Full List

Search

Recent Breaches

• Paidwork LLC March 29, 2026 • [ hack, leak, financial ] Hackers claimed to have obtained data from Paidwork in March 2026 and offered it for sale. An approximately 11 GB database attributed to Paidwork was subsequently published in July and contained more than 23 million unique email addresses along with extensive profile, financial, device, transaction, and authentication data. Paidwork stated that it had not confirmed compromise of its systems or user accounts and was investigating the reported incident.
• Jones Day March 30, 2026 • [ phishing, ransomware, leak ] Jones Day confirmed a phishing incident in which an unauthorized third party accessed a limited number of dated files for 10 clients; Silent Ransom Group claimed responsibility and posted data on its leak site on March 30, 2026.
• Kootenai County March 30, 2026 • [ ransomware, government ] On March 30, 2026, Kootenai County detected ransomware on its computer network. Contemporary local reporting documented a countywide network outage affecting multiple systems and services; emergency services remained operational, and the outage was restored later that day. The county secured the network, restored operations, engaged forensic specialists, and notified federal law enforcement. Its investigation confirmed that cybercriminals took data from the network. The county completed its data review on July 2 and began mailing notices on July 22. The affected-person count, ransomware group, access method, ransom demand, and payment status were not disclosed.
• Campbell University March 31, 2026 • [ ransomware, education ] An unauthorized party accessed one Campbell University cloud data-storage platform from March 31 to April 1, 2026. Campbell proactively took the platform offline and worked with its provider to restore it from backups; it stated that no other campus systems or data sources were affected. This was defensive containment, and no attacker-caused disruption was established. INC Ransom claimed the incident on April 11, and DataBreach.com's verified searchable dataset confirms the data compromise.
• Undisclosed non-clinical operational-support vendor used by Lumexa Imaging March 31, 2026 • [ hack, healthcare ] An unauthorized actor accessed a network-server environment operated by Lumexa Imaging's unnamed non-clinical support vendor between March 31 and April 9, 2026 and took patient documents from a network segment dedicated to Lumexa-affiliated radiology practices. Lumexa disconnected its systems from the vendor on April 9. Before reconnection, the vendor reset passwords, scrubbed and validated affected systems, and added monitoring. No service disruption, ransomware claim, named perpetrator, or misuse of the data was reported.
• Undisclosed educational organization April 1, 2026 Beginning in April 2026, researchers observed the Backdoor.Mistic remote access trojan deployed on the network of at least one undisclosed educational organization. The backdoor enabled file upload and download, file manipulation, folder creation, and in-memory code execution. The victim's identity, location, affected systems, and any acquired information were not disclosed. SecurityWeek attributed the activity to Woodgnat, also known as KongTuke, while Broadcom assessed that Mistic may be associated with the group.
• Undisclosed insurance organization April 1, 2026 • [ espionage, malware, finance ] Beginning in April 2026, researchers observed the Backdoor.Mistic remote access trojan deployed on the network of at least one undisclosed insurance organization. The backdoor enabled file upload and download, file manipulation, folder creation, and in-memory code execution. The victim's identity, location, affected systems, and any acquired information were not disclosed. SecurityWeek attributed the activity to Woodgnat, also known as KongTuke, while Broadcom assessed that Mistic may be associated with the group.
• Undisclosed information technology organization April 1, 2026 Beginning in April 2026, researchers observed the Backdoor.Mistic remote access trojan deployed on the network of at least one undisclosed information technology organization. The backdoor enabled file upload and download, file manipulation, folder creation, and in-memory code execution. The victim's identity, location, affected systems, and any acquired information were not disclosed. SecurityWeek attributed the activity to Woodgnat, also known as KongTuke, while Broadcom assessed that Mistic may be associated with the group.
• Undisclosed professional services organization April 1, 2026 • [ espionage, malware, technology ] Beginning in April 2026, researchers observed the Backdoor.Mistic remote access trojan deployed on the network of at least one undisclosed professional services organization. The backdoor enabled file upload and download, file manipulation, folder creation, and in-memory code execution. The victim's identity, location, affected systems, and any acquired information were not disclosed. SecurityWeek attributed the activity to Woodgnat, also known as KongTuke, while Broadcom assessed that Mistic may be associated with the group.
