Full List

Search

Recent Breaches

• Undisclosed Windows users seeking system and hardware utilities March 1, 2026 • [ malware, technology, financial ] Beginning in March 2026, attackers used poisoned search results and fake download sites impersonating utilities such as CrystalDiskInfo, HWMonitor, PDFgear, and FurMark to compromise Windows users, with some malicious links also appearing in AI-chatbot recommendations during April. The malware installed ScreenConnect for persistent access, collected host information, and deployed GPU-focused cryptocurrency miners through process hollowing. Microsoft identified more than 150 malicious domains associated with the campaign.
• West Publishing Corporation (Thomson Reuters; C-Track) March 1, 2026 An unauthorized party obtained files from West Publishing Corporation's C-Track court case-management environment in March 2026. West Publishing detected unauthorized activity June 30, 2026. Compromised records originated from courts in multiple U.S. states, the U.S. Virgin Islands, and Ontario, Canada; the incident occurred within the vendor environment rather than separate breaches of each court network. C-Track reported no operational disruption and no confirmed fraudulent use of the data.
• Ameriprise Financial March 2, 2026 • [ hack, finance, technology ] Ameriprise Financial disclosed unauthorized access to certain stored data and files in an incident dating back to March 2, 2026, which it detected and blocked on March 18. Ameriprise said there was no disruption to business operations and no indication of unauthorized transactions or fund movement. ShinyHunters claimed responsibility and allegedly threatened to release Salesforce customer records and more than 200 GB of compressed SharePoint internal data, but the full attacker claim was not confirmed by Ameriprise.
• Lewis Drug March 3, 2026 • [ ransomware, leak, healthcare ] AiLock claimed responsibility for an intrusion involving Lewis Drug in early March 2026 and alleged theft of approximately 110 GB. DataBreach.com dated the associated dataset to March 4 and indexed 22,549 rows. Public evidence supports a March 2026 event rather than the previously coded July 2025 date. No encryption or operational disruption was publicly documented.
• Valley Family Health Care March 7, 2026 • [ ransomware, healthcare, leak ] DataBreach.com indexed 1,891,536 rows associated with Valley Family Health Care and dated the breach to March 7, 2026. Insomnia listed the organization on its data-leak site on March 18, 2026. Public reporting did not identify the access vector or document encryption or operational disruption.
• Oschadbank March 9, 2026 • [ ddos, finance, government ] Ukraines state-owned Oschadbank reported that around 10:00 on March 9, 2026, its security protocols triggered due to suspected DDoS activity. To protect systems, the bank temporarily disabled servers, causing electronic services to become unavailable. The bank stated technical inspection was ongoing and expected full restoration within about an hour; no data theft was reported in the notice.
• Elliott-Lewis Corporation March 11, 2026 • [ leak, financial, manufacturing ] Interlock claimed responsibility for compromising Elliott-Lewis Corporation on March 11, 2026 and described a large database containing confidential contracts, project files, and customer and employee data, with approximately 1.07 terabytes allegedly stolen. DataBreach.com later indexed 319,305 structured rows containing personal identifiers and bank-account information. The explicit database claim and structured records support classification as Exploitation of Application Server, although the initial access vector was not disclosed. Elliott-Lewis is a Philadelphia-based mechanical contractor. The company has not publicly confirmed the attribution, claimed volume, encryption, or operational disruption.
• Evaluate Ltd. March 15, 2026 • [ ransomware, technology, healthcare ] Everest publicly claimed Evaluate, a Norstella company, on March 15, 2026 and threatened publication of stolen data unless the company entered negotiations. Independent breach monitoring recorded approximately 1.33 TB associated with the claim, and DataBreach.com subsequently indexed 248,458 rows. Evaluate Ltd. is registered in England and Wales and headquartered in London, where it provides pharmaceutical and biotechnology market intelligence and analytics. No operational disruption has been independently established.
• Sage Water Resources, LLC March 15, 2026 • [ espionage, energy, malware ] An advanced nation-state threat actor maliciously modified PLC logic at Sage Water Resources' Blue Bench 13-1 saltwater-disposal facility in Duchesne, Utah on March 15, 2026. The changes bypassed pump shutdown safeguards and allowed pumps to continue running dry while the control system displayed normal operation. A truck driver noticed the abnormal conditions and operators shifted to manual control before equipment failure, environmental damage, or service interruption occurred.
