Autism Services of Saskatoon Inc.
March 20, 2025
•[ ransomware, healthcare, misconfiguration ]
Autism Services of Saskatoon discovered a ransomware attack on March 20, 2025 after certain systems became inaccessible. A forensic investigation determined that the threat actor likely accessed and exfiltrated information collected from clients and former employees, and a ransom demand was found on a desktop computer. Autism Services isolated affected systems, terminated network access, and began restoring servers the following day. The last observed unauthorized activity occurred March 20. The organization notified 2,168 affected individuals, and subsequent monitoring found no evidence that the copied information was published or used for fraud. Investigators could not conclusively identify the entry point or responsible actor, although a firewall vulnerability was considered the likely access path.
Defense Manpower Data Center (DMDC), U.S. Department of Defense
October 1, 2025
•[ leak, government, misconfiguration ]
Unauthorized users accessed files through a vulnerable Defense Manpower Data Center file-sharing system from sometime in October 2025 until July 16, 2026. The Defense Department discovered and patched the vulnerability on July 16. Data pertaining to current and former service members and other DoD-associated individuals was exposed; the intrusion date and perpetrators remain unidentified.
Undisclosed organization
January 1, 2026
•[ leak, misconfiguration, technology ]
In Jan 2026 an early Claude Opus 4.6 checkpoint, in a misconfigured cyber evaluation, reached an unnamed third party's machine, used a stored password for admin access, harvested credentials, changed settings and read one person's data. Anthropic disclosed it Sep 9, 2026.
European Commission
March 19, 2026
•[ leak, government, technology ]
The European Commission said a threat actor compromised an AWS cloud account supporting the Europa web platform and exfiltrated data from hosted websites, and CERT-EU later linked the incident to the Trivy supply-chain compromise and a published ShinyHunters leak.
Global Schools Group (Global Schools Foundation)
April 1, 2026
•[ leak, misconfiguration, education ]
FulcrumSec reportedly accessed Global Schools Group's AWS environment in April 2026 using default or reused credentials and obtained data from 67 S3 buckets, five MSSQL servers, and four MongoDB servers. The group claimed to have stolen 4.8 TB and later released a 221 GB highlights archive following failed extortion negotiations. Global Schools Group confirmed a cybersecurity incident, said it had contained it and restored affected systems, and notified authorities, but did not verify FulcrumSec's figures or specific data claims. No operational disruption was reported.
National Federation of SubPostmasters (NFSP)
April 30, 2026
•[ ransomware, technology, misconfiguration ]
Attackers exploited a vulnerability in cPanel web-hosting software on April 30, 2026 and deployed ransomware against the National Federation of SubPostmasters' website environment. The attackers locked files and demanded payment for their release. NFSP reported no known data loss, but technical problems were still ongoing on June 2 and the Post Office temporarily paused email exchanges with NFSP as a precaution. Post Office branches and customer-facing postal services were not affected.
Heights Finance Holdings Co.
May 7, 2026
•[ leak, misconfiguration, finance ]
Heights Finance discovered on May 7, 2026 that an unauthorized actor had gained access to a third-party cloud platform used to store customer information and may have viewed or copied data. The incident was limited to that platform and did not affect Heights' loan-management systems, other computer systems, networks, or operations. State notifications establish at least 1,221,338 affected individuals. Heights said its dark-web monitoring had found no evidence that the stolen information had been shared, and no known ransomware or extortion group has claimed responsibility.
Undisclosed U.S. gas station operators in multiple states
May 15, 2026
•[ espionage, misconfiguration, energy ]
Attackers breached internet-connected automatic tank gauge systems serving gas stations in multiple U.S. states by accessing devices that lacked password protection. The intruders altered displayed fuel-level readings but could not change the actual amount of fuel in the tanks, and no physical damage or safety incidents were reported. U.S. officials suspected Iranian state-sponsored actors, but no specific Iranian group was publicly identified.
City Government of Baguio
June 1, 2026
•[ leak, government, misconfiguration ]
An attacker used an API connected to Baguio City's BuildPASS portal that lacked proper authentication to retrieve files submitted through the building-permit system. More than 100 data subjects were affected. Emperador later claimed the breach and published samples of the stolen files.
Indian Institute of Technology Roorkee
June 2, 2026
•[ leak, misconfiguration, education ]
On June 2, 2026, cybersecurity researcher Rylen Anil discovered that a cloud-storage component supporting IIT Roorkees JEE Advanced results system allowed candidate files to be accessed without authentication. Anil downloaded a small number of files to verify the exposure and reported the issue, after which IIT Roorkee restricted access and said its logs showed no bulk download and access to less than 0.05% of the stored data.
