Undisclosed freelance employment platform users
June 1, 2016
•[ malware, social, technology ]
Russian national Searzhudin Aktulaev, extradited from Cyprus, was indicted for messaging ~80,000 users of a California freelance platform (June 2016-Nov 2017) with malicious Excel files that installed TVRAT/DarkVNC, infecting thousands of computers and stealing credentials.
Undisclosed individual
August 18, 2024
•[ social, financial, phishing ]
A Washington, D.C. crypto investor lost over 4,100 bitcoin (over $240M) on Aug. 18, 2024 after callers posing as Google and Gemini support got access to his Google Drive and security codes. Ringleader Malone Lam faced a plea hearing; 18 people were charged.
LHC Group
April 7, 2026
•[ social, phishing, healthcare ]
Louisiana home health provider LHC Group said a hacker used credentials stolen by phoning an employee to access patient files on a vendor platform from 7-15 Apr 2026. Notices went to 28,000+ people in Sep 2026; the FBI was contacted.
Undisclosed organizations
April 8, 2026
•[ ransomware, technology, social ]
Russian-speaking Aurora ransomware operators tricked the Cursor AI coding agent into aiding credential theft and intrusions at 7 to 20+ unnamed organizations from April 2026, per Reuters and CloudSEK; four victims later appeared on Aurora's leak site.
Carnival Corporation
April 14, 2026
•[ social, hack, leak ]
Carnival Corporation reported that an attacker used social engineering on April 14, 2026 to gain access to a limited portion of company IT systems and copy personal information. ShinyHunters claimed responsibility and later published Carnival data after failed negotiations. Carnival reported 5,995,277 affected individuals to the Maine Attorney General, while HIBP reported 8.7 million records and 7.5 million unique email addresses. Public reporting did not confirm encryption, data destruction, or operational disruption.
Eversource Energy
April 14, 2026
•[ phishing, social, energy ]
Phishing and social-engineering attacks compromised the credentials of two Eversource Energy employees beginning April 14, 2026. The compromised accounts allowed an unauthorized party to access files containing information belonging to 3,049 customers across Connecticut, Massachusetts, and New Hampshire. Eversource blocked the activity and reported no impact to electric, natural-gas, or water services, customer-information systems, critical operational systems, or infrastructure.
Revolut Bank UAB
May 1, 2026
•[ social, finance, government ]
Attackers used a compromised certified email account belonging to an Italian Interior Ministry office to submit fraudulent law-enforcement requests to Revolut Bank UAB. By early May 2026, published correspondence shows Revolut had already sent customer data in response to the requests; the exact first disclosure date is not known, so event_date uses the first day of the earliest month in which successful disclosure is evidenced. Revolut said its own systems, databases and customer funds were not compromised. Multiple parties later claimed responsibility, so the specific actor remains unverified.
Wilmer Cutler Pickering Hale and Dorr LLP
May 8, 2026
•[ social, ransomware, finance ]
On May 8, 2026, a WilmerHale employee provided personal information to an unauthorized third party who misrepresented their identity. The firm said the actor did not directly access its systems or network; the information had been obtained through legal services and may have included names and Social Security numbers. WilmerHale reported no known further disclosure or misuse. Later reporting attributed the incident to Silent Ransom Group, also known as Luna Moth, and alleged that WilmerHale paid at least $18 million, including a $10 million primary cyber-insurance layer; WilmerHale and the insurer did not publicly confirm those payment claims.
Fox Rothschild LLP
May 21, 2026
•[ ransomware, social, finance ]
On 2026-05-21, a sophisticated social-engineering incident enabled unauthorized access associated with one Fox Rothschild user device. Fox Rothschild stated that the activity was limited to that device and that it found no broader access to the firm's systems or network. Silent Ransom Group claimed responsibility, said it exfiltrated confidential client files, demanded payment, and later published data after the ransom deadline passed. The actor attribution, stolen-data scope, and publication details are based on the group's claim and subsequent reporting.
Chief Master Sgt. John Bentivegna (U.S. Space Force)
May 31, 2026
•[ hack, social, government ]
Hackers took control of Chief Master Sgt. of the Space Force John Bentivegna's Instagram account on May 31, 2026 and posted multiple pro-Iranian and anti-U.S. images and stories. The unauthorized content remained visible for several hours before the account was recovered. The compromise appeared limited to the Instagram account, and the perpetrators were not identified.
Exact Sciences Corporation (Abbott Cancer Diagnostics)
June 1, 2026
•[ phishing, healthcare, leak ]
In mid-June 2026, ShinyHunters used voice phishing against employees and obtained access to a limited number of legacy Exact Sciences cancer-diagnostics systems. Abbott confirmed that some affected files contained personal information and/or protected health information, but said the incident did not affect operations, products, manufacturing, laboratories, or patients. The attackers later published data, and Have I Been Pwned independently identified 10.9 million unique email addresses in the breach corpus.
