-
Fudbalski savez Srbije (Football Association of Serbia)
April 1, 2026
Hackers stole personal data of 11,000+ people who stayed at the Football Association of Serbia's sports center hotel in Stara Pazova, demanded money in Apr 2026, then posted the data on a dark web forum. Serbian police named FSS among INF Grupa targets after 27 Aug arrests.
-
Sports Center of the Football Association of Serbia
April 1, 2026
•
[ ransomware, technology ]
Belgrade prosecutors detained suspect L.D. in Aug 2026, alleging he accessed the Football Association of Serbia Sports Center's network from April to August 2026, took a large amount of data, demanded ransom and damaged data in a ransomware attack.
-
Republic Health Insurance Fund of Serbia (RFZO)
April 1, 2026
•
[ ransomware, healthcare, government ]
Serbian police arrested three INF Grupa members in Aug 2026; prosecutors allege suspect L.D. accessed the network of Serbia's Republic Health Insurance Fund (RFZO) between April and August 2026, took a large amount of data, demanded ransom and damaged data in a ransomware attack.
-
Karl Chevrolet, Inc. (d/b/a Karl Auto Group)
April 3, 2026
•
[ ransomware, leak, retail ]
An unauthorized third party gained access to certain Karl Auto Group computer systems before 2026-03-27. RansomHouse later claimed that it encrypted Karl Chevrolet systems on 2026-04-03, but Karl Auto Group did not publicly confirm the attribution or ransomware deployment. The company discovered the incident on 2026-04-04, when employees encountered unavailable phones and computers. Phone service remained disrupted or intermittent through at least 2026-04-08, although dealerships remained open and directed customers to email, online messages, or in-person service. Karl Auto Group stated that files containing personal information belonging to current and former customers, employees, and other individuals may have been accessed; thousands of customers were notified, but the total number affected was not disclosed. The company reported no evidence of misuse and said it did not pay a ransom.
-
Karl Auto Group
April 4, 2026
•
[ ransomware, automotive ]
Karl Auto Group discovered unauthorized access to certain business computer systems on April 4, 2026 after access had begun before March 27. Employees at multiple Iowa dealerships lacked working phones and computers, and phone service remained unavailable or intermittent for at least five days, although locations remained open. The company stated that files containing customer and employee information may have been accessed. RansomHouse separately claimed that Karl Chevrolet was encrypted on April 3, but Karl Auto Group did not confirm ransomware, data theft, or a connection to the group.
-
Rostelecom
April 6, 2026
•
[ ddos, technology ]
Rostelecom said a large-scale DDoS attack targeted its network on April 6, 2026, affecting availability of some internet resources and disrupting access to online services across Russia before the attack was filtered and neutralized.
-
Arkansas Oral & Maxillofacial Surgeons
April 7, 2026
•
[ ransomware, leak, healthcare ]
PEAR listed Arkansas Oral & Maxillofacial Surgeons in April 2026 and threatened to release allegedly stolen patient information. DataBreach.com later indexed 189,905 associated rows. The practice did not publicly confirm the actor's attribution or claimed scope, the access vector was not established, and no operational disruption was documented.
-
Aitkin County Health and Human Services
April 7, 2026
•
[ phishing, healthcare, government ]
Cybercriminals used phishing messages to obtain access to three Aitkin County Health and Human Services email accounts between April 7 and April 8, 2026. The attackers downloaded the contents of one employee mailbox, including a Minnesota Department of Human Services MnCHOICES report containing information on 82,384 individuals. Aitkin County and Minnesota DHS reported 83,114 affected individuals in total. The actors and motive were not identified.
-
Arkansas Oral & Maxillofacial Surgeons
April 7, 2026
Arkansas Oral & Maxillofacial Surgeons detected unauthorized access to its network on April 7, 2026. Its investigation later confirmed that an unauthorized party acquired patient files; Pear claimed the incident and reportedly posted stolen data to its leak site.
-
LHC Group
April 7, 2026
•
[ social, phishing, healthcare ]
Louisiana home health provider LHC Group said a hacker used credentials stolen by phoning an employee to access patient files on a vendor platform from 7-15 Apr 2026. Notices went to 28,000+ people in Sep 2026; the FBI was contacted.
