Oschadbank
March 9, 2026
•[ ddos, finance, government ]
Ukraines state-owned Oschadbank reported that around 10:00 on March 9, 2026, its security protocols triggered due to suspected DDoS activity. To protect systems, the bank temporarily disabled servers, causing electronic services to become unavailable. The bank stated technical inspection was ongoing and expected full restoration within about an hour; no data theft was reported in the notice.
AssuranceAmerica Managing General Agency, LLC
March 16, 2026
•[ leak, finance ]
On 2026-03-16, malicious activity targeted an AssuranceAmerica employee and enabled an unauthorized third party to access portions of the company's IT environment and copy files. AssuranceAmerica detected suspicious activity on 2026-03-17, disabled compromised credentials and unauthorized sessions, isolated affected systems, and notified law enforcement. The company completed its review of the copied files on 2026-06-15. Regulatory filings subsequently identified 6,998,886 affected individuals. No threat group publicly claimed responsibility, and AssuranceAmerica did not disclose a motive or precise access mechanism.
Ernst & Young LLP
March 28, 2026
•[ hack, technology, finance ]
An unauthorized party accessed a third-party IT service-management platform used for EY tax work from March 28 through April 12 and downloaded client documents. ShinyHunters later claimed responsibility, but EY has not confirmed that attribution or the group's separate claims of Jira, GitHub, and Azure access; no operational disruption or public confirmation of the threatened leak was reported.
Undisclosed insurance organization
April 1, 2026
•[ espionage, malware, finance ]
Beginning in April 2026, researchers observed the Backdoor.Mistic remote access trojan deployed on the network of at least one undisclosed insurance organization. The backdoor enabled file upload and download, file manipulation, folder creation, and in-memory code execution. The victim's identity, location, affected systems, and any acquired information were not disclosed. SecurityWeek attributed the activity to Woodgnat, also known as KongTuke, while Broadcom assessed that Mistic may be associated with the group.
KerberRose Wealth Management, LLC
April 29, 2026
•[ hack, leak, finance ]
An unauthorized third party accessed one KerberRose employee email account on April 29, 2026 and used that access to reach a limited portion of a backup platform supporting KerberRose Wealth Management. KerberRose discovered the incident on May 1 and notified 27,076 affected individuals. Its accounting and tax services were not affected. The actor and motive were not identified.
Revolut Bank UAB
May 1, 2026
•[ social, finance, government ]
Attackers used a compromised certified email account belonging to an Italian Interior Ministry office to submit fraudulent law-enforcement requests to Revolut Bank UAB. By early May 2026, published correspondence shows Revolut had already sent customer data in response to the requests; the exact first disclosure date is not known, so event_date uses the first day of the earliest month in which successful disclosure is evidenced. Revolut said its own systems, databases and customer funds were not compromised. Multiple parties later claimed responsibility, so the specific actor remains unverified.
Heights Finance Holdings Co.
May 7, 2026
•[ leak, misconfiguration, finance ]
Heights Finance discovered on May 7, 2026 that an unauthorized actor had gained access to a third-party cloud platform used to store customer information and may have viewed or copied data. The incident was limited to that platform and did not affect Heights' loan-management systems, other computer systems, networks, or operations. State notifications establish at least 1,221,338 affected individuals. Heights said its dark-web monitoring had found no evidence that the stolen information had been shared, and no known ransomware or extortion group has claimed responsibility.
Wilmer Cutler Pickering Hale and Dorr LLP
May 8, 2026
•[ social, ransomware, finance ]
On May 8, 2026, a WilmerHale employee provided personal information to an unauthorized third party who misrepresented their identity. The firm said the actor did not directly access its systems or network; the information had been obtained through legal services and may have included names and Social Security numbers. WilmerHale reported no known further disclosure or misuse. Later reporting attributed the incident to Silent Ransom Group, also known as Luna Moth, and alleged that WilmerHale paid at least $18 million, including a $10 million primary cyber-insurance layer; WilmerHale and the insurer did not publicly confirm those payment claims.
PT Bank Negara Indonesia (Persero) Tbk
May 11, 2026
•[ leak, finance ]
DataBreach.com indexed 185,606 rows associated with the bni.co.id domain and dated the dataset to May 11, 2026. The affected organization is PT Bank Negara Indonesia (Persero) Tbk, not Bank Indonesia, the country's central bank. TripleX separately claimed approximately 2 TB of Bank Negara Indonesia data later in May, but public evidence does not conclusively establish that the TripleX claim and this indexed dataset resulted from the same intrusion.
HDFC Asset Management Company Limited
May 16, 2026
•[ ransomware, leak, finance ]
On 16 May, an HDFC AMC IT administrator detected suspicious activity, and the company received an email from Morpheus claiming to have exfiltrated more than 680 GB of data. HDFC AMC activated containment procedures, isolated affected systems, engaged cybersecurity specialists, and notified regulators and law enforcement. On 29 May, the Bombay High Court restrained Morpheus and others from publishing or using the data. HDFC AMC later said the incident did not interrupt business continuity, did not materially affect its financial results, and did not affect investors' units or portfolio values. The initial access method was not disclosed.
