Undisclosed companies
September 1, 2021
•[ phishing, financial, technology ]
Scattered Spider crew members phished credentials at 12+ companies (entertainment, telecom, tech, BPO, IT, cloud, crypto) in 2021-2023, stole company data and millions in crypto from 29 victims. Ahmed Elbadawy's guilty plea surfaced Sept 2026 via a forfeiture filing.
Undisclosed U.S. online banking customers
November 1, 2023
•[ phishing, finance ]
Russian web developer Sergei Filimonov, extradited from Georgia, pleaded not guilty in Atlanta to charges he used fake bank login pages from Nov. 2023 to Oct. 2025 to steal U.S. customers' credentials and drain accounts. FBI counts 19+ victims and about $14.6M lost.
Undisclosed individual
August 18, 2024
•[ social, financial, phishing ]
A Washington, D.C. crypto investor lost over 4,100 bitcoin (over $240M) on Aug. 18, 2024 after callers posing as Google and Gemini support got access to his Google Drive and security codes. Ringleader Malone Lam faced a plea hearing; 18 people were charged.
France Travail
January 12, 2025
•[ leak, government, phishing ]
France Travail and the Union nationale des missions locales stated that personal data for about 1.6 million young people supported by mission locales could have been exposed following an IT intrusion. The organizations said an agent account was compromised and the attacker created two new accounts that enabled consultation of files for supported youths (including users registered with France Travail or recommended training via the Ouiform tool). The joint statement listed the specific data fields potentially exposed and said that no passwords or bank details were extracted, while warning affected individuals to be vigilant for phishing and identity-theft attempts.
Undisclosed Ukrainian organization
April 2, 2025
•[ espionage, phishing, malware ]
On April 2, 2025, a phishing email sent from a compromised account induced a victim at an undisclosed Ukrainian organization to open a malicious Remote Desktop Protocol file and connect to actor-controlled infrastructure. Google Threat Intelligence Group observed Turla deploy the StockStay.MarketMaker downloader to the victim device, which retrieved the StockStay backdoor from compromised Ukrainian government infrastructure. The victim's identity and any acquired information were not disclosed.
Harvard University
November 18, 2025
•[ phishing, leak, education ]
Harvard disclosed that an unauthorized party accessed information systems used by its Alumni Affairs and Development office after a phone-based phishing attack. The compromised systems contained records used for alumni engagement and fundraising, including donation-related information, event attendance records, and contact details such as email addresses, telephone numbers, and home addresses. University communications indicated the systems did not generally contain Social Security numbers, passwords, or financial account numbers, but noted the institution was still investigating exactly what information was accessed and advised vigilance for suspicious communications purporting to be from the University.
Xsolis, Inc.
January 20, 2026
•[ phishing, healthcare, technology ]
A targeted phishing attack on January 20, 2026 resulted in unauthorized access to a limited portion of Xsolis's environment through January 22. The unauthorized actor acquired files containing personal and protected health information supplied by Xsolis's healthcare clients. Xsolis reported no known actual or attempted misuse of the information.
Undisclosed banking customers, financial-services customers, and small-to-medium businesses in Portugal, Spain, Mexico, and Latin America
February 24, 2026
•[ phishing, malware, financial ]
WatchGuard telemetry identified Grandoreiro infections beginning in late February 2026. Phishing links delivered ZIP archives containing legitimate applications and malicious DLLs for side-loading, while a related campaign used an obfuscated VBS file to install the banking trojan. The confirmed victim population comprised banking and financial-services customers, small-to-medium businesses, and users in Portugal, Spain, Mexico, and other parts of Latin America; references to banks in the malware code identify targeted banking applications, not confirmed compromises of the banks themselves.
Jones Day
March 30, 2026
•[ phishing, ransomware, leak ]
Jones Day confirmed a phishing incident in which an unauthorized third party accessed a limited number of dated files for 10 clients; Silent Ransom Group claimed responsibility and posted data on its leak site on March 30, 2026.
Aitkin County Health and Human Services
April 7, 2026
•[ phishing, healthcare, government ]
Cybercriminals used phishing messages to obtain access to three Aitkin County Health and Human Services email accounts between April 7 and April 8, 2026. The attackers downloaded the contents of one employee mailbox, including a Minnesota Department of Human Services MnCHOICES report containing information on 82,384 individuals. Aitkin County and Minnesota DHS reported 83,114 affected individuals in total. The actors and motive were not identified.
