Sports Center of the Football Association of Serbia
April 1, 2026
•[ ransomware, technology ]
Belgrade prosecutors detained suspect L.D. in Aug 2026, alleging he accessed the Football Association of Serbia Sports Center's network from April to August 2026, took a large amount of data, demanded ransom and damaged data in a ransomware attack.
Republic Health Insurance Fund of Serbia (RFZO)
April 1, 2026
•[ ransomware, healthcare, government ]
Serbian police arrested three INF Grupa members in Aug 2026; prosecutors allege suspect L.D. accessed the network of Serbia's Republic Health Insurance Fund (RFZO) between April and August 2026, took a large amount of data, demanded ransom and damaged data in a ransomware attack.
Karl Chevrolet, Inc. (d/b/a Karl Auto Group)
April 3, 2026
•[ ransomware, leak, retail ]
An unauthorized third party gained access to certain Karl Auto Group computer systems before 2026-03-27. RansomHouse later claimed that it encrypted Karl Chevrolet systems on 2026-04-03, but Karl Auto Group did not publicly confirm the attribution or ransomware deployment. The company discovered the incident on 2026-04-04, when employees encountered unavailable phones and computers. Phone service remained disrupted or intermittent through at least 2026-04-08, although dealerships remained open and directed customers to email, online messages, or in-person service. Karl Auto Group stated that files containing personal information belonging to current and former customers, employees, and other individuals may have been accessed; thousands of customers were notified, but the total number affected was not disclosed. The company reported no evidence of misuse and said it did not pay a ransom.
Karl Auto Group
April 4, 2026
•[ ransomware, automotive ]
Karl Auto Group discovered unauthorized access to certain business computer systems on April 4, 2026 after access had begun before March 27. Employees at multiple Iowa dealerships lacked working phones and computers, and phone service remained unavailable or intermittent for at least five days, although locations remained open. The company stated that files containing customer and employee information may have been accessed. RansomHouse separately claimed that Karl Chevrolet was encrypted on April 3, but Karl Auto Group did not confirm ransomware, data theft, or a connection to the group.
Arkansas Oral & Maxillofacial Surgeons
April 7, 2026
•[ ransomware, leak, healthcare ]
PEAR listed Arkansas Oral & Maxillofacial Surgeons in April 2026 and threatened to release allegedly stolen patient information. DataBreach.com later indexed 189,905 associated rows. The practice did not publicly confirm the actor's attribution or claimed scope, the access vector was not established, and no operational disruption was documented.
Undisclosed organizations
April 8, 2026
•[ ransomware, technology, social ]
Russian-speaking Aurora ransomware operators tricked the Cursor AI coding agent into aiding credential theft and intrusions at 7 to 20+ unnamed organizations from April 2026, per Reuters and CloudSEK; four victims later appeared on Aurora's leak site.
See's Candies, Inc.
April 11, 2026
•[ ransomware, leak, retail ]
An unauthorized actor accessed portions of See's Candies' network from April 11 through April 13, 2026. See's discovered the activity on April 12 and determined that the actor acquired files before encrypting files on a subset of servers; at least some stolen files were later published on the dark web. Qilin publicly claimed the company. Subsequent regulatory filings report 23,737 affected individuals, while DataBreach.com separately indexed 112,767 rows.
Undisclosed Middle Eastern manufacturing company
April 11, 2026
•[ ransomware, manufacturing, technology ]
Kaspersky reconstructed initial VPN access using compromised credentials on April 11, 2026, data theft on April 13 and operational disruption beginning April 14. Attackers deployed malicious Active Directory policies that disabled administrator accounts and displayed ransom demands. Stolen information was subsequently published. No Windows file encryption was confirmed. PAYLOAD identifies the associated ransomware family and malicious policy; the operator was not separately identified. April 11 dates initial access, not the first confirmed data theft. The victim's country and recovery duration were not disclosed.
Undisclosed organization
April 15, 2026
•[ ransomware, leak ]
Black Shrantac claimed at least one victim, exfiltrated sensitive data, and deployed ransomware to encrypt files while using a Tor leak site to pressure victims.
Ohio Living
April 16, 2026
•[ ransomware, healthcare, financial ]
Ohio Living detected suspicious network activity on April 17, 2026. Its investigation determined that an unauthorized actor accessed systems and copied files from its network between April 16 and April 17. Ohio Living secured the network and began reviewing the files; no operational disruption was reported, and the 500-person figure reported to HHS was preliminary. On August 5, the Dark Project ransomware group claimed responsibility for an April 2026 attack on Ohio Living and alleged that it stole at least 600 GB, including at least 5,000 files containing employee, patient, medical, insurance, Social Security, financial, and banking information. Ohio Living had not publicly confirmed the attribution or the claimed volume.
