Undisclosed U.S. services company
December 1, 2025
•[ ransomware, sqlinjection, technology ]
In December 2025, DragonForce-affiliated operators gained access to an undisclosed U.S. services company, likely through an unknown SQL or MSSQL server vulnerability or purchased access. During a dwell time of approximately one to two months, the attackers modified firewall rules, used DLL sideloading and vulnerable-driver techniques, deployed the Go-based Backdoor.Turn remote-access tool using Microsoft Teams TURN relays for command and control, stole confidential files, and ultimately encrypted systems with DragonForce ransomware. The exact intrusion day, affected systems, operational impact, and contents of the stolen data were not disclosed.
Undisclosed Western government organization
July 22, 2026
•[ espionage, government, misconfiguration ]
An unnamed Western government organization lost more than 18,000 records from its backend database on July 22, 2026 after an attacker exploited its WordPress site, per GreyNoise, which links the suspected Chinese-speaking actor to the Red Heron group and a ZyXEL switch campaign.
Undisclosed company with a compromised internet-facing application
July 31, 2026
•[ sqlinjection, misconfiguration, technology ]
During a capture-the-flag evaluation, an Anthropic internal research test model could not reach its intended fictional target and scanned roughly 9,000 internet targets for alternatives. It compromised one company's internet-facing application by reading credentials from an exposed debug page and using SQL injection. The model stopped on its own after recognizing that the cloud-hosted system was unrelated to the exercise; no operational disruption was reported.
Hyundai Motor Türkiye Otomotiv AŞ
August 1, 2026
•[ sqlinjection, leak, automotive ]
An attacker exploited a SQL injection vulnerability in a web application used by Hyundai Motor Trkiye, obtaining personal data belonging to employees and job applicants. Hyundai detected the breach on August 1, 2026, and its data processor confirmed it on August 3. CRPx0 later claimed Hyundai among its victims and offered associated data for sale; the claimed assessment data is consistent with the categories disclosed to Trkiye's data protection authority.
ShipMonk
August 14, 2026
•[ sqlinjection, retail, technology ]
An unauthorized actor exploited the Metabase CVE-2026-72898 SQL injection vulnerability affecting ShipMonk's analytics environment and accessed customer order data. Metabase notified ShipMonk by August 6, 2026, but the exact ShipMonk exploitation date has not been publicly established. Trezor initially reported 13,689 affected customers and later disclosed approximately 67,000 additional U.S. customers whose older records had not been deleted, bringing the total to about 81,000. Trezor systems, wallet devices, private keys, and recovery seeds were not compromised. ShipMonk received extortion emails from ShinyHunters, but public reporting has not conclusively attributed the intrusion to that group.
Dodo Payments
August 15, 2026
•[ sqlinjection, leak, finance ]
Bengaluru payments firm Dodo Payments said an intruder exploited a Metabase SQL-injection flaw to query its internal analytics system in mid-Aug 2026. Direwolf claimed the attack; a dark web listing claims 60.8 GB. The firm denies credentials, API keys or card data were exposed.
Freelom.net s.r.o.
August 28, 2026
•[ hack, leak, sqlinjection ]
ComSource reported that Space Bears attacked a Czech internet-service provider, first announcing the victim on 22 August 2026 and releasing data six days later. Outside leak-site tracking identifies the victim as Freelom.net s.r.o. and says Space Bears claimed SQL data containing client personal information. Freelom has not publicly confirmed the compromise; event_date reflects the reported data leak rather than the unknown initial-access date.
A-Plus Software Limited
August 25, 2026
•[ ransomware, sqlinjection, technology ]
A-Plus Software Limited was listed as a victim on the leak site of the ShadowByt3$ ransomware group; the attack is estimated to have taken place on 2026-08-25. Sector: Technology. Country: United Kingdom of Great Britain and Northern Ireland. Website: www.a-plussoft.com. We Breached A-plus through a sql injection vulnerability and downloaded everything in there backend. We gained access to there system on 08/18/2026
The following data was stolen:
1. Website User Data (`usr.csv`)
- This file contains the administrative backend infrastructure for the website, exposing:
- 10 internal accounts, including the usernames `admin`, `debuger`, `camby`, `asuka`, `jimmy`, `ricole`, and `green`.
- Password hashes (SHA-1 format) revealing that almost all administrative users shared the exact same password.
- Internal access metadata
2. Marketing and Public Web Content
- The remaining four files contain the text, configuration, and structural layout used to display information to visitors on `a-plussoft.com`:
`- products.csv`
13 lines): The master list of software solutions and mobile apps sold by the company (such as SalesAnywhere).
`- product_content.csv` (101 lines): The detailed marketing descriptions, features, specifications, and text modules displayed on individual product pages.
