Recent Breaches
-
June 24, 2021 • During June 24-25, 2021, attackers encrypted files held by a French enterprise-software hosting provider and demanded ransom for decryption. The company restored hosted applications but could not recover certain data belonging to 14 customers because adequate off-site backups were absent. The case became public through reporting of a 2026 insurance judgment. Criminal/Financial is supported by the explicit ransomware demand; theft of files was not established. Software is a litigation pseudonym rather than the company's verified legal name.
-
September 1, 2021 • Scattered Spider crew members phished credentials at 12+ companies (entertainment, telecom, tech, BPO, IT, cloud, crypto) in 2021-2023, stole company data and millions in crypto from 29 victims. Ahmed Elbadawy's guilty plea surfaced Sept 2026 via a forfeiture filing.
-
May 21, 2022 • Turkish kebab chain Baydner was breached on May 21, 2022: malware on its IT manager's computer exposed web-service passwords, and attackers copied data on 505,337 people, then messaged an executive. Turkey's KVKK fined the chain 1M TL in 2026.
-
July 29, 2022 • An unauthorized actor accessed portions of Order Express's network between July 29 and September 7, 2022. Order Express discovered server connectivity problems on September 7 and shut down its network; investigators later determined that ransomware had encrypted just over half of its servers and that customer data had been accessed and exfiltrated. State breach filings identify 63,220 affected individuals. Contemporaneous public reporting attributed the incident to Cl0p, although Order Express itself described the attacker as unknown.
-
October 21, 2022 • Citizen Lab found with high confidence that former Greek MEP Stelios Kouloglou's iPhone was successfully infected with NSO Group's Pegasus on October 21, 2022 and again on March 6-7, 2023 using the PWNYOURHOME zero-click exploit. The infections occurred during sensitive PEGA Committee work. Researchers did not attribute the operation to a government, found no indication Greece was responsible, and assessed that the first infection overlapped with an operator previously targeting Russian- and Belarusian-speaking journalists and activists.
-
April 1, 2023 • The university's CIO/CISO dates LockBit's entry to April 1, 2023, using compromised employee credentials. About 13 days later, attackers encrypted servers and destroyed an onsite backup. They demanded US$1.25 million; the university did not pay. Stolen files were published around June 12. Cached server credentials were compromised. April 1 dates initial access, not encryption or confirmed extraction; the August 2026 interview describes a 2023 incident.
-
April 1, 2023 • Ex-U.S. Army soldier Cameron Wagenius ('kiberphant0m') and co-conspirators stole credentials and data, incl. call detail records, from at least 10 organizations incl. U.S. and foreign telecoms (Apr 2023-Dec 2024), sold and leaked data and sought $1M+ via extortion; 70-month term.
-
May 10, 2023 • A RedLine infostealer infected a senior officer's Windows computer used by the Syrian National Army Military Police Investigation Section in Suluk on May 10, 2023. Hudson Rock recovered a stealer log timestamped 09:39 showing the unit-named Windows account and theft of saved passwords, browser cookies, a live Telegram session, and 14 desktop files, including seven active detainee interrogation records. Five recovered Office lock files indicate some records were open when the malware ran. The log subsequently circulated in criminal markets. The individual RedLine affiliate responsible has not been identified. RedLine is commodity malware-as-a-service designed for credential and financial-data theft and resale, supporting Criminal actor type and Financial motive.
-
June 7, 2023 • Unauthorized access between June 7 July 12 2023 led to acquisition of sensitive personal and health information of 10,833 individuals. No service disruption; services remained operational. No perpetrator identified. Incident discovered July 12 2023; disclosure publicized via Yahoo on August 30 2025.
-
August 1, 2023 • Cameron Curry, a contract data analyst, used his access to Brightly Software's payroll information and corporate data to remove sensitive files between August and December 2023. Beginning in December, he used the alias Loot to demand $2.5 million in cryptocurrency and threatened to publish the stolen information.
-
September 1, 2023 • In September 2023, UNC6508 compromised a REDCap server belonging to an undisclosed North American medical research university. Three months later, the actor deployed the INFINITERED backdoor, harvested credentials, persisted through REDCap upgrades, obtained domain-administrator access, and created a Google Workspace content-compliance rule that silently forwarded selected emails to an actor-controlled account. Activity continued through November 2025. Google also identified additional organizations in the United States and Canada compromised with INFINITERED, but this row represents the detailed September 2023 university victim.
-
November 1, 2023 • Russian web developer Sergei Filimonov, extradited from Georgia, pleaded not guilty in Atlanta to charges he used fake bank login pages from Nov. 2023 to Oct. 2025 to steal U.S. customers' credentials and drain accounts. FBI counts 19+ victims and about $14.6M lost.
-
December 23, 2023 • On 2023-12-23, law enforcement informed St. George Fire Protection District No. 2 that threat actors had infiltrated its network. A later lawsuit alleged that compromised remote-access credentials used by the district's managed service provider enabled the intrusion and that attackers used legitimate administrative tools while inside the environment. The district's domain controllers were compromised, and it subsequently rebuilt servers, switches, domain controllers, firewalls, and backup infrastructure. No data theft, affected-person count, actor, motive, or service interruption was publicly reported.
-
January 22, 2024 • Black Basta ransomware group attacked UK water supplier Southern Water in January 2024, encrypting several IT systems and stealing customer and corporate data. The company later reported approximately 45 million in total expenses related to recovery, legal fees, and customer notification. The breach exposed nearly half a million customer records, and operations were temporarily disrupted though water services continued. Southern Water confirmed data exfiltration via its internal investigation and regulator notifications.
-
February 27, 2024 • Between February 27, 2024, and December 5, 2025, one or more unnamed suspected China-linked operators maintained PlugX, ShadowPad, and Cobalt Strike command-and-control activity involving Balochistan Police network appliances and web servers. In late 2024, an operator uploaded malicious cms_plugin.exe variants to the police Complaint Management System, including a Rust stager and a .NET implant that loaded AsyncRAT, creating a malware-delivery path to police and public users. SentinelLabs did not name the actor and warned that the shared or commodity tooling may represent more than one operator; no theft of the records stored on the affected systems was confirmed.
-
May 15, 2024 • Amazon confirms a data breach involving employee information after data allegedly stolen during the May 2023 MOVEit attacks is leaked on a hacking forum.
-
May 29, 2024 • The information of over 300,000 Presbyterian Healthcare Services patients is compromised as a result of a data breach at law firm Thompson Coburn.
-
June 28, 2024 • Two teenagers hacked servers supporting Seoul Facilities Corporation's Ttareungyi public bike-sharing service between June 28 and June 29, 2024 after identifying a web vulnerability that permitted access to member information without normal authentication. Approximately 4.62 million member records were stolen. During the June 28-30 incident, a DDoS attack also caused Ttareungyi-related pages to be unavailable for about 80 minutes. One suspect later told police that curiosity and a desire to show off motivated his actions; police also investigated whether the data may have been intended for sale but found no evidence that it was distributed to third parties.
-
July 11, 2024 Scott County reported unauthorized access to a health employee email account in July 2024.
-
August 18, 2024 • A Washington, D.C. crypto investor lost over 4,100 bitcoin (over $240M) on Aug. 18, 2024 after callers posing as Google and Gemini support got access to his Google Drive and security codes. Ringleader Malone Lam faced a plea hearing; 18 people were charged.