Nephrology Associates, M.D., P.A.
January 17, 2026
•[ leak, healthcare ]
Kansas kidney-care practice Nephrology Associates, M.D., P.A. had its network accessed Jan 17-Apr 9, 2026, and patient data removed. The Gentlemen listed it on its leak site Mar 7 and offered the data for sale. The practice reported 24,088 patients affected to HHS on July 29.
Rocky Mountain Associated Physicians, P.C.
January 26, 2026
•[ leak, healthcare ]
Rocky Mountain Associated Physicians stated that an unauthorized actor accessed systems including its patient database and other data files at an unknown date no earlier than October 30, 2025, and that it confirmed compromised patient information on February 2, 2026. PEAR listed the practice on its leak site on January 30, 2026 and later released data. The source's January 26, 2026 breach date is used as the event date. No encryption or operational disruption was reported.
MG Oil Company, Inc.
January 29, 2026
•[ ransomware, leak, energy ]
Akira listed MG Oil Company on January 29, 2026 and claimed theft of approximately 35 GB of corporate data. DataBreach.com subsequently indexed 9,891 associated rows. The company's public attribution, the access vector, and any operational disruption were not established; therefore, only the achieved data-exposure effect is coded.
Undisclosed People Playground user
February 1, 2026
•[ hack, leak, technology ]
A malicious mod overwrote users' Workshop uploads, deleted saved creations and reset settings and achievements. This represents an unnamed affected user in the February incident, separate from September. February 1 is the earliest-warning fallback, not a verified infection date. Sabotage is inferred from deliberate deletion and alteration; actor type and operator identity are unestablished.
Peachtree Group
February 19, 2026
•[ hack, leak, finance ]
PayoutsKing claimed it exfiltrated approximately 698 GB of data from Peachtree Group in an intrusion dated February 19, 2026 and publicly listed the company on April 30. DataBreach.com later indexed 299,873 rows. Litigation filed after the incident alleges that personally identifiable information belonging to current and former employees was accessed. A separate July 2026 claim by The Gentlemen appears to concern a later incident and is not merged into this record.
Little Bonanza, Inc. d/b/a Bonanza Casino
February 21, 2026
•[ ransomware, leak ]
Bonanza Casino detected suspicious network activity on 21 February after finding certain systems offline. It secured the environment and engaged forensic specialists, who determined that an unauthorized party accessed certain systems and copied files. Medusa publicly claimed responsibility on 17 March and threatened to publish the stolen data. Bonanza Casino completed its affected-person review on 1 July and issued notices on 8 July. The intrusion method, duration of the system outage, and nationwide number of affected individuals were not disclosed.
Strategic Education, Inc.
February 23, 2026
•[ leak, education ]
An unauthorized actor accessed Strategic Education's computer servers between February 23 and February 25, 2026 and copied certain files. The company discovered the incident on May 21 and began notifying affected individuals on May 29. Regulatory filings in six states identify at least 190,155 affected residents, although Strategic Education did not disclose a confirmed nationwide total. The actor, access method, and motive were not identified.
Rockwood Retirement Communities
February 26, 2026
•[ leak, healthcare, technology ]
KAIROS listed Rockwood Retirement Communities on its leak site on February 27, 2026. DataBreach.com subsequently indexed 132,606 structured records associated with the breach and dated the underlying event February 26. The records support classification of the affected asset as a database-backed application server, although the initial access vector was not disclosed. Rockwood operates nonprofit senior-living communities in Spokane. No victim notice or independent report confirmed encryption or operational disruption.
Physicians' Clinic of Iowa
February 26, 2026
•[ leak, healthcare ]
Anubis claimed a data breach at Physicians' Clinic of Iowa on February 26, 2026 and published images reportedly showing personal identifiers and protected health information. DataBreach.com later indexed 158,631 structured records. The database-like patient records support classification of the affected asset as an application server, although the initial access vector was not disclosed. The clinic has not publicly confirmed the attribution or disclosed the precise number of affected patients, encryption, or operational disruption.
Central National Gottesman Inc.
February 26, 2026
•[ ransomware, leak, manufacturing ]
On or around February 26, 2026, an unauthorized third party accessed part of Central National Gottesman's network and obtained files from company systems. The incident was discovered by February 28. PayoutsKing publicly claimed the company on March 2. Regulatory filings report 9,126 affected individuals and confirm exposure of identity, financial, health, and payroll-related information. DataBreach.com separately indexed 207,519 rows associated with the incident.
