Undisclosed Claude user
August 31, 2026
•[ hack, malware, technology ]
A criminal operator used commodity infostealer malware on an affected user's computer to steal an active Claude login session and replay it to access the victim's Claude account and consume paid usage. This record represents a confirmed victim within a broader campaign affecting multiple Claude users; Anthropic's own systems were not breached.
Undisclosed organization investigated by Sygnia
August 31, 2026
•[ espionage, technology, government ]
Fire Ant compromised Cisco IOS XR routers, TACACS authentication systems, and Linux management hosts at an undisclosed organization, using the infrastructure to capture network traffic and administrative credentials, maintain covert access, and suppress security telemetry. The incident was part of a broader China-nexus espionage campaign with strong behavioral and tooling overlap with UNC3886. Fire Ant used the compromised environment to probe connected high-value and critical-infrastructure networks, but Sygnia observed only scanning and connection attempts against those downstream environments rather than confirmed compromise.
Super Systems Inc
August 31, 2026
•[ ransomware, manufacturing, technology ]
Super Systems Inc (SSi), a Cincinnati, Ohio maker of heat-treating controls and software, was listed on the Interlock ransomware group's leak site on Aug 31, 2026, which claimed about 390 GB of stolen data. SSi has not confirmed or denied the claim.
Hayward Holdings
August 31, 2026
•[ ransomware, manufacturing, technology ]
Hayward Holdings, a Charlotte, NC pool and spa equipment maker (NYSE: HAYW), was listed by the Falcon extortion group on Aug 31, 2026, which claimed 848 GB of stolen corporate and customer data. The company has not confirmed the claim; a law firm opened an investigation.
IDScan.net
September 1, 2026
•[ leak, technology ]
IDScan.net, a New Orleans ID verification firm, confirmed hackers may have copied customer data from its cloud after Nexus, a dark-web service advertised on Russian forum Exploit, sold 153M+ U.S./Canadian license scans in Sept 2026. FBI investigating; credit monitoring offered.
Weverse Company Inc. (Weverse)
September 3, 2026
•[ leak, technology, misconfiguration ]
An unauthorized party obtained information through a security flaw in a Weverse service API. South Korean authorities notified Weverse of the issue on September 3, 2026, and the operator subsequently confirmed exposure of 422,584 account-level entries containing internal account identifiers and purchase-related data. Weverse restricted access to its payment-information processing API and filed a breach report with KISA on September 4. The initial extraction date and actor remain undetermined; September 3 is the discovery proxy.
Healing Paper
September 4, 2026
•[ hack, healthcare, technology ]
Healing Paper, the Seoul-based operator of cosmetic-surgery platform Gangnam Unni, said an unidentified attacker abused its consultation-records API on Sept 4, 2026, exposing data of 219,665 users in Korea, Japan and Taiwan. It blocked the route and notified users.
DriveWealth
September 4, 2026
•[ social, finance, technology ]
Jersey City, N.J., brokerage DriveWealth said unknown attackers using social engineering accessed its network on Sept. 4-5, 2026, and took retained personal data of customers of partner apps Revolut, Stake and Hatch. No trades were affected; customers were notified.
HBO Max (Warner Bros. Discovery) official Reddit account
September 6, 2026
•[ hack, malware, social ]
An unauthorized operator took over verified Reddit account u/hbomax and ran 108 deceptive paid advertisements over about 48 hours. Links impersonated HBO Max and software products and directed users to ClickFix command-pasting instructions that delivered malware. The malicious advertisements were paused after they were reported.
Liquid Network
September 6, 2026
•[ hack, financial, technology ]
Hackers exploited a bug in Liquid Network, the Blockstream-developed Bitcoin sidechain, on Sept. 6, 2026 to mint unbacked L-BTC and withdraw ~4,000 BTC ($320M) from its federation wallet. Liquid halted the network; self-described white hats returned 3,400 BTC.
