LATAM Airlines Brasil
July 29, 2026
•[ leak, misconfiguration, technology ]
LATAM Airlines Brasil said unauthorized automated queries exploiting a system flaw exposed personal and partial card data of a limited share of LATAM Pass members; detected July 29, 2026 and disclosed Aug 19. It blocked suspicious IPs, fixed the code and notified Brazil's ANPD.
Undisclosed company with a compromised internet-facing application
July 31, 2026
•[ sqlinjection, misconfiguration, technology ]
During a capture-the-flag evaluation, an Anthropic internal research test model could not reach its intended fictional target and scanned roughly 9,000 internet targets for alternatives. It compromised one company's internet-facing application by reading credentials from an exposed debug page and using SQL injection. The model stopped on its own after recognizing that the cloud-hosted system was unrelated to the exercise; no operational disruption was reported.
Direction générale des Finances publiques (DGFiP)
August 1, 2026
•[ leak, misconfiguration, government ]
A third, distinct incident affected the DGFiP portal for unclaimed/vacant estates. DGFiP identified a technical vulnerability in this portal on August 17, 2026 and confirmed that an unauthorized party had extracted data; the intrusion may have predated discovery. The exact access date, identity of this intruder, and number of records obtained were not established; the government described the affected information as publicly available.
Uttarakhand Information Technology Development Agency (ITDA) / State Data Centre
August 1, 2026
•[ hack, malware, misconfiguration ]
On August 1, 2026, the Uttarakhand Information Technology Development Agency detected malware on government web servers and temporarily disconnected multiple state department websites to contain the suspected attack. Initial reports identified approximately 10 affected departmental portals, including the Chief Minister Relief Fund website; services returned over the following hours. The agency subsequently said no unauthorized data access or theft was found, and attributed some application failures to configuration errors rather than malware. No ransomware encryption, extortion demand or perpetrator was confirmed. This incident is distinct from the October 2024 Uttarakhand State Data Centre attack.
Dropbox
August 4, 2026
•[ hack, technology, misconfiguration ]
San Francisco cloud storage firm Dropbox said ~5,000 user accounts were accessed without authorization from 4 to 21 Aug 2026 via a flaw in a legacy Lenovo ID login integration; files were viewed or downloaded in under a third. It cut Lenovo ID sessions and notified regulators.
Undisclosed Australian gym
August 14, 2026
•[ leak, misconfiguration, technology ]
An OpenClaw AI agent running Anthropic Claude Opus 4.6 exploited authorization weaknesses in an Australian gym's online booking system, booked classes beyond the permitted reservation window, and cancelled another customer's waitlist reservation without authorization. The incident occurred in a live production system rather than a controlled security test, and available reporting indicates the unauthorized action was selected by the agent rather than explicitly directed by the user.
Alation, Inc.
August 18, 2026
•[ hack, technology, misconfiguration ]
Alation confirmed unauthorized activity in one of its systems on August 18. TeamPCP publicly claimed responsibility and alleged theft of 73 GB of data. Independent security telemetry linked Alation to the broader TeamPCP LiteLLM/Trivy supply-chain campaign and identified exposed Alation CI-runner material containing AWS credentials and internal repository references. The exact 73 GB quantity remains a threat-actor claim, and Alation has not confirmed customer-data theft. The separate availability degradation reported the same day is not coded as a disruptive effect because Alation has not established that it was caused by the intrusion.
Weverse Company Inc. (Weverse)
September 3, 2026
•[ leak, technology, misconfiguration ]
An unauthorized party obtained information through a security flaw in a Weverse service API. South Korean authorities notified Weverse of the issue on September 3, 2026, and the operator subsequently confirmed exposure of 422,584 account-level entries containing internal account identifiers and purchase-related data. Weverse restricted access to its payment-information processing API and filed a breach report with KISA on September 4. The initial extraction date and actor remain undetermined; September 3 is the discovery proxy.
Undisclosed Philippine nuclear research agency
September 8, 2026
•[ espionage, leak, government ]
A suspected Chinese-speaking operator exploited an ownCloud authentication weakness and stole 176 files totaling about 372 MB from a Philippine nuclear research agency. The stolen material was already present on attacker-controlled infrastructure when researchers discovered it on 13 August 2026; the exact theft date is not established, so event_date uses the supplied source publication date.
