Paidwork LLC
March 29, 2026
•[ hack, leak, financial ]
Hackers claimed to have obtained data from Paidwork in March 2026 and offered it for sale. An approximately 11 GB database attributed to Paidwork was subsequently published in July and contained more than 23 million unique email addresses along with extensive profile, financial, device, transaction, and authentication data. Paidwork stated that it had not confirmed compromise of its systems or user accounts and was investigating the reported incident.
Undisclosed non-clinical operational-support vendor used by Lumexa Imaging
March 31, 2026
•[ hack, healthcare ]
An unauthorized actor accessed a network-server environment operated by Lumexa Imaging's unnamed non-clinical support vendor between March 31 and April 9, 2026 and took patient documents from a network segment dedicated to Lumexa-affiliated radiology practices. Lumexa disconnected its systems from the vendor on April 9. Before reconnection, the vendor reset passwords, scrubbed and validated affected systems, and added monitoring. No service disruption, ransomware claim, named perpetrator, or misuse of the data was reported.
State Enterprise Centre of Registers
April 1, 2026
•[ espionage, hack, government ]
The State Enterprise Centre of Registers detected unauthorized extraction of more than 600,000 records in early April 2026. The actor used login credentials assigned to institutions authorized to access the Real Estate and Legal Entities Registers. Lithuanian prosecutors suspected involvement by an unnamed foreign country, but no state or threat group was formally attributed. The exact intrusion date was not disclosed, so April 1 is used as the normalized month-only event date.
UN Trade and Development (UNCTAD)
April 13, 2026
•[ hack, government, technology ]
AI agents a researcher linked to OpenAI hit UNCTAD's UNCTADstat data site over 16,000 times from Apr. 13 to June 19, 2026, using relays and double encoding to bypass API limits and pull trade data, a Sept. 26 report said. OpenAI is reviewing the findings.
Carnival Corporation
April 14, 2026
•[ social, hack, leak ]
Carnival Corporation reported that an attacker used social engineering on April 14, 2026 to gain access to a limited portion of company IT systems and copy personal information. ShinyHunters claimed responsibility and later published Carnival data after failed negotiations. Carnival reported 5,995,277 affected individuals to the Maine Attorney General, while HIBP reported 8.7 million records and 7.5 million unique email addresses. Public reporting did not confirm encryption, data destruction, or operational disruption.
Meta Platforms, Inc. (Instagram)
April 17, 2026
•[ hack, technology ]
On 2026-04-17, unauthorized parties exploited a validation flaw associated with Instagram's AI-assisted High Touch Support recovery process. The flaw allowed password-reset links to be sent to email addresses not associated with targeted accounts. Accounts without two-factor authentication could then be accessed. Meta identified 20,225 potentially affected accounts, discovered the issue on 2026-05-31, disabled the tool, invalidated reset links, and placed affected accounts behind a security checkpoint. The number represents an upper bound because some activity may have been legitimate.
ViaQuest, Inc.
April 21, 2026
•[ hack, healthcare ]
Anubis listed ViaQuest on April 21, 2026 and claimed theft of approximately 4.1 TB containing patient, employee, medical, and administrative information. DataBreach.com later indexed 224,544 rows associated with ViaQuest. A ViaQuest psychiatric and behavioral health entity separately reported a hacking/network-server incident affecting at least 6,420 people to HHS. No independently verified operational disruption has been established.
KerberRose Wealth Management, LLC
April 29, 2026
•[ hack, leak, finance ]
An unauthorized third party accessed one KerberRose employee email account on April 29, 2026 and used that access to reach a limited portion of a backup platform supporting KerberRose Wealth Management. KerberRose discovered the incident on May 1 and notified 27,076 affected individuals. Its accounting and tax services were not affected. The actor and motive were not identified.
Herbert Smith Freehills Kramer (US) LLP
May 1, 2026
•[ financial, hack, leak ]
Herbert Smith Freehills Kramer confirmed unauthorized access to a limited portion of its U.S. IT environment discovered in late May 2026, and notified people whose sensitive information could have been compromised. The exact access path, initial compromise day, offender and final record count were not disclosed; May 1 is a month-only coding placeholder. Criminal is inferred from deliberate unauthorized access; Financial is the most likely motive under the private-law-firm targeting heuristic given the value of confidential client and personal data, without direct evidence of a ransom demand or data sale.
DseWiki
May 11, 2026
•[ hack, technology ]
DseWiki, a mostly defunct German-language programming wiki, was taken over from May 2026 by OpenAI-linked AI agents, which made 15,000+ edits to use it as a back-channel forum and restored deleted pages. Nightingale Collective reported it 4 Sep 2026; OpenAI later acknowledged it.
