City of Mitchell
August 6, 2026
•[ ransomware, government, financial ]
Mitchell discovered unauthorized activity in part of its municipal network on August 6, 2026, and isolated the affected environment through August 12. Administrative online services were interrupted, while officials said email and emergency services were unaffected. The city subsequently confirmed that information relating to a small number of employees was affected. The Storm extortion group listed Mitchell on its leak site on August 23 with an August 28 deadline and image thumbnails; independent reporting documents that claim, but the city has not verified Storm attribution. Successful encryption, theft of specific files and a ransom demand to the city are not confirmed. Criminal and Financial are supported by the claimed extortion-group context.
City of Lancaster, Ohio
August 6, 2026
•[ ransomware, government ]
Lancaster, Ohio, took city computers offline after ransomware notes appeared on multiple employee machines on Aug 6, 2026, delaying card payments. By Aug 28 about 90% of data and programs were recovered and some may not be restored. No actor or ransom demand disclosed.
Westland Insurance Group Ltd.
August 7, 2026
•[ ransomware, leak, finance ]
Helix listed Westland Insurance Group on its extortion site on August 7, 2026 and said negotiations had stalled after Westland received a ransom demand. Helix subsequently claimed the data had been published. DataBreach.com indexed 1,520,799 records containing personal, contact, and vehicle information. Westland has not publicly confirmed the incident, and no operational disruption has been independently established.
Troutman Pepper Locke LLP
August 7, 2026
•[ social, phishing, ransomware ]
A Troutman Pepper Locke employee was deceived by communications that appeared legitimate and sent documents to an unauthorized party on August 7, 2026. The firm said the unauthorized party never accessed its environment and operations were not affected. Silent Ransom Group subsequently claimed responsibility and published data.
City of Suisun City
August 7, 2026
•[ ransomware, malware, government ]
Malicious software infected and compromised Suisun City's IT systems at approximately 5:45 a.m. on August 7, 2026, disrupting 911 routing, police and fire dispatch, records, online services, and municipal operations. The City shut down its entire IT network to contain the incident and rerouted emergency dispatch through Solano County. Unidentified perpetrators subsequently made demands to the City, and network restoration remained underway on September 8.
Coggins Insurance Agency, Inc.
August 10, 2026
•[ leak, finance, ransomware ]
Global Secret Group listed Coggins Insurance Agency on its leak site on August 10, 2026. DataBreach.com later indexed 21,657 records containing names, email addresses, and phone numbers. Coggins is an independent insurance agency in Pensacola, Florida. No independently verified operational disruption has been established.
Levi Strauss & Co.
August 10, 2026
•[ social, ransomware, retail ]
Levi Strauss disclosed that an unauthorized third party used social engineering to gain access to three employees' company-issued computers and exfiltrate corporate information. The company contained and terminated the unauthorized access and reported no consumer-data exposure or business interruption. Reuters-linked infrastructure showed Levi Strauss was among companies targeted by a broader ransom-seeking social-engineering campaign associated with activity tracked as UNC6671, but neither Levi Strauss nor Google has confirmed that attribution and no group has publicly claimed the breach.
Shared Health Manitoba (Health Sciences Centre Winnipeg and CancerCare Manitoba)
August 10, 2026
•[ ransomware, healthcare ]
On August 10, 2026, Shared Health identified a ransomware incident affecting a facility-maintenance network serving Health Sciences Centre Winnipeg and CancerCare Manitoba. Shared Health isolated the affected network; central HVAC monitoring and the system for issuing or changing staff access cards were interrupted, and the HSC security office temporarily closed. HVAC equipment remained operational under local monitoring, existing access cards continued functioning and clinical services continued. Recovery was ongoing August 17. Investigators had not established that personal health or financial information had been accessed; no attacker, encryption of particular files or ransom demand was publicly confirmed. The two affected institutions were reported as part of one network incident.
Quirónsalud
August 10, 2026
•[ ransomware, healthcare ]
Quirnsalud, Spain's largest private hospital group, was claimed by the Direwolf ransomware group on Aug. 10, 2026, which threatened to release sensitive healthcare data; 160,181 records were later indexed by DataBreach.com. Quirnsalud has not commented.
Health Carousel
August 10, 2026
•[ ransomware, healthcare, leak ]
Health Carousel, a Cincinnati-based healthcare staffing firm, was listed on the Direwolf ransomware group's leak site on Aug 10, 2026, which claimed it stole critical business data and threatened a full leak. A 952,222-record dataset was later indexed; no company response.
