-
AssuranceAmerica Managing General Agency, LLC
March 16, 2026
•
[ leak, finance ]
On 2026-03-16, malicious activity targeted an AssuranceAmerica employee and enabled an unauthorized third party to access portions of the company's IT environment and copy files. AssuranceAmerica detected suspicious activity on 2026-03-17, disabled compromised credentials and unauthorized sessions, isolated affected systems, and notified law enforcement. The company completed its review of the copied files on 2026-06-15. Regulatory filings subsequently identified 6,998,886 affected individuals. No threat group publicly claimed responsibility, and AssuranceAmerica did not disclose a motive or precise access mechanism.
-
European Commission
March 19, 2026
•
[ leak, government, technology ]
The European Commission said a threat actor compromised an AWS cloud account supporting the Europa web platform and exfiltrated data from hosted websites, and CERT-EU later linked the incident to the Trivy supply-chain compromise and a published ShinyHunters leak.
-
Speed Group
March 19, 2026
•
[ ransomware, manufacturing, hack ]
Forensic investigators found that unauthorized operators transferred files from a Speed Group server by March 19, 2026, then moved through the multinational manufacturers network using privileged credentials. On March 29 at about 19:59 the operators deployed ransomware that encrypted corporate servers and backups in France and the United States and a network storage device at the Chilean subsidiary in Quilicura. The company estimated that approximately 5% of its data was permanently lost. BlackNevas/Trial Recovery was attributed through forensic indicators and ransom notes and claimed theft of more than 1 TB, but that volume is unverified. The Chilean subsidiary filed a criminal complaint.
-
Shun Hing Group
March 20, 2026
Shun Hing Group detected unauthorized access and damage to its computer systems on March 20. The Hong Kong privacy regulator said data linked to more than 921,000 people may have been leaked and personal data linked to about 1.05 million people may have been maliciously encrypted. LockBit later claimed responsibility; the company did not publicly confirm the attribution.
-
Axcera LLC
March 22, 2026
•
[ hack, leak, technology ]
LAPSUS$ claimed on March 22, 2026 that it had stolen approximately 13 GB from Axcera, including source code, cloud configurations, credentials, API keys, and MongoDB database dumps. DataBreach.com later indexed 11,977 rows containing email addresses. Axcera did not publicly confirm the actor's full claim, and no operational disruption was reported.
-
RCI Hospitality Holdings, Inc.
March 23, 2026
RCI Internet Services, a subsidiary of RCI Hospitality Holdings, discovered an insecure direct object reference vulnerability in an IIS web server on March 23, 2026. An unauthorized actor exploited the vulnerability to access and steal files containing personal information belonging to approximately 40,000 independent contractors. The actor and motive were not identified, and no operational disruption was reported.
-
Rogers Communications
March 27, 2026
Rogers Communications disclosed unauthorized third-party access to limited customer information, including names, contact information, account numbers, and language preferences; the company said no personal financial information was accessed.
-
Ultrahuman
March 27, 2026
•
[ leak, malware, healthcare ]
On March 27, 2026, attackers used credentials stolen from a malware-infected employee laptop to obtain read-only access to Ultrahuman's internal analytics system. Ultrahuman said wellness data belonging to approximately 0.1% of users was accessed, took the affected system offline, and revoked access. The company reported that passwords, payment information, production systems, and Ultrahuman Ring devices were not compromised and did not confirm whether data was exfiltrated.
-
Taft Stettinius & Hollister LLP
March 27, 2026
Taft Stettinius & Hollister identified unauthorized activity involving a law-firm network system in March 2026. State notification records indicate an incident date of approximately March 27 and possible exposure of names and Social Security numbers; notices were reported in July and news coverage published August 7. The attacker, access method and purpose were not identified. Criminal is a limited inference from the unauthorized access; Financial is a target-based inference for a private law firm holding sensitive client and identity information rather than a proven extortion motive.
-
Ernst & Young LLP
March 28, 2026
•
[ hack, technology, finance ]
An unauthorized party accessed a third-party IT service-management platform used for EY tax work from March 28 through April 12 and downloaded client documents. ShinyHunters later claimed responsibility, but EY has not confirmed that attribution or the group's separate claims of Jira, GitHub, and Azure access; no operational disruption or public confirmation of the threatened leak was reported.
-
ZEGO Textilveredelungszentrum GmbH
March 29, 2026
•
[ hack, manufacturing ]
On March 29, 2026, a cyberattack caused a complete production outage at ZEGO Textilveredelungszentrum for nearly six weeks. ZEGO said the resulting economic burden could not be fully offset and made an insolvency filing necessary. The filing did not end the business: the provisional insolvency administrator authorized continued operations, and ZEGO continued accepting and fulfilling orders while pursuing restructuring. No public source identifies the perpetrator or confirms ransomware, extortion, or data theft; the Criminal and Financial classifications are limited contextual inferences rather than confirmed attribution.
