Ministerio de Justicia y del Derecho (Colombian Ministry of Justice)
August 2, 2026
•[ ransomware, government, technology ]
On August 2, 2026 a ransomware infection struck the Colombian Ministry of Justice, disrupting administrative IT and digital services. The ministry isolated affected systems and switched document submission and citizen assistance to in-person, telephone and temporary email channels. By August 15 the cannabis-control licensing platform (MICC) remained unavailable and SICOQ operated only partially; the electronic archive document system (SGDEA) remained out of service on August 20, restricting access to registered petitions. No verified file theft, attacker identity or completed encryption extent was disclosed.
Metabase, Inc. (Metabase Cloud)
August 3, 2026
•[ hack, leak, technology ]
On August 3, 2026, attackers exploited a previously unknown vulnerability in Metabase Cloud's authentication flow to create unauthorized administrator sessions and API keys on customer analytics instances. They accessed or exported data from affected customer-connected databases, including Framework and Tally. Metabase said fewer than 3% of its cloud customers were compromised and deployed patches by August 6. ShinyHunters publicly claimed responsibility on August 11, but the attribution has not been independently confirmed. This record captures the shared Metabase Cloud compromise, with customer disclosures representing downstream effects rather than separate intrusions into their production networks.
Undisclosed organization investigated by QUIRSO
August 4, 2026
•[ ransomware, technology, hack ]
Attackers exploited a VMware vCenter server at an unnamed organization, terminated running virtual machines and encrypted datastore files with Babuk-derived ransomware on August 4. This documented attack occurred within a larger global vCenter exploitation campaign; ransomware deployment at other victims is unverified.
Jared Wray-maintained Keyv, Cacheable and Ecto projects
August 4, 2026
•[ hack, technology ]
An attacker used a compromised maintainer token to alter the Keyv, Cacheable and Ecto repositories and publish poisoned releases on 4 August 2026. Attacker-associated account activity began by 08:34:57 UTC and the first confirmed malicious package was published at 09:35 UTC.
Deliveroo (Roofoods Limited)
August 4, 2026
•[ hack, technology ]
ChainDrop harvested publishing credentials associated with Deliveroo and used them to publish malicious versions of two npm packages during the automated propagation wave on 4 August 2026. The first malicious publication occurred at approximately 10:33 UTC.
Ornikar (Marianne Formation)
August 4, 2026
•[ hack, malware, technology ]
ChainDrop harvested publishing credentials associated with Ornikar and used them to publish malicious versions across 42 @ornikar package names during the automated propagation wave on 4 August 2026. Malicious publication activity began at approximately 10:19 UTC.
OneReach.ai
August 4, 2026
•[ hack, malware, technology ]
ChainDrop harvested publishing credentials associated with OneReach.ai and used them to publish malicious releases across the @onereach and @or-sdk namespaces on 4 August 2026. Malicious publication activity began at approximately 10:39 UTC.
Picsart
August 4, 2026
•[ hack, technology ]
ChainDrop harvested publishing credentials associated with Picsart and used them to publish malicious versions of two npm packages during the automated propagation wave on 4 August 2026. Malicious publication activity began at approximately 10:37 UTC.
Qlik Technologies Inc.
August 4, 2026
•[ hack, malware, technology ]
ChainDrop harvested Qlik-associated publishing credentials and used them to publish malicious releases across at least 28 @qlik and 22 @nebula.js package names on 4 August 2026. Additional Qlik-associated unscoped packages were reported but are not included in the minimum scope count.
ServiceTitan Inc.
August 4, 2026
•[ hack, malware, technology ]
ChainDrop harvested publishing credentials associated with ServiceTitan and used them to publish malicious releases across 141 @servicetitan package names during the automated propagation wave on 4 August 2026.
HubSync
August 4, 2026
•[ hack, technology, malware ]
ChainDrop harvested publishing credentials associated with HubSync and used them to poison the @hubsync/web-sdk-react package during the automated propagation wave on 4 August 2026. Malicious publication activity began at approximately 10:12 UTC.