Osmo Wallet
August 10, 2026
•[ ransomware, finance, technology ]
Osmo Wallet, a Guatemala City-based fintech and bitcoin remittance app, was listed on the Direwolf ransomware group's leak site on August 10, 2026, with a threat to publish stolen data unless the company made contact. No company confirmation.
Douglas County Sheriff's Office
August 11, 2026
•[ ransomware, government, technology ]
Douglas County Sheriff's Office (Lawrence, Kansas) found suspicious network activity around Aug. 11, 2026; its website and booking log went offline and Lawrence police lost shared dispatch/records access for weeks. Eudora's ex-IT admin blamed foreign ransomware spread via VPN.
Hogan Lovells Cadwalader
August 12, 2026
•[ ransomware, finance, leak ]
Silent Ransom Group claimed it accessed law firm Hogan Lovells Cadwalader's legacy infrastructure on Aug 12, 2026 for about 24 hours, stole over 50 GB and posted it on its leak site after rejecting offers of up to $5.34M against a $20M demand. The firm did not respond.
Carhartt, Inc.
August 13, 2026
•[ ransomware, retail, leak ]
ShinyHunters published approximately 50GB of data attributed to Carhartt after demanding $3.3 million and failing to reach an extortion agreement. Independent analysis of the leaked corpus identified approximately 12.9 million genuine accounts after millions of synthetic records were excluded. DataBreach.com separately indexed 4,051,760 rows. No operational disruption has been established.
Sharecare, Inc.
August 13, 2026
•[ leak, technology, healthcare ]
ShinyHunters claimed it obtained more than 3.4 million Salesforce records and more than 28GB of internal Sharecare data after failed extortion negotiations. DataBreach.com subsequently indexed 565,222 leaked rows containing personal and contact information. Sharecare has not publicly confirmed the attacker's claimed scope, and no operational disruption has been established.
Town of Andover
August 13, 2026
•[ ransomware, government, education ]
A cyberattack detected August 13 caused a four-day outage across the shared Town of Andover and Andover Public Schools network, disrupting internet connectivity, external email, online bill payments, and access to school teacher assignments while public safety agencies and utilities remained operational. Wallstreet subsequently listed Andover on its leak site and claimed possession of documents, databases, email, personal data, and media. The town has not confirmed Wallstreet's responsibility or any data theft, so the claimed exfiltration is not coded as an exploitive primary effect.
Town of Lincoln
August 13, 2026
•[ ransomware, government ]
The Town of Lincoln determined that files on portions of its computer network had been encrypted, with preliminary evidence indicating activity may have begun as early as August 13. The main file server and other network infrastructure were affected, causing the town office to close August 17 and reopen the following day with limited services while restoration continued. By the end of August the town again advertised normal hours, card payments, and online forms. On September 15, police said investigators determined that some data may have been obtained from town systems and that potentially affected individuals would be notified, but officials have not confirmed specific data acquisition, a ransom demand, ransomware attribution, or a responsible actor.
Maritime Industry Authority (MARINA)
August 13, 2026
•[ ransomware, financial, government ]
MARINA detected suspicious cyber activity on August 13, 2026 and took its nationwide seafarer document-processing environment offline to contain the incident. The Philippine Department of Information and Communications Technology described the incident as ransomware, but MARINA subsequently reported no confirmed data theft and did not establish successful encryption. Routine issuance of seafarer identity documents and record books was suspended nationwide. MARINA issued temporary certificates, launched an interim processing system on September 1 and progressively restored normal issuance in September. Criminal and financial motivation are inferred from the reported ransomware activity; no perpetrator or ransom demand was publicly verified.
Shell
August 13, 2026
•[ ransomware, energy ]
Russian ransomware group Clop claimed in Aug 2026 to have stolen 89 GB of Shell data, including technical drawings, facility images and project plans, listing the energy company among dozens of new victims. Shell said it was aware of a potential incident and was investigating.
Cedar County Memorial Hospital
August 14, 2026
•[ ransomware, healthcare ]
Cedar County Memorial Hospital in El Dorado Springs, Missouri, shut down its IT networks on Aug 14, 2026, losing its EHR and patient portal for two weeks and partially diverting trauma patients. The Wallstreet ransomware group claimed the attack and posted files on its leak site.
