CAMILLA Australia Pty Ltd
April 1, 2026
•[ leak, retail ]
In April 2026, an unauthorized third party accessed CAMILLA Australia Pty Ltd's Australian network and exfiltrated customer records held within its point-of-sale system. CAMILLA secured its systems, notified affected customers and the Australian privacy regulator, and said its operations and order processing continued without disruption.
Global Schools Group (Global Schools Foundation)
April 1, 2026
•[ leak, misconfiguration, education ]
FulcrumSec reportedly accessed Global Schools Group's AWS environment in April 2026 using default or reused credentials and obtained data from 67 S3 buckets, five MSSQL servers, and four MongoDB servers. The group claimed to have stolen 4.8 TB and later released a 221 GB highlights archive following failed extortion negotiations. Global Schools Group confirmed a cybersecurity incident, said it had contained it and restored affected systems, and notified authorities, but did not verify FulcrumSec's figures or specific data claims. No operational disruption was reported.
Karl Chevrolet, Inc. (d/b/a Karl Auto Group)
April 3, 2026
•[ ransomware, leak, retail ]
An unauthorized third party gained access to certain Karl Auto Group computer systems before 2026-03-27. RansomHouse later claimed that it encrypted Karl Chevrolet systems on 2026-04-03, but Karl Auto Group did not publicly confirm the attribution or ransomware deployment. The company discovered the incident on 2026-04-04, when employees encountered unavailable phones and computers. Phone service remained disrupted or intermittent through at least 2026-04-08, although dealerships remained open and directed customers to email, online messages, or in-person service. Karl Auto Group stated that files containing personal information belonging to current and former customers, employees, and other individuals may have been accessed; thousands of customers were notified, but the total number affected was not disclosed. The company reported no evidence of misuse and said it did not pay a ransom.
Arkansas Oral & Maxillofacial Surgeons
April 7, 2026
•[ ransomware, leak, healthcare ]
PEAR listed Arkansas Oral & Maxillofacial Surgeons in April 2026 and threatened to release allegedly stolen patient information. DataBreach.com later indexed 189,905 associated rows. The practice did not publicly confirm the actor's attribution or claimed scope, the access vector was not established, and no operational disruption was documented.
See's Candies, Inc.
April 11, 2026
•[ ransomware, leak, retail ]
An unauthorized actor accessed portions of See's Candies' network from April 11 through April 13, 2026. See's discovered the activity on April 12 and determined that the actor acquired files before encrypting files on a subset of servers; at least some stolen files were later published on the dark web. Qilin publicly claimed the company. Subsequent regulatory filings report 23,737 affected individuals, while DataBreach.com separately indexed 112,767 rows.
Undisclosed Middle Eastern manufacturing company
April 11, 2026
•[ ransomware, manufacturing, technology ]
Kaspersky reconstructed initial VPN access using compromised credentials on April 11, 2026, data theft on April 13 and operational disruption beginning April 14. Attackers deployed malicious Active Directory policies that disabled administrator accounts and displayed ransom demands. Stolen information was subsequently published. No Windows file encryption was confirmed. PAYLOAD identifies the associated ransomware family and malicious policy; the operator was not separately identified. April 11 dates initial access, not the first confirmed data theft. The victim's country and recovery duration were not disclosed.
Carnival Corporation
April 14, 2026
•[ social, hack, leak ]
Carnival Corporation reported that an attacker used social engineering on April 14, 2026 to gain access to a limited portion of company IT systems and copy personal information. ShinyHunters claimed responsibility and later published Carnival data after failed negotiations. Carnival reported 5,995,277 affected individuals to the Maine Attorney General, while HIBP reported 8.7 million records and 7.5 million unique email addresses. Public reporting did not confirm encryption, data destruction, or operational disruption.
Undisclosed organization
April 15, 2026
•[ ransomware, leak ]
Black Shrantac claimed at least one victim, exfiltrated sensitive data, and deployed ransomware to encrypt files while using a Tor leak site to pressure victims.
Family Medical Associates of Raleigh, P.A.
April 18, 2026
•[ leak, healthcare ]
Family Medical Associates of Raleigh identified suspicious activity on 7 May. Its investigation found that an unauthorized third party intermittently accessed certain systems between 18 and 20 April and downloaded internal data containing protected health information. Genesis claimed responsibility on 3 June and threatened disclosure. A verified searchable dataset containing 126,856 rows confirms the data compromise. The practice did not report encryption, system downtime, or interruption of patient services, and the initial access method remains undisclosed.
Cherry Health (Cherry Street Services, Inc.)
April 19, 2026
•[ leak, healthcare ]
On or about 2026-04-19, Cherry Health detected suspicious activity involving its network. An investigation determined that an unauthorized individual accessed and copied certain information. Cherry Health's preliminary notice stated that the data could relate to current or former patients and current or former staff members and that its review of the affected files was continuing. The organization had not identified the actor, access method, total number of affected individuals, or evidence that the information had been used for identity theft or fraud.
