Bennett College
October 27, 2025
•[ ransomware, education ]
Bennett College, a private HBCU for women in Greensboro, N.C., had network data accessed Oct. 27-Nov. 15, 2025, affecting 30,065 people. INC Ransom listed the college on its leak site Dec. 6; the college notified the state AG and offered credit monitoring.
Cornerstone Staffing Solutions, Inc.
November 13, 2025
•[ ransomware, technology ]
Qilin listed Cornerstone Staffing Solutions on November 13, 2025 and displayed samples from recruitment databases and company files while threatening publication. Cornerstone had not publicly confirmed the claim, and no operational disruption was reported.
Under Armour
November 17, 2025
•[ ransomware, retail, technology ]
Everest ransomware group claims to have breached Under Armour systems and exfiltrated 343GB of data including detailed product records internal corporate files and extensive customer information and has issued a short deadline for the company to make contact while threatening to leak the data if there is no response
National Association on Drug Abuse Problems (NADAP)
November 26, 2025
•[ ransomware, healthcare ]
Unauthorized access to NADAP's network occurred on or around November 26, 2025 and was discovered on January 10, 2026. NADAP isolated and took impacted systems offline as a containment measure. Genesis claimed responsibility on March 6, 2026 and said it stole approximately 2 TB of medical and HR data. NYC Health + Hospitals confirmed that 5,086 of its patients were among those whose protected health information was accessed.
Undisclosed U.S. services company
December 1, 2025
•[ ransomware, sqlinjection, technology ]
In December 2025, DragonForce-affiliated operators gained access to an undisclosed U.S. services company, likely through an unknown SQL or MSSQL server vulnerability or purchased access. During a dwell time of approximately one to two months, the attackers modified firewall rules, used DLL sideloading and vulnerable-driver techniques, deployed the Go-based Backdoor.Turn remote-access tool using Microsoft Teams TURN relays for command and control, stole confidential files, and ultimately encrypted systems with DragonForce ransomware. The exact intrusion day, affected systems, operational impact, and contents of the stolen data were not disclosed.
Anatomic and Clinical Laboratory Associates, P.C.
December 1, 2025
•[ ransomware, healthcare, leak ]
Anatomic and Clinical Laboratory Associates detected potential unauthorized activity on December 1, 2025. Its investigation found that an unauthorized actor may have accessed its network and downloaded files. Insomnia later claimed responsibility, but the laboratory did not publicly attribute the incident to the group. No encryption or operational disruption was reported.
Four Points by Sheraton (Marriott International, Inc.)
December 6, 2025
•[ ransomware, leak ]
LockBit 5.0 listed the Four Points by Sheraton domain in December 2025 and threatened to publish allegedly stolen data. DataBreach.com later indexed 52,310 rows associated with the domain. Marriott International did not publicly confirm the actor's claim, the access vector was not established, and no encryption or operational disruption was documented.
United Medical Doctors
December 12, 2025
•[ ransomware, healthcare, leak ]
United Medical Doctors confirmed unauthorized access to its systems at varying times between December 12, 2025 and March 31, 2026, during which an unauthorized user accessed and/or acquired files. UMD detected suspicious activity on March 31. Insomnia publicly claimed the organization on April 9 and threatened disclosure of stolen information. DataBreach.com subsequently indexed 638,670 rows associated with the incident. No independently verified operational disruption has been established.
City of Milton
December 26, 2025
•[ ransomware, government ]
The City of Milton detected suspicious activity consistent with ransomware on December 26, 2025 and took steps to secure its network. The resulting network outage delayed utility bills, paused automatic payments, and caused some online accounts to display temporary zero balances. Utility billing services were restored by February 6, 2026. The city stated that no data was taken and waived late fees and utility shutoffs associated with the billing delay.
Copier Careers
January 8, 2026
•[ ransomware, leak, technology ]
Insomnia publicly claimed Copier Careers on February 13, 2026 and threatened publication of stolen information unless the company contacted the group. The underlying breach is dated January 8, 2026, and DataBreach.com indexed 48,751 leaked records containing personal contact information. No operational disruption has been independently established.
MG Oil Company, Inc.
January 29, 2026
•[ ransomware, leak, energy ]
Akira listed MG Oil Company on January 29, 2026 and claimed theft of approximately 35 GB of corporate data. DataBreach.com subsequently indexed 9,891 associated rows. The company's public attribution, the access vector, and any operational disruption were not established; therefore, only the achieved data-exposure effect is coded.
