SafePal (SkyGenesis Holdings Limited)
August 17, 2026
•[ leak, phishing, technology ]
SafePal confirmed that an authorization flaw in an order-tracking plugin allowed unauthorized external access to customer order information affecting 39,798 customers. The precise access date has not been established. Customers reported phishing and impersonation attempts using detailed SafePal order information by early July, and SafePal later identified more than 30 fraudulent websites or phishing links associated with scam activity. A threat actor subsequently advertised a dataset matching the affected population for sale. Seed phrases, private keys, wallet passwords, payment information and government identification were not affected.
Bits of Gold
August 17, 2026
•[ hack, finance, technology ]
Hackers gained unauthorized access to a third-party data analytics system used by Bits of Gold and accessed personal information belonging to approximately 200,000 customers. The company said funds, digital assets, passwords, private keys, CVV codes, and scanned identification documents were not affected.
Alation, Inc.
August 18, 2026
•[ hack, technology, misconfiguration ]
Alation confirmed unauthorized activity in one of its systems on August 18. TeamPCP publicly claimed responsibility and alleged theft of 73 GB of data. Independent security telemetry linked Alation to the broader TeamPCP LiteLLM/Trivy supply-chain campaign and identified exposed Alation CI-runner material containing AWS credentials and internal repository references. The exact 73 GB quantity remains a threat-actor claim, and Alation has not confirmed customer-data theft. The separate availability degradation reported the same day is not coded as a disruptive effect because Alation has not established that it was caused by the intrusion.
Koninklijke Philips N.V.
August 18, 2026
•[ ransomware, technology, healthcare ]
Philips identified and contained unauthorized activity affecting a specific enterprise server used to store internal data and isolated the affected server. Philips reported no impact to customer environments. In a September 14 update, Philips said incident-response activities were complete and investigation findings supported closure of the incident, while additional analysis of a subset of downloaded data remained ongoing. Cl0p claimed approximately 13.5 GB of drawings, diagrams, and blueprints.
City of Fort Scott
August 18, 2026
•[ ransomware, government, technology ]
A ransomware attack detected on 18 Aug 2026 closed Fort Scott, Kansas, City Hall and forced the city network offline; IT staff restored systems within six days, with about a week of data lost on two machines. The attackers were not identified.
PayUp
August 19, 2026
•[ ransomware, finance, technology ]
PayUp, an Austin, Texas fintech offering early vendor payments and invoice factoring to property managers, was listed on the Direwolf ransomware group's leak site on Aug 19, 2026, claiming stolen customer records. PayUp has not confirmed the claim.
Undisclosed crates.io maintainer
August 20, 2026
•[ hack, leak, malware ]
On Aug 20, 2026, attackers hijacked a crates.io maintainer's account and published tampered versions of Rust crates arrayref, internment and append-only-vec carrying a credential- and wallet-stealing payload. Wiz linked it to North Korean actors; versions were removed.
ReliaQuest, LLC
August 22, 2026
•[ social, phishing, technology ]
ShinyHunters targeted ReliaQuest on August 22, 2026 using voice phishing, a lookalike single-sign-on page, and impersonation of a named ReliaQuest security employee. One employee entered a password and approved an MFA push, allowing the attacker to establish a temporary authenticated identity session and obtain view-only access to the employees Okta dashboard. Device-trust controls blocked every attempt to open business applications, and ReliaQuest terminated the session, expired the password, and reset authentication factors. ShinyHunters later posted screenshots from the identity dashboard, but no customer data or broader internal systems were accessed.
CyrusOne, LLC
August 23, 2026
•[ ransomware, technology ]
ShinyHunters claimed it stole 12.9 million Salesforce records and approximately 645 GB of SharePoint data from CyrusOne and demanded $13 million. The stolen material reportedly included customer and employee records, contracts, data center engineering drawings, security documentation and access-control information. DataBreach.com indexed 552,494 records from the released data. No operational disruption has been established.
