Delek US Holdings, Inc.
August 19, 2026
•[ ransomware, leak, energy ]
Helix listed Delek US on its extortion site on August 19, 2026 and claimed possession of customer and employee information. DataBreach.com subsequently indexed 122,079 leaked records containing personal and contact information. Delek US has not publicly confirmed the incident, and no operational disruption has been independently established.
Undisclosed crates.io maintainer
August 20, 2026
•[ hack, leak, malware ]
On Aug 20, 2026, attackers hijacked a crates.io maintainer's account and published tampered versions of Rust crates arrayref, internment and append-only-vec carrying a credential- and wallet-stealing payload. Wiz linked it to North Korean actors; versions were removed.
McKesson Corporation
August 21, 2026
•[ phishing, healthcare, leak ]
McKesson discovered the intrusion on August 25, 2026. ShinyHunters claimed it used voice phishing against employees to compromise Okta single-sign-on accounts and access Salesforce and Snowflake environments, with approximately 1 TB exfiltrated between August 21 and August 25. McKesson confirmed customer-data exfiltration from third-party applications but has not confirmed the claimed access method, volume, record count, or data categories. Company services remained operational.
The Revel Collective
August 21, 2026
•[ ransomware, leak, retail ]
The Revel Collective, a UK operator of bars and social venues, was listed on the Direwolf ransomware group's leak site on Aug 21, 2026, claiming about 700 GB of stolen data. The company has not publicly confirmed an incident or notified customers.
Brookview Financial
August 24, 2026
•[ leak, ransomware, finance ]
DragonForce listed Brookview Financial on its leak site on August 24, 2026 and claimed theft of customer information including credit reports and Social Security numbers. DataBreach.com indexed 254,414 leaked rows containing customer contact information. Brookview Financial is a private mortgage lender headquartered in Hamden, Connecticut. The company has not publicly confirmed the incident, and no operational disruption has been independently established.
Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF)
August 26, 2026
•[ ransomware, government, leak ]
ATF publicly confirmed on August 26, 2026 that an unauthorized actor had compromised a standalone system containing information about targets of ATF investigations. The system was quickly disconnected and was separate from ATF's enterprise network, eForms, laboratory, and case-management systems. Qilin claimed responsibility the same day and later published approximately 6.3 GB of purported data from the CALEA environment. ATF has not publicly authenticated the full leak or confirmed Qilin's attribution, and mission operations were unaffected.
Nutex Health Inc.
August 26, 2026
•[ leak, healthcare, financial ]
Nutex Health disclosed that an unauthorized third party accessed and exfiltrated information from company servers. The company publicly disclosed the incident on August 24 but has not published the intrusion date; under the coding guide the SecurityWeek publication date is used because the compromise date remains undetermined. Nutex later confirmed that patient, employee, credentialed-provider, business, and financial information was involved. The Gentlemen claimed the incident on August 31, and Nutex said on September 10 that data purportedly obtained in the event had been published. Nutex reported no material operational impact.
Greenberg Traurig
August 26, 2026
•[ ransomware, leak, finance ]
Silent Ransom Group accessed U.S. law firm Greenberg Traurig's work devices in Aug 2026 and leaked stolen files with about 126,000 SSNs on Sept 2 after ransom talks stalled. The firm confirmed limited document access, notified regulators and reported 150,000 affected in Oregon.
Undisclosed Czech healthcare organization
August 27, 2026
•[ leak, healthcare, financial ]
ComSource detected a data leak from an unnamed Czech healthcare organization on 27 August 2026. DataBastard offered the stolen database for sale for $1,400. The exact initial-access and exfiltration dates were not reported, so event_date uses the first documented detection of the leak.
Freelom.net s.r.o.
August 28, 2026
•[ hack, leak, sqlinjection ]
ComSource reported that Space Bears attacked a Czech internet-service provider, first announcing the victim on 22 August 2026 and releasing data six days later. Outside leak-site tracking identifies the victim as Freelom.net s.r.o. and says Space Bears claimed SQL data containing client personal information. Freelom has not publicly confirmed the compromise; event_date reflects the reported data leak rather than the unknown initial-access date.