Goodwin Procter LLP
April 16, 2026
•[ ransomware, financial, technology ]
Goodwin Procter disclosed a spring 2026 unauthorized data-access incident dated April 16 in state records. The firm notified a limited number of clients and affected people. Insurance-industry reporting linked the extortion to Luna Moth and reported a ransom payment around US$10 million, citing people familiar with the matter; Goodwin did not independently confirm that payment or attribution. Its effect was acquisition of sensitive information, without verified encryption or service shutdown. Criminal/Financial is supported by the attributed financially motivated extortion campaign.
NTN Bearing Corporation of America
April 24, 2026
•[ ransomware, manufacturing, leak ]
PayoutsKing claimed it compromised NTN Bearing Corporation of America and threatened publication of stolen data. Ransomware tracking places the estimated attack on April 24, 2026 and the public claim on May 13. DataBreach.com later indexed 115,671 leaked rows containing personal and contact information. No independently verified operational disruption has been established.
The Walman Optical Company
April 27, 2026
•[ ransomware, manufacturing, healthcare ]
Medusa publicly claimed Walman Optical on April 27, 2026. DataBreach.com subsequently indexed 690,400 records containing personal and identity information associated with the company. Multiple federal data-security lawsuits were filed against Walman in May 2026 following the incident. Federal contracting and environmental records identify Walman's primary activity as ophthalmic goods manufacturing. No independently verified operational disruption has been established.
National Federation of SubPostmasters (NFSP)
April 30, 2026
•[ ransomware, technology, misconfiguration ]
Attackers exploited a vulnerability in cPanel web-hosting software on April 30, 2026 and deployed ransomware against the National Federation of SubPostmasters' website environment. The attackers locked files and demanded payment for their release. NFSP reported no known data loss, but technical problems were still ongoing on June 2 and the Post Office temporarily paused email exchanges with NFSP as a precaution. Post Office branches and customer-facing postal services were not affected.
Scope Systems Pty Ltd
May 5, 2026
•[ ransomware, technology ]
On May 5, 2026, an unidentified ransomware actor accessed Scope Systems' network, encrypted its hosted client servers, and disrupted customer access to Pronto Xi, its support portal, APIs, and other cloud services. The actor remained in the network for less than 24 hours and exfiltrated data from Scope Systems' internal file server, while Scope reported that data stored on client servers was not accessed and restored all client servers from backups by May 17.
Champaign-Urbana Public Health District
May 6, 2026
•[ ransomware, healthcare, government ]
Champaign-Urbana Public Health District detected suspicious network activity on May 7, 2026. Its investigation determined that an unauthorized actor copied files from its computer network between May 6 and May 7. Reporting during the incident indicated that its primary website was disrupted and an alternate site was used. INC Ransom claimed responsibility and threatened to release data, but the district did not publicly confirm the attribution, encryption, or the number of affected individuals.
Wilmer Cutler Pickering Hale and Dorr LLP
May 8, 2026
•[ social, ransomware, finance ]
On May 8, 2026, a WilmerHale employee provided personal information to an unauthorized third party who misrepresented their identity. The firm said the actor did not directly access its systems or network; the information had been obtained through legal services and may have included names and Social Security numbers. WilmerHale reported no known further disclosure or misuse. Later reporting attributed the incident to Silent Ransom Group, also known as Luna Moth, and alleged that WilmerHale paid at least $18 million, including a $10 million primary cyber-insurance layer; WilmerHale and the insurer did not publicly confirm those payment claims.
Lifelong Access
May 10, 2026
•[ ransomware, healthcare, leak ]
Lynx listed Lifelong Access on its extortion site on 10 May and threatened to publish stolen information unless the organization negotiated. A subsequently published searchable dataset contains 98,974 records with personal contact and birth-date information. Lifelong Access has not publicly confirmed the incident or disclosed the intrusion method, ransom demand, encryption, or operational impact. No service disruption was identified in public reporting.
Waterford Hotel Group
May 11, 2026
•[ ransomware, financial, technology ]
Waterford Hotel Group, a Connecticut hotel and conference center manager, was listed by the Interlock ransomware group on May 11, 2026; Interlock claimed to hold personal, confidential, partner and financial data from the chain and its divisions. No company confirmation.
Pratiksha Foundation Charitable Trust
May 12, 2026
•[ ransomware, healthcare, education ]
By 2026-05-12, FulcrumSec had contacted Pratiksha Foundation Charitable Trust after compromising educational databases and demanded $750,000 to prevent disclosure. The compromised information included children's medical and mental-health details, travel and location information, and parental income data. The Bombay High Court issued an ex parte interim order on 2026-06-12 restraining FulcrumSec from publishing or disseminating the stolen information and directing service providers to block identifiers used by the group.
