French Ministry of National Education (staff-training information system)
July 25, 2026
•[ leak, government, education ]
On the night of July 25, 2026 an attacker used an impersonated or compromised professional account to enter the French Education Ministry staff-training information system. Security personnel were alerted July 26 and suspended external access to contain the intrusion. Information about ministry staff employed in regional academies since 2001 may have been acquired, and affected personnel were notified. ZeroBytes later claimed much wider education data theft and published alleged samples, but the ministry had not confirmed that claimed student population or data volume. This intrusion is distinct from the ministry COMPAS breach in March 2026.
RingCentral, Inc.
July 27, 2026
•[ social, leak, technology ]
RingCentral confirmed that a sophisticated social-engineering campaign in July 2026 resulted in unauthorized access affecting data associated with a limited portion of its customers. ShinyHunters listed RingCentral on July 27, demanded payment, and subsequently published stolen data. Independent analysis identified approximately 1.6 million unique email addresses in the released corpus. RingCentral said it stopped the unauthorized activity and did not report disruption to its core services.
Advanced Procurement for Universities and Colleges
July 31, 2026
•[ hack, social, education ]
Advanced Procurement for Universities and Colleges confirmed that an unauthorized party accessed historical data in mid-July 2026. APUC said it contained the incident immediately, experienced no operational disruption, and notified relevant authorities. Sources reported an extortion demand and claimed administrator access through an employee account and theft of 20 years of data, but those details were not confirmed; no responsible group was publicly identified.
Troutman Pepper Locke LLP
August 7, 2026
•[ social, phishing, ransomware ]
A Troutman Pepper Locke employee was deceived by communications that appeared legitimate and sent documents to an unauthorized party on August 7, 2026. The firm said the unauthorized party never accessed its environment and operations were not affected. Silent Ransom Group subsequently claimed responsibility and published data.
Levi Strauss & Co.
August 10, 2026
•[ social, ransomware, retail ]
Levi Strauss disclosed that an unauthorized third party used social engineering to gain access to three employees' company-issued computers and exfiltrate corporate information. The company contained and terminated the unauthorized access and reported no consumer-data exposure or business interruption. Reuters-linked infrastructure showed Levi Strauss was among companies targeted by a broader ransom-seeking social-engineering campaign associated with activity tracked as UNC6671, but neither Levi Strauss nor Google has confirmed that attribution and no group has publicly claimed the breach.
Quinn Emanuel Urquhart & Sullivan LLP
August 14, 2026
•[ social, espionage, leak ]
On August 14, 2026 an unauthorized third party used social engineering to obtain access through one temporarily compromised Quinn Emanuel user account to stored files in a single software application. The intruder accessed a limited number of client documents including material concerning Muddy Waters from litigation in Florida. The law firm notified affected parties and law enforcement, and said unauthorized access was no longer ongoing. A separate 2023 Quinn Emanuel client-data exposure involved a third-party data center and is not this incident.
Seyfarth Shaw LLP
August 18, 2026
•[ social, phishing, leak ]
Chicago law firm Seyfarth Shaw said an attacker posing as its IT help desk tricked an employee on Aug. 18, 2026, into emailing client documents with names and SSNs to an outside account. It says its network was not entered; it notified state AGs and offered credit monitoring.
McKesson Corporation
August 21, 2026
•[ phishing, healthcare, leak ]
McKesson discovered the intrusion on August 25, 2026. ShinyHunters claimed it used voice phishing against employees to compromise Okta single-sign-on accounts and access Salesforce and Snowflake environments, with approximately 1 TB exfiltrated between August 21 and August 25. McKesson confirmed customer-data exfiltration from third-party applications but has not confirmed the claimed access method, volume, record count, or data categories. Company services remained operational.
Undisclosed U.S. individual
August 21, 2026
•[ social, finance, government ]
Scammers initially impersonated an American Express representative and then NYPD and FBI personnel, using transfers, real officer names and badge numbers, and a video call to build credibility. The victim ultimately provided personal identification information.
ReliaQuest, LLC
August 22, 2026
•[ social, phishing, technology ]
ShinyHunters targeted ReliaQuest on August 22, 2026 using voice phishing, a lookalike single-sign-on page, and impersonation of a named ReliaQuest security employee. One employee entered a password and approved an MFA push, allowing the attacker to establish a temporary authenticated identity session and obtain view-only access to the employees Okta dashboard. Device-trust controls blocked every attempt to open business applications, and ReliaQuest terminated the session, expired the password, and reset authentication factors. ShinyHunters later posted screenshots from the identity dashboard, but no customer data or broader internal systems were accessed.
