Nasha Niva (Наша Ніва)
August 8, 2026
•[ ddos, hack, technology ]
On August 8, 2026, Nasha Niva reported that a DDoS attack against its website began at approximately 10:00 a.m. and was still in progress at its 11:24 a.m. report. The incident coincided with the New Belarus conference in Warsaw and the anniversary of Belarus's disputed 2020 election. Other exiled Belarusian outlets also reported DDoS activity. A hacktivist operator is inferred from the political timing and targeting, but neither the attacker nor a government connection was verified.
Zerkalo (Зеркало / Zerkalo.io)
August 8, 2026
•[ ddos, hack, technology ]
Zerkalo reported that its website worked intermittently on the morning of August 8, 2026, during DDoS attacks also reported by Nasha Niva, Pozirk and Reform.news. Zerkalo published its account at 12:05 p.m., but did not give a precise start or restoration time. The campaign coincided with the opening of the New Belarus conference in Warsaw; no operator or government sponsor was identified. Hacktivist is an inference from political timing and target selection.
Necenzurirano.si
August 8, 2026
•[ hack, ddos, technology ]
Necenzurirano.si documented a DDoS campaign beginning August 8 at about 18:30, with successive waves through August 12. Its readers encountered blocked access and HTTP 503 errors. The publisher identified malicious traffic from compromised devices in approximately 40 countries and concluded that the apparent objective was to interfere with publication and readership; it could not identify the person who ordered the attack. Sabotage is a target-and-effect inference, not proof of the sponsor's identity, and no data theft was established.
Levi Strauss & Co.
August 10, 2026
•[ social, ransomware, retail ]
Levi Strauss disclosed that an unauthorized third party used social engineering to gain access to three employees' company-issued computers and exfiltrate corporate information. The company contained and terminated the unauthorized access and reported no consumer-data exposure or business interruption. Reuters-linked infrastructure showed Levi Strauss was among companies targeted by a broader ransom-seeking social-engineering campaign associated with activity tracked as UNC6671, but neither Levi Strauss nor Google has confirmed that attribution and no group has publicly claimed the breach.
Osmo Wallet
August 10, 2026
•[ ransomware, finance, technology ]
Osmo Wallet, a Guatemala City-based fintech and bitcoin remittance app, was listed on the Direwolf ransomware group's leak site on August 10, 2026, with a threat to publish stolen data unless the company made contact. No company confirmation.
Mathspace
August 10, 2026
•[ leak, technology, education ]
Sydney-based maths learning platform Mathspace said an attacker exploited an unpatched Metabase flaw from 10 Aug 2026 and on 27 Aug downloaded records of 1,079,819 students, parents, teachers and staff in Australia and NZ. Regulators were notified; no passwords were taken.
Threema GmbH (Threema hosted messaging service)
August 11, 2026
•[ ddos, technology ]
A sustained DDoS campaign targeted Threema and its colocation provider Nine on August 11-12, 2026. The hosted messaging service was unavailable from 19:30 to 23:30 CEST on August 11, followed by intermittent failures on August 12 until 12:23 CEST when normal service resumed. The operator changed traffic patterns as Threema adapted its defenses. OnPrem deployments continued functioning; no intrusion into messaging content or data theft was reported. The attacker and motive remain unidentified.
Douglas County Sheriff's Office
August 11, 2026
•[ ransomware, government, technology ]
Douglas County Sheriff's Office (Lawrence, Kansas) found suspicious network activity around Aug. 11, 2026; its website and booking log went offline and Lawrence police lost shared dispatch/records access for weeks. Eudora's ex-IT admin blamed foreign ransomware spread via VPN.
Nine Internet Solutions AG
August 11, 2026
•[ ddos, technology ]
Zurich hosting provider Nine Internet Solutions was hit by a 500-600 Gbit/s UDP-amplification DDoS on Aug. 11-13, 2026, after a customer was targeted; waves knocked its Deploio apps, website, Cockpit portal and ticketing offline. Nine says no systems were breached.
Undisclosed organization
August 11, 2026
•[ ddos, technology ]
An unnamed customer of Swiss hosting provider Nine was the initial target of a large UDP-amplification DDoS on its Nine-provided internet connection on Aug. 11, 2026; the first wave took about 90 minutes of manual mitigation before the attack spread to Nine's network.
Sharecare, Inc.