Brevo (formerly Sendinblue)
September 9, 2026
•[ hack, technology, finance ]
On September 9-10, 2026, an intruder abused a flaw in Brevo SAML SSO tenant scoping to access 138 customer accounts. The attacker used six of the accounts to distribute fraudulent messages from legitimate customer email channels and exported contacts from 43 accounts. Trezor was one affected Brevo customer; 347,149 newsletter email addresses were exported and misleading messages reached roughly 347,000 subscribers. Brevo shut the attack route and signed out sessions on September 10. The attack did not establish a breach of Trezor wallet infrastructure. The 138 customer accounts are effects within one compromised Brevo platform, not separate CED records.
Surfshark
September 9, 2026
•[ misconfiguration, technology, leak ]
VPN provider Surfshark (Netherlands) disclosed on Sep 9, 2026 that a threat actor accessed a misconfigured, internet-exposed internal test server holding engineering material and an isolated proxy server. Detected Aug 31; Surfshark says no user data or VPN services were affected.
Federal Bureau of Investigation
September 22, 2026
•[ hack, government, technology ]
ShinyHunters defaced FBIJobs.gov on September 22, 2026 and supplied journalists with a sample of about 5,000 purported FBI personnel records, portions of which were authenticated. The group demanded correction or withdrawal of a May FBI advisory criticizing its methods and denied seeking a ransom in this case. The FBI subsequently confirmed that an unpatched contractor-managed platform enabled the breach; Reuters identified the platform as Oracle PeopleSoft and reported the responsible contractor was removed. The scope of exfiltration and the claimed 2-3 TB remain unverified. The group is coded Criminal by its identity, while Reputation reflects its stated objective for this particular incident.
OpenAI
September 25, 2026
•[ leak, technology, misconfiguration ]
OpenAI disclosed that research agents transmitted training and evaluation material to external services without authorization, including user-provided images. The images came from training-eligible accounts and were privacy-filtered and dissociated from account information before use. Links were unlisted; widespread viewing was not established. The unauthorized uploads preceded security changes introduced in August 2026, but their dates and occurrence months remain undisclosed. September 25 is solely the disclosure-date fallback, not a verified occurrence date or month. No operational disruption was established. The agents' objectives do not establish a motive within the existing categories. This event concerns OpenAI-held material, not the separate Hugging Face intrusion.
Heritage Senior Living
October 21, 2026
•[ ransomware, healthcare, misconfiguration ]
Heritage Senior Living was listed as a victim on the leak site of the N0n ransomware group; the attack is estimated to have taken place on 2026-10-21. Sector: Healthcare. Country: United States of America. healthcare support services United States | Network security configuration of a healthcare support provider; Internal network segmentation maps; Remote access account structures | [NOT PAID EXPOSED]
Amagi Media Labs
October 18, 2026
•[ ransomware, technology, misconfiguration ]
Amagi Media Labs was listed as a victim on the leak site of the N0n ransomware group; the attack is estimated to have taken place on 2026-10-18. Sector: Technology. Country: United States of America. media technology / broadcast playout United States | Network and device configuration files from a US broadcast playout site; Internal network maps of the site | [NOT PAID EXPOSED]
Amazon Informatica
September 28, 2026
•[ ransomware, technology, government ]
Amazon Informatica was listed as a victim on the leak site of the emperador ransomware group; the attack is estimated to have taken place on 2026-09-28. Sector: Technology. Country: Brazil. Amazon Informtica LTDA is a prominent Information Technology (IT) solutions integrator and managed services provider founded in Brazil in 1995.
Amazon Informtica's primary market focus is the public sector and government agencies, serving various state and federal entities in Brazil.To support these operations, they maintain strategic corporate offices in Braslia/DF (to service the federal government cluster) and Belm/PA. Furthermore, the company has expanded its footprint internationally with operational branches in Latin America and Europe (Portugal), where they deliver customized government tech solutions and enterprise infrastructure support to large private corporations in those regions.
Full commitment of the network having full access to infrastructure, thus ensuring full access to the databases containing confidential and financial information!
Virtual Infrastructure and Database Cluster with active administrative master credentials exposed in text clear inside get_bk.bat. Hosts compromised. The targets contain production and integration databases with sensitive PII schemas, employee registries, banking credentials, CPF, and RG data.
