Valley Family Health Care
March 7, 2026
•[ ransomware, healthcare, leak ]
DataBreach.com indexed 1,891,536 rows associated with Valley Family Health Care and dated the breach to March 7, 2026. Insomnia listed the organization on its data-leak site on March 18, 2026. Public reporting did not identify the access vector or document encryption or operational disruption.
Evaluate Ltd.
March 15, 2026
•[ ransomware, technology, healthcare ]
Everest publicly claimed Evaluate, a Norstella company, on March 15, 2026 and threatened publication of stolen data unless the company entered negotiations. Independent breach monitoring recorded approximately 1.33 TB associated with the claim, and DataBreach.com subsequently indexed 248,458 rows. Evaluate Ltd. is registered in England and Wales and headquartered in London, where it provides pharmaceutical and biotechnology market intelligence and analytics. No operational disruption has been independently established.
Speed Group
March 19, 2026
•[ ransomware, manufacturing, hack ]
Forensic investigators found that unauthorized operators transferred files from a Speed Group server by March 19, 2026, then moved through the multinational manufacturers network using privileged credentials. On March 29 at about 19:59 the operators deployed ransomware that encrypted corporate servers and backups in France and the United States and a network storage device at the Chilean subsidiary in Quilicura. The company estimated that approximately 5% of its data was permanently lost. BlackNevas/Trial Recovery was attributed through forensic indicators and ransom notes and claimed theft of more than 1 TB, but that volume is unverified. The Chilean subsidiary filed a criminal complaint.
Jones Day
March 30, 2026
•[ phishing, ransomware, leak ]
Jones Day confirmed a phishing incident in which an unauthorized third party accessed a limited number of dated files for 10 clients; Silent Ransom Group claimed responsibility and posted data on its leak site on March 30, 2026.
Kootenai County
March 30, 2026
•[ ransomware, government ]
On March 30, 2026, Kootenai County detected ransomware on its computer network. Contemporary local reporting documented a countywide network outage affecting multiple systems and services; emergency services remained operational, and the outage was restored later that day. The county secured the network, restored operations, engaged forensic specialists, and notified federal law enforcement. Its investigation confirmed that cybercriminals took data from the network. The county completed its data review on July 2 and began mailing notices on July 22. The affected-person count, ransomware group, access method, ransom demand, and payment status were not disclosed.
Campbell University
March 31, 2026
•[ ransomware, education ]
An unauthorized party accessed one Campbell University cloud data-storage platform from March 31 to April 1, 2026. Campbell proactively took the platform offline and worked with its provider to restore it from backups; it stated that no other campus systems or data sources were affected. This was defensive containment, and no attacker-caused disruption was established. INC Ransom claimed the incident on April 11, and DataBreach.com's verified searchable dataset confirms the data compromise.
Sports Center of the Football Association of Serbia
April 1, 2026
•[ ransomware, technology ]
Belgrade prosecutors detained suspect L.D. in Aug 2026, alleging he accessed the Football Association of Serbia Sports Center's network from April to August 2026, took a large amount of data, demanded ransom and damaged data in a ransomware attack.
Republic Health Insurance Fund of Serbia (RFZO)
April 1, 2026
•[ ransomware, healthcare, government ]
Serbian police arrested three INF Grupa members in Aug 2026; prosecutors allege suspect L.D. accessed the network of Serbia's Republic Health Insurance Fund (RFZO) between April and August 2026, took a large amount of data, demanded ransom and damaged data in a ransomware attack.
Karl Chevrolet, Inc. (d/b/a Karl Auto Group)
April 3, 2026
•[ ransomware, leak, retail ]
An unauthorized third party gained access to certain Karl Auto Group computer systems before 2026-03-27. RansomHouse later claimed that it encrypted Karl Chevrolet systems on 2026-04-03, but Karl Auto Group did not publicly confirm the attribution or ransomware deployment. The company discovered the incident on 2026-04-04, when employees encountered unavailable phones and computers. Phone service remained disrupted or intermittent through at least 2026-04-08, although dealerships remained open and directed customers to email, online messages, or in-person service. Karl Auto Group stated that files containing personal information belonging to current and former customers, employees, and other individuals may have been accessed; thousands of customers were notified, but the total number affected was not disclosed. The company reported no evidence of misuse and said it did not pay a ransom.
Karl Auto Group
April 4, 2026
•[ ransomware, automotive ]
Karl Auto Group discovered unauthorized access to certain business computer systems on April 4, 2026 after access had begun before March 27. Employees at multiple Iowa dealerships lacked working phones and computers, and phone service remained unavailable or intermittent for at least five days, although locations remained open. The company stated that files containing customer and employee information may have been accessed. RansomHouse separately claimed that Karl Chevrolet was encrypted on April 3, but Karl Auto Group did not confirm ransomware, data theft, or a connection to the group.