Nigerian Army (Headquarters)
August 29, 2026
•[ social, government, technology ]
On August 29, 2026, unauthorized memecoin-promotional posts appeared on the Nigerian Army official X account (@NigeriaArmyInfo), reportedly beginning around 3:50 p.m. The Army acknowledged attempted unauthorized account access around 5 p.m., activated security measures to regain exclusive control and told users to disregard unverified posts. The account-access mechanism and the operator were not identified, and no theft of information or intrusion into other Army systems was established. This was a separate social-media account and incident from the August 15 Defence Headquarters hijacking.
DriveWealth
September 4, 2026
•[ social, finance, technology ]
Jersey City, N.J., brokerage DriveWealth said unknown attackers using social engineering accessed its network on Sept. 4-5, 2026, and took retained personal data of customers of partner apps Revolut, Stake and Hatch. No trades were affected; customers were notified.
HBO Max (Warner Bros. Discovery) official Reddit account
September 6, 2026
•[ hack, malware, social ]
An unauthorized operator took over verified Reddit account u/hbomax and ran 108 deceptive paid advertisements over about 48 hours. Links impersonated HBO Max and software products and directed users to ClickFix command-pasting instructions that delivered malware. The malicious advertisements were paused after they were reported.
Brevo (formerly Sendinblue)
September 9, 2026
•[ hack, technology, finance ]
On September 9-10, 2026, an intruder abused a flaw in Brevo SAML SSO tenant scoping to access 138 customer accounts. The attacker used six of the accounts to distribute fraudulent messages from legitimate customer email channels and exported contacts from 43 accounts. Trezor was one affected Brevo customer; 347,149 newsletter email addresses were exported and misleading messages reached roughly 347,000 subscribers. Brevo shut the attack route and signed out sessions on September 10. The attack did not establish a breach of Trezor wallet infrastructure. The 138 customer accounts are effects within one compromised Brevo platform, not separate CED records.
Undisclosed freight carrier
September 18, 2026
•[ social, phishing, retail ]
An unnamed third-party freight carrier experienced an email-system compromise. Attackers obtained shipment-related information through the carrier, used it to arrange a fraudulent pickup supported by apparently correct paperwork, and diverted a load of blueberries from a cold-storage facility. The carrier itself was the compromised IT victim; the food theft was a downstream consequence. Victim country, compromise date, technique, actor identity and quantity of accessed correspondence were not disclosed. September 18, 2026 is a publication-date fallback, not the date of the intrusion.
Electrolux & Ontrac
September 25, 2026
•[ ransomware, manufacturing, retail ]
Electrolux & Ontrac was listed as a victim on the leak site of the emperador ransomware group; the attack is estimated to have taken place on 2026-09-25. Sector: Manufacturing. Hello Electrolux & OnTrac,
Still no response from you. When we called your IT helpdesk posing as threat researchers and asked about the breach, we were told, "We cannot talk about it."
You have one week before we release more data - starting with information on your employees.
We'd prefer to settle this directly.
Same goes for OnTrac. We recently learned that OnTrac has been paying employees as little as $14.50 an hour. As a result, we will be releasing salary information for all of their employees.
I also managed to get in touch with a former OnTrac employee, chill guy. Said his time there was horrible.
EMAIL: xdlmfao@morke.ru
SESSION: 05651c7323273b723588d47455471ee9e27feb5187a30f2933554a705aacb38358 [Sector: Retail, Manufacturing, Transportation]
Acli
August 14, 2026
•[ ransomware, social, government ]
Acli was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-08-14. Country: Italy. Website: acli.it. acli.it zoominfo.com/c/acli/372618594 ACLI (Christian Associations of Italian Workers) is a major Italian Catholic social promotion organization founded in 1944 to advocate for labor rights and human dignity. Operating a vast network of local clubs, the association provides essential community services, including tax assistance, employment support, and vocational training. Today, it continues to champion social solidarity, democratic participation, and active citizenship across Italy and internationally.
hd-werkstaetten.de
August 18, 2026
•[ ransomware, manufacturing, social ]
hd-werkstaetten.de was listed as a victim on the leak site of the ZaWoo ransomware group; the attack is estimated to have taken place on 2026-08-18. Sector: Manufacturing. Country: Germany. Website: hd-werkstaetten.de. hd-werkstaetten.de belongs to Heidelberger Werksttten der Lebenshilfe Heidelberg e. V., a German social enterprise / sheltered workshop organization supporting people with disabilities through employment, vocational training, and workplace inclusion. Its main site is in Heidelberg, Baden-Wrttemberg, Germany.
