fbc.ca
November 4, 2026
•[ ransomware, finance ]
fbc.ca was listed as a victim on the leak site of the BrainCipher ransomware group; the attack is estimated to have taken place on 2026-11-04. Sector: Financial Services. Country: Canada. Website: fbc.ca.
Kde
November 4, 2026
•[ ransomware, technology, manufacturing ]
Kde was listed as a victim on the leak site of the medusalocker ransomware group; the attack is estimated to have taken place on 2026-11-04. Sector: Technology. Moroccan industrial/automotive company (icn.ma) with a full in-house accounting office: general-ledger and cash-desk files, client balances, bank transfer orders (BMCE), purchase orders, staff lists, and trade documents including an overseas distribution agreement and proforma invoices for FAS Automotive (encap_maroc).
Dian
November 4, 2026
•[ ransomware, government, finance ]
Dian was listed as a victim on the leak site of the medusalocker ransomware group; the attack is estimated to have taken place on 2026-11-04. Country: Colombia. Website: dian.gov.co. Organization with 339 emails extracted. Domain: dian.gov.co
Undisclosed companies
September 1, 2021
•[ phishing, financial, technology ]
Scattered Spider crew members phished credentials at 12+ companies (entertainment, telecom, tech, BPO, IT, cloud, crypto) in 2021-2023, stole company data and millions in crypto from 29 victims. Ahmed Elbadawy's guilty plea surfaced Sept 2026 via a forfeiture filing.
Order Express, Inc.
July 29, 2022
•[ ransomware, finance, leak ]
An unauthorized actor accessed portions of Order Express's network between July 29 and September 7, 2022. Order Express discovered server connectivity problems on September 7 and shut down its network; investigators later determined that ransomware had encrypted just over half of its servers and that customer data had been accessed and exfiltrated. State breach filings identify 63,220 affected individuals. Contemporaneous public reporting attributed the incident to Cl0p, although Order Express itself described the attacker as unknown.
Undisclosed U.S. online banking customers
November 1, 2023
•[ phishing, finance ]
Russian web developer Sergei Filimonov, extradited from Georgia, pleaded not guilty in Atlanta to charges he used fake bank login pages from Nov. 2023 to Oct. 2025 to steal U.S. customers' credentials and drain accounts. FBI counts 19+ victims and about $14.6M lost.
Undisclosed individual
August 18, 2024
•[ social, financial, phishing ]
A Washington, D.C. crypto investor lost over 4,100 bitcoin (over $240M) on Aug. 18, 2024 after callers posing as Google and Gemini support got access to his Google Drive and security codes. Ringleader Malone Lam faced a plea hearing; 18 people were charged.
Gazprombank
December 5, 2024
•[ hack, finance, espionage ]
Russian users report difficulties accessing services at Gazprombank, one of the countrys largest privately owned banks, following an alleged cyberattack by Ukraines military intelligence agency.
MassDevelopment
January 18, 2025
•[ ransomware, finance, government ]
MassDevelopment, the Massachusetts state development finance agency in Boston, was listed by the BianLian ransomware group on its leak site on Jan 18, 2025, which claimed theft of 4 TB of data. The agency has not publicly confirmed the claim.
Intesa Sanpaolo
February 17, 2025
•[ hack, ddos, finance ]
Pro-Russian hacktivist group NoName057(16) claimed a coordinated DDoS campaign against Italian institutions and banks, causing temporary service disruptions but no data compromise; politically motivated, with activity spanning several days.
Internal Revenue Service
February 25, 2025
•[ insider, leak, government ]
Insider contractor illicitly accessed and leaked confidential IRS taxpayer records (activity occurred 20182020; higher victim count publicized Feb 2025).
Norwest Venture Partners
August 9, 2025
•[ ransomware, finance, technology ]
Sinobi claimed an intrusion into Norwest Venture Partners dated 9 August 2025 and publicly listed the firm on 15 August, threatening to publish stolen data unless Norwest negotiated. The supplied breach database later indexed 4,156 email records. Norwest did not publicly confirm the incident, and no victim-specific evidence of encryption or operational disruption was found; disruption cannot be ruled out because Sinobi commonly deploys ransomware.
