Rama Judicial
November 27, 2025
•[ ransomware, government ]
Rama Judicial was listed as a victim on the leak site of the killsec ransomware group; the attack is estimated to have taken place on 2025-11-27. Sector: Government & Defense. Country: Colombia. Website: ramajudicial.gov.co. Price ??? Disclosures 0/1
Santa Paula
November 27, 2025
•[ ransomware, government ]
Santa Paula was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2025-11-27. Sector: Government & Defense. Country: United States of America. Website: www.spcity.org.
Williamson County, TX
November 28, 2025
•[ ransomware, government ]
Williamson County, TX was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2025-11-28. Sector: Government & Defense. Country: United States of America. Website: www.williamson-county.org.
8200 Unit corpses
November 29, 2025
•[ ransomware, government, technology ]
8200 Unit corpses was listed as a victim on the leak site of the handala ransomware group; the attack is estimated to have taken place on 2025-11-29. WANTED $10,000 REWARD Ron Weinberg Email: ron.wnbrg@gmail.com Phone: +972 53 279 0256 Ron Weinberg is currently under investigation. He is an experienced cyber security and network research specialist, formerly Head of Cyber Security and Network Research at the IDF 8200 Unit (Aham Shhakim). Weinberg possesses extensive knowledge in cyber security, network protocols, technological research,
Badan Pengelola Keuangan Haji
November 29, 2025
•[ ransomware, finance, government ]
Badan Pengelola Keuangan Haji was listed as a victim on the leak site of the blackshrantac ransomware group; the attack is estimated to have taken place on 2025-11-29. Sector: Financial Services. Country: Indonesia. Website: bpkh.go.id. [AI generated] "Badan Pengelola Keuangan Haji" (BPKH) is an agency overseen by the Indonesian Government. Located in Jakarta, its primary responsibility is to handle and manage the finances related to the Hajj pilgrimage for Indonesian Muslims. Recognized by Law No.34 of 2014, BPKH is accountable for optimizing funds, managing risks and making sure every Hajj participants financial demands are met.
Tasmanian Government (agencies including the Department for Education, Children and Young People and TasTAFE)
January 1, 2023
•[ hack, government, education ]
hacked third party service
United States Immigration and Customs Enforcement, United States Border Patrol
January 1, 2026
•[ leak, government ]
Whistleblowing
AfD
September 9, 2026
•[ hack, leak, government ]
In September 2026, the German political party Alternative fr Deutschland (AfD) suffered a data breach which exposed 345k unique email addresses. The following month, hundreds of gigabytes of data containing hundreds of thousands of emails and attachments was published online, with searchable AI-generated summaries and downloadable original files. An analysis of the incident reported that the breach was detected as early as 9 September, with a subsequent intrusion occurring five days later. In its public statement, AfD attributed the breach to an attack on a hosting provider, identified in subsequent reporting as the party-owned Alternita Dienstleistungs GmbH.
Assurance Retraite
September 1, 2024
•[ leak, government ]
In September 2024, the French national pension fund Assurance Retraite suffered a data breach affecting approximately 370k assistance beneficiaries. The data included 70k unique email addresses along with names, dates of birth, physical addresses, phone numbers, income levels, marital statuses, French social security numbers (NIR) and contact details of relatives or other nominated contacts. In its disclosure notice, Assurance Retraite attributed the breach to a compromised partner account.
Operation Endgame 4.0
June 18, 2026
•[ hack, malware, technology ]
On 18 June 2026, the latest phase of Operation Endgame targeted the SocGholish malware operation, a prolific malware distribution network used to compromise systems and facilitate further cybercrime. Coordinated by international law enforcement agencies with support from Europol and Eurojust, the operation remediated almost 15,000 compromised websites and disrupted more than 100 servers and domains used to distribute malware. Authorities initially provided HIBP with 154k impacted email addresses and more than half a million previously unseen passwords recovered during the operation. The following week, a further 4M email addresses and 9M passwords relating to the StealC malware operation targeted by Operation Endgame were provided to HIBP, bringing the total to almost 4.2M unique email addresses.
