Recent Breaches
-
February 1, 2026 • A malicious mod overwrote users' Workshop uploads, deleted saved creations and reset settings and achievements. This represents an unnamed affected user in the February incident, separate from September. February 1 is the earliest-warning fallback, not a verified infection date. Sabotage is inferred from deliberate deletion and alteration; actor type and operator identity are unestablished.
-
February 1, 2026 • An unnamed Latvian company was hacked in Feb. 2026 when an attacker exploited a website vulnerability, exported personal data from its database and demanded payment not to leak it. Latvian police linked the case to the TSC breach and arrested a 23-year-old suspect on Sept. 15.
-
February 1, 2026 The EvilTokens phishing service, active since February 2026, used device-code phishing to steal Microsoft 365 tokens, compromising 12,000+ inboxes at 10,000+ organizations for email monitoring and business email compromise. Microsoft and Cloudflare disrupted it in Sep 2026.
-
February 5, 2026 • An unauthorized third party acquired files from Monmouth University's network between 5 and 13 February 2026; the university learned of the access on 3 March and later determined the affected data on 29 May. PEAR claimed responsibility on 26 March and alleged theft of 16 TB for extortion. Monmouth stated that there was no operational disruption and that university systems and programs continued operating normally. The initial access method was not disclosed.
-
February 10, 2026 • Nitrogen claimed on February 10, 2026 that it had compromised Professional Compounding Centers of America's network, exfiltrated a significant amount of data, and would publish it unless its demands were accepted. DataBreach.com subsequently indexed 1,500,874 rows and dated the published dataset to May 12. PCCA did not publicly confirm the actor's claim, and no operational disruption was documented.
-
February 17, 2026 • Plaza Home Mortgage detected unauthorized access to an employee computer on or around February 17, 2026 and took action to remove the intruder. The company determined that an unauthorized party may have obtained personal information belonging to customers and employees and notified 137,976 individuals. Silent Ransom Group later claimed responsibility, but Plaza did not publicly confirm the attribution.
-
February 19, 2026 • PayoutsKing claimed it exfiltrated approximately 698 GB of data from Peachtree Group in an intrusion dated February 19, 2026 and publicly listed the company on April 30. DataBreach.com later indexed 299,873 rows. Litigation filed after the incident alleges that personally identifiable information belonging to current and former employees was accessed. A separate July 2026 claim by The Gentlemen appears to concern a later incident and is not merged into this record.
-
February 20, 2026 • Silent Ransom Group stated that it gained access to Wood Smith Henning & Berman's network on February 20, 2026 and acquired approximately 3.6 GB of data. Negotiations began by March 3, with the group demanding $1.8 million to delete the files. After negotiations failed, the group published the data on March 17. DataBreaches reviewed the leaked material and confirmed that it included technical reports, expert analyses, legal research, and files from multiple client matters. The access method was not disclosed, no malware or encryption was reported, and the firm did not respond to a request for comment.
-
February 21, 2026 • Bonanza Casino detected suspicious network activity on 21 February after finding certain systems offline. It secured the environment and engaged forensic specialists, who determined that an unauthorized party accessed certain systems and copied files. Medusa publicly claimed responsibility on 17 March and threatened to publish the stolen data. Bonanza Casino completed its affected-person review on 1 July and issued notices on 8 July. The intrusion method, duration of the system outage, and nationwide number of affected individuals were not disclosed.
-
February 23, 2026 • An unauthorized actor accessed Strategic Education's computer servers between February 23 and February 25, 2026 and copied certain files. The company discovered the incident on May 21 and began notifying affected individuals on May 29. Regulatory filings in six states identify at least 190,155 affected residents, although Strategic Education did not disclose a confirmed nationwide total. The actor, access method, and motive were not identified.
-
February 24, 2026 • WatchGuard telemetry identified Grandoreiro infections beginning in late February 2026. Phishing links delivered ZIP archives containing legitimate applications and malicious DLLs for side-loading, while a related campaign used an obfuscated VBS file to install the banking trojan. The confirmed victim population comprised banking and financial-services customers, small-to-medium businesses, and users in Portugal, Spain, Mexico, and other parts of Latin America; references to banks in the malware code identify targeted banking applications, not confirmed compromises of the banks themselves.