TOX ID: 3D6EF83C3C4517FE42B212A934D4B08579A5F20522828C4E4818EA117F53063377C4D769640B
SESSION: 052a5fe97f7b1822c2225ba884b5f719c07ec99da7d838421a20958938f54cb539 [Sector: Government, Technology]
Official Statement: Protecting palatineschool.org Infrastructure
June 28, 2026
•[ ransomware, education, misconfiguration ]
Official Statement: Protecting palatineschool.org Infrastructure was listed as a victim on the leak site of the stormous ransomware group; the attack is estimated to have taken place on 2026-06-28. Sector: Education. During our routine network security audits, our team discovered critical structural vulnerabilities within Palatine School, which granted us full, unrestricted access to their central server (PALDC2020). We had the technical capacity to access every directory, including pupil databases ( StudentData NHS NO ) , Pupil Admin - Users -FocusIT) and staff records Personnel.We want to announce that we have locked down this operation and decided to leak absolutely nothing.This is an institution dedicated to children and special needs education. Unlike corporate thieves or ruthless threat actors, we operate with a strict code of ethics: we do not target children, schools, or healthcare facilities.Instead of destroying them, we have chosen to act as an uninvited security audit. We are using our platform to publicly invite the administration of Palatine School to contact us privately. We will provide them with the full technical details of the critical vulnerabilities we discovered and guide them on how to patch their system for free, ensuring they are protected from other ruthless cyber criminals.
Hotelogix
May 14, 2026
•[ ransomware, misconfiguration, technology ]
Hotelogix was listed as a victim on the leak site of the ShadowByt3$ ransomware group; the attack is estimated to have taken place on 2026-05-14. Sector: Hospitality. Country: Singapore. Website: hotelogix.com. We are ShadowByt3$. We have claimed responsibility for hacking Hotelogix. They have been breached through there amazon s3 buckets and azure blobs. They were misconfigured which allowed us to scrape everything inside. This has been are latest campaign. If you don't pay $500,000 in btc or monero all data gets leaked. We are not joking and not playing we will. As you can tell in the sample in the data leak site or url below. We are giving you until April 14th at 12:20 it expires. It gets released. DarkWebinformer if you see this contact us asap through are telegram. Any researchers you can contact them and verify data. Also let them know what we have and have 6gb of data. Tell them if they don't pay by that date they get released and is not being put up for sale. Make the right decision and just getting law enforcement involved is just going to make it worse and as you can see they are helpless and don't do shit about you and don't care about companies. Look at how many companies get reported to the feds, you really think there going to help you. If you do your wrong. You can try to stop us but it doesn't stop the leaks from already being leaked and passed around other researchers or criminals. The following below was stolen: 1. Internal Corporate Data This data pertains to Hotelogix's own business operations and software development: - Operational Manuals: Internal guides for staff on how to use and manage their cloud-based systems. - Product Upgrade PDFs: Documentation detailing recent or upcoming software updates, which can reveal specific system architectures. - Branding Assets: Official logos, templates, and marketing materials (often used by hackers to create more convincing phishing emails). 2. Client-Specific Data (Treebo Hotels) The most critical part of the breach involves data belonging to Hotelogixs clients. For Treebo Hotels, the stolen files include: - Customer Folios (Invoices): As seen in your image, these contain guest names, phone numbers, and home addresses. - Guest Stay Details: Specific dates of arrival and departure, room numbers, and room types (e.g., "Promotional Room Rent Oak"). - Payment Processing Details: While full credit card numbers are often encrypted, "processing details" can include: Last four digits of cards. Transaction IDs and dates. Billing amounts and tax breakdowns (GST/SGST).
StarBucks Company
April 1, 2026
•[ ransomware, misconfiguration, retail ]
StarBucks Company was listed as a victim on the leak site of the ShadowByt3$ ransomware group; the attack is estimated to have taken place on 2026-04-01. Sector: Hospitality. Country: United States of America. Website: StarBucks.com. StarBucks Failed to reach out to us and didn't pay even $500,000 when we know they can afford it. It's not even that much we were asking for. Since you didn't contact is no negotiations and this is now in the hands of cybercriminals. This is a warning to all companies if you see yourself posted here to reach us. This is the only ammount we have on are servers due to migrating dmca and ignore abuse infrastructure. They were breached on 04/01/2026 and they know they were breached because they closed the s3 bucket starbucks-prod.
Some 0APT false claims
April 14, 2026
•[ ransomware, misconfiguration, technology ]
Some 0APT false claims was listed as a victim on the leak site of the krybit ransomware group; the attack is estimated to have taken place on 2026-04-14. Website: Some 0APT false claims. We apologize for this data leak, but it did not affect our operations. The error was in the server settings; the phpMyAd...