LHC Group
April 7, 2026
•[ social, phishing, healthcare ]
Louisiana home health provider LHC Group said a hacker used credentials stolen by phoning an employee to access patient files on a vendor platform from 7-15 Apr 2026. Notices went to 28,000+ people in Sep 2026; the FBI was contacted.
Eversource Energy
April 14, 2026
•[ phishing, social, energy ]
Phishing and social-engineering attacks compromised the credentials of two Eversource Energy employees beginning April 14, 2026. The compromised accounts allowed an unauthorized party to access files containing information belonging to 3,049 customers across Connecticut, Massachusetts, and New Hampshire. Eversource blocked the activity and reported no impact to electric, natural-gas, or water services, customer-information systems, critical operational systems, or infrastructure.
GO2 Health
April 24, 2026
•[ phishing, healthcare, leak ]
A phishing attack enabled unauthorized access to GO2 Health's main email mailbox on April 24, 2026. The clinic engaged specialists, contained the incident, reset credentials associated with delegated mailbox access, notified the Office of the Australian Information Commissioner on May 18, and began notifying affected patients on July 16. Automatic archiving limited exposed email to the preceding 12 months, and the primary patient-information system was not accessed.
GO2 Health
April 24, 2026
•[ phishing, healthcare ]
A phishing attack compromised GO2 Health's main email mailbox in April 2026. Investigation found that information contained in the mailbox may have been accessed, including some patients' Department of Veterans' Affairs identification numbers and other information patients had sent by email. The affected mailbox retained approximately 12 months of email. GO2 Health stated that its primary patient-record system was not accessed, notified the Australian privacy regulator on May 18, and notified affected patients in July.
At least one business traveler
May 1, 2026
•[ phishing, malware, espionage ]
Attackers manipulated hospitality captive-portal traffic to redirect at least one business traveler to credential-phishing and malware infrastructure. Microsoft later attributed the CaptiveCrunch campaign to the SVR-linked Midnight Blizzard cluster and confirmed endpoint collection and exfiltration; no operational disruption to the traveler was reported.
Monongalia County General Hospital Company
May 6, 2026
•[ phishing, healthcare ]
Monongalia County General Hospital Company discovered on May 6, 2026, that a small number of email users had been targeted in a successful phishing attack. A forensic investigation determined that an unauthorized party accessed certain Mon General email mailboxes on May 6 and that access was terminated the same day. No other hospital systems or data storage were affected. Mon General mailed notices to individuals whose patient information may have been contained in the mailboxes and offered two years of credit monitoring.
Connecticut Department of Children and Families
May 20, 2026
•[ phishing, government ]
An external phishing email compromised two Connecticut Department of Children and Families employee accounts on May 20, 2026, allowing an outside attacker to download emails. State IT personnel removed the attacker the same day, pulled the malicious email from agency inboxes, and temporarily disabled the two accounts. The review and law-enforcement investigation remained active; no operational disruption was reported.
Clark County School District
May 22, 2026
•[ hack, phishing, financial ]
Hackers scammed three Clark County School District employees, accessed their login credentials, and used direct-deposit information to fraudulently withdraw money from the employees accounts.
Multiple undisclosed Windows users
June 1, 2026
•[ leak, malware, phishing ]
Attackers distributed a PureLogs information-stealing payload through fake purchase-order emails containing a RAR archive. The archive launched JavaScript and PowerShell, used process hollowing to inject a downloader into MsBuild.exe, and retrieved a fileless PureLogs payload from command-and-control infrastructure. The malware collected browser, cryptocurrency-wallet, messaging, VPN, application, clipboard, screenshot, and system data and exfiltrated it through encrypted HTTP POST requests. Public reporting did not identify the affected users or provide an infection count, so the source publication date is used as the event date.
Exact Sciences Corporation (Abbott Cancer Diagnostics)
June 1, 2026
•[ phishing, healthcare, leak ]
In mid-June 2026, ShinyHunters used voice phishing against employees and obtained access to a limited number of legacy Exact Sciences cancer-diagnostics systems. Abbott confirmed that some affected files contained personal information and/or protected health information, but said the incident did not affect operations, products, manufacturing, laboratories, or patients. The attackers later published data, and Have I Been Pwned independently identified 10.9 million unique email addresses in the breach corpus.
