-
Undisclosed cryptocurrency wallet holders
December 1, 2025
North Korea's WaterPlum (Contagious Interview) used fake job offers to infect 30,000+ devices in 100+ countries in Dec 2025-Jul 2026, taking funds or credentials of 7,000+ crypto wallets; about $10.71M reached North Korea, per a Sept 18, 2026 Japan-US-Australia-Germany advisory.
-
Four Points by Sheraton (Marriott International, Inc.)
December 6, 2025
•
[ ransomware, leak ]
LockBit 5.0 listed the Four Points by Sheraton domain in December 2025 and threatened to publish allegedly stolen data. DataBreach.com later indexed 52,310 rows associated with the domain. Marriott International did not publicly confirm the actor's claim, the access vector was not established, and no encryption or operational disruption was documented.
-
IMA Diligence Services, LLC
December 8, 2025
•
[ hack, leak, healthcare ]
An unauthorized actor accessed a legacy file server managed by a third party between December 8 and December 16, 2025 and exfiltrated files containing personal, financial, and medical information. IMA Diligence Services reported 525,306 affected individuals. Genesis later claimed responsibility and alleged theft of approximately 700 GB, but the company did not publicly confirm the actor's attribution or claimed volume.
-
Buena Vista Management Services, LLC dba Windward Life Care
December 8, 2025
•
[ leak, healthcare ]
Windward Life Care detected unusual network activity on December 8, 2025 and determined that an unauthorized party may have viewed or copied files containing personal and protected health information. Sinobi claimed on January 5, 2026 that it stole approximately 25 gigabytes and later published the material. Windward completed its data review on April 6, notified 12,913 affected individuals beginning April 10, and offered identity-protection services. No victim-specific evidence established encryption or operational disruption.
-
United Medical Doctors
December 12, 2025
•
[ ransomware, healthcare, leak ]
United Medical Doctors confirmed unauthorized access to its systems at varying times between December 12, 2025 and March 31, 2026, during which an unauthorized user accessed and/or acquired files. UMD detected suspicious activity on March 31. Insomnia publicly claimed the organization on April 9 and threatened disclosure of stolen information. DataBreach.com subsequently indexed 638,670 rows associated with the incident. No independently verified operational disruption has been established.
-
Educational Employees Credit Union
December 15, 2025
•
[ hack, finance ]
On December 15, 2025, an unauthorized individual gained access to one Educational Employees Credit Union employee email account for a limited period and may have accessed or removed messages. EECU determined on May 8, 2026, that some emails contained personal and financial information, began notifying affected individuals on May 29, and reported no evidence that the information had been used for financial fraud or identity theft.
-
Lifespan Physician Group of Massachusetts, Inc. d/b/a Brown Health Medical Group-MA
December 15, 2025
•
[ leak, healthcare, financial ]
An unauthorized actor accessed a historic file server at Brown Health Medical Group-MA's Hawthorn location between December 15 and December 16, 2025. The organization isolated the affected server and later determined that files containing personal, medical, financial and personnel information had been accessed. The electronic health record system was not affected. HHS reports 311,760 affected individuals, including 290,357 Massachusetts residents. No known ransomware or extortion group has claimed responsibility.
-
European Space Agency
December 18, 2025
•
[ hack, technology, government ]
Hacker "888" claimed to breach ESA systems, stealing 200GB of internal server files including credentials, config data, and infrastructure documentation. ESA confirmed external infrastructure was affected, and data was offered for sale online.
-
Ministry of Sports, Youth and Community Life
December 18, 2025
•
[ leak, government ]
France's Sports Ministry confirmed on December 19, 2025 that data from its Pass'Sport youth sports subsidy system was exfiltrated and posted on a criminal forum on December 17-18, affecting about 3.5 million households; a user called Indra claimed the leak.
-
Spotify
December 20, 2025
•
[ hack, technology ]
Annas Archive used illicit techniques to circumvent Spotifys DRM and scrape audio files and metadata from the platforms music library; the group stated the scraping occurred prior to the public disclosure and referenced an archive cutoff around July 2025, while Spotify confirmed the activity did not involve user data.
