Recent Breaches
-
May 2, 2023 • Northwest Health La Porte confirms that the protected health information of 10,256 patients was compromised in the Clop ransomware group's series of attacks exploiting the zero-day vulnerability in Fortra's GoAnywhere file transfer.
-
May 2, 2023 • Physicians Insurance A Mutual Company, its affiliate MedChoice Risk Retention Group, and its subsidiary Experix (collectively "Physicians Insurance") file a notice of data breach after discovering that an unauthorized party gained access to an employee's email account.
-
May 2, 2023 • Optima Tax Relief files a notice of data breach after learning that a recent data security incident exposed the confidential information of certain customers to an unauthorized party.
-
May 2, 2023 • Wichita State University takes proactive measures and disconnects several University systems to isolate an unauthorized attempt by a third party to access the University's systems
-
May 1, 2023 • Barracuda, a company known for its email and network security solutions, warns customers that some of their Email Security Gateway (ESG) appliances were breached last week by targeting CVE-2023-2868, a now-patched zero-day vulnerability.
-
May 1, 2023 Researchers from ClearSky Security reveal the details of 'Fata Morgana' a watering hole attack on at least eight shipping and logistics companies in Israel. The attack is highly likely to be orchestrated by a nation-state actor from Iran, with a low confidence specific attribution to Tortoiseshell (also called TA456 or Imperial Kitten).
-
May 1, 2023 • Emby says it remotely shut down an undisclosed number of user-hosted media server instances that were recently hacked by exploiting a previously known vulnerability and an insecure admin account configuration.
-
May 1, 2023 • Precision Anesthesia Billing files a notice of data breach after discovering that an unauthorized party was able to access confidential patient information provided to the company.
-
May 1, 2023 • Heritage Group files a notice of data breach after an unauthorized party gained access to the company's computer network and was able to access confidential information belonging to certain current and former employees and their dependents.
-
May 1, 2023 • Mission Community Hospital is added to the list of the victims of the RansomHouse group, which claimed to have stolen 2.5 TB of data, including a large amount of patient data exploiting vulnerabilities on Paragon and Cisco.
-
May 1, 2023 • The City of Dallas suffers a Royal ransomware attack, causing it to shut down some of its IT systems to prevent the attack's spread.
-
May 1, 2023 Attackers exploit a Level Finance smart contract vulnerability to drain approximately $1,100,000 worth of cryptocurrency.
-
May 1, 2023 • Roosevelt University (RU) files a notice of data breach after discovering that an unauthorized actor was able to access confidential student and prospective student information in the school's possession.
-
May 1, 2023 • Western Sydney University (WSU) notifies students and academic staff about a data breach after threat actors breached its Microsoft 365 and Sharepoint environment.
-
May 1, 2023 • In January 2025, a data breach from the Columbian website for Le Coq Sportif was posted to a popular hacking forum. The data included almost 80k unique email addresses with the breach dating back to May 2023. Impacted data included physical and IP addresses, names, purchases, genders, dates of birth and bcrypt password hashes. The data was provided to HIBP by a source who requested it be attributed to "oathnet.ru".
-
April 30, 2023 • The North Carolina Housing Finance Agency (NCHFA) loses nearly $3 million in a business email compromise (BEC) scam.
-
April 30, 2023 • TIC Hosting, a hosting provider in Romania, suffers a data breach affecting 300 customers.
-
April 30, 2023 • The Bluefield University is hit with an Avos ransomware attack. Few days later the ransomware gang hijacks the University's emergency broadcast system, "RamAlert," to send students and staff SMS texts and email alerts that their data was stolen and would soon be released.
-
April 30, 2023 Data extortion group Karakurt claims it attacked Our Sunday Visitor, a Catholic publishing company, The attackers claim to have stolen 130 gigabytes of data, including accounting documents, HR information, employee data, financial contracts, invoices, marketing information and more.
-
April 30, 2023 • ChildFund in New Zealand issues a public notice about a data breach involving a telemarketing company, Pareto Phone Limited. ChildFund had contracted with Pareto in 2014 to conduct fundraising activity on its behalf.