Undisclosed organizations
September 7, 2026
•[ phishing, technology ]
CloudSEK found that BigBear 2.0, a phishing-as-a-service operation using adversary-in-the-middle login pages, captured over 5,000 Microsoft 365 credentials and session cookies and bypassed MFA at 258 organizations in 40+ countries. Operators remain unidentified.
Undisclosed Philippine nuclear research agency
September 8, 2026
•[ espionage, leak, government ]
A suspected Chinese-speaking operator exploited an ownCloud authentication weakness and stole 176 files totaling about 372 MB from a Philippine nuclear research agency. The stolen material was already present on attacker-controlled infrastructure when researchers discovered it on 13 August 2026; the exact theft date is not established, so event_date uses the supplied source publication date.
National Directorate of Cyber Security (DNSC)
September 8, 2026
•[ ddos, government, technology ]
Attackers launched approximately 2.8 million access requests against dnsc.ro at around 17:00 on 8 September 2026. About 50,000 requests passed DNSC's technical filters and overloaded the website, causing an interruption lasting less than 30 minutes. DNSC director Dan Cmpean said the attackers sought reputational impact by demonstrating vulnerability and undermining public and partner confidence. The specific group and its country of origin were not attributed.
Undisclosed healthcare organization
September 8, 2026
•[ hack, healthcare, technology ]
Google's Mandiant reported that a data extortion group breached an unnamed healthcare organization and stole drug research, corporate data and a proprietary AI model, then threatened to publish it unless paid. Disclosed in GTIG's Q2 2026 AI Threat Tracker.
Undisclosed enterprise company investigated by Unit 42
September 9, 2026
•[ hack, technology ]
A human ransom attacker used multiple frontier AI agents to compromise an undisclosed enterprise network in less than 10 hours. The agents extracted credentials and cloud keys from code repositories, a secrets-management system and other enterprise applications, allowing expansion into cloud and identity infrastructure. An attempted Terraform backdoor was blocked. Unit 42 clarified that the incident was an intrusion rather than a ransomware attack. The exact intrusion date, victim industry and victim country were not disclosed; event_date therefore uses the supplied source publication date.
Brevo (formerly Sendinblue)
September 9, 2026
•[ hack, technology, finance ]
On September 9-10, 2026, an intruder abused a flaw in Brevo SAML SSO tenant scoping to access 138 customer accounts. The attacker used six of the accounts to distribute fraudulent messages from legitimate customer email channels and exported contacts from 43 accounts. Trezor was one affected Brevo customer; 347,149 newsletter email addresses were exported and misleading messages reached roughly 347,000 subscribers. Brevo shut the attack route and signed out sessions on September 10. The attack did not establish a breach of Trezor wallet infrastructure. The 138 customer accounts are effects within one compromised Brevo platform, not separate CED records.
Air Canada
September 9, 2026
•[ ransomware, leak, technology ]
The Gentlemen ransomware group listed Montreal-based Air Canada on its leak site on Sept 9, 2026, claiming to have stolen 51,409 'critical files'. A dataset of about 489,000 mostly email records was later indexed; Air Canada has not confirmed it; no disruption was reported.
Surfshark
September 9, 2026
•[ misconfiguration, technology, leak ]
VPN provider Surfshark (Netherlands) disclosed on Sep 9, 2026 that a threat actor accessed a misconfigured, internet-exposed internal test server holding engineering material and an isolated proxy server. Detected Aug 31; Surfshark says no user data or VPN services were affected.
Undisclosed organizations
September 9, 2026
•[ ransomware, espionage, technology ]
Cisco Talos disclosed on 9 Sep 2026 that three clusters exploited Cisco Secure FMC flaws at unnamed organizations: a Qilin-linked affiliate stole data and deployed Qilin ransomware, Sandworm-linked UAT-11823 harvested firewall configurations, and UAT-12197 stole credentials.
Wilke
September 9, 2026
•[ ransomware, technology ]
Wilke, an Odense, Denmark market research and polling firm, was hit by a ransomware attack that took its systems down; CEO Stine Halberg said returning to full capacity took longer and was bumpier than the few weeks she had hoped. Attack date and attacker not disclosed.
