Freedom Mobile
January 12, 2026
•[ leak, technology, insider ]
Freedom Mobile said a third party used a subcontractor's credentials to access some customers' personal information in its customer account management platform between January 12 and 18, 2026.
Grubhub
January 15, 2026
•[ hack, technology, retail ]
Grubhub confirmed that unauthorized actors accessed parts of its internal systems and downloaded data, and sources reported the company faced extortion demands. Reporting linked the incident to a broader Salesforce-related campaign associated with ShinyHunters, including threats to leak data connected to Salesforce and Zendesk tooling used for customer support. Grubhub stated that sensitive information such as customer financial details and order history were not affected, but it did not publicly specify exactly which data fields were taken, how many individuals were impacted, or the precise intrusion window, while it worked with external security experts and law enforcement.
Xsolis, Inc.
January 20, 2026
•[ phishing, healthcare, technology ]
A targeted phishing attack on January 20, 2026 resulted in unauthorized access to a limited portion of Xsolis's environment through January 22. The unauthorized actor acquired files containing personal and protected health information supplied by Xsolis's healthcare clients. Xsolis reported no known actual or attempted misuse of the information.
Undisclosed People Playground user
February 1, 2026
•[ hack, leak, technology ]
A malicious mod overwrote users' Workshop uploads, deleted saved creations and reset settings and achievements. This represents an unnamed affected user in the February incident, separate from September. February 1 is the earliest-warning fallback, not a verified infection date. Sabotage is inferred from deliberate deletion and alteration; actor type and operator identity are unestablished.
Undisclosed Latvian company
February 1, 2026
•[ ransomware, hack, technology ]
An unnamed Latvian company was hacked in Feb. 2026 when an attacker exploited a website vulnerability, exported personal data from its database and demanded payment not to leak it. Latvian police linked the case to the TSC breach and arrested a 23-year-old suspect on Sept. 15.
Professional Compounding Centers of America, Inc.
February 10, 2026
•[ ransomware, healthcare, technology ]
Nitrogen claimed on February 10, 2026 that it had compromised Professional Compounding Centers of America's network, exfiltrated a significant amount of data, and would publish it unless its demands were accepted. DataBreach.com subsequently indexed 1,500,874 rows and dated the published dataset to May 12. PCCA did not publicly confirm the actor's claim, and no operational disruption was documented.
Wood Smith Henning & Berman LLP
February 20, 2026
•[ ransomware, finance, technology ]
Silent Ransom Group stated that it gained access to Wood Smith Henning & Berman's network on February 20, 2026 and acquired approximately 3.6 GB of data. Negotiations began by March 3, with the group demanding $1.8 million to delete the files. After negotiations failed, the group published the data on March 17. DataBreaches reviewed the leaked material and confirmed that it included technical reports, expert analyses, legal research, and files from multiple client matters. The access method was not disclosed, no malware or encryption was reported, and the firm did not respond to a request for comment.
Undisclosed banking customers, financial-services customers, and small-to-medium businesses in Portugal, Spain, Mexico, and Latin America
February 24, 2026
•[ phishing, malware, financial ]
WatchGuard telemetry identified Grandoreiro infections beginning in late February 2026. Phishing links delivered ZIP archives containing legitimate applications and malicious DLLs for side-loading, while a related campaign used an obfuscated VBS file to install the banking trojan. The confirmed victim population comprised banking and financial-services customers, small-to-medium businesses, and users in Portugal, Spain, Mexico, and other parts of Latin America; references to banks in the malware code identify targeted banking applications, not confirmed compromises of the banks themselves.
Rockwood Retirement Communities
February 26, 2026
•[ leak, healthcare, technology ]
KAIROS listed Rockwood Retirement Communities on its leak site on February 27, 2026. DataBreach.com subsequently indexed 132,606 structured records associated with the breach and dated the underlying event February 26. The records support classification of the affected asset as a database-backed application server, although the initial access vector was not disclosed. Rockwood operates nonprofit senior-living communities in Spokane. No victim notice or independent report confirmed encryption or operational disruption.
Novo Nordisk A/S
March 1, 2026
•[ ransomware, leak, healthcare ]
FulcrumSec claimed that it obtained access in March 2026 through a GitHub access token, cloned Novo Nordisk repositories, obtained additional credentials, remained in the environment for more than two months, and stole more than 700,000 files totaling approximately 1.3 TB before demanding $25 million. Novo Nordisk confirmed unauthorized access to a limited number of internal IT systems and the external copying of non-public and personal data, but it did not publicly attribute the incident to FulcrumSec or confirm the actor's claimed volume and contents. Reuters could not independently verify the authenticity of the published data. Novo Nordisk temporarily took certain internal systems offline for containment, while stating that its core business operations remained operational. Because only March 2026 was reported for initial access, 2026-03-01 is used as the normalized event date.