-
February 26, 2026 • KAIROS listed Rockwood Retirement Communities on its leak site on February 27, 2026. DataBreach.com subsequently indexed 132,606 structured records associated with the breach and dated the underlying event February 26. The records support classification of the affected asset as a database-backed application server, although the initial access vector was not disclosed. Rockwood operates nonprofit senior-living communities in Spokane. No victim notice or independent report confirmed encryption or operational disruption.
-
February 26, 2026 • Anubis claimed a data breach at Physicians' Clinic of Iowa on February 26, 2026 and published images reportedly showing personal identifiers and protected health information. DataBreach.com later indexed 158,631 structured records. The database-like patient records support classification of the affected asset as an application server, although the initial access vector was not disclosed. The clinic has not publicly confirmed the attribution or disclosed the precise number of affected patients, encryption, or operational disruption.
-
February 26, 2026 • On or around February 26, 2026, an unauthorized third party accessed part of Central National Gottesman's network and obtained files from company systems. The incident was discovered by February 28. PayoutsKing publicly claimed the company on March 2. Regulatory filings report 9,126 affected individuals and confirm exposure of identity, financial, health, and payroll-related information. DataBreach.com separately indexed 207,519 rows associated with the incident.
-
March 1, 2026 • FulcrumSec claimed that it obtained access in March 2026 through a GitHub access token, cloned Novo Nordisk repositories, obtained additional credentials, remained in the environment for more than two months, and stole more than 700,000 files totaling approximately 1.3 TB before demanding $25 million. Novo Nordisk confirmed unauthorized access to a limited number of internal IT systems and the external copying of non-public and personal data, but it did not publicly attribute the incident to FulcrumSec or confirm the actor's claimed volume and contents. Reuters could not independently verify the authenticity of the published data. Novo Nordisk temporarily took certain internal systems offline for containment, while stating that its core business operations remained operational. Because only March 2026 was reported for initial access, 2026-03-01 is used as the normalized event date.
-
March 1, 2026 • Beginning in March 2026, attackers used poisoned search results and fake download sites impersonating utilities such as CrystalDiskInfo, HWMonitor, PDFgear, and FurMark to compromise Windows users, with some malicious links also appearing in AI-chatbot recommendations during April. The malware installed ScreenConnect for persistent access, collected host information, and deployed GPU-focused cryptocurrency miners through process hollowing. Microsoft identified more than 150 malicious domains associated with the campaign.
-
March 1, 2026 An unauthorized party obtained files from West Publishing Corporation's C-Track court case-management environment in March 2026. West Publishing detected unauthorized activity June 30, 2026. Compromised records originated from courts in multiple U.S. states, the U.S. Virgin Islands, and Ontario, Canada; the incident occurred within the vendor environment rather than separate breaches of each court network. C-Track reported no operational disruption and no confirmed fraudulent use of the data.
-
March 2, 2026 • Ameriprise Financial disclosed unauthorized access to certain stored data and files in an incident dating back to March 2, 2026, which it detected and blocked on March 18. Ameriprise said there was no disruption to business operations and no indication of unauthorized transactions or fund movement. ShinyHunters claimed responsibility and allegedly threatened to release Salesforce customer records and more than 200 GB of compressed SharePoint internal data, but the full attacker claim was not confirmed by Ameriprise.
-
March 3, 2026 • AiLock claimed responsibility for an intrusion involving Lewis Drug in early March 2026 and alleged theft of approximately 110 GB. DataBreach.com dated the associated dataset to March 4 and indexed 22,549 rows. Public evidence supports a March 2026 event rather than the previously coded July 2025 date. No encryption or operational disruption was publicly documented.
-
March 7, 2026 • DataBreach.com indexed 1,891,536 rows associated with Valley Family Health Care and dated the breach to March 7, 2026. Insomnia listed the organization on its data-leak site on March 18, 2026. Public reporting did not identify the access vector or document encryption or operational disruption.