Here at Pope and Johnson County Title Company
November 3, 2026
•[ ransomware, finance, government ]
Here at Pope and Johnson County Title Company was listed as a victim on the leak site of the rhysida ransomware group; the attack is estimated to have taken place on 2026-11-03. Sector: Financial Services. Here at Pope and Johnson County Title Company Pope County Title Company - title insurance & escrow agency2,536,208 files, ~784 GBPope County Title Company / Johnson County Title / Carol Collins Law / Principle Escrow / Principle Intermediary (Russellville, AR) is a title agency closing real-estate deals for First American Title Insurance, running escrow trusts and acting as a qualified intermediary for IRS 1031 like-kind exchanges. Power title plant: 591,000-record county registry, 19832026 data;SoftPro daily closing documents 20202026 plus a SQL backup (fully restored and examined);WordData business documents: 1031 exchanges, escrow registers, HR, taxes, passwords.412 SSNs + 4,549 TaxIDs in the production database; 1,202 buyers/sellers from 2025+; fresh W-2/1099 for all staff (SSN, wages, addresses);scans of passports, driver licenses and Social Security cards of staff and clients;bank portal passwords in plain spreadsheets, plus security answers; Centennial / FSB account numbers, wire instructions, FUND escrow ledgers 20242026;owners' personal finances: joint 1040 returns 20022018 (spouses' SSNs), medical bills, investment accounts, SSA retirement application 12/2024;5th Judicial District criminal-case materials (the owner is a sitting public defender): Cellebrite phone extractions of defendants, jury instructions;law-practice case files: divorces, guardianships, estates. More
City of Edgewater
November 3, 2026
•[ ransomware, government, leak ]
City of Edgewater was listed as a victim on the leak site of the Booba Project ransomware group; the attack is estimated to have taken place on 2026-11-03. Sector: Government & Defense. Country: United States of America. Website: www.cityofedgewater.org. Government Administration Stolen data: 47 GB.
hillandbeyer.com
November 3, 2026
•[ ransomware, leak, healthcare ]
hillandbeyer.com was listed as a victim on the leak site of the incransom ransomware group; the attack is estimated to have taken place on 2026-11-03. Sector: Professional Services. Country: United States of America. Website: hillandbeyer.com. Hill & Beyer is a law firm that provides legal representation and related client services.
Management at Hill & Beyer has been officially informed regarding a major breach involving highly sensitive data.
The compromised file repository encompasses a broad spectrum of confidential documents, notably featuring private patient medical histories and health records, audio recordings alongside transcripts from 911 emergency dispatches, investigative files concerning legal infractions, and comprehensive logs and transcripts of formal interrogations.
Initially, an effort was made to resolve the matter privately and confidentially. Numerous phone calls, warnings, and formal notifications were dispatched to the organization's administration and leadership. However, management chose to disregard these warnings and severed all communication without implementing any remediation measures. Consequently, this public statement is being issued.
