-
Live! Casino
April 23, 2026
DataBreach.com indexed a structured dataset attributed to LockBit 5.0 under the Live! Casino name and dated it April 23, 2026. The material contained 1,786,224 rows of personal data, supporting classification of the affected asset as a database-backed application server, although the initial access vector was not disclosed. The listing did not identify the specific Live! property or report operational disruption. Separate reporting documented a Medusa claim against Live! Casino Pittsburgh in March and litigation concerning approximately 44,000 people associated with Cordish-operated Live! properties, but public evidence does not establish that those matters and this LockBit 5.0 dataset arose from the same compromise.
-
GO2 Health
April 24, 2026
•
[ phishing, healthcare, leak ]
A phishing attack enabled unauthorized access to GO2 Health's main email mailbox on April 24, 2026. The clinic engaged specialists, contained the incident, reset credentials associated with delegated mailbox access, notified the Office of the Australian Information Commissioner on May 18, and began notifying affected patients on July 16. Automatic archiving limited exposed email to the preceding 12 months, and the primary patient-information system was not accessed.
-
NTN Bearing Corporation of America
April 24, 2026
•
[ ransomware, manufacturing, leak ]
PayoutsKing claimed it compromised NTN Bearing Corporation of America and threatened publication of stolen data. Ransomware tracking places the estimated attack on April 24, 2026 and the public claim on May 13. DataBreach.com later indexed 115,671 leaked rows containing personal and contact information. No independently verified operational disruption has been established.
-
GO2 Health
April 24, 2026
•
[ phishing, healthcare ]
A phishing attack compromised GO2 Health's main email mailbox in April 2026. Investigation found that information contained in the mailbox may have been accessed, including some patients' Department of Veterans' Affairs identification numbers and other information patients had sent by email. The affected mailbox retained approximately 12 months of email. GO2 Health stated that its primary patient-record system was not accessed, notified the Australian privacy regulator on May 18, and notified affected patients in July.
-
University of Iowa
April 25, 2026
University of Iowa student data (usernames, emails, enrollment info) was exposed in the ShinyHunters breach of vendor Instructure's Canvas platform, disclosed May 2026; its Canvas-based ICON system was offline for hours on May 7. UI later sought incident-response services.
-
Iowa State University
April 25, 2026
•
[ leak, education, technology ]
Iowa State University student data (usernames, emails, enrollment info) was exposed in the ShinyHunters breach of vendor Instructure's Canvas platform, disclosed May 2026; ISU lost Canvas access on May 7 until the next morning amid the nationwide outage.
-
The Walman Optical Company
April 27, 2026
•
[ ransomware, manufacturing, healthcare ]
Medusa publicly claimed Walman Optical on April 27, 2026. DataBreach.com subsequently indexed 690,400 records containing personal and identity information associated with the company. Multiple federal data-security lawsuits were filed against Walman in May 2026 following the incident. Federal contracting and environmental records identify Walman's primary activity as ophthalmic goods manufacturing. No independently verified operational disruption has been established.
-
Nephrology Associates, PA
April 28, 2026
Arkansas nephrology practice Nephrology Associates, PA was listed Apr 28, 2026 by extortion group Insomnia, which says it alerted the practice Apr 6 and then leaked patient files. DataBreaches reviewed the leaked data; the practice had made no public disclosure as of Sept 2026.
-
KerberRose Wealth Management, LLC
April 29, 2026
•
[ hack, leak, finance ]
An unauthorized third party accessed one KerberRose employee email account on April 29, 2026 and used that access to reach a limited portion of a backup platform supporting KerberRose Wealth Management. KerberRose discovered the incident on May 1 and notified 27,076 affected individuals. Its accounting and tax services were not affected. The actor and motive were not identified.
-
Data Exchange Corporation
April 30, 2026
PayoutsKing listed Data Exchange Corporation on April 30, 2026 and threatened to publish stolen data unless contacted. DataBreach.com dated the indexed leak to May 13 and later indexed 12,429,335 rows. Because the actor's public claim establishes that data had been acquired by April 30, that date is used as the event date. Public reporting did not confirm encryption or operational disruption.
-
National Federation of SubPostmasters (NFSP)
April 30, 2026
•
[ ransomware, technology, misconfiguration ]
Attackers exploited a vulnerability in cPanel web-hosting software on April 30, 2026 and deployed ransomware against the National Federation of SubPostmasters' website environment. The attackers locked files and demanded payment for their release. NFSP reported no known data loss, but technical problems were still ongoing on June 2 and the Post Office temporarily paused email exchanges with NFSP as a precaution. Post Office branches and customer-facing postal services were not affected.
