Undisclosed organizations
April 1, 2023
•[ leak, insider, technology ]
Ex-U.S. Army soldier Cameron Wagenius ('kiberphant0m') and co-conspirators stole credentials and data, incl. call detail records, from at least 10 organizations incl. U.S. and foreign telecoms (Apr 2023-Dec 2024), sold and leaked data and sought $1M+ via extortion; 70-month term.
Syrian National Army Military Police Investigation Section, Suluk
May 10, 2023
•[ leak, malware, government ]
A RedLine infostealer infected a senior officer's Windows computer used by the Syrian National Army Military Police Investigation Section in Suluk on May 10, 2023. Hudson Rock recovered a stealer log timestamped 09:39 showing the unit-named Windows account and theft of saved passwords, browser cookies, a live Telegram session, and 14 desktop files, including seven active detainee interrogation records. Five recovered Office lock files indicate some records were open when the malware ran. The log subsequently circulated in criminal markets. The individual RedLine affiliate responsible has not been identified. RedLine is commodity malware-as-a-service designed for credential and financial-data theft and resale, supporting Criminal actor type and Financial motive.
Premier Health Partners
June 7, 2023
•[ leak, healthcare ]
Unauthorized access between June 7 July 12 2023 led to acquisition of sensitive personal and health information of 10,833 individuals. No service disruption; services remained operational. No perpetrator identified. Incident discovered July 12 2023; disclosure publicized via Yahoo on August 30 2025.
Southern Water
January 22, 2024
•[ ransomware, leak, technology ]
Black Basta ransomware group attacked UK water supplier Southern Water in January 2024, encrypting several IT systems and stealing customer and corporate data. The company later reported approximately 45 million in total expenses related to recovery, legal fees, and customer notification. The breach exposed nearly half a million customer records, and operations were temporarily disrupted though water services continued. Southern Water confirmed data exfiltration via its internal investigation and regulator notifications.
Amazon
May 15, 2024
•[ hack, leak, technology ]
Amazon confirms a data breach involving employee information after data allegedly stolen during the May 2023 MOVEit attacks is leaked on a hacking forum.
Presbyterian Healthcare Services
May 29, 2024
•[ leak, healthcare ]
The information of over 300,000 Presbyterian Healthcare Services patients is compromised as a result of a data breach at law firm Thompson Coburn.
Seoul Facilities Corporation
June 28, 2024
•[ hack, leak, ddos ]
Two teenagers hacked servers supporting Seoul Facilities Corporation's Ttareungyi public bike-sharing service between June 28 and June 29, 2024 after identifying a web vulnerability that permitted access to member information without normal authentication. Approximately 4.62 million member records were stolen. During the June 28-30 incident, a DDoS attack also caused Ttareungyi-related pages to be unavailable for about 80 minutes. One suspect later told police that curiosity and a desire to show off motivated his actions; police also investigated whether the data may have been intended for sale but found no evidence that it was distributed to third parties.
Hot Topic
October 21, 2024
•[ leak, retail, technology ]
An alleged data breach exposes the personal information of 56,904,909 accounts for Hot Topic, Box Lunch, and Torrid customers, but the threat actors claims to have stolen 350 million records.
France Travail
January 12, 2025
•[ leak, government, phishing ]
France Travail and the Union nationale des missions locales stated that personal data for about 1.6 million young people supported by mission locales could have been exposed following an IT intrusion. The organizations said an agent account was compromised and the attacker created two new accounts that enabled consultation of files for supported youths (including users registered with France Travail or recommended training via the Ouiform tool). The joint statement listed the specific data fields potentially exposed and said that no passwords or bank details were extracted, while warning affected individuals to be vigilant for phishing and identity-theft attempts.
Terry J. Dubrow, MD, A Medical Corporation
January 16, 2025
•[ leak, healthcare ]
An unauthorized actor accessed a portion of the practice's network beginning January 16, 2025 and acquired patient records. The practice confirmed the affected information on July 27, 2026 and later notified patients.
NorthBay Healthcare Corporation
January 29, 2025
•[ leak, healthcare ]
NorthBay Healthcare Corporation in California notifies 569,012 people of a breach that occurred between January 11 to April 1, 2024.
Internal Revenue Service
February 25, 2025
•[ insider, leak, government ]
Insider contractor illicitly accessed and leaked confidential IRS taxpayer records (activity occurred 20182020; higher victim count publicized Feb 2025).
AIL Hospitality Group
March 7, 2025
•[ ransomware, leak, retail ]
PEAR listed AIL Hospitality Group on its leak site on August 5, 2025. DataBreach.com later indexed 11,086 records containing names and driver's license information and assigns March 7, 2025 as the breach date. Independent ransomware trackers estimate the compromise in early July 2025, so the precise intrusion date remains contested. No independently verified operational disruption has been established.
4chan
April 14, 2025
•[ leak, hack, technology ]
Several gigabytes of internal 4chan backend data, including moderator emails, hashed passwords, and source code, were stolen and leaked online; brief service outage reported; no ransom or financial motive indicated.
Optima Tax Relief
May 1, 2025
•[ ransomware, financial, leak ]
Ransomware operators infiltrated Optima Tax Reliefs network and stole client tax-case data before leaking samples online. The company confirmed exposure of 3,114 individuals SSNs and financial account details but reported no further operational disruption.
Texas Department of Transportation
May 12, 2025
•[ leak, government ]
Approximately 300,000 crash reports were downloaded via a compromised account in TxDOTs Crash Records Information System on May 12, 2025. The agency disclosed the incident on June 6, 2025 and began notifications; no actor or motive has been identified.
Academic Urology & Urogynecology of Arizona
May 18, 2025
•[ ransomware, healthcare, leak ]
Academic Urology detected unauthorized network access on May 22, 2025 and later determined that files may have been accessed or acquired between May 18 and May 22. INC claimed the incident on June 17, 2025, but the practice did not confirm that attribution. The practice notified 73,281 people after completing its review on January 30, 2026; no operational disruption was reported.
Hôpital Privé de la Loire
June 26, 2025
•[ hack, leak, healthcare ]
Hpital priv de la Loire in Saint-tienne, France (Ramsay Sant) had its electronic patient record accessed June 26-July 1, 2025 via a doctor's account. Hacker "Marak" claimed the theft and tried to sell the data. CNIL fined the hospital 500,000 on Sept. 3, 2026.
Blue Fish Pediatrics, L.L.P.
July 11, 2025
•[ leak, healthcare ]
Blue Fish Pediatrics determined that an unauthorized party had access to a limited number of files in its computer systems between 2025-07-11 and 2025-07-17. The practice completed its file review on 2026-05-04 and notified affected individuals in June 2026. The incident affected 62,150 individuals in total, including 41,485 Texas residents. Blue Fish Pediatrics did not publicly identify the actor, motive, or initial access method.
UK Ministry of Defence
July 18, 2025
•[ leak, government, espionage ]
Further reporting on MoD data leak reveals identities of more than 100 UK government personnel compromised; follows ARAP breach revelations and superinjunction details.