• State Enterprise Centre of Registers April 1, 2026 • [ espionage, hack, government ] The State Enterprise Centre of Registers detected unauthorized extraction of more than 600,000 records in early April 2026. The actor used login credentials assigned to institutions authorized to access the Real Estate and Legal Entities Registers. Lithuanian prosecutors suspected involvement by an unnamed foreign country, but no state or threat group was formally attributed. The exact intrusion date was not disclosed, so April 1 is used as the normalized month-only event date.
• CAMILLA Australia Pty Ltd April 1, 2026 • [ leak, retail ] In April 2026, an unauthorized third party accessed CAMILLA Australia Pty Ltd's Australian network and exfiltrated customer records held within its point-of-sale system. CAMILLA secured its systems, notified affected customers and the Australian privacy regulator, and said its operations and order processing continued without disruption.
• Global Schools Group (Global Schools Foundation) April 1, 2026 • [ leak, misconfiguration, education ] FulcrumSec reportedly accessed Global Schools Group's AWS environment in April 2026 using default or reused credentials and obtained data from 67 S3 buckets, five MSSQL servers, and four MongoDB servers. The group claimed to have stolen 4.8 TB and later released a 221 GB highlights archive following failed extortion negotiations. Global Schools Group confirmed a cybersecurity incident, said it had contained it and restored affected systems, and notified authorities, but did not verify FulcrumSec's figures or specific data claims. No operational disruption was reported.
• James Fallon High School April 1, 2026 James Fallon High School in North Albury, NSW, Australia, suffered a cyber data breach identified in April 2026 from a source outside NSW, exposing school documents and some student, parent and staff data. The education department and Cyber NSW concluded their probe in September.
• Fudbalski savez Srbije (Football Association of Serbia) April 1, 2026 Hackers stole personal data of 11,000+ people who stayed at the Football Association of Serbia's sports center hotel in Stara Pazova, demanded money in Apr 2026, then posted the data on a dark web forum. Serbian police named FSS among INF Grupa targets after 27 Aug arrests.
• Sports Center of the Football Association of Serbia April 1, 2026 • [ ransomware, technology ] Belgrade prosecutors detained suspect L.D. in Aug 2026, alleging he accessed the Football Association of Serbia Sports Center's network from April to August 2026, took a large amount of data, demanded ransom and damaged data in a ransomware attack.
• Republic Health Insurance Fund of Serbia (RFZO) April 1, 2026 • [ ransomware, healthcare, government ] Serbian police arrested three INF Grupa members in Aug 2026; prosecutors allege suspect L.D. accessed the network of Serbia's Republic Health Insurance Fund (RFZO) between April and August 2026, took a large amount of data, demanded ransom and damaged data in a ransomware attack.
• Karl Chevrolet, Inc. (d/b/a Karl Auto Group) April 3, 2026 • [ ransomware, leak, retail ] An unauthorized third party gained access to certain Karl Auto Group computer systems before 2026-03-27. RansomHouse later claimed that it encrypted Karl Chevrolet systems on 2026-04-03, but Karl Auto Group did not publicly confirm the attribution or ransomware deployment. The company discovered the incident on 2026-04-04, when employees encountered unavailable phones and computers. Phone service remained disrupted or intermittent through at least 2026-04-08, although dealerships remained open and directed customers to email, online messages, or in-person service. Karl Auto Group stated that files containing personal information belonging to current and former customers, employees, and other individuals may have been accessed; thousands of customers were notified, but the total number affected was not disclosed. The company reported no evidence of misuse and said it did not pay a ransom.
• Karl Auto Group April 4, 2026 • [ ransomware, automotive ] Karl Auto Group discovered unauthorized access to certain business computer systems on April 4, 2026 after access had begun before March 27. Employees at multiple Iowa dealerships lacked working phones and computers, and phone service remained unavailable or intermittent for at least five days, although locations remained open. The company stated that files containing customer and employee information may have been accessed. RansomHouse separately claimed that Karl Chevrolet was encrypted on April 3, but Karl Auto Group did not confirm ransomware, data theft, or a connection to the group.
• Rostelecom April 6, 2026 • [ ddos, technology ] Rostelecom said a large-scale DDoS attack targeted its network on April 6, 2026, affecting availability of some internet resources and disrupting access to online services across Russia before the attack was filtered and neutralized.
• Arkansas Oral & Maxillofacial Surgeons April 7, 2026 • [ ransomware, leak, healthcare ] PEAR listed Arkansas Oral & Maxillofacial Surgeons in April 2026 and threatened to release allegedly stolen patient information. DataBreach.com later indexed 189,905 associated rows. The practice did not publicly confirm the actor's attribution or claimed scope, the access vector was not established, and no operational disruption was documented.