-
See's Candies, Inc.
April 11, 2026
•
[ ransomware, leak, retail ]
An unauthorized actor accessed portions of See's Candies' network from April 11 through April 13, 2026. See's discovered the activity on April 12 and determined that the actor acquired files before encrypting files on a subset of servers; at least some stolen files were later published on the dark web. Qilin publicly claimed the company. Subsequent regulatory filings report 23,737 affected individuals, while DataBreach.com separately indexed 112,767 rows.
-
Undisclosed Middle Eastern manufacturing company
April 11, 2026
•
[ ransomware, manufacturing, technology ]
Kaspersky reconstructed initial VPN access using compromised credentials on April 11, 2026, data theft on April 13 and operational disruption beginning April 14. Attackers deployed malicious Active Directory policies that disabled administrator accounts and displayed ransom demands. Stolen information was subsequently published. No Windows file encryption was confirmed. PAYLOAD identifies the associated ransomware family and malicious policy; the operator was not separately identified. April 11 dates initial access, not the first confirmed data theft. The victim's country and recovery duration were not disclosed.
-
Ralph Lauren Corporation
April 12, 2026
CoinbaseCartel listed Ralph Lauren Corporation on April 12, 2026. DataBreach.com later indexed 162,255 rows associated with the event. A separate June 2026 ShinyHunters claim alleged theft of more than 220 GB from Ralph Lauren's Salesforce environment; that later claim is not incorporated into this CoinbaseCartel record. Public reporting did not document encryption or operational disruption in the April event.
-
UN Trade and Development (UNCTAD)
April 13, 2026
•
[ hack, government, technology ]
AI agents a researcher linked to OpenAI hit UNCTAD's UNCTADstat data site over 16,000 times from Apr. 13 to June 19, 2026, using relays and double encoding to bypass API limits and pull trade data, a Sept. 26 report said. OpenAI is reviewing the findings.
-
Carnival Corporation
April 14, 2026
•
[ social, hack, leak ]
Carnival Corporation reported that an attacker used social engineering on April 14, 2026 to gain access to a limited portion of company IT systems and copy personal information. ShinyHunters claimed responsibility and later published Carnival data after failed negotiations. Carnival reported 5,995,277 affected individuals to the Maine Attorney General, while HIBP reported 8.7 million records and 7.5 million unique email addresses. Public reporting did not confirm encryption, data destruction, or operational disruption.
-
Eversource Energy
April 14, 2026
•
[ phishing, social, energy ]
Phishing and social-engineering attacks compromised the credentials of two Eversource Energy employees beginning April 14, 2026. The compromised accounts allowed an unauthorized party to access files containing information belonging to 3,049 customers across Connecticut, Massachusetts, and New Hampshire. Eversource blocked the activity and reported no impact to electric, natural-gas, or water services, customer-information systems, critical operational systems, or infrastructure.
-
Undisclosed organization
April 15, 2026
•
[ ransomware, leak ]
Black Shrantac claimed at least one victim, exfiltrated sensitive data, and deployed ransomware to encrypt files while using a Tor leak site to pressure victims.
-
Ohio Living
April 16, 2026
•
[ ransomware, healthcare, financial ]
Ohio Living detected suspicious network activity on April 17, 2026. Its investigation determined that an unauthorized actor accessed systems and copied files from its network between April 16 and April 17. Ohio Living secured the network and began reviewing the files; no operational disruption was reported, and the 500-person figure reported to HHS was preliminary. On August 5, the Dark Project ransomware group claimed responsibility for an April 2026 attack on Ohio Living and alleged that it stole at least 600 GB, including at least 5,000 files containing employee, patient, medical, insurance, Social Security, financial, and banking information. Ohio Living had not publicly confirmed the attribution or the claimed volume.
-
TriWest Healthcare Alliance
April 16, 2026
TriWest Healthcare Alliance discovered unauthorized network activity on April 16, 2026. An unauthorized person gained limited access to parts of TriWest's network and downloaded beneficiary information. TriWest blocked further access, hired a forensic expert, notified authorities, and strengthened access controls and monitoring. TriWest notified 11,844 beneficiaries, while its HHS Office for Civil Rights filing listed 11,848 affected individuals. No misuse or operational disruption was reported. No attacker, ransomware activity, extortion, leak-site claim, or access method was identified; therefore, the actor type and motive remain undetermined.
-
Goodwin Procter LLP
April 16, 2026
•
[ ransomware, financial, technology ]
Goodwin Procter disclosed a spring 2026 unauthorized data-access incident dated April 16 in state records. The firm notified a limited number of clients and affected people. Insurance-industry reporting linked the extortion to Luna Moth and reported a ransom payment around US$10 million, citing people familiar with the matter; Goodwin did not independently confirm that payment or attribution. Its effect was acquisition of sensitive information, without verified encryption or service shutdown. Criminal/Financial is supported by the attributed financially motivated extortion campaign.
