Recent Breaches
-
May 12, 2026 • Islamic Cyber Resistance in Iraq (313 Team), a pro-Iran hacktivist group, claimed it launched a DDoS attack against Spotify's main servers on May 12, 2026, causing disruption to the application, web player, and support site. Spotify publicly acknowledged service issues and later said they were resolved, but public reporting did not show that Spotify confirmed the claimed DDoS attribution. No data theft, account compromise, or operational data exposure was reported.
-
May 12, 2026 • By 2026-05-12, FulcrumSec had contacted Pratiksha Foundation Charitable Trust after compromising educational databases and demanded $750,000 to prevent disclosure. The compromised information included children's medical and mental-health details, travel and location information, and parental income data. The Bombay High Court issued an ex parte interim order on 2026-06-12 restraining FulcrumSec from publishing or disseminating the stolen information and directing service providers to block identifiers used by the group.
-
May 12, 2026 • From May 12 through June 3, 2026, an unauthorized party accessed a Frontier Airlines data-storage account and exfiltrated files containing personal information associated with employees and passengers. Frontier discovered the intrusion on June 18 and notified affected individuals in July. State-regulator reporting put the combined affected population at 11,482. Frontier reported that flights, booking activities, and other business operations continued without interruption. The responsible actor and access method remain unidentified. The separate BobDaHacker API disclosure and ExfilSquad's later claim of 43 GB and approximately 2.4 million records have not been established as this incident and are not included in the coded data effects.
-
May 12, 2026 Symantec's Threat Hunter Team found the Daxin kernel-mode backdoor and the previously undocumented Stupig backdoor on one compromised Windows host at a Taiwan-based subsidiary of a multinational high-tech manufacturer after the host began reporting telemetry on May 12, 2026. An outdated Digiwin single sign-on portal running obsolete Java versions was assessed as the most likely initial-access vector. Stupig enabled pre-login SYSTEM-level command execution and possible credential theft, while Daxin hijacked legitimate TCP connections for covert command-and-control. No named Chinese group or intelligence service, accessed data, or confirmed compromise date before May 2026 was identified; a possible intrusion dating to 2013 remains unconfirmed.
-
May 14, 2026 • On 2026-05-14, unauthorized actors accessed the World Food Programme's Self-Registration Application for Palestine, which Gaza residents used to register for food and cash assistance. The breach exposed names, identification numbers, mobile telephone numbers, and location data associated with approximately 600,000 households. WFP stated that the incident was isolated to the Palestine application, temporarily shut down the platform, contained the intrusion, and strengthened security controls. No actor claimed responsibility, and the access method was not disclosed.
-
May 14, 2026 • Krum Public Library detected unusual network activity on May 14, 2026 and later confirmed a ransomware attack limited to the library environment. Computer access, printing, and Wi-Fi were unavailable, and checkout was temporarily limited to five items. Forensic investigators determined that some library network files had been accessed without authorization, although the city said Social Security numbers and personal financial account information were not affected. NightSpire claimed responsibility and described financial and human-resources data, but the city did not confirm the attribution or claimed contents.
-
May 15, 2026 • Attackers breached internet-connected automatic tank gauge systems serving gas stations in multiple U.S. states by accessing devices that lacked password protection. The intruders altered displayed fuel-level readings but could not change the actual amount of fuel in the tanks, and no physical damage or safety incidents were reported. U.S. officials suspected Iranian state-sponsored actors, but no specific Iranian group was publicly identified.
-
May 15, 2026 • An unidentified actor compromised DHS's Homeland Security Information Network servers and an associated SharePoint environment. From May 15 through May 24, analysts observed altered files on testing and production servers, malicious code executed through a legitimate web-server program, and deleted activity logs, but the activity was dismissed as a false positive. Similar activity continued from May 25 through June 3. On June 4, the attackers installed hidden backdoors and stole credential files, prompting confirmation of the breach. DHS isolated affected systems and mitigated the vulnerability; HSIN remained operational, classified networks were not affected, and neither the actor nor any theft of additional HSIN documents had been established.
-
May 16, 2026 • Beginning on May 16, 2026, an unidentified actor exploited a previously unknown vulnerability in third-party software embedded in KDDI's centrally operated email platform for internet service providers and acquired email-account credentials stored in the shared system. KDDI detected and blocked the unauthorized access on June 17; its investigation confirmed exposure of 12,233,087 email addresses and 7,616,173 associated passwords across services provided to STNet, KDDI Web Communications, JCOM, Chubu Telecommunications, NIFTY, and BIGLOBE. KDDI found no suspicious access beyond the exploited component, and its separate au, UQ mobile, and au one net email systems were unaffected.