Undisclosed Latvian company
February 1, 2026
•[ ransomware, hack, technology ]
An unnamed Latvian company was hacked in Feb. 2026 when an attacker exploited a website vulnerability, exported personal data from its database and demanded payment not to leak it. Latvian police linked the case to the TSC breach and arrested a 23-year-old suspect on Sept. 15.
Monmouth University
February 5, 2026
•[ ransomware, education ]
An unauthorized third party acquired files from Monmouth University's network between 5 and 13 February 2026; the university learned of the access on 3 March and later determined the affected data on 29 May. PEAR claimed responsibility on 26 March and alleged theft of 16 TB for extortion. Monmouth stated that there was no operational disruption and that university systems and programs continued operating normally. The initial access method was not disclosed.
Professional Compounding Centers of America, Inc.
February 10, 2026
•[ ransomware, healthcare, technology ]
Nitrogen claimed on February 10, 2026 that it had compromised Professional Compounding Centers of America's network, exfiltrated a significant amount of data, and would publish it unless its demands were accepted. DataBreach.com subsequently indexed 1,500,874 rows and dated the published dataset to May 12. PCCA did not publicly confirm the actor's claim, and no operational disruption was documented.
Plaza Home Mortgage, Inc.
February 17, 2026
•[ ransomware, finance ]
Plaza Home Mortgage detected unauthorized access to an employee computer on or around February 17, 2026 and took action to remove the intruder. The company determined that an unauthorized party may have obtained personal information belonging to customers and employees and notified 137,976 individuals. Silent Ransom Group later claimed responsibility, but Plaza did not publicly confirm the attribution.
Wood Smith Henning & Berman LLP
February 20, 2026
•[ ransomware, finance, technology ]
Silent Ransom Group stated that it gained access to Wood Smith Henning & Berman's network on February 20, 2026 and acquired approximately 3.6 GB of data. Negotiations began by March 3, with the group demanding $1.8 million to delete the files. After negotiations failed, the group published the data on March 17. DataBreaches reviewed the leaked material and confirmed that it included technical reports, expert analyses, legal research, and files from multiple client matters. The access method was not disclosed, no malware or encryption was reported, and the firm did not respond to a request for comment.
Little Bonanza, Inc. d/b/a Bonanza Casino
February 21, 2026
•[ ransomware, leak ]
Bonanza Casino detected suspicious network activity on 21 February after finding certain systems offline. It secured the environment and engaged forensic specialists, who determined that an unauthorized party accessed certain systems and copied files. Medusa publicly claimed responsibility on 17 March and threatened to publish the stolen data. Bonanza Casino completed its affected-person review on 1 July and issued notices on 8 July. The intrusion method, duration of the system outage, and nationwide number of affected individuals were not disclosed.
Central National Gottesman Inc.
February 26, 2026
•[ ransomware, leak, manufacturing ]
On or around February 26, 2026, an unauthorized third party accessed part of Central National Gottesman's network and obtained files from company systems. The incident was discovered by February 28. PayoutsKing publicly claimed the company on March 2. Regulatory filings report 9,126 affected individuals and confirm exposure of identity, financial, health, and payroll-related information. DataBreach.com separately indexed 207,519 rows associated with the incident.
Novo Nordisk A/S
March 1, 2026
•[ ransomware, leak, healthcare ]
FulcrumSec claimed that it obtained access in March 2026 through a GitHub access token, cloned Novo Nordisk repositories, obtained additional credentials, remained in the environment for more than two months, and stole more than 700,000 files totaling approximately 1.3 TB before demanding $25 million. Novo Nordisk confirmed unauthorized access to a limited number of internal IT systems and the external copying of non-public and personal data, but it did not publicly attribute the incident to FulcrumSec or confirm the actor's claimed volume and contents. Reuters could not independently verify the authenticity of the published data. Novo Nordisk temporarily took certain internal systems offline for containment, while stating that its core business operations remained operational. Because only March 2026 was reported for initial access, 2026-03-01 is used as the normalized event date.
Lewis Drug
March 3, 2026
•[ ransomware, leak, healthcare ]
AiLock claimed responsibility for an intrusion involving Lewis Drug in early March 2026 and alleged theft of approximately 110 GB. DataBreach.com dated the associated dataset to March 4 and indexed 22,549 rows. Public evidence supports a March 2026 event rather than the previously coded July 2025 date. No encryption or operational disruption was publicly documented.
