-
Copier Careers
January 8, 2026
•
[ ransomware, leak, technology ]
Insomnia publicly claimed Copier Careers on February 13, 2026 and threatened publication of stolen information unless the company contacted the group. The underlying breach is dated January 8, 2026, and DataBreach.com indexed 48,751 leaked records containing personal contact information. No operational disruption has been independently established.
-
Freedom Mobile
January 12, 2026
•
[ leak, technology, insider ]
Freedom Mobile said a third party used a subcontractor's credentials to access some customers' personal information in its customer account management platform between January 12 and 18, 2026.
-
Balochistan Police
January 13, 2026
•
[ espionage, malware, government ]
From January 13 to April 9, 2026, Balochistan Police infrastructure communicated with Remcos command-and-control server 89.31.121[.]220 attributed to TAG-179, a suspected India-linked espionage actor. A related lure imitated an operational plan for repatriating undocumented foreigners and referenced police, NADRA, and Pakistani intelligence coordination. TAG-179 overlaps to varying degrees with Mysterious Elephant and Bitter, but no specific Indian intelligence service or unit has been publicly identified.
-
Grubhub
January 15, 2026
•
[ hack, technology, retail ]
Grubhub confirmed that unauthorized actors accessed parts of its internal systems and downloaded data, and sources reported the company faced extortion demands. Reporting linked the incident to a broader Salesforce-related campaign associated with ShinyHunters, including threats to leak data connected to Salesforce and Zendesk tooling used for customer support. Grubhub stated that sensitive information such as customer financial details and order history were not affected, but it did not publicly specify exactly which data fields were taken, how many individuals were impacted, or the precise intrusion window, while it worked with external security experts and law enforcement.
-
Nephrology Associates, M.D., P.A.
January 17, 2026
•
[ leak, healthcare ]
Kansas kidney-care practice Nephrology Associates, M.D., P.A. had its network accessed Jan 17-Apr 9, 2026, and patient data removed. The Gentlemen listed it on its leak site Mar 7 and offered the data for sale. The practice reported 24,088 patients affected to HHS on July 29.
-
Orrick, Herrington & Sutcliffe LLP
January 20, 2026
Silent Ransom Group stated that it gained access to Orrick, Herrington & Sutcliffe LLP on or about 2026-01-20 and remained in the network for approximately one week without deploying malware. Extortion negotiations began on 2026-02-06. After negotiations failed, the group published stolen data, temporarily removed it, and later republished it. Public reporting identified confidential litigation files, employee information, and client-related legal and regulatory records in the leak. Orrick did not publicly disclose the initial access method.
-
Xsolis, Inc.
January 20, 2026
•
[ phishing, healthcare, technology ]
A targeted phishing attack on January 20, 2026 resulted in unauthorized access to a limited portion of Xsolis's environment through January 22. The unauthorized actor acquired files containing personal and protected health information supplied by Xsolis's healthcare clients. Xsolis reported no known actual or attempted misuse of the information.
-
Rocky Mountain Associated Physicians, P.C.
January 26, 2026
•
[ leak, healthcare ]
Rocky Mountain Associated Physicians stated that an unauthorized actor accessed systems including its patient database and other data files at an unknown date no earlier than October 30, 2025, and that it confirmed compromised patient information on February 2, 2026. PEAR listed the practice on its leak site on January 30, 2026 and later released data. The source's January 26, 2026 breach date is used as the event date. No encryption or operational disruption was reported.
-
Florida Court Clerks & Comptrollers
January 27, 2026
•
[ insider, government ]
Between January 27 and May 1, 2026, former Florida Department of Juvenile Justice probation officer Crystal Lawson allegedly used credentials that remained active after her termination to repeatedly access confidential records in Florida's Comprehensive Case Information System. Investigators said she disclosed active arrest warrants and other restricted case information to members and associates of a drug-trafficking organization, contributing to lost evidence, unrecovered assets, and at least one suspect temporarily fleeing arrest.
-
Penobscot Valley Hospital
January 28, 2026
•
[ hack, healthcare ]
Penobscot Valley Hospital detected suspicious network activity on January 28, 2026, secured its systems, engaged forensic specialists, and notified law enforcement. The investigation determined on February 12 that an unauthorized individual may have accessed files and folders on the hospital network and concluded on June 4 that affected files contained personal and protected health information belonging to patients and employees. A federal healthcare-breach record reports 33,107 affected individuals, but the patient-employee split was not disclosed. Notifications began in July. No operational disruption or responsible group was reported.