North Carolina State Ports Authority
August 4, 2026
•[ hack, technology, government ]
North Carolina Ports detected a cyberattack late on August 4, 2026. Affected IT systems forced manual processing and delayed gate openings at three facilities. Normal gate schedules resumed August 6 while manual processing continued. August 4 is the reported disruption and detection date; initial access is unknown. The authority did not disclose the technical mechanism, attacker, ransom demand, encryption or data theft.
Dropbox
August 4, 2026
•[ hack, technology, misconfiguration ]
San Francisco cloud storage firm Dropbox said ~5,000 user accounts were accessed without authorization from 4 to 21 Aug 2026 via a flaw in a legacy Lenovo ID login integration; files were viewed or downloaded in under a third. It cut Lenovo ID sessions and notified regulators.
Lego Certified Stores South Africa
August 5, 2026
•[ hack, leak, retail ]
An unauthorized third party exploited a previously unknown Metabase vulnerability on August 5, 2026 and accessed Lego Certified Stores South Africa customer data held in a Metabase reporting tool used internally by loyalty provider Marsello. No payment card information or account passwords were involved.
Uber Freight
August 6, 2026
•[ ransomware, financial, technology ]
Uber Freight confirmed unauthorized access to portions of its systems and data repositories. The Helix extortion group listed Uber Freight on its leak site August 6, 2026, claiming nearly one million stolen files from cloud storage, email and logistics/accounting records. An external breach index separately reported approximately 5.44 million data rows, but Uber Freight did not verify the posted data or the scale of theft. Google links Helix infrastructure to the financially motivated UNC6671 cluster; company-specific attribution remains claim-based. Uber Freight said the incident was contained and remediated without operational disruption. The actual date of the initial intrusion or data extraction was not established; August 6 is the earliest documented public-leak date, not the verified intrusion date.
Undisclosed United States LightSpy victim
August 6, 2026
•[ espionage, malware, technology ]
Arctic Wolf researchers identified LightSpy victims in at least 13 countries, including the United States, and documented a wider campaign in which the spyware infected multiple device types and network routers. This conservative record represents at least one unidentified United States victim; the victim's device type, organization or individual status, and exact data acquired were not disclosed. Researchers linked the latest LightSpy activity to a Chinese contractor after identifying one of the spyware operators through the platform's administrative infrastructure.
MyDr Sp. z o.o.
August 6, 2026
•[ leak, healthcare, technology ]
An unidentified attacker deliberately obtained unauthorized access to MyDr's systems no later than August 6, 2026 after overcoming or bypassing technical security controls. Polish prosecutors confirmed access to patient information stored on MyDr infrastructure, and subsequent forensic findings communicated to healthcare customers determined that an unauthorized third party accessed the environment and copied the contents of a cloud-hosted database containing historical patient information. Authorities said the incident may affect approximately 18.8 million people and more than 12,000 medical facilities. Central Polish e-health services and ongoing healthcare delivery were not disrupted.
Norsk Tipping AS
August 7, 2026
•[ ddos, hack, technology ]
Norsk Tipping confirmed a new DDoS attack between 20:53 and 21:08 on August 7 that made its services inaccessible to some customers. The company said operations had returned to normal and that it did not know who was responsible. The attack followed restored service after August 4, so it is a distinct disruptive event. No data theft or ransom demand was reported; Sabotage is a contextual inference based on the targeted service interference.
Pozirk (Позірк)
August 8, 2026
•[ ddos, technology, government ]
Pozirk reported a DDoS attack against its online news platform on the morning of August 8, 2026, alongside attacks against Nasha Niva, Zerkalo and Reform.news. The assault coincided with the New Belarus conference in Warsaw. The responsible operator and precise outage duration were not established; no information theft was reported.
Reform.news
August 8, 2026
•[ ddos, government, technology ]
Reform.news reported a DDoS attack against its website on August 8, 2026 as part of concurrent attacks against independent Belarusian news outlets. Reports linked the timing to the New Belarus conference and the anniversary of the 2020 election, without identifying a perpetrator. Reform.news operates from Warsaw under a Polish registered supporting foundation. No data theft was reported.
