Dell
July 21, 2025
•[ hack, technology ]
Dell claims a demo/test environment at its Customer Solution Centers was breached by the World Leaks extortion group. Stolen data appears largely synthetic with no customer impact reported.
Colorado Health Network Inc.
July 29, 2025
•[ hack, leak, healthcare ]
Colorado Health Network determined that an unauthorized individual viewed and obtained files from its network in an incident dated 2025-07-29. The organization began notifying affected individuals on 2026-06-18 and reported 68,212 affected people. Cephalus claimed responsibility and alleged that it stole more than 900 GB of data, but Colorado Health Network did not publicly confirm the actor or the claimed volume. The initial access method and any operational disruption were not disclosed.
Uganda Electricity Transmission Company Limited (UETCL)
August 1, 2025
•[ ransomware, energy, hack ]
In August 2025, Uganda Electricity Transmission Company Limited experienced a suspected ransomware incident that compromised monitoring systems for the national electricity transmission network; the service was restored through backup procedures, according to INTERPOL reporting cited in August 2026. Qilin claimed to have breached the utility on August 18, 2025 and to possess contracts, financial statements, identity documents and service agreements, but independent verification of those stolen files, encryption and the precise disruption date is unavailable. No confirmed manipulation of physical grid controls or nationwide blackout was established.
Bandai Namco Filmworks
November 4, 2025
•[ hack, leak, technology ]
Between 5:00 and 8:45 p.m. on November 4, 2025, an unnamed 15-year-old student sent false account-cancellation requests to Bandai Channel after identifying a server vulnerability and used ChatGPT to refine and automate his code. He changed his IP address about 30 times after being blocked, caused 46,812 accounts to be deregistered, and prompted a service suspension from November 6 to December 19. Bandai Namco Filmworks later said personal information from up to 1.366 million accounts may have been exposed, but confirmed no online publication or secondary misuse.
Greenbaum, Rowe, Smith & Davis LLP
November 25, 2025
•[ hack, brute-force, healthcare ]
An unauthorized party used compromised login credentials to access Greenbaum, Rowe, Smith & Davis LLP's network server between November 25 and November 27, 2025. The firm discovered the intrusion on November 27 and determined on April 15, 2026 that files containing patient information from healthcare clients had been acquired. Greenbaum reset passwords, replaced compromised equipment, notified law enforcement, and offered identity-monitoring services. No operational disruption was reported, no group claimed the attack, and no stolen data was found published or misused. Criminal and Financial are bounded inferences from credential-based theft of identity and health data; the actor and country remain undetermined.
Upbit
November 27, 2025
•[ financial, hack, finance ]
Unauthorized exploitation of Upbits Solana hot wallet enabled attackers to initiate a sequence of unauthorized withdrawals totaling roughly $38 million USD over a 54-minute window (04:4205:36 KST). No user data loss or service outage was reported, and Upbit moved remaining assets to cold storage and pledged full customer reimbursement.
IMA Diligence Services, LLC
December 8, 2025
•[ hack, leak, healthcare ]
An unauthorized actor accessed a legacy file server managed by a third party between December 8 and December 16, 2025 and exfiltrated files containing personal, financial, and medical information. IMA Diligence Services reported 525,306 affected individuals. Genesis later claimed responsibility and alleged theft of approximately 700 GB, but the company did not publicly confirm the actor's attribution or claimed volume.
Educational Employees Credit Union
December 15, 2025
•[ hack, finance ]
On December 15, 2025, an unauthorized individual gained access to one Educational Employees Credit Union employee email account for a limited period and may have accessed or removed messages. EECU determined on May 8, 2026, that some emails contained personal and financial information, began notifying affected individuals on May 29, and reported no evidence that the information had been used for financial fraud or identity theft.
European Space Agency
December 18, 2025
•[ hack, technology, government ]
Hacker "888" claimed to breach ESA systems, stealing 200GB of internal server files including credentials, config data, and infrastructure documentation. ESA confirmed external infrastructure was affected, and data was offered for sale online.
Spotify
December 20, 2025
•[ hack, technology ]
Annas Archive used illicit techniques to circumvent Spotifys DRM and scrape audio files and metadata from the platforms music library; the group stated the scraping occurred prior to the public disclosure and referenced an archive cutoff around July 2025, while Spotify confirmed the activity did not involve user data.
