Recent Breaches
-
February 10, 2026 • Nitrogen claimed on February 10, 2026 that it had compromised Professional Compounding Centers of America's network, exfiltrated a significant amount of data, and would publish it unless its demands were accepted. DataBreach.com subsequently indexed 1,500,874 rows and dated the published dataset to May 12. PCCA did not publicly confirm the actor's claim, and no operational disruption was documented.
-
February 17, 2026 • Plaza Home Mortgage detected unauthorized access to an employee computer on or around February 17, 2026 and took action to remove the intruder. The company determined that an unauthorized party may have obtained personal information belonging to customers and employees and notified 137,976 individuals. Silent Ransom Group later claimed responsibility, but Plaza did not publicly confirm the attribution.
-
February 19, 2026 • PayoutsKing claimed it exfiltrated approximately 698 GB of data from Peachtree Group in an intrusion dated February 19, 2026 and publicly listed the company on April 30. DataBreach.com later indexed 299,873 rows. Litigation filed after the incident alleges that personally identifiable information belonging to current and former employees was accessed. A separate July 2026 claim by The Gentlemen appears to concern a later incident and is not merged into this record.
-
February 20, 2026 • Silent Ransom Group stated that it gained access to Wood Smith Henning & Berman's network on February 20, 2026 and acquired approximately 3.6 GB of data. Negotiations began by March 3, with the group demanding $1.8 million to delete the files. After negotiations failed, the group published the data on March 17. DataBreaches reviewed the leaked material and confirmed that it included technical reports, expert analyses, legal research, and files from multiple client matters. The access method was not disclosed, no malware or encryption was reported, and the firm did not respond to a request for comment.
-
February 21, 2026 • Bonanza Casino detected suspicious network activity on 21 February after finding certain systems offline. It secured the environment and engaged forensic specialists, who determined that an unauthorized party accessed certain systems and copied files. Medusa publicly claimed responsibility on 17 March and threatened to publish the stolen data. Bonanza Casino completed its affected-person review on 1 July and issued notices on 8 July. The intrusion method, duration of the system outage, and nationwide number of affected individuals were not disclosed.
-
February 23, 2026 • An unauthorized actor accessed Strategic Education's computer servers between February 23 and February 25, 2026 and copied certain files. The company discovered the incident on May 21 and began notifying affected individuals on May 29. Regulatory filings in six states identify at least 190,155 affected residents, although Strategic Education did not disclose a confirmed nationwide total. The actor, access method, and motive were not identified.
-
February 24, 2026 • WatchGuard telemetry identified Grandoreiro infections beginning in late February 2026. Phishing links delivered ZIP archives containing legitimate applications and malicious DLLs for side-loading, while a related campaign used an obfuscated VBS file to install the banking trojan. The confirmed victim population comprised banking and financial-services customers, small-to-medium businesses, and users in Portugal, Spain, Mexico, and other parts of Latin America; references to banks in the malware code identify targeted banking applications, not confirmed compromises of the banks themselves.
-
February 26, 2026 • KAIROS listed Rockwood Retirement Communities on its leak site on February 27, 2026. DataBreach.com subsequently indexed 132,606 structured records associated with the breach and dated the underlying event February 26. The records support classification of the affected asset as a database-backed application server, although the initial access vector was not disclosed. Rockwood operates nonprofit senior-living communities in Spokane. No victim notice or independent report confirmed encryption or operational disruption.
-
February 26, 2026 • Anubis claimed a data breach at Physicians' Clinic of Iowa on February 26, 2026 and published images reportedly showing personal identifiers and protected health information. DataBreach.com later indexed 158,631 structured records. The database-like patient records support classification of the affected asset as an application server, although the initial access vector was not disclosed. The clinic has not publicly confirmed the attribution or disclosed the precise number of affected patients, encryption, or operational disruption.
-
February 26, 2026 • On or around February 26, 2026, an unauthorized third party accessed part of Central National Gottesman's network and obtained files from company systems. The incident was discovered by February 28. PayoutsKing publicly claimed the company on March 2. Regulatory filings report 9,126 affected individuals and confirm exposure of identity, financial, health, and payroll-related information. DataBreach.com separately indexed 207,519 rows associated with the incident.