Juge, Napolitano, Ruli, Putfark & Pittman
November 4, 2026
•[ ransomware, leak, healthcare ]
Juge, Napolitano, Ruli, Putfark & Pittman was listed as a victim on the leak site of the rhysida ransomware group; the attack is estimated to have taken place on 2026-11-04. Sector: Professional Services. Juge, Napolitano, Ruli, Putfark & Pittman Juge, Napolitano, Ruli, Putfark & Pittman / 'WC Defense' - insurer & corporate defense law firm.The Juge Firm (Metairie / Covington, LA, founded 1983) is one of the oldest workers' compensation defense law firms, protecting employers, insurers and TPAs against injured workers' claims.Clients (148 client-guideline files): Sedgwick, Gallagher Bassett, Broadspire/Crawford,ESIS/ACE, AIG, Allstate, Chubb, Zurich, Amazon, Walmart, Home Depot, CVS Health, FedEx, Lyft, Costco, Hilton, Northrop Grumman, State Farm,Travelers, Coca-Cola, Fluor, GEO Group, Archdiocese of New Orleans, the cities of New Orleans / Baton Rouge / Shreveport, and others.2,383,324 files, ~3.2 TB.- 4,477 full workers' comp defense case files: 175,993 PDFs, 73,239 DOCX, 61,622 DOC, 55,798 MSG emails, 28,244 TIF scans;- claimant medical imaging: 6,461 DICOM files (MRI/CT/X-ray);- 28,410 medical EOBs and disputed LDOL-WC-1008 claims (full PII + diagnoses of injured workers);- 1,884 new-file intake sheets with complete claimant PII (SSN, address, DOB, injury);- 3,265 counterparty W-9 forms (EINs, signatures, current 20242025);- 850 claimant surveillance videos ('Surveillance', 214 GB) - covert footage of injured workers;- inbound attorney-correspondence faxes, live ECF/PACER court logins, and 148 confidential insurer client guidelines. More
Dian
November 4, 2026
•[ ransomware, government, finance ]
Dian was listed as a victim on the leak site of the medusalocker ransomware group; the attack is estimated to have taken place on 2026-11-04. Country: Colombia. Website: dian.gov.co. Organization with 339 emails extracted. Domain: dian.gov.co
Stelios Kouloglou
October 21, 2022
•[ espionage, government, technology ]
Citizen Lab found with high confidence that former Greek MEP Stelios Kouloglou's iPhone was successfully infected with NSO Group's Pegasus on October 21, 2022 and again on March 6-7, 2023 using the PWNYOURHOME zero-click exploit. The infections occurred during sensitive PEGA Committee work. Researchers did not attribute the operation to a government, found no indication Greece was responsible, and assessed that the first infection overlapped with an operator previously targeting Russian- and Belarusian-speaking journalists and activists.
Syrian National Army Military Police Investigation Section, Suluk
May 10, 2023
•[ leak, malware, government ]
A RedLine infostealer infected a senior officer's Windows computer used by the Syrian National Army Military Police Investigation Section in Suluk on May 10, 2023. Hudson Rock recovered a stealer log timestamped 09:39 showing the unit-named Windows account and theft of saved passwords, browser cookies, a live Telegram session, and 14 desktop files, including seven active detainee interrogation records. Five recovered Office lock files indicate some records were open when the malware ran. The log subsequently circulated in criminal markets. The individual RedLine affiliate responsible has not been identified. RedLine is commodity malware-as-a-service designed for credential and financial-data theft and resale, supporting Criminal actor type and Financial motive.
St. George Fire Protection District No. 2
December 23, 2023
•[ hack, government, technology ]
On 2023-12-23, law enforcement informed St. George Fire Protection District No. 2 that threat actors had infiltrated its network. A later lawsuit alleged that compromised remote-access credentials used by the district's managed service provider enabled the intrusion and that attackers used legitimate administrative tools while inside the environment. The district's domain controllers were compromised, and it subsequently rebuilt servers, switches, domain controllers, firewalls, and backup infrastructure. No data theft, affected-person count, actor, motive, or service interruption was publicly reported.
Balochistan Police
February 27, 2024
•[ espionage, malware, government ]
Between February 27, 2024, and December 5, 2025, one or more unnamed suspected China-linked operators maintained PlugX, ShadowPad, and Cobalt Strike command-and-control activity involving Balochistan Police network appliances and web servers. In late 2024, an operator uploaded malicious cms_plugin.exe variants to the police Complaint Management System, including a Rust stager and a .NET implant that loaded AsyncRAT, creating a malware-delivery path to police and public users. SentinelLabs did not name the actor and warned that the shared or commodity tooling may represent more than one operator; no theft of the records stored on the affected systems was confirmed.
Seoul Facilities Corporation
June 28, 2024
•[ hack, leak, ddos ]
Two teenagers hacked servers supporting Seoul Facilities Corporation's Ttareungyi public bike-sharing service between June 28 and June 29, 2024 after identifying a web vulnerability that permitted access to member information without normal authentication. Approximately 4.62 million member records were stolen. During the June 28-30 incident, a DDoS attack also caused Ttareungyi-related pages to be unavailable for about 80 minutes. One suspect later told police that curiosity and a desire to show off motivated his actions; police also investigated whether the data may have been intended for sale but found no evidence that it was distributed to third parties.