-
MG Oil Company, Inc.
January 29, 2026
•
[ ransomware, leak, energy ]
Akira listed MG Oil Company on January 29, 2026 and claimed theft of approximately 35 GB of corporate data. DataBreach.com subsequently indexed 9,891 associated rows. The company's public attribution, the access vector, and any operational disruption were not established; therefore, only the achieved data-exposure effect is coded.
-
Rocky Mountain Care
January 30, 2026
Rocky Mountain Care determined that an unauthorized third party viewed or obtained files from its network between 2026-01-30 and 2026-02-02. Qilin listed the organization on its data-leak site on 2026-02-23 and claimed responsibility. A subsequently published dataset contained 48,667 records with identity and contact information. Public reporting did not confirm encryption, operational disruption, or the initial access method, so the event is coded as Exploitive rather than Disruptive.
-
Undisclosed People Playground user
February 1, 2026
•
[ hack, leak, technology ]
A malicious mod overwrote users' Workshop uploads, deleted saved creations and reset settings and achievements. This represents an unnamed affected user in the February incident, separate from September. February 1 is the earliest-warning fallback, not a verified infection date. Sabotage is inferred from deliberate deletion and alteration; actor type and operator identity are unestablished.
-
Undisclosed Latvian company
February 1, 2026
•
[ ransomware, hack, technology ]
An unnamed Latvian company was hacked in Feb. 2026 when an attacker exploited a website vulnerability, exported personal data from its database and demanded payment not to leak it. Latvian police linked the case to the TSC breach and arrested a 23-year-old suspect on Sept. 15.
-
Undisclosed organizations
February 1, 2026
The EvilTokens phishing service, active since February 2026, used device-code phishing to steal Microsoft 365 tokens, compromising 12,000+ inboxes at 10,000+ organizations for email monitoring and business email compromise. Microsoft and Cloudflare disrupted it in Sep 2026.
-
Monmouth University
February 5, 2026
•
[ ransomware, education ]
An unauthorized third party acquired files from Monmouth University's network between 5 and 13 February 2026; the university learned of the access on 3 March and later determined the affected data on 29 May. PEAR claimed responsibility on 26 March and alleged theft of 16 TB for extortion. Monmouth stated that there was no operational disruption and that university systems and programs continued operating normally. The initial access method was not disclosed.
-
Professional Compounding Centers of America, Inc.
February 10, 2026
•
[ ransomware, healthcare, technology ]
Nitrogen claimed on February 10, 2026 that it had compromised Professional Compounding Centers of America's network, exfiltrated a significant amount of data, and would publish it unless its demands were accepted. DataBreach.com subsequently indexed 1,500,874 rows and dated the published dataset to May 12. PCCA did not publicly confirm the actor's claim, and no operational disruption was documented.
-
Plaza Home Mortgage, Inc.
February 17, 2026
•
[ ransomware, finance ]
Plaza Home Mortgage detected unauthorized access to an employee computer on or around February 17, 2026 and took action to remove the intruder. The company determined that an unauthorized party may have obtained personal information belonging to customers and employees and notified 137,976 individuals. Silent Ransom Group later claimed responsibility, but Plaza did not publicly confirm the attribution.
-
Peachtree Group
February 19, 2026
•
[ hack, leak, finance ]
PayoutsKing claimed it exfiltrated approximately 698 GB of data from Peachtree Group in an intrusion dated February 19, 2026 and publicly listed the company on April 30. DataBreach.com later indexed 299,873 rows. Litigation filed after the incident alleges that personally identifiable information belonging to current and former employees was accessed. A separate July 2026 claim by The Gentlemen appears to concern a later incident and is not merged into this record.
-
Wood Smith Henning & Berman LLP
February 20, 2026
•
[ ransomware, finance, technology ]
Silent Ransom Group stated that it gained access to Wood Smith Henning & Berman's network on February 20, 2026 and acquired approximately 3.6 GB of data. Negotiations began by March 3, with the group demanding $1.8 million to delete the files. After negotiations failed, the group published the data on March 17. DataBreaches reviewed the leaked material and confirmed that it included technical reports, expert analyses, legal research, and files from multiple client matters. The access method was not disclosed, no malware or encryption was reported, and the firm did not respond to a request for comment.