Novo Nordisk A/S
March 1, 2026
•[ ransomware, leak, healthcare ]
FulcrumSec claimed that it obtained access in March 2026 through a GitHub access token, cloned Novo Nordisk repositories, obtained additional credentials, remained in the environment for more than two months, and stole more than 700,000 files totaling approximately 1.3 TB before demanding $25 million. Novo Nordisk confirmed unauthorized access to a limited number of internal IT systems and the external copying of non-public and personal data, but it did not publicly attribute the incident to FulcrumSec or confirm the actor's claimed volume and contents. Reuters could not independently verify the authenticity of the published data. Novo Nordisk temporarily took certain internal systems offline for containment, while stating that its core business operations remained operational. Because only March 2026 was reported for initial access, 2026-03-01 is used as the normalized event date.
Lewis Drug
March 3, 2026
•[ ransomware, leak, healthcare ]
AiLock claimed responsibility for an intrusion involving Lewis Drug in early March 2026 and alleged theft of approximately 110 GB. DataBreach.com dated the associated dataset to March 4 and indexed 22,549 rows. Public evidence supports a March 2026 event rather than the previously coded July 2025 date. No encryption or operational disruption was publicly documented.
Valley Family Health Care
March 7, 2026
•[ ransomware, healthcare, leak ]
DataBreach.com indexed 1,891,536 rows associated with Valley Family Health Care and dated the breach to March 7, 2026. Insomnia listed the organization on its data-leak site on March 18, 2026. Public reporting did not identify the access vector or document encryption or operational disruption.
Elliott-Lewis Corporation
March 11, 2026
•[ leak, financial, manufacturing ]
Interlock claimed responsibility for compromising Elliott-Lewis Corporation on March 11, 2026 and described a large database containing confidential contracts, project files, and customer and employee data, with approximately 1.07 terabytes allegedly stolen. DataBreach.com later indexed 319,305 structured rows containing personal identifiers and bank-account information. The explicit database claim and structured records support classification as Exploitation of Application Server, although the initial access vector was not disclosed. Elliott-Lewis is a Philadelphia-based mechanical contractor. The company has not publicly confirmed the attribution, claimed volume, encryption, or operational disruption.
AssuranceAmerica Managing General Agency, LLC
March 16, 2026
•[ leak, finance ]
On 2026-03-16, malicious activity targeted an AssuranceAmerica employee and enabled an unauthorized third party to access portions of the company's IT environment and copy files. AssuranceAmerica detected suspicious activity on 2026-03-17, disabled compromised credentials and unauthorized sessions, isolated affected systems, and notified law enforcement. The company completed its review of the copied files on 2026-06-15. Regulatory filings subsequently identified 6,998,886 affected individuals. No threat group publicly claimed responsibility, and AssuranceAmerica did not disclose a motive or precise access mechanism.
European Commission
March 19, 2026
•[ leak, government, technology ]
The European Commission said a threat actor compromised an AWS cloud account supporting the Europa web platform and exfiltrated data from hosted websites, and CERT-EU later linked the incident to the Trivy supply-chain compromise and a published ShinyHunters leak.
Axcera LLC
March 22, 2026
•[ hack, leak, technology ]
LAPSUS$ claimed on March 22, 2026 that it had stolen approximately 13 GB from Axcera, including source code, cloud configurations, credentials, API keys, and MongoDB database dumps. DataBreach.com later indexed 11,977 rows containing email addresses. Axcera did not publicly confirm the actor's full claim, and no operational disruption was reported.
Ultrahuman
March 27, 2026
•[ leak, malware, healthcare ]
On March 27, 2026, attackers used credentials stolen from a malware-infected employee laptop to obtain read-only access to Ultrahuman's internal analytics system. Ultrahuman said wellness data belonging to approximately 0.1% of users was accessed, took the affected system offline, and revoked access. The company reported that passwords, payment information, production systems, and Ultrahuman Ring devices were not compromised and did not confirm whether data was exfiltrated.
Paidwork LLC
March 29, 2026
•[ hack, leak, financial ]
Hackers claimed to have obtained data from Paidwork in March 2026 and offered it for sale. An approximately 11 GB database attributed to Paidwork was subsequently published in July and contained more than 23 million unique email addresses along with extensive profile, financial, device, transaction, and authentication data. Paidwork stated that it had not confirmed compromise of its systems or user accounts and was investigating the reported incident.
Jones Day
March 30, 2026
•[ phishing, ransomware, leak ]
Jones Day confirmed a phishing incident in which an unauthorized third party accessed a limited number of dated files for 10 clients; Silent Ransom Group claimed responsibility and posted data on its leak site on March 30, 2026.