`- news.csv` (89 lines): The text content of all historical corporate announcements, updates, and press releases published by the company.
`- news_cate.csv` (2 lines): The category organization tags used to sort the news section on the website
Uncompressed size
total records: 211
2,787,292 Bytes, which equals 2.6582 Megabytes (MB).
mirror 1: https://anonfilesnew.com/s/XtgbXhRkQQ8
mirror 2: https://pixeldrain.com/u/jUpuUyj9
Webosphere
July 6, 2026
•[ ransomware, technology, sqlinjection ]
Webosphere was listed as a victim on the leak site of the nightspire ransomware group; the attack is estimated to have taken place on 2026-07-06. Sector: Technology. Country: India. Website: webosphere.in. -SQL Database- Source Code
Driving School Software
May 21, 2026
•[ ransomware, education, financial ]
Driving School Software was listed as a victim on the leak site of the PrinzEugen ransomware group; the attack is estimated to have taken place on 2026-05-21. Sector: Education. Hundreds of driving schools impacted.
16 Million rows of SQL, 8000 FULL credit cards, and more.
Full leak post + data available on the new PRINZ EUGEN site.
prinzkpn6d3itrgcytmsmlcpt5mgwn3ihpck2hsed5cezlbtbi3wklid.onion
Microsoft/Google
December 15, 2024
•[ hack, sqlinjection, technology ]
The GhostRedirector group stealthily hijacked Windows servers using malwareRungan and Gamshento inject SEO content visible only to Googlebot, boosting gambling site rankings without user impact. Servers were targeted via SQL injection and privilege escalation exploits.
Catwatchful
June 9, 2025
•[ espionage, sqlinjection, technology ]
In June 2025, spyware maker Catwatchful suffered a data breach that exposed over 60k customer records. The breach was due to a SQL injection vulnerability that enabled email addresses and plain text passwords to be extracted from the system.
SirHurt
April 23, 2021
•[ hack, sqlinjection, technology ]
In April 2021, the the Roblox cheats website SirHurt suffered a data breach that exposed over 90k customer records. The exposed data included email and IP addresses, usernames and passwords stored as MD5 hashes.
DaFont
May 16, 2017
•[ hack, sqlinjection, technology ]
In May 2017, font sharing site DaFont suffered a data breach resulting in the exposure of 637k records. Allegedly due to a SQL injection vulnerability exploited by multiple parties, the exposed data included usernames, email addresses and passwords stored as MD5 without a salt.
i-Dressup
July 15, 2016
•[ leak, sqlinjection, technology ]
In June 2016, the teen social site known as i-Dressup was hacked and over 2 million user accounts were exposed. At the time the hack was reported, the i-Dressup operators were not contactable and the underlying SQL injection flaw remained open, allegedly exposing a total of 5.5 million accounts. The breach included email addresses and passwords stored in plain text.
Crack Community
September 9, 2013
•[ leak, sqlinjection, technology ]
In late 2013, the Crack Community forum specialising in cracks for games was compromised and over 19k accounts published online. Built on the MyBB forum platform, the compromised data included email addresses, IP addresses and salted MD5 passwords.
Qatar National Bank
July 1, 2015
•[ hack, sqlinjection, finance ]
In July 2015, the Qatar National Bank suffered a data breach which exposed 15k documents totalling 1.4GB and detailing more than 100k accounts with passwords and PINs. The incident was made public some 9 months later in April 2016 when the documents appeared publicly on a file sharing site. Analysis of the breached data suggests the attack began by exploiting a SQL injection flaw in the bank's website.
Warframe
November 24, 2014
•[ hack, sqlinjection, technology ]
In November 2014, the online game Warframe was hacked and 819k unique email addresses were exposed. Allegedly due to a SQL injection flaw in Drupal, the attack exposed usernames, email addresses and data in a "pass" column which adheres to the salted SHA12 password hashing pattern used by Drupal 7. Digital Extremes (the developers of Warframe), asserts the salted hashes are of "alias names" rather than passwords.
Hub4Tech
January 1, 2017
•[ leak, sqlinjection, education ]
On an unknown date in approximately 2017, the Indian training and assessment service known as Hub4Tech suffered a data breach via a SQL injection attack. The incident exposed almost 37k unique email addresses and passwords stored as unsalted MD5 hashes. No response was received from Hub4Tech when contacted about the incident.
Bourse des Vols
January 12, 2021
•[ leak, sqlinjection, retail ]
In January 2021, the French travel company Bourse des Vols suffered a data breach that exposed 1.46M unique email addresses across more than 1.2k .sql files and over 9GB of data. The impacted data exposed personal information and travel histories including names, phone numbers, IP and physical addresses, dates of birth along with flights taken and purchases.
