Herbert Smith Freehills Kramer (US) LLP
May 1, 2026
•[ financial, hack, leak ]
Herbert Smith Freehills Kramer confirmed unauthorized access to a limited portion of its U.S. IT environment discovered in late May 2026, and notified people whose sensitive information could have been compromised. The exact access path, initial compromise day, offender and final record count were not disclosed; May 1 is a month-only coding placeholder. Criminal is inferred from deliberate unauthorized access; Financial is the most likely motive under the private-law-firm targeting heuristic given the value of confidential client and personal data, without direct evidence of a ransom demand or data sale.
Waterford Hotel Group
May 11, 2026
•[ ransomware, financial, technology ]
Waterford Hotel Group, a Connecticut hotel and conference center manager, was listed by the Interlock ransomware group on May 11, 2026; Interlock claimed to hold personal, confidential, partner and financial data from the chain and its divisions. No company confirmation.
Krum Public Library
May 14, 2026
•[ ransomware, government, financial ]
Krum Public Library detected unusual network activity on May 14, 2026 and later confirmed a ransomware attack limited to the library environment. Computer access, printing, and Wi-Fi were unavailable, and checkout was temporarily limited to five items. Forensic investigators determined that some library network files had been accessed without authorization, although the city said Social Security numbers and personal financial account information were not affected. NightSpire claimed responsibility and described financial and human-resources data, but the city did not confirm the attribution or claimed contents.
Clark County School District
May 22, 2026
•[ hack, phishing, financial ]
Hackers scammed three Clark County School District employees, accessed their login credentials, and used direct-deposit information to fraudulently withdraw money from the employees accounts.
C2M LLC d/b/a Click2Mail
June 2, 2026
•[ financial, leak, technology ]
A Click2Mail customer reported that the company's online debit-card checkout process was hijacked on June 2 and again later in the summer, with payment-card information captured during checkout and subsequently associated with fraudulent use. Other customers also publicly reported card fraud following Click2Mail transactions. C2M LLC later filed a breach notice with the Vermont Attorney General on September 15 confirming exposure of financial account codes and credit and debit account information affecting at least seven Vermont residents. The regulatory filing confirms the data exposure but does not disclose the technical intrusion method, full compromise window, total victim count, or responsible actor.
AS Latvijas valsts meži
June 11, 2026
•[ ransomware, financial, technology ]
Intrusion indicators show that the attacker entered AS Latvijas valsts mei systems on 2026-06-11 and remained undetected until malicious activity was identified during the night of 2026-06-22 to 2026-06-23. The attacker exfiltrated company data and deployed ransomware, while LVM disconnected LVM GEO, its map-services system, the Mednis application, and several internal customer- and provider-facing systems. CERT.LV confirmed that 44 GB of stolen data was published, including internal documents, emails, source code, digital certificates, cryptographic keys, and user credentials, and assessed that the attacker likely obtained more data. Timber deliveries were reduced after the attack and returned to full volume on 2026-07-01, although other systems remained under restoration on 2026-07-09. Public threat-monitoring sources identify ByteToBreach as the claimant, but CERT.LV has publicly described the perpetrator only as a foreign financially motivated ransomware actor.
Undisclosed Connecticut Medicaid provider
June 18, 2026
•[ leak, financial, healthcare ]
An unauthorized third party first gained access on June 18, 2026 to an undisclosed Connecticut Medicaid providers reimbursement account on the Gainwell Technologies-operated HUSKY provider portal and obtained claims and payment information for approximately 41,000 HUSKY Health members. Gainwell detected the unauthorized access on June 25. Connecticut DSS and Gainwell determined that the activity appeared financially motivated rather than directed specifically at patient data. Electronic health records, Social Security numbers, and financial account information were not compromised, and no evidence of misuse had been identified when notifications began. This incident is separate from the March 2026 compromise of Hartford HealthCare payment accounts on the same portal.
Polymarket via undisclosed third-party provider
June 25, 2026
•[ hack, financial, technology ]
On 2026-06-25, Polymarket disclosed that an undisclosed third-party provider had been compromised, allowing attackers to inject a malicious script into Polymarket's frontend for some users. The script enabled unauthorized cryptocurrency transactions from connected user wallets. Polymarket removed the affected dependency, contained the incident, contacted affected users, and stated that it would reimburse them in full. Blockchain investigators estimated that approximately $2.94 million was stolen from about 11 wallets, but Polymarket did not confirm the exact loss or number of affected users. No intellectual property, organizational data, customer personal data, or broader platform outage was reported.
Undisclosed Minnesota MyChart user
July 1, 2026
•[ phishing, healthcare, financial ]
A Minnesota MyChart user reported to the Federal Trade Commission that a phishing email impersonating MyChart offered a free Medicare Kit in exchange for completing a survey and paying shipping. The victim, who identified Welia Health in Mora as the provider through which they used MyChart, completed the survey, entered credit-card and personal information, and submitted the form. Minutes later, the victim observed a card transaction categorized as an unrelated animal/pet service. Later reporting based on FTC complaints confirmed multiple successful victims of the same broader MyChart impersonation campaign. Epic and Welia Health were not themselves breached.
Undisclosed Illinois MyChart user
July 1, 2026
•[ phishing, healthcare, financial ]
An Illinois MyChart user reported to the Federal Trade Commission that a phishing email impersonating MyChart offered a free Medicare Kit and directed the victim through a survey to a shipping-payment step. The victim submitted Mastercard information before recognizing the message as fraudulent and reported that the scammers had obtained the card information. The complaint is one of several successful victims documented in the broader coordinated MyChart impersonation campaign. MyChart and Epic were not themselves breached.
