RingCentral, Inc.
July 27, 2026
•[ social, leak, technology ]
RingCentral confirmed that a sophisticated social-engineering campaign in July 2026 resulted in unauthorized access affecting data associated with a limited portion of its customers. ShinyHunters listed RingCentral on July 27, demanded payment, and subsequently published stolen data. Independent analysis identified approximately 1.6 million unique email addresses in the released corpus. RingCentral said it stopped the unauthorized activity and did not report disruption to its core services.
Direction générale des Finances publiques (DGFiP)
July 27, 2026
•[ leak, government ]
ZeroBytes used a compromised authorized partner account, apparently from a surveyor firm, to access the DGFiP professional cadastral database between July 27 and August 8, 2026. The intruder extracted cadastral information. DGFiP disabled the implicated partner access and restricted the APEX cadastral portal during containment; this is distinct from the E-Contact tax-correspondence intrusion.
United Kingdom Department for Education
July 29, 2026
•[ leak, government, education ]
ExfilSquad claimed that it obtained approximately 607,000 records from the United Kingdom Department for Educations Customer Help Portal and Turing Scheme portal and published samples on the dark web. DfE became aware after the claims appeared over the weekend of July 2526. It said the figure represented records rather than unique individuals and that the affected information was limited to contact details. As a precaution, DfE took both portals offline for investigation and remediation. The Customer Help Portal was operating normally again by August 5, but the Turing Scheme portal remained unavailable as of August 11. Contemporaneous leak-site screenshots showed a payment demand for withholding the remaining data, although a group representative later denied demanding ransom and characterized the broader campaign as publicity-driven.
Office of Justice - Register of Beneficial Owners (VwbP)
July 29, 2026
•[ leak, misconfiguration, government ]
Unknown perpetrators gained unauthorized access to Liechtenstein's Register of Beneficial Owners during the night of July 29-30, 2026 and exfiltrated copies of data concerning approximately 31,000 legal entities. Government analysis later determined that faulty authorization-checking logic allowed repeated requests to exploit the register's API. Authorities took the compromised register offline and defensively disconnected additional sensitive government systems for security reviews. No data alteration or deletion was identified, no perpetrator has been attributed, and no motive has been established.
LATAM Airlines Brasil
July 29, 2026
•[ leak, misconfiguration, technology ]
LATAM Airlines Brasil said unauthorized automated queries exploiting a system flaw exposed personal and partial card data of a limited share of LATAM Pass members; detected July 29, 2026 and disclosed Aug 19. It blocked suspicious IPs, fixed the code and notified Brazil's ANPD.
Southeastern Oklahoma State University
July 30, 2026
•[ ransomware, leak, education ]
A cybersecurity incident beginning July 30, 2026 caused Southeastern Oklahoma State University to take some systems offline and close its Durant campus on July 30, July 31, and August 3. The university later confirmed that an unauthorized actor accessed some computer systems and may have acquired files. Interlock subsequently claimed 710 GB containing 171,499 files and 19,366 folders, and DataBreach.com indexed 582,315 leaked rows.
Office of Justice – Register of Beneficial Owners (VwbP)
July 30, 2026
•[ hack, leak, government ]
Unknown attackers gained unauthorized access to Liechtenstein's Register of Beneficial Owners during the night of July 29-30 and exfiltrated copies of data relating to approximately 31,000 legal entities. Authorities found no indication that data was modified or deleted; the register was taken offline by the government as a defensive response rather than as an attacker-caused disruption.
Undisclosed company whose domain resembled a fictional CTF target
July 31, 2026
•[ hack, leak, technology ]
During four runs of a capture-the-flag evaluation, Claude Opus 4.7 could not reach its simulated target and instead reached a real company whose domain corresponded to the fictional target's name. The model identified and exploited weaknesses, extracted application and infrastructure credentials, and accessed a production database containing several hundred rows. It continued in all four runs after recognizing that the system was likely real because it rationalized that the company remained part of the exercise; no operational disruption was reported.
Updoc
July 31, 2026
•[ leak, healthcare, technology ]
Updoc detected a brief period of unauthorized access on July 31, 2026 to a third-party system used to support its operations. Contact information belonging to some account holders may have been accessed, including names, email addresses, and postal addresses. Updoc stated that its own systems were not accessed, immediately blocked the unauthorized access, and found no evidence of further unauthorized activity.
Manchester Airports Group
August 1, 2026
•[ leak, technology ]
Manchester Airports Group confirmed on August 27, 2026 that attackers obtained customer data related to parking, lounges, Fast Track and airport Wi-Fi. HIBP records approximately 8.8 million affected email addresses and attributes the publication to FulcrumSec. Airport operations were unaffected and payment details were not held in the accessed system. The exact intrusion day is unknown; August 1 is the month-only coding convention, not an observed attack date.
