Singing River Health System
December 21, 2025
•[ unauthorized access, data breach, patient information ]
Singing River Health System discovered that an unauthorized party gained access to its computer network between December 19 and December 21, 2025. On February 10, 2026, SRHS learned that the unauthorized party had accessed files containing patient information, and on May 19, 2026 it began mailing notices to affected patients. SRHS also temporarily shut down select systems, including internet access and MyChart, as a defensive containment measure; public reporting did not confirm attacker-caused encryption or destructive disruption.
Blanchard Training and Development, Inc.
March 3, 2026
•[ unauthorized access, PII, financial information ]
Blanchard Training and Development, Inc. identified unusual activity in its network environment on March 4, 2026, and later determined that an unauthorized individual may have copied certain information between March 3 and March 4. DataBreach indexed 494,404 rows tied to Blanchard, including names, contact information, addresses, and bank account information.
Raise the Bottom
May 15, 2026
•[ substance use disorder treatment, addiction recovery, behavioral health services ]
Raise the Bottom, an Idaho substance use disorder treatment organization, was listed in a breach involving 57,507 indexed rows. DataBreach identified exposed names, email addresses, and phone numbers; BreachSense attributed the breach to CMD and described Raise the Bottom as an Idaho-based addiction recovery, counseling, and behavioral health services provider.
Florida East Coast Railway
April 30, 2026
•[ data-extortion, data leak, PII ]
PayoutsKing claimed responsibility for a data-extortion attack against Florida East Coast Railway on April 30, 2026 and threatened to leak sensitive data unless negotiations were initiated. DataBreach.com later indexed 16,668 rows associated with the breach, including names, email addresses, and phone numbers. Public sources did not confirm successful encryption or operational disruption.
WholeHealth Chicago
May 15, 2026
•[ data leak, PII, cyberattack ]
Cmdorganization claimed responsibility for a cyberattack against WholeHealth Chicago on May 15, 2026. DataBreach later indexed 36,409 rows allegedly tied to the breach, including dates of birth, email addresses, phone numbers, and names. Public sources did not confirm file encryption, operational disruption, or a precise intrusion vector.
Family Health Centers of Southern Indiana
February 2, 2026
•[ cyberattack, data leak, PII ]
Termite claimed responsibility for a cyberattack against Family Health Centers of Southern Indiana, identified by the domain fhcenters.org, on February 2, 2026. DataBreach later indexed 60,425 rows tied to the breach, with exposed fields including dates of birth, phone numbers, names, street addresses, and bank account information. Public sources did not confirm the intrusion vector, encryption, operational disruption, or exact data-theft mechanism.
Advanta Genetics LLC
April 29, 2026
•[ data leak, healthcare, PII ]
Advanta Genetics LLC, a Texas clinical and molecular diagnostics laboratory, was listed by Aurora on April 29, 2026. Aurora claimed access to patient, provider, employee, financial, legal/regulatory, and proprietary company data. DataBreach.com indexed 280,802 rows containing Social Security numbers, birthdates, email addresses, phone numbers, names, and street addresses. Public reporting noted that Advanta had not confirmed the full scope of Aurora's claims and did not confirm encryption or operational disruption.
MiniMed Panamá
May 2, 2026
•[ data exposure, PII, plaintext credentials ]
MiniMed Panam was listed among the Panamanian health-sector platforms directly affected by data exposure in a Vecert Analyzer intelligence report cited by La Estrella de Panam. The incident was dated May 2, 2026, and outside OSINT reporting described roughly 400,000 exposed records associated with MiniMed, including a usersdata table with 74,233 records containing PII and plaintext credentials. Public reporting did not identify the threat actor, encryption, data destruction, or operational disruption.
Charter Communications, Inc.
April 1, 2026
•[ vishing, data leak, employee records ]
ShinyHunters claimed it breached Charter Communications on April 1, 2026 through a vishing attack that compromised an employee Microsoft Entra account and enabled access to Charter's Salesforce instance. BleepingComputer and Have I Been Pwned reported that the later published dataset exposed 4.9 million unique email addresses/accounts, along with names, phone numbers, and physical addresses; a subset of approximately 85,000 internal employee-directory records also included job titles. Public reporting did not confirm encryption, data destruction, or operational disruption.
Station Casinos LLC
March 5, 2026
•[ unauthorized access, personal information, PII ]
Station Casinos LLC identified unauthorized external access to its systems on March 5, 2026 and began notifying affected individuals in May 2026. Public filings confirmed names were exposed and warned that additional personal information may have been compromised, but the company had not publicly confirmed the total number of affected individuals.
