Undisclosed banking customers, financial-services customers, and small-to-medium businesses in Portugal, Spain, Mexico, and Latin America
February 24, 2026
•[ phishing, malware, financial ]
WatchGuard telemetry identified Grandoreiro infections beginning in late February 2026. Phishing links delivered ZIP archives containing legitimate applications and malicious DLLs for side-loading, while a related campaign used an obfuscated VBS file to install the banking trojan. The confirmed victim population comprised banking and financial-services customers, small-to-medium businesses, and users in Portugal, Spain, Mexico, and other parts of Latin America; references to banks in the malware code identify targeted banking applications, not confirmed compromises of the banks themselves.
Undisclosed Windows users seeking system and hardware utilities
March 1, 2026
•[ malware, technology, financial ]
Beginning in March 2026, attackers used poisoned search results and fake download sites impersonating utilities such as CrystalDiskInfo, HWMonitor, PDFgear, and FurMark to compromise Windows users, with some malicious links also appearing in AI-chatbot recommendations during April. The malware installed ScreenConnect for persistent access, collected host information, and deployed GPU-focused cryptocurrency miners through process hollowing. Microsoft identified more than 150 malicious domains associated with the campaign.
Elliott-Lewis Corporation
March 11, 2026
•[ leak, financial, manufacturing ]
Interlock claimed responsibility for compromising Elliott-Lewis Corporation on March 11, 2026 and described a large database containing confidential contracts, project files, and customer and employee data, with approximately 1.07 terabytes allegedly stolen. DataBreach.com later indexed 319,305 structured rows containing personal identifiers and bank-account information. The explicit database claim and structured records support classification as Exploitation of Application Server, although the initial access vector was not disclosed. Elliott-Lewis is a Philadelphia-based mechanical contractor. The company has not publicly confirmed the attribution, claimed volume, encryption, or operational disruption.
Paidwork LLC
March 29, 2026
•[ hack, leak, financial ]
Hackers claimed to have obtained data from Paidwork in March 2026 and offered it for sale. An approximately 11 GB database attributed to Paidwork was subsequently published in July and contained more than 23 million unique email addresses along with extensive profile, financial, device, transaction, and authentication data. Paidwork stated that it had not confirmed compromise of its systems or user accounts and was investigating the reported incident.
Ohio Living
April 16, 2026
•[ ransomware, healthcare, financial ]
Ohio Living detected suspicious network activity on April 17, 2026. Its investigation determined that an unauthorized actor accessed systems and copied files from its network between April 16 and April 17. Ohio Living secured the network and began reviewing the files; no operational disruption was reported, and the 500-person figure reported to HHS was preliminary. On August 5, the Dark Project ransomware group claimed responsibility for an April 2026 attack on Ohio Living and alleged that it stole at least 600 GB, including at least 5,000 files containing employee, patient, medical, insurance, Social Security, financial, and banking information. Ohio Living had not publicly confirmed the attribution or the claimed volume.
Goodwin Procter LLP
April 16, 2026
•[ ransomware, financial, technology ]
Goodwin Procter disclosed a spring 2026 unauthorized data-access incident dated April 16 in state records. The firm notified a limited number of clients and affected people. Insurance-industry reporting linked the extortion to Luna Moth and reported a ransom payment around US$10 million, citing people familiar with the matter; Goodwin did not independently confirm that payment or attribution. Its effect was acquisition of sensitive information, without verified encryption or service shutdown. Criminal/Financial is supported by the attributed financially motivated extortion campaign.
Herbert Smith Freehills Kramer (US) LLP
May 1, 2026
•[ financial, hack, leak ]
Herbert Smith Freehills Kramer confirmed unauthorized access to a limited portion of its U.S. IT environment discovered in late May 2026, and notified people whose sensitive information could have been compromised. The exact access path, initial compromise day, offender and final record count were not disclosed; May 1 is a month-only coding placeholder. Criminal is inferred from deliberate unauthorized access; Financial is the most likely motive under the private-law-firm targeting heuristic given the value of confidential client and personal data, without direct evidence of a ransom demand or data sale.
Waterford Hotel Group
May 11, 2026
•[ ransomware, financial, technology ]
Waterford Hotel Group, a Connecticut hotel and conference center manager, was listed by the Interlock ransomware group on May 11, 2026; Interlock claimed to hold personal, confidential, partner and financial data from the chain and its divisions. No company confirmation.
Krum Public Library
May 14, 2026
•[ ransomware, government, financial ]
Krum Public Library detected unusual network activity on May 14, 2026 and later confirmed a ransomware attack limited to the library environment. Computer access, printing, and Wi-Fi were unavailable, and checkout was temporarily limited to five items. Forensic investigators determined that some library network files had been accessed without authorization, although the city said Social Security numbers and personal financial account information were not affected. NightSpire claimed responsibility and described financial and human-resources data, but the city did not confirm the attribution or claimed contents.
Clark County School District
May 22, 2026
•[ hack, phishing, financial ]
Hackers scammed three Clark County School District employees, accessed their login credentials, and used direct-deposit information to fraudulently withdraw money from the employees accounts.
C2M LLC d/b/a Click2Mail
June 2, 2026
•[ financial, leak, technology ]
A Click2Mail customer reported that the company's online debit-card checkout process was hijacked on June 2 and again later in the summer, with payment-card information captured during checkout and subsequently associated with fraudulent use. Other customers also publicly reported card fraud following Click2Mail transactions. C2M LLC later filed a breach notice with the Vermont Attorney General on September 15 confirming exposure of financial account codes and credit and debit account information affecting at least seven Vermont residents. The regulatory filing confirms the data exposure but does not disclose the technical intrusion method, full compromise window, total victim count, or responsible actor.
