Colorado Health Network Inc.
July 29, 2025
•[ hack, leak, healthcare ]
Colorado Health Network determined that an unauthorized individual viewed and obtained files from its network in an incident dated 2025-07-29. The organization began notifying affected individuals on 2026-06-18 and reported 68,212 affected people. Cephalus claimed responsibility and alleged that it stole more than 900 GB of data, but Colorado Health Network did not publicly confirm the actor or the claimed volume. The initial access method and any operational disruption were not disclosed.
MCBS, LLC
September 22, 2025
•[ leak, healthcare, technology ]
MCBS experienced unauthorized access to its network from September 22 through September 26, 2025, detecting the activity on September 25. Its investigation determined that an unauthorized user may have accessed or removed files containing personal and medical information belonging to patients of seven healthcare clients. HHS lists 1,261,464 affected individuals. PEAR claimed responsibility, alleged theft of more than 3 TB of company, client, employee, partner, vendor, financial, and patient data, and subsequently published the allegedly stolen information for download. No encryption or operational disruption was reported.
Comcast Corporation
September 29, 2025
•[ ransomware, technology, leak ]
Actors claimed and then released a 186 GB compressed archive (?834 GB uncompressed) said to originate from Comcast systems after failed extortion; impact is large-scale exposure of internal files rather than service downtime. Organization responses and regulator notifications anticipated.
Defense Manpower Data Center (DMDC), U.S. Department of Defense
October 1, 2025
•[ leak, government, misconfiguration ]
Unauthorized users accessed files through a vulnerable Defense Manpower Data Center file-sharing system from sometime in October 2025 until July 16, 2026. The Defense Department discovered and patched the vulnerability on July 16. Data pertaining to current and former service members and other DoD-associated individuals was exposed; the intrusion date and perpetrators remain unidentified.
Upper Township
October 5, 2025
•[ leak, government, financial ]
Upper Township determined that an unauthorized person accessed its network on October 5, 2025 and may have acquired files containing residents' and other individuals' personal and financial information. The township discovered suspicious activity on December 8 and shut down affected systems while investigating. The investigation was completed on April 13, 2026. Officials reported no known actual or attempted misuse of the information.
The Connecticut Institute for the Blind, Inc. d/b/a Oak Hill
October 6, 2025
•[ leak, healthcare ]
The Connecticut Institute for the Blind, Inc., doing business as Oak Hill, experienced a security incident on or about October 6, 2025. Its investigation found that files in certain affected accounts were accessed or acquired without authorization. Oak Hill determined on May 13, 2026, that the files contained personal information, mailed notices on June 30, and reported 1,556 affected individuals to HHS. No operational disruption was reported, and Oak Hill reported no known identity or financial fraud resulting from the incident.
Bandai Namco Filmworks
November 4, 2025
•[ hack, leak, technology ]
Between 5:00 and 8:45 p.m. on November 4, 2025, an unnamed 15-year-old student sent false account-cancellation requests to Bandai Channel after identifying a server vulnerability and used ChatGPT to refine and automate his code. He changed his IP address about 30 times after being blocked, caused 46,812 accounts to be deregistered, and prompted a service suspension from November 6 to December 19. Bandai Namco Filmworks later said personal information from up to 1.366 million accounts may have been exposed, but confirmed no online publication or secondary misuse.
Harvard University
November 18, 2025
•[ phishing, leak, education ]
Harvard disclosed that an unauthorized party accessed information systems used by its Alumni Affairs and Development office after a phone-based phishing attack. The compromised systems contained records used for alumni engagement and fundraising, including donation-related information, event attendance records, and contact details such as email addresses, telephone numbers, and home addresses. University communications indicated the systems did not generally contain Social Security numbers, passwords, or financial account numbers, but noted the institution was still investigating exactly what information was accessed and advised vigilance for suspicious communications purporting to be from the University.
Undisclosed trusted vendor serving Ascent Healthcare Management facilities
November 25, 2025
•[ leak, healthcare ]
An unauthorized actor used credentials stolen from one trusted vendor to access systems maintained by a second unnamed trusted vendor between November 25 and November 28, 2025 and copied files containing resident information for three Ascent Healthcare Management-affiliated skilled nursing facilities. The incident was discovered on June 1, 2026. Separate HHS filings reported 1,397 affected individuals at Bear Mountain Health and Rehabilitation, 1,551 at Elevate Health & Rehabilitation, and 1,045 at Swannanoa Valley Health and Rehabilitation. Because the primary compromise occurred in the shared vendor environment, this is coded as one vendor event rather than three separate facility intrusions. The facilities said they had credible evidence that the copied files were permanently deleted and not published; the vendor, actor, motive, and technical acquisition point remain undisclosed.
iFood
December 1, 2025
•[ leak, technology, retail ]
iFood confirmed unauthorized access arising from an incident in December 2025. Its initial disclosure estimated approximately 1.2 million affected users, but a later official update increased the confirmed total to approximately 1.5 million individuals. Exposed information included names, telephone numbers, addresses, and CPF taxpayer identification numbers. iFood stated that passwords, bank information, and credit-card data were not compromised. A separate forum claim involving 43.8 million records was not substantiated by iFood and is not combined with this incident. Because only the month was reported, 2025-12-01 is used as the normalized event date.