Fox Rothschild LLP
May 21, 2026
•[ ransomware, social, finance ]
On 2026-05-21, a sophisticated social-engineering incident enabled unauthorized access associated with one Fox Rothschild user device. Fox Rothschild stated that the activity was limited to that device and that it found no broader access to the firm's systems or network. Silent Ransom Group claimed responsibility, said it exfiltrated confidential client files, demanded payment, and later published data after the ransom deadline passed. The actor attribution, stolen-data scope, and publication details are based on the group's claim and subsequent reporting.
North Dallas Shared Ministries (Now-Forward, Inc.)
May 25, 2026
•[ leak, healthcare, finance ]
cmdorganization listed North Dallas Shared Ministries on May 25, 2026 and threatened to publish the full leak unless contacted. DataBreach.com later indexed 188,961 structured records containing personal identifiers and contact information. The organization, now operating as Now-Forward, provides financial assistance, food, clothing, medical and dental care, and other services to low-income residents. Public court dockets show data-breach class-action petitions against the organization, but no victim or regulator notice publicly established the initial access vector, encryption, or operational disruption.
At least one PTC Windchill/FlexPLM customer
June 1, 2026
•[ ransomware, technology, finance ]
Ransom-ISAC assesses that Cl0p affiliates likely began exploiting CVE-2026-12569 as a zero-day in early June 2026 against internet-exposed PTC Windchill and FlexPLM systems. Attackers deployed custom JSP webshells capable of credential theft and large-scale data exfiltration. Extortion emails were observed beginning July 20, and Cl0p later named more than 40 alleged victims, including Shell, Philips, Fiserv, Zebra Technologies, Mindray, and others. Victim-specific stolen-data volumes ranged from about 1 GB to several terabytes according to Cl0p, although many individual claims remain unconfirmed.
Hollard Insurance Group
June 1, 2026
•[ ransomware, finance, technology ]
South African insurer Hollard's funeral-policyholder data was leaked by The Gentlemen in Sept. 2026 after a June 2026 extortion breach of its administrator MIP Holdings' Jira platform. Hollard says its own systems were not compromised and notified affected customers.
PrivatBank
June 1, 2026
•[ hack, ddos, finance ]
PrivatBank, Ukraine's largest state-owned bank, said an 'unusual' DDoS attack using infected devices of Ukrainian users caused a June 2026 failure of its services, blocking some legitimate customers during filtering. The bank blamed Russia; August outages were a supplier fault.
Undisclosed organizations in education, transportation, healthcare, and finance
June 5, 2026
•[ ransomware, education, finance ]
Microsoft reported that The Gentlemen ransomware had affected organizations in the education, transportation, healthcare, and financial sectors across North America, South America, Europe, Africa, and Asia. The self-propagating Go-based encryptor could spread through Windows networks, encrypt local volumes and network shares, delete shadow copies, and leave ransom notes. Microsoft tracks the ransomware operators as Storm-2697, while affiliates conduct the intrusions. Exact victim identities, attack dates, disruption duration, and affected-system counts were not disclosed.
VTB Bank (PJSC)
June 8, 2026
•[ ddos, finance, hack ]
On June 8, 2026, a DDoS attack disrupted VTB Banks online services, preventing some customers from logging into mobile and web banking or completing payments and transfers. Complaints increased around 11:00 Moscow time, and VTB reported that service availability had been fully restored after 17:00.
Undisclosed third-party law firm used by Navient
June 8, 2026
•[ ransomware, finance ]
Navient learned on June 8, 2026, that ransomware had affected certain information systems at an undisclosed third-party law firm providing it legal services. An unauthorized actor accessed Navient-related data held by the firm, including sensitive borrower information. The incident was limited to the law firm's environment; Navient found no access to its own systems and experienced no disruption to operations or customer services. Public disclosures did not identify the law firm, ransomware operator, affected-person count, access method, or any operational disruption at the firm.
Central Bank of Libya
June 9, 2026
•[ ransomware, finance, government ]
On 2026-06-09, the Central Bank of Libya confirmed a cyberattack affecting a limited number of systems and technical services. The bank activated emergency response and business-continuity procedures and isolated affected systems. Qilin claimed responsibility on 2026-06-22 and threatened to release confidential banking data. The bank later said it was investigating material published on the dark web. The access method, data categories, volume, and effects on customers or financial assets were not publicly established, and the Qilin attribution remains an attacker claim.
Aflac Life Insurance Japan Ltd.
June 10, 2026
•[ hack, leak, finance ]
Aflac Life Insurance Japan determined that unauthorized access and data leakage first occurred on 2026-06-10, with multiple unauthorized accesses continuing through 2026-06-25. The incident affected Aflac Yorisou Net and related systems and exposed personal information concerning approximately 4.4 million customers and approximately 40,000 current and former agencies. Aflac temporarily suspended the policyholder portal and several related online services as a containment measure, while claims and other procedures continued through call centers. The initial access method, actor, and motive remained under investigation.