Arkansas Oral & Maxillofacial Surgeons
April 7, 2026
•[ ransomware, leak, healthcare ]
PEAR listed Arkansas Oral & Maxillofacial Surgeons in April 2026 and threatened to release allegedly stolen patient information. DataBreach.com later indexed 189,905 associated rows. The practice did not publicly confirm the actor's attribution or claimed scope, the access vector was not established, and no operational disruption was documented.
Undisclosed organizations
April 8, 2026
•[ ransomware, technology, social ]
Russian-speaking Aurora ransomware operators tricked the Cursor AI coding agent into aiding credential theft and intrusions at 7 to 20+ unnamed organizations from April 2026, per Reuters and CloudSEK; four victims later appeared on Aurora's leak site.
See's Candies, Inc.
April 11, 2026
•[ ransomware, leak, retail ]
An unauthorized actor accessed portions of See's Candies' network from April 11 through April 13, 2026. See's discovered the activity on April 12 and determined that the actor acquired files before encrypting files on a subset of servers; at least some stolen files were later published on the dark web. Qilin publicly claimed the company. Subsequent regulatory filings report 23,737 affected individuals, while DataBreach.com separately indexed 112,767 rows.
Undisclosed Middle Eastern manufacturing company
April 11, 2026
•[ ransomware, manufacturing, technology ]
Kaspersky reconstructed initial VPN access using compromised credentials on April 11, 2026, data theft on April 13 and operational disruption beginning April 14. Attackers deployed malicious Active Directory policies that disabled administrator accounts and displayed ransom demands. Stolen information was subsequently published. No Windows file encryption was confirmed. PAYLOAD identifies the associated ransomware family and malicious policy; the operator was not separately identified. April 11 dates initial access, not the first confirmed data theft. The victim's country and recovery duration were not disclosed.
Undisclosed organization
April 15, 2026
•[ ransomware, leak ]
Black Shrantac claimed at least one victim, exfiltrated sensitive data, and deployed ransomware to encrypt files while using a Tor leak site to pressure victims.
Ohio Living
April 16, 2026
•[ ransomware, healthcare, financial ]
Ohio Living detected suspicious network activity on April 17, 2026. Its investigation determined that an unauthorized actor accessed systems and copied files from its network between April 16 and April 17. Ohio Living secured the network and began reviewing the files; no operational disruption was reported, and the 500-person figure reported to HHS was preliminary. On August 5, the Dark Project ransomware group claimed responsibility for an April 2026 attack on Ohio Living and alleged that it stole at least 600 GB, including at least 5,000 files containing employee, patient, medical, insurance, Social Security, financial, and banking information. Ohio Living had not publicly confirmed the attribution or the claimed volume.
Goodwin Procter LLP
April 16, 2026
•[ ransomware, financial, technology ]
Goodwin Procter disclosed a spring 2026 unauthorized data-access incident dated April 16 in state records. The firm notified a limited number of clients and affected people. Insurance-industry reporting linked the extortion to Luna Moth and reported a ransom payment around US$10 million, citing people familiar with the matter; Goodwin did not independently confirm that payment or attribution. Its effect was acquisition of sensitive information, without verified encryption or service shutdown. Criminal/Financial is supported by the attributed financially motivated extortion campaign.
NTN Bearing Corporation of America
April 24, 2026
•[ ransomware, manufacturing, leak ]
PayoutsKing claimed it compromised NTN Bearing Corporation of America and threatened publication of stolen data. Ransomware tracking places the estimated attack on April 24, 2026 and the public claim on May 13. DataBreach.com later indexed 115,671 leaked rows containing personal and contact information. No independently verified operational disruption has been established.
The Walman Optical Company
April 27, 2026
•[ ransomware, manufacturing, healthcare ]
Medusa publicly claimed Walman Optical on April 27, 2026. DataBreach.com subsequently indexed 690,400 records containing personal and identity information associated with the company. Multiple federal data-security lawsuits were filed against Walman in May 2026 following the incident. Federal contracting and environmental records identify Walman's primary activity as ophthalmic goods manufacturing. No independently verified operational disruption has been established.
National Federation of SubPostmasters (NFSP)
April 30, 2026
•[ ransomware, technology, misconfiguration ]
Attackers exploited a vulnerability in cPanel web-hosting software on April 30, 2026 and deployed ransomware against the National Federation of SubPostmasters' website environment. The attackers locked files and demanded payment for their release. NFSP reported no known data loss, but technical problems were still ongoing on June 2 and the Post Office temporarily paused email exchanges with NFSP as a precaution. Post Office branches and customer-facing postal services were not affected.
