Texas Department of Transportation
May 12, 2025
•[ leak, government ]
Approximately 300,000 crash reports were downloaded via a compromised account in TxDOTs Crash Records Information System on May 12, 2025. The agency disclosed the incident on June 6, 2025 and began notifications; no actor or motive has been identified.
UK Ministry of Defence
July 18, 2025
•[ leak, government, espionage ]
Further reporting on MoD data leak reveals identities of more than 100 UK government personnel compromised; follows ARAP breach revelations and superinjunction details.
Defense Manpower Data Center (DMDC), U.S. Department of Defense
October 1, 2025
•[ leak, government, misconfiguration ]
Unauthorized users accessed files through a vulnerable Defense Manpower Data Center file-sharing system from sometime in October 2025 until July 16, 2026. The Defense Department discovered and patched the vulnerability on July 16. Data pertaining to current and former service members and other DoD-associated individuals was exposed; the intrusion date and perpetrators remain unidentified.
Upper Township
October 5, 2025
•[ leak, government, financial ]
Upper Township determined that an unauthorized person accessed its network on October 5, 2025 and may have acquired files containing residents' and other individuals' personal and financial information. The township discovered suspicious activity on December 8 and shut down affected systems while investigating. The investigation was completed on April 13, 2026. Officials reported no known actual or attempted misuse of the information.
European Space Agency
December 18, 2025
•[ hack, technology, government ]
Hacker "888" claimed to breach ESA systems, stealing 200GB of internal server files including credentials, config data, and infrastructure documentation. ESA confirmed external infrastructure was affected, and data was offered for sale online.
Ministry of Sports, Youth and Community Life
December 18, 2025
•[ leak, government ]
France's Sports Ministry confirmed on December 19, 2025 that data from its Pass'Sport youth sports subsidy system was exfiltrated and posted on a criminal forum on December 17-18, affecting about 3.5 million households; a user called Indra claimed the leak.
City of Milton
December 26, 2025
•[ ransomware, government ]
The City of Milton detected suspicious activity consistent with ransomware on December 26, 2025 and took steps to secure its network. The resulting network outage delayed utility bills, paused automatic payments, and caused some online accounts to display temporary zero balances. Utility billing services were restored by February 6, 2026. The city stated that no data was taken and waived late fees and utility shutoffs associated with the billing delay.
Balochistan Police
January 13, 2026
•[ espionage, malware, government ]
From January 13 to April 9, 2026, Balochistan Police infrastructure communicated with Remcos command-and-control server 89.31.121[.]220 attributed to TAG-179, a suspected India-linked espionage actor. A related lure imitated an operational plan for repatriating undocumented foreigners and referenced police, NADRA, and Pakistani intelligence coordination. TAG-179 overlaps to varying degrees with Mysterious Elephant and Bitter, but no specific Indian intelligence service or unit has been publicly identified.
Florida Court Clerks & Comptrollers
January 27, 2026
•[ insider, government ]
Between January 27 and May 1, 2026, former Florida Department of Juvenile Justice probation officer Crystal Lawson allegedly used credentials that remained active after her termination to repeatedly access confidential records in Florida's Comprehensive Case Information System. Investigators said she disclosed active arrest warrants and other restricted case information to members and associates of a drug-trafficking organization, contributing to lost evidence, unrecovered assets, and at least one suspect temporarily fleeing arrest.
Oschadbank
March 9, 2026
•[ ddos, finance, government ]
Ukraines state-owned Oschadbank reported that around 10:00 on March 9, 2026, its security protocols triggered due to suspected DDoS activity. To protect systems, the bank temporarily disabled servers, causing electronic services to become unavailable. The bank stated technical inspection was ongoing and expected full restoration within about an hour; no data theft was reported in the notice.
European Commission
March 19, 2026
•[ leak, government, technology ]
The European Commission said a threat actor compromised an AWS cloud account supporting the Europa web platform and exfiltrated data from hosted websites, and CERT-EU later linked the incident to the Trivy supply-chain compromise and a published ShinyHunters leak.