-
May 16, 2026 • On 16 May, an HDFC AMC IT administrator detected suspicious activity, and the company received an email from Morpheus claiming to have exfiltrated more than 680 GB of data. HDFC AMC activated containment procedures, isolated affected systems, engaged cybersecurity specialists, and notified regulators and law enforcement. On 29 May, the Bombay High Court restrained Morpheus and others from publishing or using the data. HDFC AMC later said the incident did not interrupt business continuity, did not materially affect its financial results, and did not affect investors' units or portfolio values. The initial access method was not disclosed.
-
May 18, 2026 • Insomnia claimed Mid-Cumberland Human Resource Agency as a victim in June 2026 and threatened publication of stolen information. DataBreach.com indexes 196,568 records and dates the underlying breach to May 18, 2026. MCHRA is a Nashville-based nonprofit providing social, health-support, meals, transit, and related human services. No independently verified operational disruption has been established.
-
May 20, 2026 • An external phishing email compromised two Connecticut Department of Children and Families employee accounts on May 20, 2026, allowing an outside attacker to download emails. State IT personnel removed the attacker the same day, pulled the malicious email from agency inboxes, and temporarily disabled the two accounts. The review and law-enforcement investigation remained active; no operational disruption was reported.
-
May 21, 2026 • On 2026-05-21, a sophisticated social-engineering incident enabled unauthorized access associated with one Fox Rothschild user device. Fox Rothschild stated that the activity was limited to that device and that it found no broader access to the firm's systems or network. Silent Ransom Group claimed responsibility, said it exfiltrated confidential client files, demanded payment, and later published data after the ransom deadline passed. The actor attribution, stolen-data scope, and publication details are based on the group's claim and subsequent reporting.
-
May 22, 2026 • Hackers scammed three Clark County School District employees, accessed their login credentials, and used direct-deposit information to fraudulently withdraw money from the employees accounts.
-
May 23, 2026 • ShinyHunters claimed on May 23, 2026 that it accessed Baker Distributing's Salesforce and SharePoint environments and stole customer, employee, lead, and support-ticket data. The data was subsequently published and indexed, but Baker Distributing did not publicly confirm the actor's full claimed scope. No encryption or operational disruption was documented.
-
May 23, 2026 • DentaQuest confirmed unauthorized access to a limited portion of its network and said it acted to contain the incident. ShinyHunters claimed responsibility and published approximately 234 GB of allegedly stolen data after negotiations failed. Have I Been Pwned identified information associated with approximately 2.6 million accounts. DentaQuest said its systems remained fully operational with limited customer-service disruption but did not publicly confirm the actor's claimed volume or attribution.
-
May 24, 2026 • Orion Telecom experienced a series of DDoS attack waves from 2026-05-24 through 2026-06-07. The company confirmed that the attacks caused service disruptions and affected service quality for some subscribers, with home-internet outages reported from 2026-05-26. Peak attack traffic reached 1.8 Tbps. Orion said layered traffic filtering prevented substantial prolonged service problems. The company declined to identify the attackers. Although it had prepared for possible hacktivist activity around Russia Day, no group claimed the 2026 attacks and the actor type and motive remain undetermined.
-
May 25, 2026 • cmdorganization listed North Dallas Shared Ministries on May 25, 2026 and threatened to publish the full leak unless contacted. DataBreach.com later indexed 188,961 structured records containing personal identifiers and contact information. The organization, now operating as Now-Forward, provides financial assistance, food, clothing, medical and dental care, and other services to low-income residents. Public court dockets show data-breach class-action petitions against the organization, but no victim or regulator notice publicly established the initial access vector, encryption, or operational disruption.
-
May 25, 2026 • The Gentlemen used credentials that an MIP employee had reused on an unrelated service that was previously breached to reach an employee personal laptop and MIP's legacy Atlassian Jira support environment around 25 May 2026. Jira contained screenshots, attachments, personal information and credentials; credentials obtained there also enabled access to certain FTP/SFTP sites. Attackers remained in the environment until detection on 14 June and exfiltrated about 400,000 records. MIP's core policy-administration systems were not compromised. MIP later confirmed paying a substantial ransom for a deletion promise that was not honored.
-
May 26, 2026 • DataBreach.com indexed 936,468 rows associated with Plexsupply and dated the breach to May 26, 2026. PEAR listed the company on its leak site on May 30. Public reporting did not identify the access vector or document encryption or operational disruption.