Full List

Search

Recent Breaches

• Olympique de Marseille February 1, 2026 • [ cyberattack, data leak, data breach ] Olympique de Marseille confirmed a cyberattack after a threat actor claimed to have breached club systems earlier in February and leaked samples of staff and supporter data online.
• Undisclosed U.S. organization February 1, 2026 • [ cyber espionage, APT, backdoor ] HackRead reported that researchers linked a campaign observed in early February 2026 to Iran-aligned APT MuddyWater, described as operating under Irans Ministry of Intelligence and Security. The report stated attackers infiltrated networks of several U.S. organizations across sectors (including banking and aviation) and an Israeli software development services operation, maintaining persistence and using a new custom backdoor called Dindoor to remotely issue commands and sustain access. The article describes espionage tradecraft and persistence but does not list specific victims or confirm specific data stolen.
• Uffizi Galleries February 1, 2026 • [ cyberattack, backup restoration, operational disruption ] Uffizi Galleries confirmed a cyberattack but said nothing was stolen and disruption was limited to restoring backups.
• Undisclosed Mexican Bank #2 February 1, 2026 • [ ransomware, Qilin, electronic channels ] Banco de Mxico reported that an undisclosed bank suffered a February 2026 ransomware incident involving Qilin that affected electronic channels and electronic transfer services; no customer financial impact was reported and the institutions financial impact remained pending.
• Tulsa International Airport January 31, 2026 • [ ransomware, data leak, internal documents ] Qilin ransomware gang claimed responsibility for a ransomware attack on Tulsa International Airport and posted leaked internal documents; airport confirmed incident but not the attribution.
• Step Finance January 31, 2026 • [ hacking, cryptocurrency theft, treasury breach ] Step Finance reported that hackers compromised devices belonging to company executives and used that access to breach several treasury wallets, resulting in approximately $40 million in stolen digital assets. The platform detected the incident on January 31, 2026 and engaged cybersecurity researchers and partners; it reported partial recovery (including assets associated with Remora and other positions) and stated certain operations were halted to reinforce security. The incident affected treasury wallet holdings rather than user rTokens (reported as fully backed), and Step advised users to avoid interacting with the STEP token pending an outcome plan and snapshot process.
• Association Nationale des Premiers Secours January 30, 2026 • [ data breach, PII, legacy system ] In January 2026, a data breach impacting the French non-profit Association Nationale des Premiers Secours (ANPS) was posted to a hacking forum. The breach exposed 5.6k unique email addresses along with names, dates of birth and places of birth. ANPS self-submitted the data to HIBP and advised the incident was traced back to a legacy system and did not impact health data, financial information or passwords.
• Ttareungyi (Seoul public bike-sharing service) January 30, 2026 • [ data breach, PII exposure, data leak ] Approximately 4500000 user records including user IDs and mobile phone numbers were exposed in a data breach affecting Seouls public bike-sharing service Ttareungyi; authorities stated the timing of the exposure was under investigation, and no attacker attribution had been confirmed at the time of reporting.
• Multiple organizations with exposed MongoDB databases January 30, 2026 • [ MongoDB, data breach, ransomware ] A threat actor actively accessed, queried, and ransacked more than 1400 publicly exposed MongoDB application servers, exfiltrating data and leaving ransom notes demanding payment in exchange for deletion or non-disclosure of the stolen information.
• At least one government, military, and technology entity in Ukraine January 30, 2026 • [ APT, vulnerability exploitation, state-sponsored attack ] Security researchers reported that state-sponsored advanced persistent threat groups exploited a WinRAR vulnerability in real-world attacks that successfully compromised at least one government, military, and technology organization in Ukraine, using malicious archive files to gain unauthorized access to victim systems.
• Provecho January 30, 2026 • [ data leak, email addresses, usernames ] In early 2026, data purportedly sourced from the recipe and meal planning service Provecho was alleged to have been obtained in a breach. The exposed data included 713k unique email address along with username and the creator account holders followed. Provecho has been notified and is aware of the claims surrounding the incident.
• European Commission January 30, 2026 • [ cyberattack, data leak, vulnerability exploitation ] The European Commission disclosed it detected traces of a cyberattack on January 30, 2026 targeting its central infrastructure used to manage staff mobile devices. The Commission said the incident may have resulted in access to staff names and mobile phone numbers for some employees, but it had not found evidence that managed mobile devices themselves were compromised. The Commission stated its response contained and cleaned the system within nine hours. The article notes the Commission did not disclose the initial access method, but the incident appeared linked to attacks exploiting vulnerabilities in Ivanti Endpoint Manager Mobile (EPMM).
• Valtori (Finnish Government ICT Centre) mobile device management service January 30, 2026 • [ data breach, mobile device management, zero-day vulnerability ] Valtori reported a data breach identified on January 30, 2026 in the mobile device management service it provides to Finlands government shared ICT services. Valtori said the attacker accessed information used to operate the service, including names, work email addresses, phone numbers, and device details, and that investigation later found the scope could involve a substantially larger number of users (about 50,000). Valtori stated no data stored directly on mobile devices was compromised. The root cause was described as exploitation of a zero-day vulnerability in a commercial mobile management product, compounded by the systems failure to permanently delete historical data.
• Match Group Inc. (Tinder, Hinge, OkCupid) January 29, 2026 • [ data leak, cybercrime, ShinyHunters ] A cybercrime group calling itself ShinyHunters claimed responsibility for accessing and leaking limited user and internal data from Match Group platforms. Match Group confirmed a security incident but stated that passwords, financial information, and private messages were not compromised.
• SmarterTools January 29, 2026 • [ ransomware, network intrusion, vulnerability ] SmarterTools confirmed that the Warlock ransomware gang breached its network after compromising a single SmarterMail virtual machine set up by an employee and not kept updated. The company said the intrusion began January 29, 2026 and that the attackers waited about a week before attempting encryption, but security controls reportedly prevented encryption, impacted systems were isolated, and data was restored from backups. SmarterTools stated business applications and customer account data were not impacted.
• Embark Studios (Arc Raiders & The Finals servers) January 28, 2026 • [ DDoS attacks, server disruption, gameplay instability ] Embark Studios confirmed that the multiplayer games ARC Raiders and The Finals were hit by extensive, coordinated DDoS attacks that disrupted servers, leading to connection drops, lag, and gameplay instability for players worldwide.
• Bumble Inc. (dating app) January 28, 2026 • [ unauthorized access, internal network, compromised account ] A contractor account at Bumble was compromised, granting limited unauthorized access to part of the internal network. Bumble stated that no user accounts, profile data, messages, or member databases were accessed.
• City of New Britain January 28, 2026 • [ ransomware, cyberattack, infrastructure disruption ] City of New Britain municipal systems were taken offline following a ransomware attack that disrupted internal networks and communications, prompting coordination with federal and state authorities to restore services.
• Figure January 28, 2026 • [ social engineering, fintech, data leak ] In February 2026, data obtained from the fintech lending platform Figure was publicly posted online. The exposed data, dating back to January 2026, contained over 900k unique email addresses along with names, phone numbers, physical addresses and dates of birth. Figure confirmed the incident and attributed it to a social engineering attack in which an employee was tricked into providing access.
• Euroxx Securities S.A. January 27, 2026 • [ cyberattack, defensive shutdown, system shutdown ] Cyberattack on Euroxx prompted a defensive system shutdown; no disruption or data loss confirmed.