Arkin Group
June 30, 2026
•[ ransomware, social, retail ]
Arkin Group was listed as a victim on the leak site of the blacknevas ransomware group; the attack is estimated to have taken place on 2026-06-30. Sector: Professional Services. Country: Turkey. Website: arkingroup.com. CYBERSECURITY: ARKIN HOTEL GROUP SUFFERS MASSIVE DATA BREACH OVER 1 TB OF GUEST AND CASINO DATA STOLENCybersecurity experts from Cyclops Threat Intelligence have reported a critical incident affecting the Arkn Group hotel chain (www.arkingroup.com), including its premium properties The Arkn Colony, The Arkn Iskele, and Arkn Palm Beach in Northern Cyprus. According to preliminary assessments, the attackers managed to exfiltrate over one terabyte of internal documents, customer databases, and transaction logs, including confidential information from the Arkn Palm Beach Casino.Attack detailsAnalysts have established that the attackers gained initial access through a compromised employee account in the reservations department. Using legitimate remote administration tools, they gradually expanded their privileges, bypassed network segmentation, and exfiltrated a dataset totalling approximately 1.4 TB. Some of the stolen information has already surfaced on underground forums and darknet marketplaces.The stolen data includes: Full guest profiles (passport details, phone numbers, addresses, stay history); Financial details of bookings and payment credentials; The internal CRM system with staff notes on VIP clients; Casino database: player IDs, deposit amounts, visit frequency, records of chip exchange transactions and fund movements; Scanned passports, compliance check forms (KYC/AML), including source-of-funds questionnaires for high rollers.Objective and likely operatorBased on the intrusion characteristics and tactics used, experts link the incident to the threat group CryptoRex (tracked since 2023), which specialises in attacking hospitality and gambling businesses in the Mediterranean region. A combination of financial extortion and data sale to multiple buyers is considered likely. So far, no official ransom demand has been received, but portions of the archives have been put up for auction with a starting price of 8 bitcoins.Potential consequences of the leakThe leakage of confidential guest and especially casino client data entails a cascade of risks that go far beyond reputational damage.1. Personal security of high-net-worth guestsThe VIP casino player database, containing passport details, habits, and financial capabilities, serves as a direct directory for kidnappers, extortionists, and organised crime groups. Affected individuals may face real threats to their physical safety, as well as targeted blackmail (e.g., threats to expose gambling activity to business partners or family members in countries where gambling is stigmatised).2. Financial fraudPayment data from hotel guests and credit/debit cards linked to casino accounts will enable unauthorised transactions. Given the high credit limits of casino patrons, the scale of potential phishing and card fraud is assessed as very significant.3. Compliance nightmare and regulatory finesAlthough the international casino operators in Northern Cyprus do not directly fall under GDPR, many guests are citizens of the EU, the UK, and CIS countries. The breach demonstrates a flagrant failure to meet personal data protection standards. Lawsuits by affected individuals in national courts and scrutiny by international payment systems (Visa, Mastercard) are possible, which could suspend acquiring services.4. Risks to the casino itself and the jurisdiction[6/9/2026 1:09 PM] ChatGPT 5 | Deepseek | Claude: The exposure of internal AML records documenting the origin of funds and possible links to politically exposed persons could spark money-laundering investigations. For Northern Cypruss gambling zone, already under close watch by the FATF, this could lead to tighter international financial monitoring and being placed on grey lists.5. Reputational ruinNo wealthy client will entrust their data to a hotel incapable of protecting basic IT infrastructure. Trust in the Arkn brand, which for decades has built an image of secluded luxury, will be undermined for years. Competitors in the elite leisure market, especially in Dubai, Monaco, and the Maldives, will immediately exploit the situation to poach wary clientele.Analysts recommendationsCyclops Threat Intelligence strongly advises all individuals who have ever stayed at Arkn hotels or visited Arkn Palm Beach Casino to: Immediately block and reissue any bank cards used; Monitor credit reports for new applications; Enable additional authentication factors on email and financial services; Be highly critical of any incoming calls or messages demanding identity confirmation or fund transfers these could be targeted attacks using contextual details from the leaked staff notes.The Arkn Group press office has not yet responded to official inquiries. The companys website remains operational, but online booking sections are temporarily unavailable. Northern Cyprus authorities stated that they are aware of the incident and have begun consultations with EU experts under a cyber-resilience programme.Report prepared by the Thomson Reuters cybersecurity desk based on the Cyclops Threat Intelligence analytical brief.
