RingCentral, Inc.
July 27, 2026
•[ social, leak, technology ]
RingCentral confirmed that a sophisticated social-engineering campaign in July 2026 resulted in unauthorized access affecting data associated with a limited portion of its customers. ShinyHunters listed RingCentral on July 27, demanded payment, and subsequently published stolen data. Independent analysis identified approximately 1.6 million unique email addresses in the released corpus. RingCentral said it stopped the unauthorized activity and did not report disruption to its core services.
ASOS plc
July 28, 2026
•[ financial, retail, brute-force ]
ASOS detected suspicious customer account activity on July 28, 2026 and confirmed unauthorized access on July 29. Attackers used customer login credentials stolen from unrelated services to access ASOS accounts, exposing personal and partial payment information relating to 138,828 customers. ASOS locked affected sessions, required password resets, and blocked or canceled suspicious transactions. This account-takeover episode is separate from the October 2026 ASOS app-notification incident. The perpetrators were not identified; criminal and financial intent are inferred from the credential-stuffing and suspected fraudulent transactions.
Leviton
July 31, 2026
•[ ransomware, manufacturing, technology ]
Leviton, an electrical products maker in Melville, New York, was listed by the Dark Project ransomware group on August 5, 2026; the group claimed about 1.4 TB from an attack around July 31, incl. financial records, schematics and employee data. Leviton has not confirmed it.
Undisclosed Indiana MyChart user
August 1, 2026
•[ phishing, financial, healthcare ]
An Indiana MyChart user reported to the Federal Trade Commission that a phishing email impersonating MyChart offered a free Medicare first-aid kit in exchange for completing a survey and paying $9.95 shipping. After the victim submitted payment information, the card was charged $9.95 and then immediately charged another $29.95 by a separate scam company. The complaint confirms successful acquisition and fraudulent use of payment data within the broader coordinated MyChart impersonation campaign. MyChart and Epic were not themselves breached.
Department of Land Transport (DLT), Thailand
August 4, 2026
•[ financial, leak, insider ]
Thailand's Department of Land Transport and cybersecurity authorities investigated unauthorized vehicle-registry searches through accounts associated with three government agencies. The DLT confirmed that displayed data were genuine and that access had occurred, while officials said the core registry was not directly hacked. Other reporting describes illegal paid lookup services and sale of government data, supporting a limited Criminal/Financial inference despite the political prominence of some exposed people. Initial access date is unknown; August 4 is the public-discovery proxy.
Uber Freight
August 6, 2026
•[ ransomware, financial, technology ]
Uber Freight confirmed unauthorized access to portions of its systems and data repositories. The Helix extortion group listed Uber Freight on its leak site August 6, 2026, claiming nearly one million stolen files from cloud storage, email and logistics/accounting records. An external breach index separately reported approximately 5.44 million data rows, but Uber Freight did not verify the posted data or the scale of theft. Google links Helix infrastructure to the financially motivated UNC6671 cluster; company-specific attribution remains claim-based. Uber Freight said the incident was contained and remediated without operational disruption. The actual date of the initial intrusion or data extraction was not established; August 6 is the earliest documented public-leak date, not the verified intrusion date.
City of Mitchell
August 6, 2026
•[ ransomware, government, financial ]
Mitchell discovered unauthorized activity in part of its municipal network on August 6, 2026, and isolated the affected environment through August 12. Administrative online services were interrupted, while officials said email and emergency services were unaffected. The city subsequently confirmed that information relating to a small number of employees was affected. The Storm extortion group listed Mitchell on its leak site on August 23 with an August 28 deadline and image thumbnails; independent reporting documents that claim, but the city has not verified Storm attribution. Successful encryption, theft of specific files and a ransom demand to the city are not confirmed. Criminal and Financial are supported by the claimed extortion-group context.
Wildberries (RWB)
August 10, 2026
•[ ddos, retail, financial ]
Cyber Corps conducted a DDoS campaign against Wildberries on 10-11 August 2026 that disrupted the marketplace's main remote customer-service channel and partially destabilized payment infrastructure, with users reporting inability to complete financial transactions. Ukraine's Defence Intelligence said the operation was intended to reinforce the effects of Ukrainian strikes against Wildberries logistics facilities. Wildberries later confirmed DDoS attacks against its Seller Balance systems; some subsequent seller-withdrawal delays resulted from defensive controls activated in response to the attacks.
Maritime Industry Authority (MARINA)
August 13, 2026
•[ ransomware, financial, government ]
MARINA detected suspicious cyber activity on August 13, 2026 and took its nationwide seafarer document-processing environment offline to contain the incident. The Philippine Department of Information and Communications Technology described the incident as ransomware, but MARINA subsequently reported no confirmed data theft and did not establish successful encryption. Routine issuance of seafarer identity documents and record books was suspended nationwide. MARINA issued temporary certificates, launched an interim processing system on September 1 and progressively restored normal issuance in September. Criminal and financial motivation are inferred from the reported ransomware activity; no perpetrator or ransom demand was publicly verified.