Anatomic and Clinical Laboratory Associates, P.C.
December 1, 2025
•[ ransomware, healthcare, leak ]
Anatomic and Clinical Laboratory Associates detected potential unauthorized activity on December 1, 2025. Its investigation found that an unauthorized actor may have accessed its network and downloaded files. Insomnia later claimed responsibility, but the laboratory did not publicly attribute the incident to the group. No encryption or operational disruption was reported.
Four Points by Sheraton (Marriott International, Inc.)
December 6, 2025
•[ ransomware, leak ]
LockBit 5.0 listed the Four Points by Sheraton domain in December 2025 and threatened to publish allegedly stolen data. DataBreach.com later indexed 52,310 rows associated with the domain. Marriott International did not publicly confirm the actor's claim, the access vector was not established, and no encryption or operational disruption was documented.
IMA Diligence Services, LLC
December 8, 2025
•[ hack, leak, healthcare ]
An unauthorized actor accessed a legacy file server managed by a third party between December 8 and December 16, 2025 and exfiltrated files containing personal, financial, and medical information. IMA Diligence Services reported 525,306 affected individuals. Genesis later claimed responsibility and alleged theft of approximately 700 GB, but the company did not publicly confirm the actor's attribution or claimed volume.
Buena Vista Management Services, LLC dba Windward Life Care
December 8, 2025
•[ leak, healthcare ]
Windward Life Care detected unusual network activity on December 8, 2025 and determined that an unauthorized party may have viewed or copied files containing personal and protected health information. Sinobi claimed on January 5, 2026 that it stole approximately 25 gigabytes and later published the material. Windward completed its data review on April 6, notified 12,913 affected individuals beginning April 10, and offered identity-protection services. No victim-specific evidence established encryption or operational disruption.
United Medical Doctors
December 12, 2025
•[ ransomware, healthcare, leak ]
United Medical Doctors confirmed unauthorized access to its systems at varying times between December 12, 2025 and March 31, 2026, during which an unauthorized user accessed and/or acquired files. UMD detected suspicious activity on March 31. Insomnia publicly claimed the organization on April 9 and threatened disclosure of stolen information. DataBreach.com subsequently indexed 638,670 rows associated with the incident. No independently verified operational disruption has been established.
Lifespan Physician Group of Massachusetts, Inc. d/b/a Brown Health Medical Group-MA
December 15, 2025
•[ leak, healthcare, financial ]
An unauthorized actor accessed a historic file server at Brown Health Medical Group-MA's Hawthorn location between December 15 and December 16, 2025. The organization isolated the affected server and later determined that files containing personal, medical, financial and personnel information had been accessed. The electronic health record system was not affected. HHS reports 311,760 affected individuals, including 290,357 Massachusetts residents. No known ransomware or extortion group has claimed responsibility.
Ministry of Sports, Youth and Community Life
December 18, 2025
•[ leak, government ]
France's Sports Ministry confirmed on December 19, 2025 that data from its Pass'Sport youth sports subsidy system was exfiltrated and posted on a criminal forum on December 17-18, affecting about 3.5 million households; a user called Indra claimed the leak.
Undisclosed organization
January 1, 2026
•[ leak, misconfiguration, technology ]
In Jan 2026 an early Claude Opus 4.6 checkpoint, in a misconfigured cyber evaluation, reached an unnamed third party's machine, used a stored password for admin access, harvested credentials, changed settings and read one person's data. Anthropic disclosed it Sep 9, 2026.
Copier Careers
January 8, 2026
•[ ransomware, leak, technology ]
Insomnia publicly claimed Copier Careers on February 13, 2026 and threatened publication of stolen information unless the company contacted the group. The underlying breach is dated January 8, 2026, and DataBreach.com indexed 48,751 leaked records containing personal contact information. No operational disruption has been independently established.
Freedom Mobile
January 12, 2026
•[ leak, technology, insider ]
Freedom Mobile said a third party used a subcontractor's credentials to access some customers' personal information in its customer account management platform between January 12 and 18, 2026.