Royal Thai Police
December 1, 2024
•[ espionage, malware, government ]
Yokai backdoor deployed via LNK / PDF decoy and DLL side-loading to infiltrate Thai police systems for espionage.
France Travail
January 12, 2025
•[ leak, government, phishing ]
France Travail and the Union nationale des missions locales stated that personal data for about 1.6 million young people supported by mission locales could have been exposed following an IT intrusion. The organizations said an agent account was compromised and the attacker created two new accounts that enabled consultation of files for supported youths (including users registered with France Travail or recommended training via the Ouiform tool). The joint statement listed the specific data fields potentially exposed and said that no passwords or bank details were extracted, while warning affected individuals to be vigilant for phishing and identity-theft attempts.
MassDevelopment
January 18, 2025
•[ ransomware, finance, government ]
MassDevelopment, the Massachusetts state development finance agency in Boston, was listed by the BianLian ransomware group on its leak site on Jan 18, 2025, which claimed theft of 4 TB of data. The agency has not publicly confirmed the claim.
Intesa Sanpaolo
February 17, 2025
•[ hack, ddos, finance ]
Pro-Russian hacktivist group NoName057(16) claimed a coordinated DDoS campaign against Italian institutions and banks, causing temporary service disruptions but no data compromise; politically motivated, with activity spanning several days.
Internal Revenue Service
February 25, 2025
•[ insider, leak, government ]
Insider contractor illicitly accessed and leaked confidential IRS taxpayer records (activity occurred 20182020; higher victim count publicized Feb 2025).
Undisclosed Ukrainian organization
April 2, 2025
•[ espionage, phishing, malware ]
On April 2, 2025, a phishing email sent from a compromised account induced a victim at an undisclosed Ukrainian organization to open a malicious Remote Desktop Protocol file and connect to actor-controlled infrastructure. Google Threat Intelligence Group observed Turla deploy the StockStay.MarketMaker downloader to the victim device, which retrieved the StockStay backdoor from compromised Ukrainian government infrastructure. The victim's identity and any acquired information were not disclosed.
Ministry of iTaukei Affairs
April 4, 2025
•[ hack, government, technology ]
The Ministry of iTaukei Affairs official Facebook page was hacked and defaced by unauthorized users posting content such as Hollywood movie clips. No sensitive or internal data was compromised; cybersecurity teams are working to restore control.
Bharat Sanchar Nigam Limited (BSNL)
April 23, 2025
•[ hack, ddos, technology ]
NSFOCUS identified DDoS traffic against Bharat Sanchar Nigam Limited websites on April 23, 25 and 26, 2025 using CLDAP, NetBIOS and NTP reflection. Its May 7 observations reported the corporate site and related online services still inaccessible. The duration of each traffic wave is documented, but continuous downtime and any effect on the wider telecom network are not established. The attacker is unidentified; Hacktivist and Protest are limited inferences from the India-Pakistan conflict-related campaign.
Power Grid Corporation of India Limited (POWERGRID)
May 2, 2025
•[ hack, ddos, energy ]
On May 2, 2025 NSFOCUS observed an NTP-reflection DDoS attack against POWERGRID public website lasting 31 minutes 26 seconds. Secondary cybersecurity reporting describes temporary website and online-service disruption, while NSFOCUS distinguishes possible online billing or fault-reporting effects from confirmed measurements. No disruption to the physical power grid was reported. No operator was identified; Hacktivist and Protest are inferred from the wider India-Pakistan cyber confrontation.
Office of the President of India
May 7, 2025
•[ ddos, government ]
NSFOCUS observed two consecutive DNS-reflection DDoS waves targeting presidentofindia.gov.in on May 7-8, 2025 during the India-Pakistan military escalation. The first lasted about 2 hours 16 minutes and the second about 19 hours 46 minutes using NSFOCUS GMT+8 reporting times. Media described Indian government portals becoming unavailable during the campaign, but did not independently quantify a continuous outage of this particular website. The operator remains unknown; Hacktivist and Protest are inferred from timing and target selection.