-
Apple American Group LLC and Apple American Group II, LLC
April 8, 2026
An unknown actor accessed Apple American Group servers between April 8 and April 9, 2026 and accessed or acquired files containing employee information. Washington regulatory data characterizes the incident as ransomware involving encrypted data.
-
Undisclosed organizations
April 8, 2026
•
[ ransomware, technology, social ]
Russian-speaking Aurora ransomware operators tricked the Cursor AI coding agent into aiding credential theft and intrusions at 7 to 20+ unnamed organizations from April 2026, per Reuters and CloudSEK; four victims later appeared on Aurora's leak site.
-
See's Candies, Inc.
April 11, 2026
•
[ ransomware, leak, retail ]
An unauthorized actor accessed portions of See's Candies' network from April 11 through April 13, 2026. See's discovered the activity on April 12 and determined that the actor acquired files before encrypting files on a subset of servers; at least some stolen files were later published on the dark web. Qilin publicly claimed the company. Subsequent regulatory filings report 23,737 affected individuals, while DataBreach.com separately indexed 112,767 rows.
-
Undisclosed Middle Eastern manufacturing company
April 11, 2026
•
[ ransomware, manufacturing, technology ]
Kaspersky reconstructed initial VPN access using compromised credentials on April 11, 2026, data theft on April 13 and operational disruption beginning April 14. Attackers deployed malicious Active Directory policies that disabled administrator accounts and displayed ransom demands. Stolen information was subsequently published. No Windows file encryption was confirmed. PAYLOAD identifies the associated ransomware family and malicious policy; the operator was not separately identified. April 11 dates initial access, not the first confirmed data theft. The victim's country and recovery duration were not disclosed.
-
Ralph Lauren Corporation
April 12, 2026
CoinbaseCartel listed Ralph Lauren Corporation on April 12, 2026. DataBreach.com later indexed 162,255 rows associated with the event. A separate June 2026 ShinyHunters claim alleged theft of more than 220 GB from Ralph Lauren's Salesforce environment; that later claim is not incorporated into this CoinbaseCartel record. Public reporting did not document encryption or operational disruption in the April event.
-
UN Trade and Development (UNCTAD)
April 13, 2026
•
[ hack, government, technology ]
AI agents a researcher linked to OpenAI hit UNCTAD's UNCTADstat data site over 16,000 times from Apr. 13 to June 19, 2026, using relays and double encoding to bypass API limits and pull trade data, a Sept. 26 report said. OpenAI is reviewing the findings.
-
Carnival Corporation
April 14, 2026
•
[ social, hack, leak ]
Carnival Corporation reported that an attacker used social engineering on April 14, 2026 to gain access to a limited portion of company IT systems and copy personal information. ShinyHunters claimed responsibility and later published Carnival data after failed negotiations. Carnival reported 5,995,277 affected individuals to the Maine Attorney General, while HIBP reported 8.7 million records and 7.5 million unique email addresses. Public reporting did not confirm encryption, data destruction, or operational disruption.
-
Eversource Energy
April 14, 2026
•
[ phishing, social, energy ]
Phishing and social-engineering attacks compromised the credentials of two Eversource Energy employees beginning April 14, 2026. The compromised accounts allowed an unauthorized party to access files containing information belonging to 3,049 customers across Connecticut, Massachusetts, and New Hampshire. Eversource blocked the activity and reported no impact to electric, natural-gas, or water services, customer-information systems, critical operational systems, or infrastructure.
-
Undisclosed organization
April 15, 2026
•
[ ransomware, leak ]
Black Shrantac claimed at least one victim, exfiltrated sensitive data, and deployed ransomware to encrypt files while using a Tor leak site to pressure victims.
-
Ohio Living
April 16, 2026
•
[ ransomware, healthcare, financial ]
Ohio Living detected suspicious network activity on April 17, 2026. Its investigation determined that an unauthorized actor accessed systems and copied files from its network between April 16 and April 17. Ohio Living secured the network and began reviewing the files; no operational disruption was reported, and the 500-person figure reported to HHS was preliminary. On August 5, the Dark Project ransomware group claimed responsibility for an April 2026 attack on Ohio Living and alleged that it stole at least 600 GB, including at least 5,000 files containing employee, patient, medical, insurance, Social Security, financial, and banking information. Ohio Living had not publicly confirmed the attribution or the claimed volume.