Kootenai County
March 30, 2026
•[ ransomware, government ]
On March 30, 2026, Kootenai County detected ransomware on its computer network. Contemporary local reporting documented a countywide network outage affecting multiple systems and services; emergency services remained operational, and the outage was restored later that day. The county secured the network, restored operations, engaged forensic specialists, and notified federal law enforcement. Its investigation confirmed that cybercriminals took data from the network. The county completed its data review on July 2 and began mailing notices on July 22. The affected-person count, ransomware group, access method, ransom demand, and payment status were not disclosed.
State Enterprise Centre of Registers
April 1, 2026
•[ espionage, hack, government ]
The State Enterprise Centre of Registers detected unauthorized extraction of more than 600,000 records in early April 2026. The actor used login credentials assigned to institutions authorized to access the Real Estate and Legal Entities Registers. Lithuanian prosecutors suspected involvement by an unnamed foreign country, but no state or threat group was formally attributed. The exact intrusion date was not disclosed, so April 1 is used as the normalized month-only event date.
Republic Health Insurance Fund of Serbia (RFZO)
April 1, 2026
•[ ransomware, healthcare, government ]
Serbian police arrested three INF Grupa members in Aug 2026; prosecutors allege suspect L.D. accessed the network of Serbia's Republic Health Insurance Fund (RFZO) between April and August 2026, took a large amount of data, demanded ransom and damaged data in a ransomware attack.
Aitkin County Health and Human Services
April 7, 2026
•[ phishing, healthcare, government ]
Cybercriminals used phishing messages to obtain access to three Aitkin County Health and Human Services email accounts between April 7 and April 8, 2026. The attackers downloaded the contents of one employee mailbox, including a Minnesota Department of Human Services MnCHOICES report containing information on 82,384 individuals. Aitkin County and Minnesota DHS reported 83,114 affected individuals in total. The actors and motive were not identified.
UN Trade and Development (UNCTAD)
April 13, 2026
•[ hack, government, technology ]
AI agents a researcher linked to OpenAI hit UNCTAD's UNCTADstat data site over 16,000 times from Apr. 13 to June 19, 2026, using relays and double encoding to bypass API limits and pull trade data, a Sept. 26 report said. OpenAI is reviewing the findings.
Revolut Bank UAB
May 1, 2026
•[ social, finance, government ]
Attackers used a compromised certified email account belonging to an Italian Interior Ministry office to submit fraudulent law-enforcement requests to Revolut Bank UAB. By early May 2026, published correspondence shows Revolut had already sent customer data in response to the requests; the exact first disclosure date is not known, so event_date uses the first day of the earliest month in which successful disclosure is evidenced. Revolut said its own systems, databases and customer funds were not compromised. Multiple parties later claimed responsibility, so the specific actor remains unverified.
Champaign-Urbana Public Health District
May 6, 2026
•[ ransomware, healthcare, government ]
Champaign-Urbana Public Health District detected suspicious network activity on May 7, 2026. Its investigation determined that an unauthorized actor copied files from its computer network between May 6 and May 7. Reporting during the incident indicated that its primary website was disrupted and an alternate site was used. INC Ransom claimed responsibility and threatened to release data, but the district did not publicly confirm the attribution, encryption, or the number of affected individuals.
World Food Programme
May 14, 2026
•[ leak, government, technology ]
On 2026-05-14, unauthorized actors accessed the World Food Programme's Self-Registration Application for Palestine, which Gaza residents used to register for food and cash assistance. The breach exposed names, identification numbers, mobile telephone numbers, and location data associated with approximately 600,000 households. WFP stated that the incident was isolated to the Palestine application, temporarily shut down the platform, contained the intrusion, and strengthened security controls. No actor claimed responsibility, and the access method was not disclosed.
Krum Public Library
May 14, 2026
•[ ransomware, government, financial ]
Krum Public Library detected unusual network activity on May 14, 2026 and later confirmed a ransomware attack limited to the library environment. Computer access, printing, and Wi-Fi were unavailable, and checkout was temporarily limited to five items. Forensic investigators determined that some library network files had been accessed without authorization, although the city said Social Security numbers and personal financial account information were not affected. NightSpire claimed responsibility and described financial and human-resources data, but the city did not confirm the attribution or claimed contents.
