Undisclosed AT&T customers
May 1, 2018
•[ insider, financial, technology ]
An AT&T store worker in Portland, Oregon used his access to AT&T systems from May 2018 to Nov 2019 to SIM-swap customers' numbers to co-conspirators' devices, letting them intercept login codes and access bank accounts (~$600,000 intended losses). He got 16 months in prison.
Undisclosed organizations
April 1, 2023
•[ leak, insider, technology ]
Ex-U.S. Army soldier Cameron Wagenius ('kiberphant0m') and co-conspirators stole credentials and data, incl. call detail records, from at least 10 organizations incl. U.S. and foreign telecoms (Apr 2023-Dec 2024), sold and leaked data and sought $1M+ via extortion; 70-month term.
Brightly Software, Inc.
August 1, 2023
•[ insider, ransomware, technology ]
Cameron Curry, a contract data analyst, used his access to Brightly Software's payroll information and corporate data to remove sensitive files between August and December 2023. Beginning in December, he used the alias Loot to demand $2.5 million in cryptocurrency and threatened to publish the stolen information.
Internal Revenue Service
February 25, 2025
•[ insider, leak, government ]
Insider contractor illicitly accessed and leaked confidential IRS taxpayer records (activity occurred 20182020; higher victim count publicized Feb 2025).
Freedom Mobile
January 12, 2026
•[ leak, technology, insider ]
Freedom Mobile said a third party used a subcontractor's credentials to access some customers' personal information in its customer account management platform between January 12 and 18, 2026.
Florida Court Clerks & Comptrollers
January 27, 2026
•[ insider, government ]
Between January 27 and May 1, 2026, former Florida Department of Juvenile Justice probation officer Crystal Lawson allegedly used credentials that remained active after her termination to repeatedly access confidential records in Florida's Comprehensive Case Information System. Investigators said she disclosed active arrest warrants and other restricted case information to members and associates of a drug-trafficking organization, contributing to lost evidence, unrecovered assets, and at least one suspect temporarily fleeing arrest.
Independent National Electoral Commission (INEC)
May 30, 2026
•[ insider, leak, government ]
INEC confirmed that a specific voter record belonging to Emeka Ike was retrieved from its restricted Continuous Voter Registration administrative portal using valid credentials assigned to authorized personnel and was released without authority. The information was posted on social media on May 30, 2026. INEC stated that there was no external intrusion or broader compromise of its database containing more than 90 million voter records. The individual responsible for retrieving or releasing the record had not been publicly identified.
Strand Fitness Pty Ltd (North Shore)
June 6, 2026
•[ leak, insider ]
Strand Fitness Pty Ltd confirmed a data breach affecting current and former members of its North Shore gym in Burdell. Queensland Police found gym member information on a USB drive during a police raid in late May 2026 and opened an investigation. Several police officers were among the affected members. Strand Fitness said the information varied by individual and may have included contact details, health information, identity documents, and payment information. The company contacted affected members, notified Queensland Police and the Office of the Australian Information Commissioner, and took additional steps to secure its systems. The breach did not affect the company's other locations. The date, method, duration, perpetrator, motive, and number of affected members were not reported.
Hospital Authority
June 10, 2026
•[ insider, healthcare ]
An intern doctor surnamed Lai allegedly used another doctor's credentials at Caritas Medical Centre to access Tuen Mun Hospital patient records through the Hospital Authority's Clinical Management System. The Hospital Authority suspended her system access, reported the matter to police, and later dismissed her after finding violations of patient privacy and professional confidentiality; no irregularities in patient treatment were identified.
Washington State Department of Social and Health Services
June 29, 2026
•[ insider, healthcare, government ]
In March 2026, the Washington State Department of Social and Health Services discovered that an employee had accessed client accounts in an internal database for reasons unrelated to authorized job duties. DSHS terminated the individual's system access, reviewed the employee's complete access history, and found that the affected records contained identity and program-enrollment information but no evidence of access to diagnoses, test results, treatments, claims, or clinical notes.
Undisclosed Chinese research institution
July 7, 2026
•[ espionage, insider, government ]
According to China's Ministry of State Security, an outsourced database maintenance worker recruited by an unidentified foreign intelligence agency used remote maintenance privileges to download core research data from an undisclosed institution's experimental database and transfer it abroad. The worker was reportedly arrested, but the institution, contractor, foreign service, incident date, and transfer channel were not disclosed. No operational disruption was reported; because the incident date is unknown, event_date defaults to the supplied source's publication date.