-
Paidwork LLC
March 29, 2026
•
[ hack, leak, financial ]
Hackers claimed to have obtained data from Paidwork in March 2026 and offered it for sale. An approximately 11 GB database attributed to Paidwork was subsequently published in July and contained more than 23 million unique email addresses along with extensive profile, financial, device, transaction, and authentication data. Paidwork stated that it had not confirmed compromise of its systems or user accounts and was investigating the reported incident.
-
Jones Day
March 30, 2026
•
[ phishing, ransomware, leak ]
Jones Day confirmed a phishing incident in which an unauthorized third party accessed a limited number of dated files for 10 clients; Silent Ransom Group claimed responsibility and posted data on its leak site on March 30, 2026.
-
Kootenai County
March 30, 2026
•
[ ransomware, government ]
On March 30, 2026, Kootenai County detected ransomware on its computer network. Contemporary local reporting documented a countywide network outage affecting multiple systems and services; emergency services remained operational, and the outage was restored later that day. The county secured the network, restored operations, engaged forensic specialists, and notified federal law enforcement. Its investigation confirmed that cybercriminals took data from the network. The county completed its data review on July 2 and began mailing notices on July 22. The affected-person count, ransomware group, access method, ransom demand, and payment status were not disclosed.
-
Campbell University
March 31, 2026
•
[ ransomware, education ]
An unauthorized party accessed one Campbell University cloud data-storage platform from March 31 to April 1, 2026. Campbell proactively took the platform offline and worked with its provider to restore it from backups; it stated that no other campus systems or data sources were affected. This was defensive containment, and no attacker-caused disruption was established. INC Ransom claimed the incident on April 11, and DataBreach.com's verified searchable dataset confirms the data compromise.
-
Undisclosed non-clinical operational-support vendor used by Lumexa Imaging
March 31, 2026
•
[ hack, healthcare ]
An unauthorized actor accessed a network-server environment operated by Lumexa Imaging's unnamed non-clinical support vendor between March 31 and April 9, 2026 and took patient documents from a network segment dedicated to Lumexa-affiliated radiology practices. Lumexa disconnected its systems from the vendor on April 9. Before reconnection, the vendor reset passwords, scrubbed and validated affected systems, and added monitoring. No service disruption, ransomware claim, named perpetrator, or misuse of the data was reported.
-
Undisclosed educational organization
April 1, 2026
Beginning in April 2026, researchers observed the Backdoor.Mistic remote access trojan deployed on the network of at least one undisclosed educational organization. The backdoor enabled file upload and download, file manipulation, folder creation, and in-memory code execution. The victim's identity, location, affected systems, and any acquired information were not disclosed. SecurityWeek attributed the activity to Woodgnat, also known as KongTuke, while Broadcom assessed that Mistic may be associated with the group.
-
Undisclosed insurance organization
April 1, 2026
•
[ espionage, malware, finance ]
Beginning in April 2026, researchers observed the Backdoor.Mistic remote access trojan deployed on the network of at least one undisclosed insurance organization. The backdoor enabled file upload and download, file manipulation, folder creation, and in-memory code execution. The victim's identity, location, affected systems, and any acquired information were not disclosed. SecurityWeek attributed the activity to Woodgnat, also known as KongTuke, while Broadcom assessed that Mistic may be associated with the group.
-
Undisclosed information technology organization
April 1, 2026
Beginning in April 2026, researchers observed the Backdoor.Mistic remote access trojan deployed on the network of at least one undisclosed information technology organization. The backdoor enabled file upload and download, file manipulation, folder creation, and in-memory code execution. The victim's identity, location, affected systems, and any acquired information were not disclosed. SecurityWeek attributed the activity to Woodgnat, also known as KongTuke, while Broadcom assessed that Mistic may be associated with the group.
-
Undisclosed professional services organization
April 1, 2026
•
[ espionage, malware, technology ]
Beginning in April 2026, researchers observed the Backdoor.Mistic remote access trojan deployed on the network of at least one undisclosed professional services organization. The backdoor enabled file upload and download, file manipulation, folder creation, and in-memory code execution. The victim's identity, location, affected systems, and any acquired information were not disclosed. SecurityWeek attributed the activity to Woodgnat, also known as KongTuke, while Broadcom assessed that Mistic may be associated with the group.
