Philadelphia Insurance
June 9, 2025
•[ unauthorized access, data leak, customer data ]
Philadelphia Insurance Companies detected unauthorized access to its systems late on June 9, 2025; it proactively disconnected affected systems, stated the incident was not ransomware and involved no encryption, and later disclosed that customer data had been accessed.
Hims & Hers Inc.
February 4, 2026
•[ third-party risk, data leak, PII ]
Hackers accessed Hims & Hers third-party ticketing system between February 4 and February 7, 2026, stealing customer support ticket data that primarily included names and email addresses; medical records and healthcare-provider communications were not affected.
Medtronic
April 17, 2026
•[ data leak, unauthorized access, personal records ]
ShinyHunters listed Medtronic on its leak site on April 17, 2026, claiming theft of more than 9 million personal records and terabytes of corporate information; Medtronic confirmed unauthorized access to corporate IT systems but had not confirmed data theft.
DocketWise
September 1, 2025
•[ unauthorized access, third-party breach, credential theft ]
DocketWise discovered unauthorized access to a third-party partner repository used in a data migration pipeline; an unauthorized actor used valid credentials to clone repositories containing law-firm customer records and personal information of their clients.
Bonifraterskie Medical Center
March 13, 2026
•[ ransomware, data leak, personal data ]
Bonifraterskie Medical Center reported a ransomware attack that encrypted part of its server infrastructure and likely exposed personal data.
Morocco’s Office of Vocational Training and Employment Promotion (OFPPT)
April 12, 2026
•[ data leak, compromised account, user data ]
OFPPT disclosed that data from about 100,000 MyWay platform users was leaked after likely misuse of a compromised account.
Inditex (Zara owner)
April 15, 2026
•[ unauthorized access, third-party breach, customer transaction information ]
Inditex reported unauthorized access to third-party-hosted databases containing customer transaction information; the company said the affected databases did not contain addresses, passwords, or bank card details and that it applied security protocols and notified authorities.
Basic-Fit
April 13, 2026
•[ unauthorized access, data breach, data leak ]
Basic-Fit detected unauthorized access to the system that records member visits and stopped the intrusion within minutes, but external security experts determined that data for active members in several countries had been downloaded, affecting about 1 million members overall, including around 200,000 in the Netherlands.
Rx Management
April 8, 2026
•[ ransomware, data leak, healthcare ]
INC Ransom listed Australian pharmacy management firm Rx Management on its leak site on April 8, 2026 and threatened to publish more than 180 GB of allegedly stolen data; the data types and full extent were not publicly verified.
Shine Aviation
April 4, 2026
•[ data leak, employee credentials, employee records ]
Anubis claimed on April 4, 2026 that it obtained 57 GB, or more than 68,000 files, from Geraldton-based Shine Aviation, including alleged employee credentials and records, access-card scans, operational documentation, and aircraft-related certificates; the claim was not independently verified.
Los Angeles City Attorney’s Office
March 20, 2026
•[ data leak, unauthorized access, third-party breach ]
World Leaks posted an archive of approximately 7.7 TB / 337,000 files after unauthorized access to a third-party discovery-transfer tool used by the Los Angeles City Attorneys Office; the data included LAPD civil litigation discovery files, personnel and disciplinary records, witness information, medical information, and investigative materials, while LAPD said its own systems were not breached.
National Supercomputing Center (NSCC) Tianjin
February 6, 2026
•[ data breach, military, aerospace ]
FlamingChina claimed to have breached the National Supercomputing Center in Tianjin and offered for sale more than 10 petabytes of allegedly stolen data, including claimed military, aerospace, research, and client datasets; the breach was not confirmed by NSCC Tianjin, but experts who reviewed samples said they appeared consistent with data expected from the facility.
Hong Kong Hospital Authority (Kowloon East Cluster)
April 3, 2026
•[ data leak, unauthorized retrieval, patient data ]
The Hospital Authority detected unauthorized retrieval and leakage of patient data from the Kowloon East Cluster on April 3, 2026, affecting more than 56,000 patients; internal checks did not indicate a cyberattack, and police and privacy regulators were notified.
Sterling Seacrest Pritchard, Inc.
August 12, 2025
•[ unauthorized access, email breach, data leak ]
Sterling Seacrest Pritchard disclosed unauthorized access to its email environment that may have exposed personal information.
Oklahoma Tax Commission
December 20, 2025
•[ unauthorized access, tax data, W-2 ]
Oklahoma Tax Commission disclosed unauthorized access to W-2 and 1099 files in the OkTAP tax portal.
The Canada Life Assurance Company
April 17, 2026
•[ unauthorized access, data leak, personal information ]
The Canada Life Assurance Company confirmed unauthorized access through an employee account that exposed personal information for up to 70,000 people.
City of Ardmore
April 8, 2026
•[ ransomware, phishing, data leak ]
On April 8, 2026, ransomware encrypted Ardmore police/internal servers after a phishing email; the incident was contained within hours, and information tied to criminal complaints and investigations, including names, addresses, and phone numbers, may have been exposed.
Gelatissimo
April 27, 2026
•[ data leak, ransomware, financial data ]
DragonForce listed Australian gelato franchiser Gelatissimo on its leak site around April 27, 2026 and claimed to have stolen more than 350 GB of data, with other reporting specifying 352.24 GB. The claimed data included sensitive employee data, financial details, operational information, and executive contact details, and the group threatened publication unless the company responded; reviewed reporting did not confirm encryption or operational disruption.
Duo Info
January 1, 2025
•[ hacking, matchmaking service, personal information ]
A Duo employee's work computer was hacked in January 2025, compromising personal information of 427,464 matchmaking service clients, including identifiers, contact details, and detailed personal profile information.
Sterling Bank Plc
March 18, 2026
•[ CVE-2025-55182, remote code execution, data leak ]
ByteToBreach exploited CVE-2025-55182 in Sterling Banks internet-facing pilot infrastructure on March 18, 2026, gaining unauthenticated remote code execution, conducting internal reconnaissance, and publishing artefacts that Web Security Lab assessed as technically substantiating compromise of customer and employee records.