Udemy, Inc.
April 24, 2026
•[ data leak, extortion, ShinyHunters ]
ShinyHunters listed Udemy in a pay-or-leak extortion attempt on April 24, 2026 and subsequently leaked data containing 1.4 million unique email addresses belonging to customers and instructors, along with names, physical addresses, phone numbers, employer information, and instructor payout methods. Public reporting did not confirm encryption, deletion, or operational disruption.
Aman Resorts
April 18, 2026
•[ extortion, data leak, PII ]
ShinyHunters named Aman Resorts in an April 2026 pay-or-leak extortion campaign and claimed compromise of over 500,000 Salesforce CRM records containing PII. DataBreach indexed 294,871 rows, while Have I Been Pwned reported over 200,000 unique email addresses and said the leaked data also included names, phone numbers, physical addresses, dates of birth, nationalities, spouse names, and VIP status codes. Public sources did not confirm encryption, data destruction, or operational disruption.
Adelante Soluciones Financieras
March 1, 2026
•[ data leak, unauthorized access, PII ]
Addi identified unauthorized activity on its platform in March 2026 and advised customers that personal information may have been compromised. ShinyHunters later claimed responsibility and published a large trove of personal data allegedly obtained from Addi. DataBreach indexed 67,979,172 rows tied to the breach, while HIBP reported approximately 34 million exposed email addresses and credit-related data points. Public sources did not confirm encryption, data destruction, operational disruption, or a precise intrusion vector.
Cushman & Wakefield
May 3, 2026
•[ vishing, PII, data leak ]
Cushman & Wakefield confirmed a vishing-related security breach in May 2026 after ShinyHunters and Qilin separately listed the company. ShinyHunters claimed theft of more than 500,000 Salesforce records containing PII and internal corporate data and later reportedly published a 50GB Salesforce-linked dataset after negotiations failed. DataBreach indexed 2,198,033 rows associated with the breach. Public sources did not confirm encryption or operational disruption.
Telecare Corporation
February 19, 2026
•[ ransomware, data leak, healthcare ]
Qilin claimed responsibility for an attack on Telecare Corporation on February 19, 2026 and threatened to release sensitive healthcare data unless negotiations began. DataBreach indexed 275,644 rows and listed exposed fields including Social Security numbers, dates of birth, email addresses, phone numbers, names, and street addresses. Public reporting did not confirm encryption, data destruction, attacker-caused operational disruption, or the exact intrusion vector.
The McLamb Group, Inc.
April 6, 2026
•[ data leak, PII, Social Security numbers ]
PEAR claimed The McLamb Group, Inc. on its leak site with an estimated attack date of April 6, 2026. DataBreach indexed 124,203 rows and listed exposed fields including Social Security numbers, dates of birth, email addresses, phone numbers, names, and street addresses. Public reporting did not confirm encryption, data destruction, attacker-caused operational disruption, or the exact intrusion vector.
Coastal Carolina Health Care
March 21, 2025
•[ unauthorized access, data breach, Social Security numbers ]
Coastal Carolina Health Care identified suspicious activity that disrupted access to some systems and later determined that an unauthorized actor accessed and acquired information from its network between March 21 and March 27, 2025. The exposed information included names and Social Security numbers for approximately 110,000 individuals.
GFN.am
March 20, 2026
•[ unauthorized access, data leak, PII ]
GFN.am, NVIDIA's regional GeForce NOW alliance partner in Armenia, suffered unauthorized access to partner-operated infrastructure between March 20 and March 28, 2026. The breach affected Armenian GeForce NOW users registered before March 9 and exposed personal account information including names, email addresses, phone numbers, dates of birth, usernames, membership status, and two-factor authentication status. NVIDIA said its own infrastructure was not affected. A forum actor using the ShinyHunters name claimed the breach, but reporting indicates the real ShinyHunters group denied involvement, so the specific perpetrator remains unidentified.
Instructure
April 29, 2026
•[ unauthorized access, data leak, PII ]
Instructure detected unauthorized access to part of its Canvas environment on April 29, 2026. The incident exposed user identifying information and messages from affected institutions; Instructure stated that core learning data, course content, submissions, credentials, passwords, dates of birth, government identifiers, and financial information were not compromised.
Extant Aerospace
August 23, 2025
•[ ransomware, data breach, PII ]
Extant Aerospace detected ransomware activity on its network in August 2025, later confirming that personal data of over 3,000 U.S. individuals was exposed, including names, addresses, dates of birth and Social Security Numbers.
