Associated Asset Management
August 15, 2026
•[ ransomware, leak, finance ]
Associated Asset Management (AAM), an Arizona homeowner association management company, was listed on the Direwolf ransomware group's leak site on Aug 15, 2026, which threatened to publish stolen data unless contacted. AAM did not publicly confirm the attack.
Arizona State University
August 17, 2026
•[ ransomware, leak, education ]
Arizona State University, a public research university in Tempe, was listed on the Direwolf ransomware group's leak site on Aug 17, 2026, claiming stolen university files; about 1.08 million records were later indexed. ASU has not publicly confirmed the breach.
Koninklijke Philips N.V.
August 18, 2026
•[ ransomware, technology, healthcare ]
Philips identified and contained unauthorized activity affecting a specific enterprise server used to store internal data and isolated the affected server. Philips reported no impact to customer environments. In a September 14 update, Philips said incident-response activities were complete and investigation findings supported closure of the incident, while additional analysis of a subset of downloaded data remained ongoing. Cl0p claimed approximately 13.5 GB of drawings, diagrams, and blueprints.
City of Fort Scott
August 18, 2026
•[ ransomware, government, technology ]
A ransomware attack detected on 18 Aug 2026 closed Fort Scott, Kansas, City Hall and forced the city network offline; IT staff restored systems within six days, with about a week of data lost on two machines. The attackers were not identified.
Delek US Holdings, Inc.
August 19, 2026
•[ ransomware, leak, energy ]
Helix listed Delek US on its extortion site on August 19, 2026 and claimed possession of customer and employee information. DataBreach.com subsequently indexed 122,079 leaked records containing personal and contact information. Delek US has not publicly confirmed the incident, and no operational disruption has been independently established.
PayUp
August 19, 2026
•[ ransomware, finance, technology ]
PayUp, an Austin, Texas fintech offering early vendor payments and invoice factoring to property managers, was listed on the Direwolf ransomware group's leak site on Aug 19, 2026, claiming stolen customer records. PayUp has not confirmed the claim.
Interim HealthCare, Inc.
August 21, 2026
•[ ransomware, healthcare, financial ]
Anubis listed Interim HealthCare, Inc., the Sunrise, Florida-based corporate franchisor, on its extortion site in August 2026 and claimed theft of approximately 530 GB of corporate and franchise-related data. The group described the material as including franchisee financial information, internal and external audit records, operational discussions, and day-to-day business memoranda. Samples and stolen material were subsequently published, supporting that data acquisition occurred, although Interim HealthCare has not publicly confirmed the intrusion, its exact date, or the claimed 530 GB total. This appears separate from Genesis's claim involving Oklahoma and Tulsa franchise operations.
The Revel Collective
August 21, 2026
•[ ransomware, leak, retail ]
The Revel Collective, a UK operator of bars and social venues, was listed on the Direwolf ransomware group's leak site on Aug 21, 2026, claiming about 700 GB of stolen data. The company has not publicly confirmed an incident or notified customers.
CyrusOne, LLC
August 23, 2026
•[ ransomware, technology ]
ShinyHunters claimed it stole 12.9 million Salesforce records and approximately 645 GB of SharePoint data from CyrusOne and demanded $13 million. The stolen material reportedly included customer and employee records, contracts, data center engineering drawings, security documentation and access-control information. DataBreach.com indexed 552,494 records from the released data. No operational disruption has been established.
Brookview Financial
August 24, 2026
•[ leak, ransomware, finance ]
DragonForce listed Brookview Financial on its leak site on August 24, 2026 and claimed theft of customer information including credit reports and Social Security numbers. DataBreach.com indexed 254,414 leaked rows containing customer contact information. Brookview Financial is a private mortgage lender headquartered in Hamden, Connecticut. The company has not publicly confirmed the incident, and no operational disruption has been independently established.
Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF)
August 26, 2026
•[ ransomware, government, leak ]
ATF publicly confirmed on August 26, 2026 that an unauthorized actor had compromised a standalone system containing information about targets of ATF investigations. The system was quickly disconnected and was separate from ATF's enterprise network, eForms, laboratory, and case-management systems. Qilin claimed responsibility the same day and later published approximately 6.3 GB of purported data from the CALEA environment. ATF has not publicly authenticated the full leak or confirmed Qilin's attribution, and mission operations were unaffected.
Canva Pty Ltd
August 26, 2026
•[ hack, ransomware, technology ]
Sydney design platform Canva said attackers using vendor Canny's link to its Salesforce account accessed limited enterprise customer contact and contract data in late Aug 2026. The Seven Deadly Sins claimed the theft, said it exported far more and listed Canva for extortion.
Greenberg Traurig
August 26, 2026
•[ ransomware, leak, finance ]
Silent Ransom Group accessed U.S. law firm Greenberg Traurig's work devices in Aug 2026 and leaked stolen files with about 126,000 SSNs on Sept 2 after ransom talks stalled. The firm confirmed limited document access, notified regulators and reported 150,000 affected in Oregon.
City of Circleville
August 27, 2026
•[ ransomware, government ]
The City of Circleville confirmed ransomware activity affecting portions of its municipal technology environment. Affected systems were isolated and rebuilt from clean environments or recovered through established procedures, and the city did not pay a ransom. Circleville has not disclosed the incident or detection date; an August 14 date circulated in secondary reporting but could not be independently corroborated. Officials reported no evidence establishing that sensitive information was exfiltrated, and no ransomware or extortion group has publicly claimed responsibility.
Hungry Lion
August 27, 2026
•[ ransomware, retail, financial ]
MedusaLocker listed South African fast-food chain Hungry Lion on its leak site on 27 Aug 2026, claiming POS data covering 111 locations in seven countries and threatening a full leak. The claim is unverified; the company did not comment.
Neogen Corporation
August 29, 2026
•[ ransomware, technology, manufacturing ]
Neogen Corporation, a Lansing, Michigan maker of food and animal safety products, was listed on ShinyHunters' leak site on August 29, 2026 with a warning to make contact by September 1 before its data is leaked. Neogen had not commented and the claim remains unverified.
DistributionNOW (DNOW Inc.)
August 29, 2026
•[ ransomware, technology ]
Houston-based industrial distributor DNOW Inc. was listed in late August 2026 by the Falcon extortion group, which claimed about 344 GB of corporate, payroll, employee and industrial-control files. DNOW has not publicly confirmed the claim.
Avelogic
August 30, 2026
•[ ransomware, technology, government ]
Ransomware hit Singapore vendor Avelogic's SmartHRMS HR and payroll system on 30-31 Aug 2026, used by MUIS-overseen mosques and madrasahs, forcing manual payroll. Avelogic found no evidence of bulk data theft, paid no ransom, filed a police report and notified the PDPC.
Super Systems Inc
August 31, 2026
•[ ransomware, manufacturing, technology ]
Super Systems Inc (SSi), a Cincinnati, Ohio maker of heat-treating controls and software, was listed on the Interlock ransomware group's leak site on Aug 31, 2026, which claimed about 390 GB of stolen data. SSi has not confirmed or denied the claim.
Hayward Holdings
August 31, 2026
•[ ransomware, manufacturing, technology ]
Hayward Holdings, a Charlotte, NC pool and spa equipment maker (NYSE: HAYW), was listed by the Falcon extortion group on Aug 31, 2026, which claimed 848 GB of stolen corporate and customer data. The company has not confirmed the claim; a law firm opened an investigation.
