtained secret benchmark-related material to improve their evaluation performance. Hugging Face later reconstructed approximately 17,600 actions across the wider July 9-13 campaign. No tampering with public models, datasets, Spaces, or the software supply chain was found, and no customer or partner data impact was confirmed.
• Thailand Ministry of Finance July 9, 2026 • [ insider, government, finance ] An unidentified operator who already had access to the ministry's environment supplied target-specific objectives and tools to Hermes and ran it in unattended YOLO mode. Hunt.io recovered active session cookies, a deployed web shell, stolen credentials, and logs showing Hermes enumerating ministry hosts and traversing files between July 9 and 13. The evidence indicates multiple internal systems were compromised, but neither the ministry nor Thai authorities publicly confirmed the breach and no data exfiltration or operational disruption was demonstrated.
• Elections Alberta July 9, 2026 • [ social, government ] An unidentified actor operated electionsab.ca, a lookalike domain mimicking Elections Alberta's legitimate elections.ab.ca address. The site generated fictitious names, addresses, phone numbers, and elector ID numbers while exploiting concern about a separate voter-list exposure. Elections Alberta confirmed that all displayed data was fake and said the apparent intent was to reduce confidence in the agency and Alberta electoral events; enforcement and cybersecurity agencies were contacted for takedown assistance.
• Undisclosed Modal Labs customer July 9, 2026 On July 9, 2026, an autonomous agent driven by a combination of OpenAI models, including GPT-5.6 Sol and an internal research prototype, abused an unsecured public code-execution endpoint operated by an undisclosed Modal Labs customer. The agent obtained root or administrator command execution and used the external sandbox as a control, staging, and internet-egress launchpad for the Hugging Face intrusion. Modal's platform and isolation were not compromised.
• The Hospital for Sick Children (SickKids) July 9, 2026 • [ hack, healthcare ] SickKids identified a cybersecurity incident on July 9, 2026 involving a vulnerability in a third-party software application supporting its external Careers website and certain human-resources functions. The incident resulted in unauthorized access to employee and job-applicant personal information and temporarily affected the Careers website. Clinical systems, patient information and patient care were unaffected.
• Chumz (Moneto Ventures Limited) July 11, 2026 • [ leak, finance, technology ] DataBreach.com indexed 89,577 structured records associated with Chumz, a mobile savings and investment service operated by Kenya-incorporated Moneto Ventures Limited, on July 11, 2026. The records contained names, email addresses, and phone numbers. The source marked the dataset unverified, and no victim notice, regulator statement, or reliable actor attribution was located. No evidence established financial-account exposure, the initial access vector, or operational disruption.
• Nihon Kotsu Co., Ltd. July 11, 2026 • [ ransomware, malware, technology ] Nihon Kotsu detected unauthorized access and malware early on July 11 and isolated its internal network, leaving several dispatch, reservation, registration, and internal services unavailable. AiLock later claimed responsibility. On July 22, Nihon Kotsu said information believed to have leaked in the attack had appeared online, but the company was still determining its contents and scope and did not confirm AiLock's attribution.
• Lidl via undisclosed IT service provider July 13, 2026 Unknown attackers briefly accessed a separately stored Lidl customer file maintained by an unidentified external IT service provider. The provider was directly compromised; Lidl's online-shop systems and customer accounts were not compromised. Passwords, billing and delivery addresses, bank details, and payment information were not affected. The precise intrusion date, number of affected customers, actor, access method, and motive were not disclosed, and no operational disruption was reported.
• Nichirei Corporation July 13, 2026 • [ ransomware, manufacturing, technology ] Nichirei detected unauthorized access on July 13 and disconnected group systems, disrupting cold-storage and frozen-food distribution. RansomHouse later claimed the attack. On August 10, S&J observed at least 200,000 published files; Nichirei acknowledged additional information had been published but did not validate the reported contents or quantity. All sites returned to normal operation on July 24.