Grubhub
January 15, 2026
•[ hack, technology, retail ]
Grubhub confirmed that unauthorized actors accessed parts of its internal systems and downloaded data, and sources reported the company faced extortion demands. Reporting linked the incident to a broader Salesforce-related campaign associated with ShinyHunters, including threats to leak data connected to Salesforce and Zendesk tooling used for customer support. Grubhub stated that sensitive information such as customer financial details and order history were not affected, but it did not publicly specify exactly which data fields were taken, how many individuals were impacted, or the precise intrusion window, while it worked with external security experts and law enforcement.
Penobscot Valley Hospital
January 28, 2026
•[ hack, healthcare ]
Penobscot Valley Hospital detected suspicious network activity on January 28, 2026, secured its systems, engaged forensic specialists, and notified law enforcement. The investigation determined on February 12 that an unauthorized individual may have accessed files and folders on the hospital network and concluded on June 4 that affected files contained personal and protected health information belonging to patients and employees. A federal healthcare-breach record reports 33,107 affected individuals, but the patient-employee split was not disclosed. Notifications began in July. No operational disruption or responsible group was reported.
Undisclosed People Playground user
February 1, 2026
•[ hack, leak, technology ]
A malicious mod overwrote users' Workshop uploads, deleted saved creations and reset settings and achievements. This represents an unnamed affected user in the February incident, separate from September. February 1 is the earliest-warning fallback, not a verified infection date. Sabotage is inferred from deliberate deletion and alteration; actor type and operator identity are unestablished.
Undisclosed Latvian company
February 1, 2026
•[ ransomware, hack, technology ]
An unnamed Latvian company was hacked in Feb. 2026 when an attacker exploited a website vulnerability, exported personal data from its database and demanded payment not to leak it. Latvian police linked the case to the TSC breach and arrested a 23-year-old suspect on Sept. 15.
Peachtree Group
February 19, 2026
•[ hack, leak, finance ]
PayoutsKing claimed it exfiltrated approximately 698 GB of data from Peachtree Group in an intrusion dated February 19, 2026 and publicly listed the company on April 30. DataBreach.com later indexed 299,873 rows. Litigation filed after the incident alleges that personally identifiable information belonging to current and former employees was accessed. A separate July 2026 claim by The Gentlemen appears to concern a later incident and is not merged into this record.
Ameriprise Financial
March 2, 2026
•[ hack, finance, technology ]
Ameriprise Financial disclosed unauthorized access to certain stored data and files in an incident dating back to March 2, 2026, which it detected and blocked on March 18. Ameriprise said there was no disruption to business operations and no indication of unauthorized transactions or fund movement. ShinyHunters claimed responsibility and allegedly threatened to release Salesforce customer records and more than 200 GB of compressed SharePoint internal data, but the full attacker claim was not confirmed by Ameriprise.
Speed Group
March 19, 2026
•[ ransomware, manufacturing, hack ]
Forensic investigators found that unauthorized operators transferred files from a Speed Group server by March 19, 2026, then moved through the multinational manufacturers network using privileged credentials. On March 29 at about 19:59 the operators deployed ransomware that encrypted corporate servers and backups in France and the United States and a network storage device at the Chilean subsidiary in Quilicura. The company estimated that approximately 5% of its data was permanently lost. BlackNevas/Trial Recovery was attributed through forensic indicators and ransom notes and claimed theft of more than 1 TB, but that volume is unverified. The Chilean subsidiary filed a criminal complaint.
Axcera LLC
March 22, 2026
•[ hack, leak, technology ]
LAPSUS$ claimed on March 22, 2026 that it had stolen approximately 13 GB from Axcera, including source code, cloud configurations, credentials, API keys, and MongoDB database dumps. DataBreach.com later indexed 11,977 rows containing email addresses. Axcera did not publicly confirm the actor's full claim, and no operational disruption was reported.
Ernst & Young LLP
March 28, 2026
•[ hack, technology, finance ]
An unauthorized party accessed a third-party IT service-management platform used for EY tax work from March 28 through April 12 and downloaded client documents. ShinyHunters later claimed responsibility, but EY has not confirmed that attribution or the group's separate claims of Jira, GitHub, and Azure access; no operational disruption or public confirmation of the threatened leak was reported.
ZEGO Textilveredelungszentrum GmbH
March 29, 2026
•[ hack, manufacturing ]
On March 29, 2026, a cyberattack caused a complete production outage at ZEGO Textilveredelungszentrum for nearly six weeks. ZEGO said the resulting economic burden could not be fully offset and made an insolvency filing necessary. The filing did not end the business: the provisional insolvency administrator authorized continued operations, and ZEGO continued accepting and fulfilling orders while pursuing restructuring. No public source identifies the perpetrator or confirms ransomware, extortion, or data theft; the Criminal and Financial classifications are limited contextual inferences rather than confirmed attribution.
