Picsart
August 4, 2026
•[ hack, technology ]
ChainDrop harvested publishing credentials associated with Picsart and used them to publish malicious versions of two npm packages during the automated propagation wave on 4 August 2026. Malicious publication activity began at approximately 10:37 UTC.
Qlik Technologies Inc.
August 4, 2026
•[ hack, malware, technology ]
ChainDrop harvested Qlik-associated publishing credentials and used them to publish malicious releases across at least 28 @qlik and 22 @nebula.js package names on 4 August 2026. Additional Qlik-associated unscoped packages were reported but are not included in the minimum scope count.
ServiceTitan Inc.
August 4, 2026
•[ hack, malware, technology ]
ChainDrop harvested publishing credentials associated with ServiceTitan and used them to publish malicious releases across 141 @servicetitan package names during the automated propagation wave on 4 August 2026.
HubSync
August 4, 2026
•[ hack, technology, malware ]
ChainDrop harvested publishing credentials associated with HubSync and used them to poison the @hubsync/web-sdk-react package during the automated propagation wave on 4 August 2026. Malicious publication activity began at approximately 10:12 UTC.
North Carolina State Ports Authority
August 4, 2026
•[ hack, technology, government ]
North Carolina Ports detected a cyberattack late on August 4, 2026. Affected IT systems forced manual processing and delayed gate openings at three facilities. Normal gate schedules resumed August 6 while manual processing continued. August 4 is the reported disruption and detection date; initial access is unknown. The authority did not disclose the technical mechanism, attacker, ransom demand, encryption or data theft.
Dropbox
August 4, 2026
•[ hack, technology, misconfiguration ]
San Francisco cloud storage firm Dropbox said ~5,000 user accounts were accessed without authorization from 4 to 21 Aug 2026 via a flaw in a legacy Lenovo ID login integration; files were viewed or downloaded in under a third. It cut Lenovo ID sessions and notified regulators.
Zenith Bank Plc
August 5, 2026
•[ hack, finance ]
Zenith Bank disclosed unauthorized access to limited customer information, including email addresses and phone numbers, as part of what it described as a broader global cyberattack affecting organizations across multiple sectors. The bank activated its incident-response procedures and said its banking systems, digital channels, customer funds, credentials, and financial information remained secure and operational.
Lego Certified Stores South Africa
August 5, 2026
•[ hack, leak, retail ]
An unauthorized third party exploited a previously unknown Metabase vulnerability on August 5, 2026 and accessed Lego Certified Stores South Africa customer data held in a Metabase reporting tool used internally by loyalty provider Marsello. No payment card information or account passwords were involved.
VL Prosperity
August 7, 2026
•[ hack, espionage, manufacturing ]
Sources told ABC News that VL Prosperity was hacked while transiting the Strait of Gibraltar and lost communications for more than 30 hours. The Coast Guard and FBI later said foreign cyber actors had compromised the vessel's network and boarded the ship on 21 August to investigate and mitigate the threat. Subsequent reporting citing unnamed U.S. officials said investigators found temporary access to a propulsion-linked digital system, but the vessel manager later said Coast Guard, classification-society and internal IT reviews found no evidence the propulsion system was compromised. The initial access vector and perpetrator remain unknown; the 7 August date comes from contemporaneous reporting and has not been publicly confirmed by U.S. authorities.
Norsk Tipping AS
August 7, 2026
•[ ddos, hack, technology ]
Norsk Tipping confirmed a new DDoS attack between 20:53 and 21:08 on August 7 that made its services inaccessible to some customers. The company said operations had returned to normal and that it did not know who was responsible. The attack followed restored service after August 4, so it is a distinct disruptive event. No data theft or ransom demand was reported; Sabotage is a contextual inference based on the targeted service interference.
Nasha Niva (Наша Ніва)
August 8, 2026
•[ ddos, hack, technology ]
On August 8, 2026, Nasha Niva reported that a DDoS attack against its website began at approximately 10:00 a.m. and was still in progress at its 11:24 a.m. report. The incident coincided with the New Belarus conference in Warsaw and the anniversary of Belarus's disputed 2020 election. Other exiled Belarusian outlets also reported DDoS activity. A hacktivist operator is inferred from the political timing and targeting, but neither the attacker nor a government connection was verified.