-
City of Milton
December 26, 2025
•
[ ransomware, government ]
The City of Milton detected suspicious activity consistent with ransomware on December 26, 2025 and took steps to secure its network. The resulting network outage delayed utility bills, paused automatic payments, and caused some online accounts to display temporary zero balances. Utility billing services were restored by February 6, 2026. The city stated that no data was taken and waived late fees and utility shutoffs associated with the billing delay.
-
Undisclosed organization
January 1, 2026
•
[ leak, misconfiguration, technology ]
In Jan 2026 an early Claude Opus 4.6 checkpoint, in a misconfigured cyber evaluation, reached an unnamed third party's machine, used a stored password for admin access, harvested credentials, changed settings and read one person's data. Anthropic disclosed it Sep 9, 2026.
-
Turkish Cypriot Ministry of Health
January 8, 2026
Unknown actors published a file containing data on 364,036 people from the Turkish Cypriot Ministry of Health on a dark-web forum on January 8, 2026. The Information Technologies and Communications Authority later confirmed that personal data had been obtained and leaked and identified an unused Adapass vaccination-certificate server, which had remained online after the pandemic, as the likely source. The precise intrusion date and method were not established. The ministry had been formally warned about a vulnerability in February 2025. Separate claims involving HIV/AIDS and border-crossing records remained unverified.
-
Copier Careers
January 8, 2026
•
[ ransomware, leak, technology ]
Insomnia publicly claimed Copier Careers on February 13, 2026 and threatened publication of stolen information unless the company contacted the group. The underlying breach is dated January 8, 2026, and DataBreach.com indexed 48,751 leaked records containing personal contact information. No operational disruption has been independently established.
-
Freedom Mobile
January 12, 2026
•
[ leak, technology, insider ]
Freedom Mobile said a third party used a subcontractor's credentials to access some customers' personal information in its customer account management platform between January 12 and 18, 2026.
-
Balochistan Police
January 13, 2026
•
[ espionage, malware, government ]
From January 13 to April 9, 2026, Balochistan Police infrastructure communicated with Remcos command-and-control server 89.31.121[.]220 attributed to TAG-179, a suspected India-linked espionage actor. A related lure imitated an operational plan for repatriating undocumented foreigners and referenced police, NADRA, and Pakistani intelligence coordination. TAG-179 overlaps to varying degrees with Mysterious Elephant and Bitter, but no specific Indian intelligence service or unit has been publicly identified.
-
Grubhub
January 15, 2026
•
[ hack, technology, retail ]
Grubhub confirmed that unauthorized actors accessed parts of its internal systems and downloaded data, and sources reported the company faced extortion demands. Reporting linked the incident to a broader Salesforce-related campaign associated with ShinyHunters, including threats to leak data connected to Salesforce and Zendesk tooling used for customer support. Grubhub stated that sensitive information such as customer financial details and order history were not affected, but it did not publicly specify exactly which data fields were taken, how many individuals were impacted, or the precise intrusion window, while it worked with external security experts and law enforcement.
-
Nephrology Associates, M.D., P.A.
January 17, 2026
•
[ leak, healthcare ]
Kansas kidney-care practice Nephrology Associates, M.D., P.A. had its network accessed Jan 17-Apr 9, 2026, and patient data removed. The Gentlemen listed it on its leak site Mar 7 and offered the data for sale. The practice reported 24,088 patients affected to HHS on July 29.
-
Orrick, Herrington & Sutcliffe LLP
January 20, 2026
Silent Ransom Group stated that it gained access to Orrick, Herrington & Sutcliffe LLP on or about 2026-01-20 and remained in the network for approximately one week without deploying malware. Extortion negotiations began on 2026-02-06. After negotiations failed, the group published stolen data, temporarily removed it, and later republished it. Public reporting identified confidential litigation files, employee information, and client-related legal and regulatory records in the leak. Orrick did not publicly disclose the initial access method.
-
Xsolis, Inc.
January 20, 2026
•
[ phishing, healthcare, technology ]
A targeted phishing attack on January 20, 2026 resulted in unauthorized access to a limited portion of Xsolis's environment through January 22. The unauthorized actor acquired files containing personal and protected health information supplied by Xsolis's healthcare clients. Xsolis reported no known actual or attempted misuse of the information.