States of Guernsey — Committee for Education, Sport & Culture
June 3, 2026
•[ social, phishing, government ]
On June 3, an attacker obtained unauthorized access to a Guernsey education employee email account and used it to send a malicious link. The mailbox remained accessible to the intruder for approximately one month and contained information relating to 74 individuals. Officials confirmed the breach but reported no evidence of data exfiltration beyond the Education IT environment. Criminal and Financial are limited inferences from the phishing/credential-abuse pattern; no extortion or political objective was established. Mixed reflects both unauthorized viewing of stored information and fraudulent use of the official mailbox.
Madison Square Garden Sports Corp.
June 5, 2026
•[ social, hack, technology ]
ShinyHunters stated that it breached Madison Square Garden on 2026-06-05 by vishing a low-level employee and abusing Microsoft Entra password-reset access, after which it reached cloud applications including Salesforce. The group demanded payment and published approximately 45 GB of data on 2026-06-16. It claimed more than 26 million customer and corporate records, while later analysis identified 9,782,361 unique email addresses and 2,820,221 unique telephone numbers. Reviewed files included internal talent and risk-assessment records, customer correspondence, and employee material. Reviewed reporting did not confirm that facial-recognition images or payment data were included.
AdaptHealth Corp.
June 15, 2026
•[ hack, social, healthcare ]
Attackers used social engineering to compromise a user session associated with a third-party contractor, accessed AdaptHealth cloud applications including patient-management and document-storage systems and external EHR portals, and exfiltrated data. AdaptHealth said the incident was contained and did not materially affect operations or patient services. ShinyHunters later claimed responsibility, but the company did not confirm the attribution.
Cook Medical LLC
July 2, 2026
•[ social, leak, healthcare ]
On July 2, 2026, a Cook Medical employee was deceived through social engineering and gave an outside party access to company systems. Cook identified and contained the access the same day. The company confirmed customer business-contact information, Salesforce communications, employee names and email addresses, and certain SharePoint business files were accessed, while stating that products, manufacturing, and patient/customer services were unaffected. ShinyHunters later claimed the incident and said it obtained more than 182 GB of data after failed extortion negotiations.
Clover Health Investments, Corp.
July 4, 2026
•[ social, healthcare, financial ]
Clover Health detected anomalous login activity on July 4, 2026 and determined that an unidentified actor used social engineering to trick three non-managerial health-plan employees into disclosing credentials, enabling access to their employee email accounts used for member visit scheduling and broker-facing sales. The accounts could access member personal and protected health information but not corporate financial or claims systems. Clover contained and terminated the access, and no operational disruption was reported. No group, country, extortion demand, or stated motive was identified; Criminal and Financial are bounded inferences from deliberate credential theft targeting accounts containing identity and health data. Clover is remote-first and states that it maintains no headquarters, so state and county remain undetermined.
Apollo Management Holdings, L.P. (Apollo Global Management)
July 6, 2026
•[ social, finance, technology ]
An unidentified actor used social engineering to compromise employee authentication and gain unauthorized access to Apollo cloud platforms between July 6 and July 10, 2026. Personal information including names, birth dates, addresses and Social Security numbers was accessed and stolen. The company reported the breach to regulators, notified affected people and offered monitoring services. The exact victim count, particular cloud application and responsible group were not disclosed.
Ksenia Sobchak
July 8, 2026
•[ hack, leak, social ]
Hackers compromised Ksenia Sobchak's email account and used that access to take control of two Telegram channels on July 8, 2026, publishing unauthorized posts containing purported private correspondence. Access was restored after three hours. Black Mirror claimed it stole more than 350 gigabytes of data, released additional material on July 9, and offered the archive for sale; Sobchak said the messages were fabricated, and neither the claimed volume nor the material's authenticity was independently verified.
Elections Alberta
July 9, 2026
•[ social, government ]
An unidentified actor operated electionsab.ca, a lookalike domain mimicking Elections Alberta's legitimate elections.ab.ca address. The site generated fictitious names, addresses, phone numbers, and elector ID numbers while exploiting concern about a separate voter-list exposure. Elections Alberta confirmed that all displayed data was fake and said the apparent intent was to reduce confidence in the agency and Alberta electoral events; enforcement and cybersecurity agencies were contacted for takedown assistance.
Prefettura di Reggio Calabria
July 21, 2026
•[ ransomware, malware, social ]
Attackers took over a certified (PEC) email account of Italy's Reggio Calabria Prefecture, reportedly via infostealer, and posed as authorities to get data on ~680 Revolut customers (July 21, 2026). Group iamnotavillain demanded ransom; prosecutors are investigating.