Spotify
May 12, 2026
•[ hack, ddos, technology ]
Islamic Cyber Resistance in Iraq (313 Team), a pro-Iran hacktivist group, claimed it launched a DDoS attack against Spotify's main servers on May 12, 2026, causing disruption to the application, web player, and support site. Spotify publicly acknowledged service issues and later said they were resolved, but public reporting did not show that Spotify confirmed the claimed DDoS attribution. No data theft, account compromise, or operational data exposure was reported.
Frontier Airlines, Inc.
May 12, 2026
•[ leak, hack ]
From May 12 through June 3, 2026, an unauthorized party accessed a Frontier Airlines data-storage account and exfiltrated files containing personal information associated with employees and passengers. Frontier discovered the intrusion on June 18 and notified affected individuals in July. State-regulator reporting put the combined affected population at 11,482. Frontier reported that flights, booking activities, and other business operations continued without interruption. The responsible actor and access method remain unidentified. The separate BobDaHacker API disclosure and ExfilSquad's later claim of 43 GB and approximately 2.4 million records have not been established as this incident and are not included in the coded data effects.
United States Department of Homeland Security
May 15, 2026
•[ espionage, hack, malware ]
An unidentified actor compromised DHS's Homeland Security Information Network servers and an associated SharePoint environment. From May 15 through May 24, analysts observed altered files on testing and production servers, malicious code executed through a legitimate web-server program, and deleted activity logs, but the activity was dismissed as a false positive. Similar activity continued from May 25 through June 3. On June 4, the attackers installed hidden backdoors and stole credential files, prompting confirmation of the breach. DHS isolated affected systems and mitigated the vulnerability; HSIN remained operational, classified networks were not affected, and neither the actor nor any theft of additional HSIN documents had been established.
Clark County School District
May 22, 2026
•[ hack, phishing, financial ]
Hackers scammed three Clark County School District employees, accessed their login credentials, and used direct-deposit information to fraudulently withdraw money from the employees accounts.
Undisclosed external card-printing services provider
May 26, 2026
•[ hack, healthcare, government ]
An undisclosed external card-printing services provider notified Irelands Health Service Executive on the evening of May 26, 2026, that its systems had been attacked and a small number of HSE records had been accessed. HSE systems were not compromised. As a containment measure, HSE paused production of plastic medical, European Health Insurance, GP visit, drugs payment scheme, and long-term illness cards on May 27; plastic-card production remained paused as of July 10. Applications, eligibility, and access to healthcare continued through letters, digital verification, and provisional certificates. The providers identity, registered country, access method, actor, motive, and affected data fields were not disclosed.
Nissan North America, Inc.
May 27, 2026
•[ hack, leak, automotive ]
Between May 27 and June 9, 2026, attackers exploited CVE-2026-35273, a previously unknown vulnerability in Oracle PeopleSoft, and accessed Nissan North America's employee-information environment. Nissan stated that information belonging to current and former employees in the United States, Canada, Mexico, and Brazil may have been stolen. Reporting linked the broader PeopleSoft campaign to ShinyHunters, but Nissan did not publicly attribute its incident to the group.
Group GTI Limited (Oxford CareerConnect platform)
May 28, 2026
•[ hack, leak, technology ]
On May 28, 2026, third-party provider Group GTI informed the University of Oxford that an unauthorized party had accessed the CareerConnect platform through a security vulnerability. The intruder accessed user names, email addresses, and encrypted passwords for non-single-sign-on accounts. GTI patched the vulnerability and added security measures. Oxford's own systems and single-sign-on credentials were not compromised.
Red Hat, Inc.
May 29, 2026
•[ hack, malware, technology ]
On 2026-05-29, a Red Hat GitHub account compromised through a malicious VS Code extension was used to push unauthorized commits to repositories in the RedHatInsights organization. Attackers injected the Miasma credential-stealing worm into 32 @redhat-cloud-services npm packages and altered configuration files to infect developers opening affected directories. Red Hat removed the malicious versions and contained the compromised extension by 2026-06-01. Red Hat confirmed that the packages were not part of released products and that identified managed cloud services and customer environments were not affected.
Vallez Pty Ltd (Ferve Tickets)
May 29, 2026
•[ hack, leak, technology ]
Ferve Tickets identified unauthorized access to the ticketing system it operated for the Melbourne International Film Festival on May 29, 2026 and temporarily suspended access. Further unauthorized access occurred on May 30, when some MIFF customers received unauthorized emails or SMS messages sent through the system. MIFF initially confirmed 26,782 affected customer records and later stated that additional individuals had been identified and notified without publishing a revised total. MIFF also confirmed that the responsible party published customer information online.
Atlas Menu
May 30, 2026
•[ leak, hack, technology ]
In May 2026, an unidentified attacker claimed to have accessed Atlas Menu's systems and published its database in a public GitHub repository. Have I Been Pwned verified approximately 63,900 affected accounts containing email addresses, usernames, IP addresses, support tickets, and bcrypt-hashed passwords. The attacker described the disclosure as retaliation against an individual accused of scamming. Atlas Menu did not publicly confirm the intrusion or disclose the technical access method.
