Medtronic
April 17, 2026
•[ data leak, unauthorized access, personal records ]
ShinyHunters listed Medtronic on its leak site on April 17, 2026, claiming theft of more than 9 million personal records and terabytes of corporate information; Medtronic confirmed unauthorized access to corporate IT systems but had not confirmed data theft.
Pricon Microelectronics, Inc.
April 17, 2026
•[ ransomware, data theft, LockBit 5.0 ]
Pricon Microelectronics suffered a ransomware attack affecting some servers; LockBit 5.0 later claimed data theft.
Adams County, Mississippi
April 17, 2026
•[ ransomware, government services, outdated systems ]
Adams County, Mississippi suffered a ransomware attack on April 17, 2026, after an outdated computer in the sanitation department allowed hackers to spread through the county network. The attack locked employees out of key services including court records, car tag payments, and public records processing; about 70% of systems were back online by the time of reporting, but full recovery was still underway.
Adumo (Lesaka unit)
April 16, 2026
•[ source code leak, payment system data, dark web ]
Adumo investigated claims that technical payment-system data and source code were offered for sale on a dark-web forum.
Zara
April 15, 2026
•[ extortion, data leak, third-party risk ]
In April 2026, the fashion brand Zara was among a number of organisations targeted by the ShinyHunters extortion group as part of their "pay or leak" campaign. The group claimed the breach was related to a compromise of the Anodot analytics platform and subsequently published a terabyte of data allegedly including 95M support ticket records. The data contained 197k unique email addresses alongside product SKUs, order IDs and the market the support ticket originated in. Zara's parent company Inditex advised that the incident didn't affect passwords or payment information.
Agence nationale des titres sécurisés (ANTS)
April 15, 2026
•[ unauthorized access, data leak, identity document theft ]
On April 15, 2026, ANTS, also known as France Titres, detected unauthorized access to the ants.gouv.fr portal. The agency confirmed a data breach involving citizen identity-document portal data, while breach3d claimed to have stolen up to 19 million records and offered them for sale; ANTS did not specify the total number of affected citizens.
Booking.com
April 15, 2026
•[ unauthorized access, data breach, PII leak ]
Booking.com detected suspicious activity affecting a number of reservations and notified customers that unauthorized third parties may have accessed booking details, names, email addresses, addresses, phone numbers, and information shared with properties; financial information was not accessed, and Booking.com reset reservation PINs for affected users.
Nigeria's Corporate Affairs Commission (CAC)
April 15, 2026
•[ unauthorized access, data exfiltration, data breach ]
Nigerias Corporate Affairs Commission confirmed unauthorized access to limited aspects of its information systems; ByteToBreach claimed it exfiltrated about 25 million documents, roughly 750 GB, from CAC infrastructure, but CAC did not confirm the volume or identify the perpetrator.
Inditex (Zara owner)
April 15, 2026
•[ unauthorized access, third-party breach, customer transaction information ]
Inditex reported unauthorized access to third-party-hosted databases containing customer transaction information; the company said the affected databases did not contain addresses, passwords, or bank card details and that it applied security protocols and notified authorities.
Bluesky
April 15, 2026
•[ DDoS attack, service disruption, 313 Team ]
Bluesky experienced a roughly 24-hour DDoS attack that intermittently disrupted core platform features; 313 Team claimed responsibility.
Guesty
April 15, 2026
•[ ransomware, extortion, data theft ]
Vect claimed it stole 700GB of Guesty data and was negotiating with the company after a ransomware-related extortion listing.
Council of Engineers Thailand
April 15, 2026
•[ data breach, personal information, database security ]
A hacker breached the Council of Engineers Thailand member database while data was being transferred between servers, stealing personal information of approximately 350,000 engineers.
Grinex
April 15, 2026
•[ cyberattack, cryptocurrency, asset theft ]
Grinex, a Kyrgyzstan-based cryptocurrency exchange linked to Russia, suspended operations after a cyberattack in which assets worth 1 billion roubles, about $13.10 million, were stolen.
Kemper
April 15, 2026
•[ ransomware, social engineering, extortion ]
In April 2026, the American insurance holding company Kemper Corporation was named by the ShinyHunters ransomware group in a "pay or leak" extortion campaign. The attackers allegedly accessed Kemper's Salesforce environment via social engineering as part of a broader campaign targeting hundreds of organisations using the same method. The group later published tens of gigabytes of data they claimed included internal directory data, Salesforce records and Stripe payment logs. Among the 269k unique email addresses were names, phone numbers, physical addresses and partial payment card data including the last 4 digits, expiry dates and card brands. Kemper confirmed the incident and stated they had engaged third-party cybersecurity experts and notified law enforcement.
Undisclosed major user-generated content platform
April 15, 2026
•[ DDoS, HTTP DDoS campaign, Cybercrime ]
In mid-April 2026, cybercriminals launched a fragmented HTTP DDoS campaign against an undisclosed major user-generated content platform, generating approximately 2.45 billion malicious requests over five hours and peaking at 205,344 requests per second. The traffic originated from more than 1.2 million unique IP addresses across 16,402 autonomous systems.
Empower Group
April 15, 2026
•[ data leak, personally identifiable information, finance ]
DragonForce reportedly claimed responsibility for a breach of Empower Group, a New York-based alternative financing provider, and claimed to have exfiltrated approximately 316GB of data. DataBreach later indexed 6,691,415 rows allegedly tied to the breach, including Social Security numbers, dates of birth, email addresses, phone numbers, names, and street addresses. Public sources did not confirm file encryption or operational disruption.
Le Desk (media outlet)
April 14, 2026
•[ DDoS attack, cyberattack, media outlet ]
Le Desk was targeted by a large DDoS attack that generated 26.69 billion HTTP requests over 42 hours.
At least one Chrome user
April 14, 2026
•[ malicious extensions, credential theft, session hijacking ]
A coordinated campaign used 108 malicious Chrome extensions published under five developer identities to route stolen credentials, user identities, browsing data, Google account information, and Telegram Web session data to shared command-and-control infrastructure. The extensions collectively had about 20,000 Chrome Web Store installs and could inject ads or arbitrary JavaScript into visited pages and open arbitrary URLs through browser-level abuse.
McGraw Hill
April 14, 2026
•[ misconfiguration, data leak, extortion ]
McGraw Hill confirmed that a Salesforce-hosted webpage misconfiguration exposed limited contact data, while ShinyHunters claimed millions of Salesforce records and attempted extortion.
Maryland Department of Assessments and Taxation
April 14, 2026
•[ suspicious activity, web application security, incident response ]
The Maryland Department of Information Technology detected suspicious activity on servers running the State Department of Assessments and Taxations Real Property Search website application on April 14, 2026 and took the site offline; no private data was reported compromised.