-
Meta Platforms, Inc. (Instagram)
April 17, 2026
•
[ hack, technology ]
On 2026-04-17, unauthorized parties exploited a validation flaw associated with Instagram's AI-assisted High Touch Support recovery process. The flaw allowed password-reset links to be sent to email addresses not associated with targeted accounts. Accounts without two-factor authentication could then be accessed. Meta identified 20,225 potentially affected accounts, discovered the issue on 2026-05-31, disabled the tool, invalidated reset links, and placed affected accounts behind a security checkpoint. The number represents an upper bound because some activity may have been legitimate.
-
Family Medical Associates of Raleigh, P.A.
April 18, 2026
•
[ leak, healthcare ]
Family Medical Associates of Raleigh identified suspicious activity on 7 May. Its investigation found that an unauthorized third party intermittently accessed certain systems between 18 and 20 April and downloaded internal data containing protected health information. Genesis claimed responsibility on 3 June and threatened disclosure. A verified searchable dataset containing 126,856 rows confirms the data compromise. The practice did not report encryption, system downtime, or interruption of patient services, and the initial access method remains undisclosed.
-
Cherry Health (Cherry Street Services, Inc.)
April 19, 2026
•
[ leak, healthcare ]
On or about 2026-04-19, Cherry Health detected suspicious activity involving its network. An investigation determined that an unauthorized individual accessed and copied certain information. Cherry Health's preliminary notice stated that the data could relate to current or former patients and current or former staff members and that its review of the affected files was continuing. The organization had not identified the actor, access method, total number of affected individuals, or evidence that the information had been used for identity theft or fraud.
-
ViaQuest, Inc.
April 21, 2026
•
[ hack, healthcare ]
Anubis listed ViaQuest on April 21, 2026 and claimed theft of approximately 4.1 TB containing patient, employee, medical, and administrative information. DataBreach.com later indexed 224,544 rows associated with ViaQuest. A ViaQuest psychiatric and behavioral health entity separately reported a hacking/network-server incident affecting at least 6,420 people to HHS. No independently verified operational disruption has been established.
-
Morning Star Tours
April 22, 2026
Morning Star Tours reported that a third-party technology provider experienced unauthorized access between April 22 and April 23, 2026, affecting data maintained for Morning Star Tours. PEAR later claimed responsibility and alleged theft of approximately 1.2 TB. Morning Star Tours reported 18,997 affected individuals but did not publicly attribute the incident to PEAR or confirm the actor's claimed volume. No operational disruption was reported.
-
Live! Casino
April 23, 2026
DataBreach.com indexed a structured dataset attributed to LockBit 5.0 under the Live! Casino name and dated it April 23, 2026. The material contained 1,786,224 rows of personal data, supporting classification of the affected asset as a database-backed application server, although the initial access vector was not disclosed. The listing did not identify the specific Live! property or report operational disruption. Separate reporting documented a Medusa claim against Live! Casino Pittsburgh in March and litigation concerning approximately 44,000 people associated with Cordish-operated Live! properties, but public evidence does not establish that those matters and this LockBit 5.0 dataset arose from the same compromise.
-
GO2 Health
April 24, 2026
•
[ phishing, healthcare, leak ]
A phishing attack enabled unauthorized access to GO2 Health's main email mailbox on April 24, 2026. The clinic engaged specialists, contained the incident, reset credentials associated with delegated mailbox access, notified the Office of the Australian Information Commissioner on May 18, and began notifying affected patients on July 16. Automatic archiving limited exposed email to the preceding 12 months, and the primary patient-information system was not accessed.
-
NTN Bearing Corporation of America
April 24, 2026
•
[ ransomware, manufacturing, leak ]
PayoutsKing claimed it compromised NTN Bearing Corporation of America and threatened publication of stolen data. Ransomware tracking places the estimated attack on April 24, 2026 and the public claim on May 13. DataBreach.com later indexed 115,671 leaked rows containing personal and contact information. No independently verified operational disruption has been established.
-
GO2 Health
April 24, 2026
•
[ phishing, healthcare ]
A phishing attack compromised GO2 Health's main email mailbox in April 2026. Investigation found that information contained in the mailbox may have been accessed, including some patients' Department of Veterans' Affairs identification numbers and other information patients had sent by email. The affected mailbox retained approximately 12 months of email. GO2 Health stated that its primary patient-record system was not accessed, notified the Australian privacy regulator on May 18, and notified affected patients in July.
-
University of Iowa
April 25, 2026
University of Iowa student data (usernames, emails, enrollment info) was exposed in the ShinyHunters breach of vendor Instructure's Canvas platform, disclosed May 2026; its Canvas-based ICON system was offline for hours on May 7. UI later sought incident-response services.