• AssuranceAmerica Managing General Agency, LLC March 16, 2026 • [ leak, finance ] On 2026-03-16, malicious activity targeted an AssuranceAmerica employee and enabled an unauthorized third party to access portions of the company's IT environment and copy files. AssuranceAmerica detected suspicious activity on 2026-03-17, disabled compromised credentials and unauthorized sessions, isolated affected systems, and notified law enforcement. The company completed its review of the copied files on 2026-06-15. Regulatory filings subsequently identified 6,998,886 affected individuals. No threat group publicly claimed responsibility, and AssuranceAmerica did not disclose a motive or precise access mechanism.
• European Commission March 19, 2026 • [ leak, government, technology ] The European Commission said a threat actor compromised an AWS cloud account supporting the Europa web platform and exfiltrated data from hosted websites, and CERT-EU later linked the incident to the Trivy supply-chain compromise and a published ShinyHunters leak.
• Speed Group March 19, 2026 • [ ransomware, manufacturing, hack ] Forensic investigators found that unauthorized operators transferred files from a Speed Group server by March 19, 2026, then moved through the multinational manufacturers network using privileged credentials. On March 29 at about 19:59 the operators deployed ransomware that encrypted corporate servers and backups in France and the United States and a network storage device at the Chilean subsidiary in Quilicura. The company estimated that approximately 5% of its data was permanently lost. BlackNevas/Trial Recovery was attributed through forensic indicators and ransom notes and claimed theft of more than 1 TB, but that volume is unverified. The Chilean subsidiary filed a criminal complaint.
• Shun Hing Group March 20, 2026 Shun Hing Group detected unauthorized access and damage to its computer systems on March 20. The Hong Kong privacy regulator said data linked to more than 921,000 people may have been leaked and personal data linked to about 1.05 million people may have been maliciously encrypted. LockBit later claimed responsibility; the company did not publicly confirm the attribution.
• Axcera LLC March 22, 2026 • [ hack, leak, technology ] LAPSUS$ claimed on March 22, 2026 that it had stolen approximately 13 GB from Axcera, including source code, cloud configurations, credentials, API keys, and MongoDB database dumps. DataBreach.com later indexed 11,977 rows containing email addresses. Axcera did not publicly confirm the actor's full claim, and no operational disruption was reported.
• RCI Hospitality Holdings, Inc. March 23, 2026 RCI Internet Services, a subsidiary of RCI Hospitality Holdings, discovered an insecure direct object reference vulnerability in an IIS web server on March 23, 2026. An unauthorized actor exploited the vulnerability to access and steal files containing personal information belonging to approximately 40,000 independent contractors. The actor and motive were not identified, and no operational disruption was reported.
• Rogers Communications March 27, 2026 Rogers Communications disclosed unauthorized third-party access to limited customer information, including names, contact information, account numbers, and language preferences; the company said no personal financial information was accessed.
• Ultrahuman March 27, 2026 • [ leak, malware, healthcare ] On March 27, 2026, attackers used credentials stolen from a malware-infected employee laptop to obtain read-only access to Ultrahuman's internal analytics system. Ultrahuman said wellness data belonging to approximately 0.1% of users was accessed, took the affected system offline, and revoked access. The company reported that passwords, payment information, production systems, and Ultrahuman Ring devices were not compromised and did not confirm whether data was exfiltrated.
• Taft Stettinius & Hollister LLP March 27, 2026 Taft Stettinius & Hollister identified unauthorized activity involving a law-firm network system in March 2026. State notification records indicate an incident date of approximately March 27 and possible exposure of names and Social Security numbers; notices were reported in July and news coverage published August 7. The attacker, access method and purpose were not identified. Criminal is a limited inference from the unauthorized access; Financial is a target-based inference for a private law firm holding sensitive client and identity information rather than a proven extortion motive.
• Ernst & Young LLP March 28, 2026 • [ hack, technology, finance ] An unauthorized party accessed a third-party IT service-management platform used for EY tax work from March 28 through April 12 and downloaded client documents. ShinyHunters later claimed responsibility, but EY has not confirmed that attribution or the group's separate claims of Jira, GitHub, and Azure access; no operational disruption or public confirmation of the threatened leak was reported.
• ZEGO Textilveredelungszentrum GmbH March 29, 2026 • [ hack, manufacturing ] On March 29, 2026, a cyberattack caused a complete production outage at ZEGO Textilveredelungszentrum for nearly six weeks. ZEGO said the resulting economic burden could not be fully offset and made an insolvency filing necessary. The filing did not end the business: the provisional insolvency administrator authorized continued operations, and ZEGO continued accepting and fulfilling orders while pursuing restructuring. No public source identifies the perpetrator or confirms ransomware, extortion, or data theft; the Criminal and Financial classifications are limited contextual inferences rather than confirmed attribution.