Norwegian Digitalisation Agency (Digdir)
August 24, 2026
•[ ddos, government, technology ]
DDoS waves targeted Digdir's ID-porten from August 24 to August 26, 2026, intermittently disrupting shared digital services. Digdir says services were mostly available during the campaign; the attack window is not continuous downtime. Server Killers claimed responsibility, without public official attribution. No personal-data loss was indicated. Some restrictions on foreign logins persisted after the attack ended.
HIT d.d. Nova Gorica
August 25, 2026
•[ hack, retail, technology ]
HIT detected unauthorized access to its information systems on August 25, 2026. The incident forced six casinos to close for roughly three days and caused limited hotel operations, cash-register problems and unavailable gaming and loyalty functions. Casinos began reopening on August 28 with reduced functionality. HIT had not disclosed whether data was stolen, whether a ransom was demanded, or who was responsible as of the source publication.
Undisclosed Philippine marine engineering and shipbuilding company
August 26, 2026
•[ espionage, manufacturing, technology ]
Website data was stolen following administrator compromise, by 13 August 2026. Espionage motive is inferred from the broader targeted collection. Intrusion date is unknown; event_date uses the publication-date fallback.
Undisclosed Philippine marine engineering and shipbuilding company
August 26, 2026
•[ financial, hack, manufacturing ]
Injected code displayed fake verification content using Amatera-linked delivery infrastructure. Financial intent is inferred; visitor infections and linkage to the separate data theft are unconfirmed. Onset is unknown; event_date uses the publication-date fallback.
Canva Pty Ltd
August 26, 2026
•[ hack, ransomware, technology ]
Sydney design platform Canva said attackers using vendor Canny's link to its Salesforce account accessed limited enterprise customer contact and contract data in late Aug 2026. The Seven Deadly Sins claimed the theft, said it exported far more and listed Canva for extortion.
Freelom.net s.r.o.
August 28, 2026
•[ hack, leak, sqlinjection ]
ComSource reported that Space Bears attacked a Czech internet-service provider, first announcing the victim on 22 August 2026 and releasing data six days later. Outside leak-site tracking identifies the victim as Freelom.net s.r.o. and says Space Bears claimed SQL data containing client personal information. Freelom has not publicly confirmed the compromise; event_date reflects the reported data leak rather than the unknown initial-access date.
Mercury Technologies
August 28, 2026
•[ leak, finance, technology ]
San Francisco fintech Mercury's client email list, stored by feedback-software vendor Canny, was exported and sold, according to The Seven Deadly Sins, which claimed to have breached Canny in late Aug 2026. Mercury has not commented and the claim is unconfirmed.
Nigerian Army (Headquarters)
August 29, 2026
•[ social, government, technology ]
On August 29, 2026, unauthorized memecoin-promotional posts appeared on the Nigerian Army official X account (@NigeriaArmyInfo), reportedly beginning around 3:50 p.m. The Army acknowledged attempted unauthorized account access around 5 p.m., activated security measures to regain exclusive control and told users to disregard unverified posts. The account-access mechanism and the operator were not identified, and no theft of information or intrusion into other Army systems was established. This was a separate social-media account and incident from the August 15 Defence Headquarters hijacking.
Neogen Corporation
August 29, 2026
•[ ransomware, technology, manufacturing ]
Neogen Corporation, a Lansing, Michigan maker of food and animal safety products, was listed on ShinyHunters' leak site on August 29, 2026 with a warning to make contact by September 1 before its data is leaked. Neogen had not commented and the claim remains unverified.
DistributionNOW (DNOW Inc.)
August 29, 2026
•[ ransomware, technology ]
Houston-based industrial distributor DNOW Inc. was listed in late August 2026 by the Falcon extortion group, which claimed about 344 GB of corporate, payroll, employee and industrial-control files. DNOW has not publicly confirmed the claim.
Avelogic
August 30, 2026
•[ ransomware, technology, government ]
Ransomware hit Singapore vendor Avelogic's SmartHRMS HR and payroll system on 30-31 Aug 2026, used by MUIS-overseen mosques and madrasahs, forcing manual payroll. Avelogic found no evidence of bulk data theft, paid no ransom, filed a police report and notified the PDPC.