Clover Health Investments, Corp.
July 4, 2026
•[ social, healthcare, financial ]
Clover Health detected anomalous login activity on July 4, 2026 and determined that an unidentified actor used social engineering to trick three non-managerial health-plan employees into disclosing credentials, enabling access to their employee email accounts used for member visit scheduling and broker-facing sales. The accounts could access member personal and protected health information but not corporate financial or claims systems. Clover contained and terminated the access, and no operational disruption was reported. No group, country, extortion demand, or stated motive was identified; Criminal and Financial are bounded inferences from deliberate credential theft targeting accounts containing identity and health data. Clover is remote-first and states that it maintains no headquarters, so state and county remain undetermined.
Office of the President of Kenya
July 18, 2026
•[ hack, government, financial ]
Attackers replaced the homepage of Kenya's official presidential website with an anti-government message, a cryptocurrency wallet, and a demand for five bitcoins while threatening to publish unspecified information about President William Ruto. Authorities temporarily restricted access for containment and restored the site by July 20; the government found no evidence of sensitive-data access, exfiltration, or loss.
Upbound Group, Inc.
July 21, 2026
•[ financial, leak, technology ]
Upbound Group disclosed multiple recent cybersecurity incidents in which unauthorized parties obtained customer information and company documents. The stolen information was used to create fraudulent lease-to-own agreements through the Acima platform; Acima paid retailers, while the fraudsters obtained merchandise and did not make the required payments. Upbound attributed approximately $13 million in elevated fraudulent contract losses during the second quarter of 2026 to the incidents. The company enhanced authentication and fraud controls and notified federal law enforcement. No actor, intrusion vector, or operational disruption was disclosed.
Thialf
July 24, 2026
•[ ransomware, financial, technology ]
RTL Nieuws identified The Gentlemen as responsible for a ransomware attack against Thialf and reported that the criminals demanded payment to make inaccessible computers available again and to prevent publication of purportedly stolen data. The group claimed to possess internal documents, employee information, financial contracts, and other sensitive data. Thialf confirmed the attack but said its forensic investigation found that data and operational processes were not affected or endangered and that planned events could continue; the claimed data theft therefore remains unverified.
RingCentral, Inc.
July 27, 2026
•[ social, leak, technology ]
RingCentral confirmed that a sophisticated social-engineering campaign in July 2026 resulted in unauthorized access affecting data associated with a limited portion of its customers. ShinyHunters listed RingCentral on July 27, demanded payment, and subsequently published stolen data. Independent analysis identified approximately 1.6 million unique email addresses in the released corpus. RingCentral said it stopped the unauthorized activity and did not report disruption to its core services.
ASOS plc
July 28, 2026
•[ financial, retail, brute-force ]
ASOS detected suspicious customer account activity on July 28, 2026 and confirmed unauthorized access on July 29. Attackers used customer login credentials stolen from unrelated services to access ASOS accounts, exposing personal and partial payment information relating to 138,828 customers. ASOS locked affected sessions, required password resets, and blocked or canceled suspicious transactions. This account-takeover episode is separate from the October 2026 ASOS app-notification incident. The perpetrators were not identified; criminal and financial intent are inferred from the credential-stuffing and suspected fraudulent transactions.
Leviton
July 31, 2026
•[ ransomware, manufacturing, technology ]
Leviton, an electrical products maker in Melville, New York, was listed by the Dark Project ransomware group on August 5, 2026; the group claimed about 1.4 TB from an attack around July 31, incl. financial records, schematics and employee data. Leviton has not confirmed it.
Undisclosed Indiana MyChart user
August 1, 2026
•[ phishing, financial, healthcare ]
An Indiana MyChart user reported to the Federal Trade Commission that a phishing email impersonating MyChart offered a free Medicare first-aid kit in exchange for completing a survey and paying $9.95 shipping. After the victim submitted payment information, the card was charged $9.95 and then immediately charged another $29.95 by a separate scam company. The complaint confirms successful acquisition and fraudulent use of payment data within the broader coordinated MyChart impersonation campaign. MyChart and Epic were not themselves breached.
Department of Land Transport (DLT), Thailand
August 4, 2026
•[ financial, leak, insider ]
Thailand's Department of Land Transport and cybersecurity authorities investigated unauthorized vehicle-registry searches through accounts associated with three government agencies. The DLT confirmed that displayed data were genuine and that access had occurred, while officials said the core registry was not directly hacked. Other reporting describes illegal paid lookup services and sale of government data, supporting a limited Criminal/Financial inference despite the political prominence of some exposed people. Initial access date is unknown; August 4 is the public-discovery proxy.
Uber Freight
August 6, 2026
•[ ransomware, financial, technology ]
Uber Freight confirmed unauthorized access to portions of its systems and data repositories. The Helix extortion group listed Uber Freight on its leak site August 6, 2026, claiming nearly one million stolen files from cloud storage, email and logistics/accounting records. An external breach index separately reported approximately 5.44 million data rows, but Uber Freight did not verify the posted data or the scale of theft. Google links Helix infrastructure to the financially motivated UNC6671 cluster; company-specific attribution remains claim-based. Uber Freight said the incident was contained and remediated without operational disruption. The actual date of the initial intrusion or data extraction was not established; August 6 is the earliest documented public-leak date, not the verified intrusion date.