AS Latvijas valsts meži
June 11, 2026
•[ ransomware, financial, technology ]
Intrusion indicators show that the attacker entered AS Latvijas valsts mei systems on 2026-06-11 and remained undetected until malicious activity was identified during the night of 2026-06-22 to 2026-06-23. The attacker exfiltrated company data and deployed ransomware, while LVM disconnected LVM GEO, its map-services system, the Mednis application, and several internal customer- and provider-facing systems. CERT.LV confirmed that 44 GB of stolen data was published, including internal documents, emails, source code, digital certificates, cryptographic keys, and user credentials, and assessed that the attacker likely obtained more data. Timber deliveries were reduced after the attack and returned to full volume on 2026-07-01, although other systems remained under restoration on 2026-07-09. Public threat-monitoring sources identify ByteToBreach as the claimant, but CERT.LV has publicly described the perpetrator only as a foreign financially motivated ransomware actor.
Undisclosed Connecticut Medicaid provider
June 18, 2026
•[ leak, financial, healthcare ]
An unauthorized third party first gained access on June 18, 2026 to an undisclosed Connecticut Medicaid providers reimbursement account on the Gainwell Technologies-operated HUSKY provider portal and obtained claims and payment information for approximately 41,000 HUSKY Health members. Gainwell detected the unauthorized access on June 25. Connecticut DSS and Gainwell determined that the activity appeared financially motivated rather than directed specifically at patient data. Electronic health records, Social Security numbers, and financial account information were not compromised, and no evidence of misuse had been identified when notifications began. This incident is separate from the March 2026 compromise of Hartford HealthCare payment accounts on the same portal.
Polymarket via undisclosed third-party provider
June 25, 2026
•[ hack, financial, technology ]
On 2026-06-25, Polymarket disclosed that an undisclosed third-party provider had been compromised, allowing attackers to inject a malicious script into Polymarket's frontend for some users. The script enabled unauthorized cryptocurrency transactions from connected user wallets. Polymarket removed the affected dependency, contained the incident, contacted affected users, and stated that it would reimburse them in full. Blockchain investigators estimated that approximately $2.94 million was stolen from about 11 wallets, but Polymarket did not confirm the exact loss or number of affected users. No intellectual property, organizational data, customer personal data, or broader platform outage was reported.
Undisclosed Minnesota MyChart user
July 1, 2026
•[ phishing, healthcare, financial ]
A Minnesota MyChart user reported to the Federal Trade Commission that a phishing email impersonating MyChart offered a free Medicare Kit in exchange for completing a survey and paying shipping. The victim, who identified Welia Health in Mora as the provider through which they used MyChart, completed the survey, entered credit-card and personal information, and submitted the form. Minutes later, the victim observed a card transaction categorized as an unrelated animal/pet service. Later reporting based on FTC complaints confirmed multiple successful victims of the same broader MyChart impersonation campaign. Epic and Welia Health were not themselves breached.
Undisclosed Illinois MyChart user
July 1, 2026
•[ phishing, healthcare, financial ]
An Illinois MyChart user reported to the Federal Trade Commission that a phishing email impersonating MyChart offered a free Medicare Kit and directed the victim through a survey to a shipping-payment step. The victim submitted Mastercard information before recognizing the message as fraudulent and reported that the scammers had obtained the card information. The complaint is one of several successful victims documented in the broader coordinated MyChart impersonation campaign. MyChart and Epic were not themselves breached.
Clover Health Investments, Corp.
July 4, 2026
•[ social, healthcare, financial ]
Clover Health detected anomalous login activity on July 4, 2026 and determined that an unidentified actor used social engineering to trick three non-managerial health-plan employees into disclosing credentials, enabling access to their employee email accounts used for member visit scheduling and broker-facing sales. The accounts could access member personal and protected health information but not corporate financial or claims systems. Clover contained and terminated the access, and no operational disruption was reported. No group, country, extortion demand, or stated motive was identified; Criminal and Financial are bounded inferences from deliberate credential theft targeting accounts containing identity and health data. Clover is remote-first and states that it maintains no headquarters, so state and county remain undetermined.
Office of the President of Kenya
July 18, 2026
•[ hack, government, financial ]
Attackers replaced the homepage of Kenya's official presidential website with an anti-government message, a cryptocurrency wallet, and a demand for five bitcoins while threatening to publish unspecified information about President William Ruto. Authorities temporarily restricted access for containment and restored the site by July 20; the government found no evidence of sensitive-data access, exfiltration, or loss.
Upbound Group, Inc.
July 21, 2026
•[ financial, leak, technology ]
Upbound Group disclosed multiple recent cybersecurity incidents in which unauthorized parties obtained customer information and company documents. The stolen information was used to create fraudulent lease-to-own agreements through the Acima platform; Acima paid retailers, while the fraudsters obtained merchandise and did not make the required payments. Upbound attributed approximately $13 million in elevated fraudulent contract losses during the second quarter of 2026 to the incidents. The company enhanced authentication and fraud controls and notified federal law enforcement. No actor, intrusion vector, or operational disruption was disclosed.
Thialf
July 24, 2026
•[ ransomware, financial, technology ]
RTL Nieuws identified The Gentlemen as responsible for a ransomware attack against Thialf and reported that the criminals demanded payment to make inaccessible computers available again and to prevent publication of purportedly stolen data. The group claimed to possess internal documents, employee information, financial contracts, and other sensitive data. Thialf confirmed the attack but said its forensic investigation found that data and operational processes were not affected or endangered and that planned events could continue; the claimed data theft therefore remains unverified.