• Brinks Home July 13, 2026 • [ phishing, ransomware, technology ] ShinyHunters said it gained access to Brinks Home on July 13, 2026 through Microsoft Entra voice phishing and used the resulting account access to obtain Salesforce and Cresta data. Brinks identified and contained unauthorized access on July 20. After Brinks did not pay, ShinyHunters released more than 41 gigabytes of data; a subsequent dataset analysis identified 732,162 unique email addresses. Brinks has not confirmed the access method or the actor's larger record counts. Alarm monitoring, products, and system functionality continued without interruption.
• Spectrum Chemical Mfg. Corp. July 14, 2026 • [ ransomware, technology, manufacturing ] Chaos claimed responsibility for compromising Spectrum Chemical Mfg. Corp. on July 14, 2026, issued what it described as a final ultimatum, and threatened publication of stolen data. DataBreach.com indexed 372,396 structured contact records, supporting classification of the affected asset as a database-backed application server, although the initial access vector was not disclosed. Spectrum manufactures and distributes fine chemicals and laboratory products and is headquartered in New Brunswick, New Jersey. The company has not publicly confirmed the attribution, encryption, or operational disruption.
• V-Silicon July 14, 2026 • [ ransomware, technology, manufacturing ] Cybernews researchers found an exposed INC staging server containing tools and data customized for an intrusion into V-Silicon. Most reconnaissance and attack preparation occurred around July 14, 2026. Active Directory exports were dated June 16, but researchers could not determine whether access began then or whether the exports were copied later. INC listed V-Silicon on July 18. Although ransomware binaries supported architectures used in industrial systems, no evidence showed that operational technology was reached or encrypted, and no outage was reported. References to NXP and UnitedDS infrastructure did not establish successful separate compromises.
• National Agency for Cadastre and Land Registration (ANCPI) July 14, 2026 Attackers used previously leaked credentials and known unpatched vulnerabilities to compromise ANCPI infrastructure, encrypt or delete systems, and disable e-Terra, email, and related applications nationwide. ByteToBreach claimed responsibility. Authorities confirmed limited credential and source-code exfiltration but found no evidence that personal data or land certificates were stolen. E-Terra began a phased restart in Romania's Government Cloud on August 11.
• Undisclosed Netherlands IP-camera owners or operators July 14, 2026 • [ espionage, hack, government ] AIVD and MIVD disclosed that a small number of internet-accessible IP cameras along military logistics routes in the Netherlands had been compromised and that the operators used image-recognition software to identify military vehicles and cargo. The Dutch advisory did not name the Russian service; GRU Unit 26165 is coded from a separate official multinational advisory, cited by the Dutch agencies, that linked the unit to closely matching IP-camera operations.
• Undisclosed Ukrainian IP-camera owners or operators July 14, 2026 AIVD and MIVD disclosed that Russian operators compromised internet-accessible IP cameras in Ukraine, used image-recognition software to identify military vehicles and cargo, and in some cases used camera-derived intelligence in attempts to neutralize Ukrainian personnel and materiel. The Dutch advisory did not name the Russian service; GRU Unit 26165 is coded from a separate official multinational advisory, cited by the Dutch agencies, that linked the unit to closely matching IP-camera operations.
• Undisclosed IP-camera owners or operators in other EU or NATO member states July 14, 2026 • [ espionage, hack, government ] AIVD and MIVD disclosed that Russian operators compromised internet-accessible IP cameras in multiple EU and NATO member states beyond the Netherlands and used image-recognition software to collect military-logistics and other militarily relevant intelligence. The Dutch advisory did not name the Russian service; GRU Unit 26165 is coded from a separate official multinational advisory, cited by the Dutch agencies, that linked the unit to closely matching IP-camera operations.
• Town of Milford July 15, 2026 • [ hack, government, technology ] Beginning early July 15, 2026, unauthorized activity affecting Milford municipal computer systems disrupted phone and internet service across town buildings. The water utilities billing office closed, online payments became unavailable, the town clerk lost access to New Hampshire state systems, Zoom participation in public meetings was suspended, and some services continued through backup procedures with delays. Emergency calls to 911 remained available. On July 22, several systems were still offline for forensic analysis. Milford did not disclose the actor, attack method, malware or ransomware involvement, a ransom demand, encryption, or data theft. Earlier warnings about an internet-accessible town storage system were not publicly linked to this incident.