GO2 Health
April 24, 2026
•[ phishing, healthcare, leak ]
A phishing attack enabled unauthorized access to GO2 Health's main email mailbox on April 24, 2026. The clinic engaged specialists, contained the incident, reset credentials associated with delegated mailbox access, notified the Office of the Australian Information Commissioner on May 18, and began notifying affected patients on July 16. Automatic archiving limited exposed email to the preceding 12 months, and the primary patient-information system was not accessed.
NTN Bearing Corporation of America
April 24, 2026
•[ ransomware, manufacturing, leak ]
PayoutsKing claimed it compromised NTN Bearing Corporation of America and threatened publication of stolen data. Ransomware tracking places the estimated attack on April 24, 2026 and the public claim on May 13. DataBreach.com later indexed 115,671 leaked rows containing personal and contact information. No independently verified operational disruption has been established.
Iowa State University
April 25, 2026
•[ leak, education, technology ]
Iowa State University student data (usernames, emails, enrollment info) was exposed in the ShinyHunters breach of vendor Instructure's Canvas platform, disclosed May 2026; ISU lost Canvas access on May 7 until the next morning amid the nationwide outage.
KerberRose Wealth Management, LLC
April 29, 2026
•[ hack, leak, finance ]
An unauthorized third party accessed one KerberRose employee email account on April 29, 2026 and used that access to reach a limited portion of a backup platform supporting KerberRose Wealth Management. KerberRose discovered the incident on May 1 and notified 27,076 affected individuals. Its accounting and tax services were not affected. The actor and motive were not identified.
Herbert Smith Freehills Kramer (US) LLP
May 1, 2026
•[ financial, hack, leak ]
Herbert Smith Freehills Kramer confirmed unauthorized access to a limited portion of its U.S. IT environment discovered in late May 2026, and notified people whose sensitive information could have been compromised. The exact access path, initial compromise day, offender and final record count were not disclosed; May 1 is a month-only coding placeholder. Criminal is inferred from deliberate unauthorized access; Financial is the most likely motive under the private-law-firm targeting heuristic given the value of confidential client and personal data, without direct evidence of a ransom demand or data sale.
Heights Finance Holdings Co.
May 7, 2026
•[ leak, misconfiguration, finance ]
Heights Finance discovered on May 7, 2026 that an unauthorized actor had gained access to a third-party cloud platform used to store customer information and may have viewed or copied data. The incident was limited to that platform and did not affect Heights' loan-management systems, other computer systems, networks, or operations. State notifications establish at least 1,221,338 affected individuals. Heights said its dark-web monitoring had found no evidence that the stolen information had been shared, and no known ransomware or extortion group has claimed responsibility.
Lifelong Access
May 10, 2026
•[ ransomware, healthcare, leak ]
Lynx listed Lifelong Access on its extortion site on 10 May and threatened to publish stolen information unless the organization negotiated. A subsequently published searchable dataset contains 98,974 records with personal contact and birth-date information. Lifelong Access has not publicly confirmed the incident or disclosed the intrusion method, ransom demand, encryption, or operational impact. No service disruption was identified in public reporting.
PT Bank Negara Indonesia (Persero) Tbk
May 11, 2026
•[ leak, finance ]
DataBreach.com indexed 185,606 rows associated with the bni.co.id domain and dated the dataset to May 11, 2026. The affected organization is PT Bank Negara Indonesia (Persero) Tbk, not Bank Indonesia, the country's central bank. TripleX separately claimed approximately 2 TB of Bank Negara Indonesia data later in May, but public evidence does not conclusively establish that the TripleX claim and this indexed dataset resulted from the same intrusion.
Frontier Airlines, Inc.
May 12, 2026
•[ leak, hack ]
From May 12 through June 3, 2026, an unauthorized party accessed a Frontier Airlines data-storage account and exfiltrated files containing personal information associated with employees and passengers. Frontier discovered the intrusion on June 18 and notified affected individuals in July. State-regulator reporting put the combined affected population at 11,482. Frontier reported that flights, booking activities, and other business operations continued without interruption. The responsible actor and access method remain unidentified. The separate BobDaHacker API disclosure and ExfilSquad's later claim of 43 GB and approximately 2.4 million records have not been established as this incident and are not included in the coded data effects.
World Food Programme
May 14, 2026
•[ leak, government, technology ]
On 2026-05-14, unauthorized actors accessed the World Food Programme's Self-Registration Application for Palestine, which Gaza residents used to register for food and cash assistance. The breach exposed names, identification numbers, mobile telephone numbers, and location data associated with approximately 600,000 households. WFP stated that the incident was isolated to the Palestine application, temporarily shut down the platform, contained the intrusion, and strengthened security controls. No actor claimed responsibility, and the access method was not disclosed.