-
March 1, 2026 • FulcrumSec claimed that it obtained access in March 2026 through a GitHub access token, cloned Novo Nordisk repositories, obtained additional credentials, remained in the environment for more than two months, and stole more than 700,000 files totaling approximately 1.3 TB before demanding $25 million. Novo Nordisk confirmed unauthorized access to a limited number of internal IT systems and the external copying of non-public and personal data, but it did not publicly attribute the incident to FulcrumSec or confirm the actor's claimed volume and contents. Reuters could not independently verify the authenticity of the published data. Novo Nordisk temporarily took certain internal systems offline for containment, while stating that its core business operations remained operational. Because only March 2026 was reported for initial access, 2026-03-01 is used as the normalized event date.
-
March 1, 2026 • Beginning in March 2026, attackers used poisoned search results and fake download sites impersonating utilities such as CrystalDiskInfo, HWMonitor, PDFgear, and FurMark to compromise Windows users, with some malicious links also appearing in AI-chatbot recommendations during April. The malware installed ScreenConnect for persistent access, collected host information, and deployed GPU-focused cryptocurrency miners through process hollowing. Microsoft identified more than 150 malicious domains associated with the campaign.
-
March 1, 2026 An unauthorized party obtained files from West Publishing Corporation's C-Track court case-management environment in March 2026. West Publishing detected unauthorized activity June 30, 2026. Compromised records originated from courts in multiple U.S. states, the U.S. Virgin Islands, and Ontario, Canada; the incident occurred within the vendor environment rather than separate breaches of each court network. C-Track reported no operational disruption and no confirmed fraudulent use of the data.
-
March 2, 2026 • Ameriprise Financial disclosed unauthorized access to certain stored data and files in an incident dating back to March 2, 2026, which it detected and blocked on March 18. Ameriprise said there was no disruption to business operations and no indication of unauthorized transactions or fund movement. ShinyHunters claimed responsibility and allegedly threatened to release Salesforce customer records and more than 200 GB of compressed SharePoint internal data, but the full attacker claim was not confirmed by Ameriprise.
-
March 3, 2026 • AiLock claimed responsibility for an intrusion involving Lewis Drug in early March 2026 and alleged theft of approximately 110 GB. DataBreach.com dated the associated dataset to March 4 and indexed 22,549 rows. Public evidence supports a March 2026 event rather than the previously coded July 2025 date. No encryption or operational disruption was publicly documented.
-
March 7, 2026 • DataBreach.com indexed 1,891,536 rows associated with Valley Family Health Care and dated the breach to March 7, 2026. Insomnia listed the organization on its data-leak site on March 18, 2026. Public reporting did not identify the access vector or document encryption or operational disruption.
-
March 9, 2026 • Ukraines state-owned Oschadbank reported that around 10:00 on March 9, 2026, its security protocols triggered due to suspected DDoS activity. To protect systems, the bank temporarily disabled servers, causing electronic services to become unavailable. The bank stated technical inspection was ongoing and expected full restoration within about an hour; no data theft was reported in the notice.
-
March 11, 2026 • Interlock claimed responsibility for compromising Elliott-Lewis Corporation on March 11, 2026 and described a large database containing confidential contracts, project files, and customer and employee data, with approximately 1.07 terabytes allegedly stolen. DataBreach.com later indexed 319,305 structured rows containing personal identifiers and bank-account information. The explicit database claim and structured records support classification as Exploitation of Application Server, although the initial access vector was not disclosed. Elliott-Lewis is a Philadelphia-based mechanical contractor. The company has not publicly confirmed the attribution, claimed volume, encryption, or operational disruption.
-
March 15, 2026 • Everest publicly claimed Evaluate, a Norstella company, on March 15, 2026 and threatened publication of stolen data unless the company entered negotiations. Independent breach monitoring recorded approximately 1.33 TB associated with the claim, and DataBreach.com subsequently indexed 248,458 rows. Evaluate Ltd. is registered in England and Wales and headquartered in London, where it provides pharmaceutical and biotechnology market intelligence and analytics. No operational disruption has been independently established.
-
March 15, 2026 • An advanced nation-state threat actor maliciously modified PLC logic at Sage Water Resources' Blue Bench 13-1 saltwater-disposal facility in Duchesne, Utah on March 15, 2026. The changes bypassed pump shutdown safeguards and allowed pumps to continue running dry while the control system displayed normal operation. A truck driver noticed the abnormal conditions and operators shifted to manual control before equipment failure, environmental damage, or service interruption occurred.