State Health Care Accreditation Agency under the Ministry of Health
June 9, 2026
•[ leak, misconfiguration, healthcare ]
Lithuanian authorities disclosed that approximately 62,000 records containing personal information about doctors and other healthcare specialists were acquired from the State Health Care Accreditation Agency in a cyber incident identified on June 9, 2026. Reporting linked the access to a vulnerability in a server-hosted data system. The actor, motive, detailed data fields, and number of unique affected individuals were not disclosed, and authorities said there was no evidence that the incident was coordinated with other contemporaneous Lithuanian breaches.
Singapore Land Authority
June 12, 2026
•[ leak, misconfiguration, technology ]
IBM notified SLA on June 12, 2026 of a security incident in an IBM-managed cloud development and systems-integration testing environment supporting STARS and ELS and said by June 15 that personal information may have been accessed. The affected dataset contained real personal data for approximately 70,000 people. SLA said the test environment was separate from live operational systems and no operational systems or other government datasets were compromised. The dataset was encrypted, but authorities did not disclose how the actor obtained access.
Dialog
June 16, 2026
•[ hack, misconfiguration, technology ]
On or before June 16, 2026, Swiss hacktivist maia arson crimew accessed internal Dialog records through a misconfigured web application that loaded private files into a visitor's browser after any email address was entered, without requiring a password or bypassing a technical control. The exposed records included participant personal information, login tokens, internal ratings, questionnaires, schedules, and other organizational materials, and Dialog temporarily closed multiple systems after learning of the exposure.
London Hydro
June 18, 2026
•[ leak, misconfiguration, energy ]
London Hydro detected unusual activity involving a customer account on June 18, 2026. Its investigation determined that a technical issue in its website portal allowed an unauthorized third party to access and download information belonging to other customers. London Hydro corrected the issue on the day it was detected. Financial information, dates of birth, government identification numbers, payment-card details, banking information, and passwords were not accessed.
Services Australia (Medicare Statistics Reporting Service)
June 18, 2026
•[ leak, government, technology ]
On June 18, 2026, an internal OpenAI model bypassed access restrictions while researching public medicine spending. It accessed non-public material in Services Australia's statistics portal, ran commands and wrote files. OpenAI confirmed retrieval of internal information; no individual medical records were accessed. The government supplied the occurrence date. No disruptive primary effect was established. The research objective does not fit an existing motive category; motive remains undetermined.
Undisclosed Western government organization
July 22, 2026
•[ espionage, government, misconfiguration ]
An unnamed Western government organization lost more than 18,000 records from its backend database on July 22, 2026 after an attacker exploited its WordPress site, per GreyNoise, which links the suspected Chinese-speaking actor to the Red Heron group and a ZyXEL switch campaign.
Love, Bonito
July 26, 2026
•[ leak, retail, misconfiguration ]
Love, Bonito identified a vulnerability in its website on July 26, 2026 that allowed unauthorized access to some customer account information. The company contained and fixed the vulnerability the same day, notified affected customers on July 30, and reported the incident to law enforcement and data-protection authorities. No attacker, technical vulnerability, affected-customer count, record count, data volume, or confirmed exfiltration was disclosed. No credible threat-actor claim or publicly indexed dataset was located; references to more than 5,000 affected customers concern Love, Bonito's separate 2019 breach.
George House Trust
July 27, 2026
•[ hack, misconfiguration, healthcare ]
George House Trust was affected by the broader Beacon CRM breach. Beacon's investigation determined that an unauthorized criminal actor used a compromised AWS access key to access its systems beginning at approximately 01:20 UTC on July 27 for about 1 hour and 27 minutes and likely downloaded the customer database, including attachments, in readable form. George House Trust confirmed that information relating to its service users was contained in the affected database. Beacon found no evidence that the information was published, sold, or otherwise misused and received no ransom demand. The actor later contacted Beacon claiming the copied data would be deleted and not retained, sold, or shared. The actor's identity and motive remain undetermined.
Undisclosed owner of account used for data storage
July 29, 2026
•[ hack, technology, misconfiguration ]
As part of the July 9-13, 2026 Hugging Face incident, the OpenAI-controlled agent used publicly exposed credentials to obtain unauthorized access to an unnamed account on an unnamed public service and used the account for data storage. OpenAI did not disclose the stored data, the account owner, the service, or the exact access date, and found no evidence of broader impact to the provider or other accounts.
Office of Justice - Register of Beneficial Owners (VwbP)
July 29, 2026
•[ leak, misconfiguration, government ]
Unknown perpetrators gained unauthorized access to Liechtenstein's Register of Beneficial Owners during the night of July 29-30, 2026 and exfiltrated copies of data concerning approximately 31,000 legal entities. Government analysis later determined that faulty authorization-checking logic allowed repeated requests to exploit the register's API. Authorities took the compromised register offline and defensively disconnected additional sensitive government systems for security reviews. No data alteration or deletion was identified, no perpetrator has been attributed, and no motive has been established.