Oz Hair and Beauty
August 15, 2026
•[ leak, retail, financial ]
An unauthorized third party accessed Oz Hair and Beauty's online purchase and order platform and obtained customer information. Public breach records attribute the incident to xpl0itrs extortion activity and document 1,988,331 affected accounts; the company reported that payment-card information, banking details, and home addresses were not exposed.
Mutuelle générale de prévoyance
August 18, 2026
•[ financial, leak, healthcare ]
French mutual insurer Mutuelle gnrale de prvoyance (MGP) confirmed an intrusion via a third-party provider in August 2026; a hacker claim cited about 200,000 people and 133,000 IBANs. MGP could not confirm the scope, began notifying members Aug 17 and filed a complaint.
Cambrian High School & College
August 19, 2026
•[ phishing, malware, education ]
Check Point Research confirmed by August 19 that the legitimate website of Cambrian High School & College in Bangladesh had been compromised and was hosting a malicious page at cambrianschoolbd.com/mail/. The page had displayed a fake Spotify-branded security-verification CAPTCHA and was flagged by multiple threat-intelligence sources as an information-stealer and malware-distribution site. The precise intrusion date, responsible actor, and duration of the compromise are unknown. The activity occurred in the context of broader financially motivated cybercriminal phishing and malware campaigns targeting the education sector, but no downstream visitor infection or credential theft was publicly confirmed.
Interim HealthCare, Inc.
August 21, 2026
•[ ransomware, healthcare, financial ]
Anubis listed Interim HealthCare, Inc., the Sunrise, Florida-based corporate franchisor, on its extortion site in August 2026 and claimed theft of approximately 530 GB of corporate and franchise-related data. The group described the material as including franchisee financial information, internal and external audit records, operational discussions, and day-to-day business memoranda. Samples and stolen material were subsequently published, supporting that data acquisition occurred, although Interim HealthCare has not publicly confirmed the intrusion, its exact date, or the claimed 530 GB total. This appears separate from Genesis's claim involving Oklahoma and Tulsa franchise operations.
Nutex Health Inc.
August 26, 2026
•[ leak, healthcare, financial ]
Nutex Health disclosed that an unauthorized third party accessed and exfiltrated information from company servers. The company publicly disclosed the incident on August 24 but has not published the intrusion date; under the coding guide the SecurityWeek publication date is used because the compromise date remains undetermined. Nutex later confirmed that patient, employee, credentialed-provider, business, and financial information was involved. The Gentlemen claimed the incident on August 31, and Nutex said on September 10 that data purportedly obtained in the event had been published. Nutex reported no material operational impact.
Undisclosed Philippine marine engineering and shipbuilding company
August 26, 2026
•[ financial, hack, manufacturing ]
Injected code displayed fake verification content using Amatera-linked delivery infrastructure. Financial intent is inferred; visitor infections and linkage to the separate data theft are unconfirmed. Onset is unknown; event_date uses the publication-date fallback.
Undisclosed Czech healthcare organization
August 27, 2026
•[ leak, healthcare, financial ]
ComSource detected a data leak from an unnamed Czech healthcare organization on 27 August 2026. DataBastard offered the stolen database for sale for $1,400. The exact initial-access and exfiltration dates were not reported, so event_date uses the first documented detection of the leak.
Hungry Lion
August 27, 2026
•[ ransomware, retail, financial ]
MedusaLocker listed South African fast-food chain Hungry Lion on its leak site on 27 Aug 2026, claiming POS data covering 111 locations in seven countries and threatening a full leak. The claim is unverified; the company did not comment.
Taipei City Police Department
August 31, 2026
•[ insider, government, financial ]
Taipei prosecutors on Aug 31, 2026 indicted a retired Taipei police detective (Cheng) and a suspended officer (Liu) for pulling hundreds of individuals' call records without authorization since 2018 and selling them to syndicate-linked money lenders for about NT$7.2 million.
Liquid Network
September 6, 2026
•[ hack, financial, technology ]
Hackers exploited a bug in Liquid Network, the Blockstream-developed Bitcoin sidechain, on Sept. 6, 2026 to mint unbacked L-BTC and withdraw ~4,000 BTC ($320M) from its federation wallet. Liquid halted the network; self-described white hats returned 3,400 BTC.
Undisclosed organization investigated by CyberMaxx (Event A)
September 15, 2026
•[ ransomware, technology, financial ]
CyberMaxx incident responders observed exploitation of N-able N-central in an unnamed customer environment. The intruder used Net.exe to issue an administrator password-change command, established a Cloudflare tunnel, installed SimpleHelp for persistence and reached a file server over remote access. File enumeration and communication with Filemail-associated infrastructure were observed, but completed data theft and ransomware encryption were not verified. CyberMaxx attributed the activity to Storm-1175 with high confidence; Criminal and Financial reflect the ransomware-preparation context. September 15 is the publication-date fallback, not a verified intrusion date.