Operation Endgame 4.0
June 18, 2026
•[ malware, hack, technology ]
On 18 June 2026, the latest phase of Operation Endgame targeted the SocGholish malware operation, a prolific malware distribution network used to compromise systems and facilitate further cybercrime. Coordinated by international law enforcement agencies with support from Europol and Eurojust, the operation remediated almost 15,000 compromised websites and disrupted more than 100 servers and domains used to distribute malware. Authorities also provided HIBP with 154k impacted email addresses and more than half a million previously unseen passwords.
Chelan County Government
May 24, 2026
•[ malware, cyberattack, network shutdown ]
Chelan County, Washington reported that malware was detected on county government systems around 10 a.m. on May 24, 2026, affecting all county departments. As a precaution, the county voluntarily shut down network access, computers, and telephone systems across departments while IT staff worked with security partners to restore systems; 911 and emergency services remained available. Public reporting did not identify the threat actor, confirm ransomware, report data theft, or confirm whether any personal data was compromised.
Snake River Correctional Institution
July 7, 2025
•[ insider threat, unauthorized access, data breach ]
A former Snake River Correctional Institution Library Coordinator, Demetre Gennette, improperly acquired Oregon Department of Corrections records between July 7, 2025 and early January 2026. The extraction involved more than 7.5GB of data across more than 33,000 files and resulted in unauthorized access to personal information belonging to staff, vendors, adults in custody, and visitors. Gennette was later indicted on charges including computer crime, aggravated theft, official misconduct, supplying contraband, and custodial sexual misconduct.
Government of Guam
May 2, 2026
•[ zero-day vulnerability, cyber incident response, website disruption ]
The Government of Guam activated its cyber incident response on May 2, 2026 after hackers exploited a critical zero-day vulnerability affecting globally used cPanel-hosted websites. Multiple GovGuam websites were disrupted, prompting a government-wide assessment and response. Officials said emergency services remained unaffected; public reporting did not identify the actor, confirm data theft, or quantify the disruption duration.
Murray County Government
May 13, 2026
•[ cyberattack, government, service disruption ]
Murray County, Georgia reported that a cyberattack hit the county government network, forcing several county offices to limit services or close until network systems were restored. The Tax Commissioner, Tax Assessor, Probate Court, and Juvenile Court offices were closed, while other county offices remained open with limited functionality; 911, public safety, and primary voting continued. Public reporting did not identify a threat actor, confirm ransomware or encryption, specify the technical mechanism, report data theft, or provide a final restoration date.
170 Ukrainian prosecutors and investigators
March 1, 2026
•[ espionage, email compromise, state-sponsored ]
Russia-linked hackers compromised Ukrainian prosecutors and investigators email accounts as part of a broader email-espionage campaign involving at least 284 inboxes.
Police Nationale (France) training platform users
March 17, 2026
•[ data breach, hacking, government ]
01net reported that data relating to French police personnel was stolen after the e-campus training platform was hacked.
Nigeria's Corporate Affairs Commission (CAC)
April 15, 2026
•[ unauthorized access, data exfiltration, data breach ]
Nigerias Corporate Affairs Commission confirmed unauthorized access to limited aspects of its information systems; ByteToBreach claimed it exfiltrated about 25 million documents, roughly 750 GB, from CAC infrastructure, but CAC did not confirm the volume or identify the perpetrator.
City of Minot Water Treatment Plant
March 14, 2026
•[ ransomware, critical infrastructure, utilities ]
Minot, North Dakota officials confirmed a ransomware event impacted a server at the citys water treatment plant on March 14, 2026. The city said the water treatment plant and broader water system remained operational and safe, with no interruption to water service reported.
Cuban Embassy in Washington D.C.
January 1, 2026
•[ cyberespionage, data exfiltration, email breach ]
China-linked hackers exploited long-unpatched Microsoft Exchange vulnerabilities on the Cuban Embassy in Washington D.C.s email servers beginning in January 2026, accessing and exfiltrating the full inboxes of 68 diplomatic officials, including the ambassador and deputy chief of mission.