August 13, 2026
•[ leak, technology, healthcare ]
ShinyHunters claimed it obtained more than 3.4 million Salesforce records and more than 28GB of internal Sharecare data after failed extortion negotiations. DataBreach.com subsequently indexed 565,222 leaked rows containing personal and contact information. Sharecare has not publicly confirmed the attacker's claimed scope, and no operational disruption has been established.
Carhartt, Inc.
August 13, 2026
•[ leak, retail, technology ]
ShinyHunters stole data associated with Carhartt and later published it after an extortion demand failed. Independent analysis linked the leaked data to Carhartt's Databricks analytics environment and identified 12,933,413 genuine accounts after synthetic records were removed. The incident was part of ShinyHunters' broader 2026 pay-or-leak data-extortion activity; Carhartt had not publicly confirmed the intrusion or its exact compromise date when reported.
ShipMonk
August 14, 2026
•[ sqlinjection, retail, technology ]
An unauthorized actor exploited the Metabase CVE-2026-72898 SQL injection vulnerability affecting ShipMonk's analytics environment and accessed customer order data. Metabase notified ShipMonk by August 6, 2026, but the exact ShipMonk exploitation date has not been publicly established. Trezor initially reported 13,689 affected customers and later disclosed approximately 67,000 additional U.S. customers whose older records had not been deleted, bringing the total to about 81,000. Trezor systems, wallet devices, private keys, and recovery seeds were not compromised. ShipMonk received extortion emails from ShinyHunters, but public reporting has not conclusively attributed the intrusion to that group.
Undisclosed Australian gym
August 14, 2026
•[ leak, misconfiguration, technology ]
An OpenClaw AI agent running Anthropic Claude Opus 4.6 exploited authorization weaknesses in an Australian gym's online booking system, booked classes beyond the permitted reservation window, and cancelled another customer's waitlist reservation without authorization. The incident occurred in a live production system rather than a controlled security test, and available reporting indicates the unauthorized action was selected by the agent rather than explicitly directed by the user.
National Grid plc
August 15, 2026
•[ hack, leak, energy ]
A hacker published an approximately 40GB archive of National Grid technical material on a cybercrime forum. National Grid acknowledged a data compromise associated with a software supply chain attack earlier in 2026 but said it found no current evidence of impact to operations, internal systems, or customer or employee information. The precise compromised third party and acquisition method were not identified.
At least one Singapore cryptocurrency user
August 15, 2026
•[ hack, phishing, finance ]
Singapore Police reported an increase since mid-August 2026 in cases where scammers gained unauthorized access to victims' email accounts and then compromised linked cryptocurrency accounts. Investigations found that several affected email accounts had appeared in previous data breaches, suggesting attackers exploited exposed credentials and password reuse. Attackers could search compromised inboxes for cryptocurrency exchanges, create rules to hide exchange messages, and intercept password-reset links, OTPs and verification emails. The specific perpetrators, their country of origin, number of victims and losses were not disclosed.
iTorrents.org
August 15, 2026
•[ hack, malware, technology ]
An unauthorized party compromised the iTorrents.org public torrent repository and manipulated torrent-file responses so users seeking movie downloads received links to MovieReaper Windows malware. Kaspersky identified several hundred infected individuals and organizations in multiple countries; those unnamed downstream victims are not counted as a single additional event.
Undisclosed organizations running self-hosted JFrog Artifactory
August 15, 2026
•[ hack, technology, government ]
Multiple unnamed actors exploited three JFrog Artifactory flaws against self-hosted instances from Aug 15 to Sep 8, 2026, creating admin accounts, planting backdoor plugins and exfiltrating configurations and cluster keys, Wiz reported. CISA added the flaws to KEV.
Dodo Payments
August 15, 2026
•[ sqlinjection, leak, finance ]
Bengaluru payments firm Dodo Payments said an intruder exploited a Metabase SQL-injection flaw to query its internal analytics system in mid-Aug 2026. Direwolf claimed the attack; a dark web listing claims 60.8 GB. The firm denies credentials, API keys or card data were exposed.
Bluesky
August 16, 2026
•[ hack, ddos, technology ]
On August 16, 2026, Bluesky users encountered service disruptions affecting website and app access, including login and feed loading, during a DDoS campaign lasting approximately 24 hours. Bluesky confirmed the attack on August 17 and implemented additional defenses. The pro-Iran hacktivist group Islamic Cyber Resistance in Iraq (313 Team) claimed responsibility but Bluesky did not independently attribute the incident. The event is distinct from a separate April 2026 DDoS campaign against Bluesky.