Upbit
November 27, 2025
•[ financial, hack, finance ]
Unauthorized exploitation of Upbits Solana hot wallet enabled attackers to initiate a sequence of unauthorized withdrawals totaling roughly $38 million USD over a 54-minute window (04:4205:36 KST). No user data loss or service outage was reported, and Upbit moved remaining assets to cold storage and pledged full customer reimbursement.
IMA Diligence Services, LLC
December 8, 2025
•[ hack, leak, healthcare ]
An unauthorized actor accessed a legacy file server managed by a third party between December 8 and December 16, 2025 and exfiltrated files containing personal, financial, and medical information. IMA Diligence Services reported 525,306 affected individuals. Genesis later claimed responsibility and alleged theft of approximately 700 GB, but the company did not publicly confirm the actor's attribution or claimed volume.
Educational Employees Credit Union
December 15, 2025
•[ hack, finance ]
On December 15, 2025, an unauthorized individual gained access to one Educational Employees Credit Union employee email account for a limited period and may have accessed or removed messages. EECU determined on May 8, 2026, that some emails contained personal and financial information, began notifying affected individuals on May 29, and reported no evidence that the information had been used for financial fraud or identity theft.
Plaza Home Mortgage, Inc.
February 17, 2026
•[ ransomware, finance ]
Plaza Home Mortgage detected unauthorized access to an employee computer on or around February 17, 2026 and took action to remove the intruder. The company determined that an unauthorized party may have obtained personal information belonging to customers and employees and notified 137,976 individuals. Silent Ransom Group later claimed responsibility, but Plaza did not publicly confirm the attribution.
Peachtree Group
February 19, 2026
•[ hack, leak, finance ]
PayoutsKing claimed it exfiltrated approximately 698 GB of data from Peachtree Group in an intrusion dated February 19, 2026 and publicly listed the company on April 30. DataBreach.com later indexed 299,873 rows. Litigation filed after the incident alleges that personally identifiable information belonging to current and former employees was accessed. A separate July 2026 claim by The Gentlemen appears to concern a later incident and is not merged into this record.
Wood Smith Henning & Berman LLP
February 20, 2026
•[ ransomware, finance, technology ]
Silent Ransom Group stated that it gained access to Wood Smith Henning & Berman's network on February 20, 2026 and acquired approximately 3.6 GB of data. Negotiations began by March 3, with the group demanding $1.8 million to delete the files. After negotiations failed, the group published the data on March 17. DataBreaches reviewed the leaked material and confirmed that it included technical reports, expert analyses, legal research, and files from multiple client matters. The access method was not disclosed, no malware or encryption was reported, and the firm did not respond to a request for comment.
Undisclosed banking customers, financial-services customers, and small-to-medium businesses in Portugal, Spain, Mexico, and Latin America
February 24, 2026
•[ phishing, malware, financial ]
WatchGuard telemetry identified Grandoreiro infections beginning in late February 2026. Phishing links delivered ZIP archives containing legitimate applications and malicious DLLs for side-loading, while a related campaign used an obfuscated VBS file to install the banking trojan. The confirmed victim population comprised banking and financial-services customers, small-to-medium businesses, and users in Portugal, Spain, Mexico, and other parts of Latin America; references to banks in the malware code identify targeted banking applications, not confirmed compromises of the banks themselves.
Ameriprise Financial
March 2, 2026
•[ hack, finance, technology ]
Ameriprise Financial disclosed unauthorized access to certain stored data and files in an incident dating back to March 2, 2026, which it detected and blocked on March 18. Ameriprise said there was no disruption to business operations and no indication of unauthorized transactions or fund movement. ShinyHunters claimed responsibility and allegedly threatened to release Salesforce customer records and more than 200 GB of compressed SharePoint internal data, but the full attacker claim was not confirmed by Ameriprise.