Mercury Technologies
August 28, 2026
•[ leak, finance, technology ]
San Francisco fintech Mercury's client email list, stored by feedback-software vendor Canny, was exported and sold, according to The Seven Deadly Sins, which claimed to have breached Canny in late Aug 2026. Mercury has not commented and the claim is unconfirmed.
IDScan.net
September 1, 2026
•[ leak, technology ]
IDScan.net, a New Orleans ID verification firm, confirmed hackers may have copied customer data from its cloud after Nexus, a dark-web service advertised on Russian forum Exploit, sold 153M+ U.S./Canadian license scans in Sept 2026. FBI investigating; credit monitoring offered.
City of Vienna (Stadt Wien)
September 3, 2026
•[ leak, government ]
From September 3 to 11 2026 an intruder used a web access vulnerability to copy documents from a municipal internal-documentation platform; city systems and accounts were not controlled. Vienna confirmed about 26000 pages or documents totaling 9 GB were acquired, affecting 2083 employees, 2885 residents, and 856 contractors. No publication or extortion was established.
Weverse Company Inc. (Weverse)
September 3, 2026
•[ leak, technology, misconfiguration ]
An unauthorized party obtained information through a security flaw in a Weverse service API. South Korean authorities notified Weverse of the issue on September 3, 2026, and the operator subsequently confirmed exposure of 422,584 account-level entries containing internal account identifiers and purchase-related data. Weverse restricted access to its payment-information processing API and filed a breach report with KISA on September 4. The initial extraction date and actor remain undetermined; September 3 is the discovery proxy.
Florida Department of Highway Safety and Motor Vehicles
September 4, 2026
•[ hack, leak, government ]
FLHSMV discovered unauthorized access to its DAVID database on September 4, 2026, through compromised credentials belonging to one Plant City police employee. September 4 is a discovery proxy; ShinyHunters' claimed September 3 collection start was not independently confirmed. The group claimed responsibility and later released an archive inspected by Straight Arrow News. The agency did not publicly verify the named operator or its advertised victim count. No encryption or operational disruption was established.
Blanco & Etcheverry
September 4, 2026
•[ ransomware, leak ]
Gunra ransomware added Montevideo law firm Blanco & Etcheverry to its leak site on Sept. 4, 2026, claiming to have leaked 300 GB of data. The firm has not confirmed the attack or commented.
Undisclosed Philippine nuclear research agency
September 8, 2026
•[ espionage, leak, government ]
A suspected Chinese-speaking operator exploited an ownCloud authentication weakness and stole 176 files totaling about 372 MB from a Philippine nuclear research agency. The stolen material was already present on attacker-controlled infrastructure when researchers discovered it on 13 August 2026; the exact theft date is not established, so event_date uses the supplied source publication date.
Air Canada
September 9, 2026
•[ ransomware, leak, technology ]
The Gentlemen ransomware group listed Montreal-based Air Canada on its leak site on Sept 9, 2026, claiming to have stolen 51,409 'critical files'. A dataset of about 489,000 mostly email records was later indexed; Air Canada has not confirmed it; no disruption was reported.
Surfshark
September 9, 2026
•[ misconfiguration, technology, leak ]
VPN provider Surfshark (Netherlands) disclosed on Sep 9, 2026 that a threat actor accessed a misconfigured, internet-exposed internal test server holding engineering material and an isolated proxy server. Detected Aug 31; Surfshark says no user data or VPN services were affected.
Undisclosed Costa Rican credit bureau
September 12, 2026
•[ leak, finance, technology ]
Costa Rican officials linked jarol1488 to theft of a credit bureau database containing personal and financial information. Authorities detected the public posting on September 12, 2026; this date is used as a discovery proxy, not a verified intrusion or extraction date. Cero Riesgo was named in attacker material but had not confirmed that the published information originated from its systems. Officials authenticated only part of a public sample, not the claimed 400 million-plus records. The database was advertised for US$2,500. The exact extraction system was not forensically confirmed. The minister described the attacker as South American without identifying a country.