Thailand Ministry of Finance
July 9, 2026
•[ insider, government, finance ]
An unidentified operator who already had access to the ministry's environment supplied target-specific objectives and tools to Hermes and ran it in unattended YOLO mode. Hunt.io recovered active session cookies, a deployed web shell, stolen credentials, and logs showing Hermes enumerating ministry hosts and traversing files between July 9 and 13. The evidence indicates multiple internal systems were compromised, but neither the ministry nor Thai authorities publicly confirmed the breach and no data exfiltration or operational disruption was demonstrated.
Bank of Baroda
July 24, 2026
•[ leak, insider, finance ]
Threat intelligence attributed the leak-site claim to Triple X, while the material was also advertised under the handle leak-king-F. The bank later confirmed that a compromised employee email account enabled unauthorized access to certain data, but it did not confirm the actor attribution or full leak claim. The incident was contained and the bank said its core banking and transaction systems were not accessed or affected.
Department of Land Transport (DLT), Thailand
August 4, 2026
•[ financial, leak, insider ]
Thailand's Department of Land Transport and cybersecurity authorities investigated unauthorized vehicle-registry searches through accounts associated with three government agencies. The DLT confirmed that displayed data were genuine and that access had occurred, while officials said the core registry was not directly hacked. Other reporting describes illegal paid lookup services and sale of government data, supporting a limited Criminal/Financial inference despite the political prominence of some exposed people. Initial access date is unknown; August 4 is the public-discovery proxy.
Newfoundland and Labrador Health Services
August 12, 2026
•[ insider, healthcare ]
A Newfoundland and Labrador Health Services employee accessed a patient's electronic health record without authorization on one occasion. An audit initiated after the patient reported the suspected privacy breach confirmed the access. NL Health Services investigated, contained the breach, notified the affected individual, and took measures intended to prevent recurrence. The privacy commissioner did not disclose the employee's identity, motive, or the date of the unauthorized access.
Samagra Portal (Samagra Samajik Suraksha Mission, Government of Madhya Pradesh)
August 19, 2026
•[ hack, government, insider ]
Cyber police opened an investigation after officials discovered that a person's Samagra record had been updated even though authorized district-level officers had not made the change. Officials tightened portal security and referred the matter for investigation.
Taipei City Police Department
August 31, 2026
•[ insider, government, financial ]
Taipei prosecutors on Aug 31, 2026 indicted a retired Taipei police detective (Cheng) and a suspended officer (Liu) for pulling hundreds of individuals' call records without authorization since 2018 and selling them to syndicate-linked money lenders for about NT$7.2 million.
HM Courts and Tribunals Service (HMCTS), Ministry of Justice
September 16, 2026
•[ insider, government ]
Court staff accessed confidential files relating to victims, survivors and families of the 2024 Southport attack without authorization. An internal review uncovered the access and the Ministry of Justice notified affected parties. Some files contained sensitive personal information; no disclosure to outside parties was found.
East Suffolk and North Essex NHS Foundation Trust
September 27, 2026
•[ insider, healthcare ]
East Suffolk and North Essex NHS Foundation Trust (England) said staff viewed the digital medical records of Noah Woods, a 3-year-old who died in September 2026, without authorization; ten staff were removed from duty or suspended and the ICO was notified.
Gamdom
October 26, 2026
•[ ransomware, financial, technology ]
Gamdom was listed as a victim on the leak site of the Whitearmor ransomware group; the attack is estimated to have taken place on 2026-10-26. Sector: Other. Gamdom is an unregulated crypto casino and sportsbook founded in 2016. It recently suffered a hot-wallet breach, with founder Felix Romer reporting over $3 million in losses, though on-chain analysts estimate the damage closer to $4.2 million.
We hold Gamdom's full user database, 15,420,003 accounts with 146 columns, with Gamdom's total combined profit value exceeding $1 billion.
The way in was something internal, a machine account that was already sitting in their admin side (Metawin).
Issued years back, nobody ever rotated it. Never meant to leave the building.
It had admin reach, and everything after that was their own stuff anyway, their control panels and secret stores.
About your provably fair: what it promised and what it delivered were never the same thing.
We demand $15,000,000 in BTC.
Emails with instructions will be sent to you directly.
To verify, a sample can be found below.