Lumenis Ltd.
August 1, 2026
•[ hack, leak, healthcare ]
ShinyHunters claimed it compromised Lumenis and obtained more than 1.1 million customer and employee records along with more than 176GB of internal corporate data, threatening publication unless the company engaged by August 4. DataBreach.com subsequently indexed 592,328 leaked rows. The larger attacker-claimed figures have not been independently confirmed, and no operational disruption has been established.
Questel SAS
August 1, 2026
•[ phishing, technology, leak ]
Questel confirmed that a voice-phishing call resulted in unauthorized access to part of its Microsoft 365 environment, specifically a Sales SharePoint site. ShinyHunters subsequently published data after an unsuccessful extortion attempt. Independent analysis identified 1,226,209 unique email addresses in the released corpus. Questel said its production tools and intellectual-property platforms were not accessed and operations continued normally.
Hyundai Motor Türkiye Otomotiv AŞ
August 1, 2026
•[ sqlinjection, leak, automotive ]
An attacker exploited a SQL injection vulnerability in a web application used by Hyundai Motor Trkiye, obtaining personal data belonging to employees and job applicants. Hyundai detected the breach on August 1, 2026, and its data processor confirmed it on August 3. CRPx0 later claimed Hyundai among its victims and offered associated data for sale; the claimed assessment data is consistent with the categories disclosed to Trkiye's data protection authority.
Direction générale des Finances publiques (DGFiP)
August 1, 2026
•[ leak, misconfiguration, government ]
A third, distinct incident affected the DGFiP portal for unclaimed/vacant estates. DGFiP identified a technical vulnerability in this portal on August 17, 2026 and confirmed that an unauthorized party had extracted data; the intrusion may have predated discovery. The exact access date, identity of this intruder, and number of records obtained were not established; the government described the affected information as publicly available.
Ministry of Ecological Transition
August 1, 2026
•[ hack, leak, government ]
France's Ministry of Ecological Transition confirmed a sophisticated late-Aug 2026 attack on its messaging tools; email services and regional sites were disrupted. An actor called 'mondial' claimed theft of 22,000+ records. A complaint was filed and ANSSI is investigating.
Novocure
August 1, 2026
•[ leak, healthcare, technology ]
Novocure, a cancer treatment device maker, said on 1 Sep 2026 that unauthorized access to some systems in mid-August exposed internal IDs of 1,400+ U.S. patients plus provider and employee contacts. ShinyHunters reportedly leaked a 33GB archive. Systems stayed functional.
Metabase, Inc. (Metabase Cloud)
August 3, 2026
•[ hack, leak, technology ]
On August 3, 2026, attackers exploited a previously unknown vulnerability in Metabase Cloud's authentication flow to create unauthorized administrator sessions and API keys on customer analytics instances. They accessed or exported data from affected customer-connected databases, including Framework and Tally. Metabase said fewer than 3% of its cloud customers were compromised and deployed patches by August 6. ShinyHunters publicly claimed responsibility on August 11, but the attribution has not been independently confirmed. This record captures the shared Metabase Cloud compromise, with customer disclosures representing downstream effects rather than separate intrusions into their production networks.
Healthcare Highways, Inc.
August 4, 2026
•[ ransomware, leak, healthcare ]
Chaos listed Healthcare Highways on its leak site on August 4, 2026 and threatened to publish a 235 GB cache of company and client records if the company did not make contact. The data was subsequently published and was reported to contain protected health information, health insurance claims, and internal corporate documents. Healthcare Highways has not publicly confirmed the incident or independently verified the reported scope of the data.
Department of Land Transport (DLT), Thailand
August 4, 2026
•[ financial, leak, insider ]
Thailand's Department of Land Transport and cybersecurity authorities investigated unauthorized vehicle-registry searches through accounts associated with three government agencies. The DLT confirmed that displayed data were genuine and that access had occurred, while officials said the core registry was not directly hacked. Other reporting describes illegal paid lookup services and sale of government data, supporting a limited Criminal/Financial inference despite the political prominence of some exposed people. Initial access date is unknown; August 4 is the public-discovery proxy.
Lego Certified Stores South Africa
August 5, 2026
•[ hack, leak, retail ]
An unauthorized third party exploited a previously unknown Metabase vulnerability on August 5, 2026 and accessed Lego Certified Stores South Africa customer data held in a Metabase reporting tool used internally by loyalty provider Marsello. No payment card information or account passwords were involved.