-
At least one business traveler
May 1, 2026
•
[ phishing, malware, espionage ]
Attackers manipulated hospitality captive-portal traffic to redirect at least one business traveler to credential-phishing and malware infrastructure. Microsoft later attributed the CaptiveCrunch campaign to the SVR-linked Midnight Blizzard cluster and confirmed endpoint collection and exfiltration; no operational disruption to the traveler was reported.
-
Revolut Bank UAB
May 1, 2026
•
[ social, finance, government ]
Attackers used a compromised certified email account belonging to an Italian Interior Ministry office to submit fraudulent law-enforcement requests to Revolut Bank UAB. By early May 2026, published correspondence shows Revolut had already sent customer data in response to the requests; the exact first disclosure date is not known, so event_date uses the first day of the earliest month in which successful disclosure is evidenced. Revolut said its own systems, databases and customer funds were not compromised. Multiple parties later claimed responsibility, so the specific actor remains unverified.
-
Digital Agency (Government Solution Service, GSS)
May 1, 2026
An unauthorized actor exploited a vulnerability in a VPN network connection device of the Japanese Digital Agency Government Solution Service and used a maintenance or operations account to access large quantities of server files. The activity reportedly began in late May 2026, was detected on June 25 and confirmed as intrusion on July 9. Potentially exposed files concern government personnel and external contractors from 23 participating organizations. The agency disabled the compromised account and VPN access and did not identify a perpetrator or confirm secondary misuse. All 23 organizations are served through one compromised shared GSS environment.
-
Herbert Smith Freehills Kramer (US) LLP
May 1, 2026
•
[ financial, hack, leak ]
Herbert Smith Freehills Kramer confirmed unauthorized access to a limited portion of its U.S. IT environment discovered in late May 2026, and notified people whose sensitive information could have been compromised. The exact access path, initial compromise day, offender and final record count were not disclosed; May 1 is a month-only coding placeholder. Criminal is inferred from deliberate unauthorized access; Financial is the most likely motive under the private-law-firm targeting heuristic given the value of confidential client and personal data, without direct evidence of a ransom demand or data sale.
-
Accretech America, Inc.
May 4, 2026
On May 4, 2026, ransomware affected some Accretech America systems and temporarily disrupted operations in the U.S. division. The company shut down its network, suspended various systems, notified authorities, and engaged outside specialists. Accretech later notified employees that information belonging to employees and their dependents had been exposed. AiLock claimed responsibility on May 11, and the supplied breach database indexed 13,095 leaked records. The initial-access method and exact duration of the disruption were not disclosed; other Tokyo Seimitsu group companies were not affected.
-
Scope Systems Pty Ltd
May 5, 2026
•
[ ransomware, technology ]
On May 5, 2026, an unidentified ransomware actor accessed Scope Systems' network, encrypted its hosted client servers, and disrupted customer access to Pronto Xi, its support portal, APIs, and other cloud services. The actor remained in the network for less than 24 hours and exfiltrated data from Scope Systems' internal file server, while Scope reported that data stored on client servers was not accessed and restored all client servers from backups by May 17.
-
Champaign-Urbana Public Health District
May 6, 2026
•
[ ransomware, healthcare, government ]
Champaign-Urbana Public Health District detected suspicious network activity on May 7, 2026. Its investigation determined that an unauthorized actor copied files from its computer network between May 6 and May 7. Reporting during the incident indicated that its primary website was disrupted and an alternate site was used. INC Ransom claimed responsibility and threatened to release data, but the district did not publicly confirm the attribution, encryption, or the number of affected individuals.
-
Monongalia County General Hospital Company
May 6, 2026
•
[ phishing, healthcare ]
Monongalia County General Hospital Company discovered on May 6, 2026, that a small number of email users had been targeted in a successful phishing attack. A forensic investigation determined that an unauthorized party accessed certain Mon General email mailboxes on May 6 and that access was terminated the same day. No other hospital systems or data storage were affected. Mon General mailed notices to individuals whose patient information may have been contained in the mailboxes and offered two years of credit monitoring.
-
Heights Finance Holdings Co.
May 7, 2026
•
[ leak, misconfiguration, finance ]
Heights Finance discovered on May 7, 2026 that an unauthorized actor had gained access to a third-party cloud platform used to store customer information and may have viewed or copied data. The incident was limited to that platform and did not affect Heights' loan-management systems, other computer systems, networks, or operations. State notifications establish at least 1,221,338 affected individuals. Heights said its dark-web monitoring had found no evidence that the stolen information had been shared, and no known ransomware or extortion group has claimed responsibility.
