Cardinal Services, Inc.
August 8, 2025
•[ hacking, unauthorized access, data leak ]
Cardinal Services, Inc., Cardinal Employer Organization, and Preferred Employer Solutions reported an external system breach involving unauthorized access to systems during two periods, June 25-26, 2025 and August 8, 2025. The organization discovered the breach on May 12, 2026 and reported it to the Maine Attorney General on May 20, 2026. Public reporting described the incident as hacking affecting 142,323 individuals.
South Alabama Regional Planning Commission
August 6, 2025
•[ hacking, unauthorized access, protected health information ]
South Alabama Regional Planning Commission reported a hacking/IT incident involving unauthorized access to protected health information. Public reporting states that the substitute breach notice did not identify when access was detected or when unauthorized access occurred, but the investigation determined on August 6, 2025 that certain files had been copied from its systems. The incident affected 3,043 individuals.
Police Nationale (France) training platform users
March 17, 2026
•[ data breach, hacking, government ]
01net reported that data relating to French police personnel was stolen after the e-campus training platform was hacked.
Boston Mountain Rural Health Center
February 27, 2026
•[ hacking, IT incident, network server ]
Boston Mountain Rural Health Center reported a hacking/IT incident involving a network server on February 27, 2026, affecting 4,800 individuals and potentially exposing sensitive personal health information; specific exposed data fields were not publicly reported.
Duo Info
January 1, 2025
•[ hacking, matchmaking service, personal information ]
A Duo employee's work computer was hacked in January 2025, compromising personal information of 427,464 matchmaking service clients, including identifiers, contact details, and detailed personal profile information.
Finance, Planning and Economic Development Ministry
January 1, 2026
•[ hacking, financial fraud, payment diversion ]
In January 2026, hackers targeted Sri Lanka's Finance, Planning and Economic Development Ministry and diverted $2.5 million from a payment intended for Australia; officials later disclosed another missing payment while investigations continued.
Marcus & Millichap
April 12, 2026
•[ hacking, extortion, data leak ]
In April 2026, the commercial real estate brokerage firm Marcus & Millichap was named as one of multiple alleged victims of the ShinyHunters hacking and extortion group. Data alleged to have been obtained from the company was subsequently released publicly and included 1.8M unique email addresses, along with names, phone numbers and employment-related information including employer, job title and physical company address. In their disclosure notice, Marcus & Millichap advised that data which may have been accessed appeared limited to "company forms, templates, marketing materials, and general contact information".
KiranaPro
June 3, 2025
•[ hacking, server deletion, data wipe ]
TechCrunch reported Indian grocery delivery startup KiranaPro was hacked and its servers were deleted, with the founder confirming the companys data had been wiped. The report described the incident as catastrophic to operations (platform disruption) but did not confirm in that initial story whether customer data was accessed or exfiltrated, focusing on the destructive effect of wiping infrastructure and data.
Tehran traffic cameras
March 3, 2026
•[ hacking, surveillance, espionage ]
DataBreaches summarized reporting alleging Israeli intelligence hacked or accessed a very large portion of Tehrans traffic camera network over multiple years to track senior Iranian officials, including Ayatollah Ali Khamenei. The reporting claimed real-time camera data (including cameras around Khameneis compound) was encrypted and transmitted to servers in Israel and used to build pattern of life intelligence, such as where security teams parked vehicles.
BadeSaba
February 28, 2026
•[ hacking, hacktivism, propaganda ]
BadeSaba, a religious calendar app with more than 5 million downloads, was hacked to display anti-regime messages to users. The compromised app showed propaganda urging armed forces to surrender and join the people.
Rinku Singh's Facebook account
February 5, 2026
•[ account takeover, hacking, social media breach ]
Indian media reported that cricketer Rinku Singhs Facebook account was hacked, with police stating the cybercrime unit was investigating. The report indicated it was not yet known whether the compromise resulted in financial fraud or other misuse beyond unauthorized access/control of the account. The confirmed effect is account compromise and loss of control of a social media profile; additional impacts were not established in the reporting.
The Nobel Foundation
October 10, 2025
•[ cyberattack, data leak, unauthorized access ]
The Norwegian Nobel Institute concluded that a cyberattack was the most likely explanation for the leak of information about the 2025 Nobel Peace Prize, after prediction-market activity shifted sharply hours before the official announcement. The report frames the incident as unauthorized access leading to premature disclosure of confidential prize-related information. The article does not provide technical details on the access vector, attacker identity, or the specific systems compromised beyond the Institutes conclusion that hacking was the likely cause.
Step Finance
January 31, 2026
•[ hacking, cryptocurrency theft, treasury breach ]
Step Finance reported that hackers compromised devices belonging to company executives and used that access to breach several treasury wallets, resulting in approximately $40 million in stolen digital assets. The platform detected the incident on January 31, 2026 and engaged cybersecurity researchers and partners; it reported partial recovery (including assets associated with Remora and other positions) and stated certain operations were halted to reinforce security. The incident affected treasury wallet holdings rather than user rTokens (reported as fully backed), and Step advised users to avoid interacting with the STEP token pending an outcome plan and snapshot process.
Lebanon’s telecoms networks
September 23, 2024
•[ hacking, telecommunications, cyber warfare ]
Israeli military officials warn residents in southern Lebanon and parts of Beirut to evacuate villages and neighbourhoods, sparking concerns that Israel had hacked into its northern neighbours telecommunications networks.
Beirut’s International Airport
January 7, 2024
•[ hacking, political motivation, operational disruption ]
Flight information display screens at Beiruts international airport are hacked to display politically motivated messages, and the incident also temporarily affects baggage inspection.
Russian Ministry of Construction, Housing and Utilities (minstroyrf.gov.ru)
June 4, 2022
•[ hacking, defacement, ransomware ]
The Russian Ministry of Construction, Housing and Utilities (minstroyrf.gov.ru) is hacked. When searched on the internet, the site's address leads to a sign in the Ukrainian language that read- Glory to Ukraine.'' The attackers also demanded ransom to prevent the leaking of personal data of the site users.
prawy.pl
April 22, 2020
•[ influence campaign, hacking, anti-NATO narratives ]
Ghostwriter, a suspected Belarus-backed hacking group, has compromised websites and email accounts in Latvia, Lithuania, and Poland'to publish fabricated documents pushing anti-North Atlantic Treaty Organization (NATO) narratives consistent with Kremlin talking points. The influence campaign started in 2017.
COMELEC (comelec.gov.ph)
March 27, 2016
•[ data breach, voter data, personal information exposure ]
The database of the Philippine Commission on Elections (COMELEC) is breached and the personal information of 55 million voters potentially exposed in two consecutive attacks. The first attack was carried out by Anonymous.
Fidelity Group (http://www.fidelitygroup.com/)
September 22, 2015
•[ hacking, extortion, data leak ]
A group of hackers that calls itself "Hack for Trump" claims to have hacked the website of Fidelity Group and threaten it would make the stolen data public unless Fidelity pays $30,000.