Zerkalo (Зеркало / Zerkalo.io)
August 8, 2026
•[ ddos, hack, technology ]
Zerkalo reported that its website worked intermittently on the morning of August 8, 2026, during DDoS attacks also reported by Nasha Niva, Pozirk and Reform.news. Zerkalo published its account at 12:05 p.m., but did not give a precise start or restoration time. The campaign coincided with the opening of the New Belarus conference in Warsaw; no operator or government sponsor was identified. Hacktivist is an inference from political timing and target selection.
Primorske novice
August 8, 2026
•[ ddos, hack ]
Primorske novice reported coordinated, multiwave traffic-flooding attacks against its news website beginning on August 8. Some readers could not load pages and online editorial production was affected. The publisher said traffic filtering restored normal service by August 10 and found no intrusion or theft of newsroom or subscriber data. A concurrent attack also affected Necenzurirano. Sabotage is inferred from the effect on news distribution and the outlets' public-information role; the operator and political motive remain unverified.
Necenzurirano.si
August 8, 2026
•[ hack, ddos, technology ]
Necenzurirano.si documented a DDoS campaign beginning August 8 at about 18:30, with successive waves through August 12. Its readers encountered blocked access and HTTP 503 errors. The publisher identified malicious traffic from compromised devices in approximately 40 countries and concluded that the apparent objective was to interfere with publication and readership; it could not identify the person who ordered the attack. Sabotage is a target-and-effect inference, not proof of the sponsor's identity, and no data theft was established.
Zakład Ubezpieczeń Społecznych (ZUS)
August 10, 2026
•[ hack, ddos, government ]
On August 10, 2026, a volumetric DDoS attack overwhelmed Poland's Social Insurance Institution web services, disrupting the website, mobile app and PUE/eZUS portal. Polish reporting places service problems shortly after 09:00, with restoration around 13:00. ZUS confirmed customers' personal information remained safe. No actor claimed the attack and no financial demand was reported. Sabotage is inferred from the targeting of public benefits-service availability, not from verified political sponsorship.
Sogang University
August 11, 2026
•[ hack, brute-force, education ]
An unidentified external attacker accessed Sogang University's integrated login system from an unauthorized overseas IP address on August 11, 2026 using brute-force activity. The university detected the incident on August 14 and confirmed that approximately 180,000 records relating to students, alumni, former students, staff, and other account holders were leaked.
Santé publique France
August 13, 2026
•[ hack, leak, government ]
French public health agency Sant publique France said a cyberattack on its brochure-ordering site moncoupon.santepubliquefrance.fr, run by an outside provider, exposed contact data of about 80,000 users. The site went into maintenance, passwords were deleted and CNIL notified.
ShipMonk
August 14, 2026
•[ sqlinjection, retail, technology ]
An unauthorized actor exploited the Metabase CVE-2026-72898 SQL injection vulnerability affecting ShipMonk's analytics environment and accessed customer order data. Metabase notified ShipMonk by August 6, 2026, but the exact ShipMonk exploitation date has not been publicly established. Trezor initially reported 13,689 affected customers and later disclosed approximately 67,000 additional U.S. customers whose older records had not been deleted, bringing the total to about 81,000. Trezor systems, wallet devices, private keys, and recovery seeds were not compromised. ShipMonk received extortion emails from ShinyHunters, but public reporting has not conclusively attributed the intrusion to that group.
National Grid plc
August 15, 2026
•[ hack, leak, energy ]
A hacker published an approximately 40GB archive of National Grid technical material on a cybercrime forum. National Grid acknowledged a data compromise associated with a software supply chain attack earlier in 2026 but said it found no current evidence of impact to operations, internal systems, or customer or employee information. The precise compromised third party and acquisition method were not identified.
University of Texas at San Antonio
August 15, 2026
•[ hack, education ]
UT San Antonio detected unauthorized activity against university technology systems at the edge of its academic-campus network during the weekend of August 15-16, 2026. The university contained the activity before it reached core systems and found no evidence that university data was accessed or exfiltrated. UTSA proactively took systems and services offline, disrupting phones, email, connectivity and other technology-dependent services and delaying the start of fall classes until August 24.