Undisclosed Windows users seeking system and hardware utilities
March 1, 2026
•[ malware, technology, financial ]
Beginning in March 2026, attackers used poisoned search results and fake download sites impersonating utilities such as CrystalDiskInfo, HWMonitor, PDFgear, and FurMark to compromise Windows users, with some malicious links also appearing in AI-chatbot recommendations during April. The malware installed ScreenConnect for persistent access, collected host information, and deployed GPU-focused cryptocurrency miners through process hollowing. Microsoft identified more than 150 malicious domains associated with the campaign.
Ameriprise Financial
March 2, 2026
•[ hack, finance, technology ]
Ameriprise Financial disclosed unauthorized access to certain stored data and files in an incident dating back to March 2, 2026, which it detected and blocked on March 18. Ameriprise said there was no disruption to business operations and no indication of unauthorized transactions or fund movement. ShinyHunters claimed responsibility and allegedly threatened to release Salesforce customer records and more than 200 GB of compressed SharePoint internal data, but the full attacker claim was not confirmed by Ameriprise.
Evaluate Ltd.
March 15, 2026
•[ ransomware, technology, healthcare ]
Everest publicly claimed Evaluate, a Norstella company, on March 15, 2026 and threatened publication of stolen data unless the company entered negotiations. Independent breach monitoring recorded approximately 1.33 TB associated with the claim, and DataBreach.com subsequently indexed 248,458 rows. Evaluate Ltd. is registered in England and Wales and headquartered in London, where it provides pharmaceutical and biotechnology market intelligence and analytics. No operational disruption has been independently established.
European Commission
March 19, 2026
•[ leak, government, technology ]
The European Commission said a threat actor compromised an AWS cloud account supporting the Europa web platform and exfiltrated data from hosted websites, and CERT-EU later linked the incident to the Trivy supply-chain compromise and a published ShinyHunters leak.
Axcera LLC
March 22, 2026
•[ hack, leak, technology ]
LAPSUS$ claimed on March 22, 2026 that it had stolen approximately 13 GB from Axcera, including source code, cloud configurations, credentials, API keys, and MongoDB database dumps. DataBreach.com later indexed 11,977 rows containing email addresses. Axcera did not publicly confirm the actor's full claim, and no operational disruption was reported.
Ultrahuman
March 27, 2026
•[ leak, malware, healthcare ]
On March 27, 2026, attackers used credentials stolen from a malware-infected employee laptop to obtain read-only access to Ultrahuman's internal analytics system. Ultrahuman said wellness data belonging to approximately 0.1% of users was accessed, took the affected system offline, and revoked access. The company reported that passwords, payment information, production systems, and Ultrahuman Ring devices were not compromised and did not confirm whether data was exfiltrated.
Ernst & Young LLP
March 28, 2026
•[ hack, technology, finance ]
An unauthorized party accessed a third-party IT service-management platform used for EY tax work from March 28 through April 12 and downloaded client documents. ShinyHunters later claimed responsibility, but EY has not confirmed that attribution or the group's separate claims of Jira, GitHub, and Azure access; no operational disruption or public confirmation of the threatened leak was reported.
Paidwork LLC
March 29, 2026
•[ hack, leak, financial ]
Hackers claimed to have obtained data from Paidwork in March 2026 and offered it for sale. An approximately 11 GB database attributed to Paidwork was subsequently published in July and contained more than 23 million unique email addresses along with extensive profile, financial, device, transaction, and authentication data. Paidwork stated that it had not confirmed compromise of its systems or user accounts and was investigating the reported incident.
Undisclosed professional services organization
April 1, 2026
•[ espionage, malware, technology ]
Beginning in April 2026, researchers observed the Backdoor.Mistic remote access trojan deployed on the network of at least one undisclosed professional services organization. The backdoor enabled file upload and download, file manipulation, folder creation, and in-memory code execution. The victim's identity, location, affected systems, and any acquired information were not disclosed. SecurityWeek attributed the activity to Woodgnat, also known as KongTuke, while Broadcom assessed that Mistic may be associated with the group.
Global Schools Group (Global Schools Foundation)
April 1, 2026
•[ leak, misconfiguration, education ]
FulcrumSec reportedly accessed Global Schools Group's AWS environment in April 2026 using default or reused credentials and obtained data from 67 S3 buckets, five MSSQL servers, and four MongoDB servers. The group claimed to have stolen 4.8 TB and later released a 221 GB highlights archive following failed extortion negotiations. Global Schools Group confirmed a cybersecurity incident, said it had contained it and restored affected systems, and notified authorities, but did not verify FulcrumSec's figures or specific data claims. No operational disruption was reported.
