Undisclosed AT&T customers
May 1, 2018
•[ insider, financial, technology ]
An AT&T store worker in Portland, Oregon used his access to AT&T systems from May 2018 to Nov 2019 to SIM-swap customers' numbers to co-conspirators' devices, letting them intercept login codes and access bank accounts (~$600,000 intended losses). He got 16 months in prison.
Undisclosed French business-software hosting company (Software; pseudonym)
June 24, 2021
•[ ransomware, financial, technology ]
During June 24-25, 2021, attackers encrypted files held by a French enterprise-software hosting provider and demanded ransom for decryption. The company restored hosted applications but could not recover certain data belonging to 14 customers because adequate off-site backups were absent. The case became public through reporting of a 2026 insurance judgment. Criminal/Financial is supported by the explicit ransomware demand; theft of files was not established. Software is a litigation pseudonym rather than the company's verified legal name.
Undisclosed companies
September 1, 2021
•[ phishing, financial, technology ]
Scattered Spider crew members phished credentials at 12+ companies (entertainment, telecom, tech, BPO, IT, cloud, crypto) in 2021-2023, stole company data and millions in crypto from 29 victims. Ahmed Elbadawy's guilty plea surfaced Sept 2026 via a forfeiture filing.
Stelios Kouloglou
October 21, 2022
•[ espionage, government, technology ]
Citizen Lab found with high confidence that former Greek MEP Stelios Kouloglou's iPhone was successfully infected with NSO Group's Pegasus on October 21, 2022 and again on March 6-7, 2023 using the PWNYOURHOME zero-click exploit. The infections occurred during sensitive PEGA Committee work. Researchers did not attribute the operation to a government, found no indication Greece was responsible, and assessed that the first infection overlapped with an operator previously targeting Russian- and Belarusian-speaking journalists and activists.
Undisclosed organizations
April 1, 2023
•[ leak, insider, technology ]
Ex-U.S. Army soldier Cameron Wagenius ('kiberphant0m') and co-conspirators stole credentials and data, incl. call detail records, from at least 10 organizations incl. U.S. and foreign telecoms (Apr 2023-Dec 2024), sold and leaked data and sought $1M+ via extortion; 70-month term.
Brightly Software, Inc.
August 1, 2023
•[ insider, ransomware, technology ]
Cameron Curry, a contract data analyst, used his access to Brightly Software's payroll information and corporate data to remove sensitive files between August and December 2023. Beginning in December, he used the alias Loot to demand $2.5 million in cryptocurrency and threatened to publish the stolen information.
Undisclosed North American medical research university
September 1, 2023
•[ espionage, malware, healthcare ]
In September 2023, UNC6508 compromised a REDCap server belonging to an undisclosed North American medical research university. Three months later, the actor deployed the INFINITERED backdoor, harvested credentials, persisted through REDCap upgrades, obtained domain-administrator access, and created a Google Workspace content-compliance rule that silently forwarded selected emails to an actor-controlled account. Activity continued through November 2025. Google also identified additional organizations in the United States and Canada compromised with INFINITERED, but this row represents the detailed September 2023 university victim.
St. George Fire Protection District No. 2
December 23, 2023
•[ hack, government, technology ]
On 2023-12-23, law enforcement informed St. George Fire Protection District No. 2 that threat actors had infiltrated its network. A later lawsuit alleged that compromised remote-access credentials used by the district's managed service provider enabled the intrusion and that attackers used legitimate administrative tools while inside the environment. The district's domain controllers were compromised, and it subsequently rebuilt servers, switches, domain controllers, firewalls, and backup infrastructure. No data theft, affected-person count, actor, motive, or service interruption was publicly reported.
Southern Water
January 22, 2024
•[ ransomware, leak, technology ]
Black Basta ransomware group attacked UK water supplier Southern Water in January 2024, encrypting several IT systems and stealing customer and corporate data. The company later reported approximately 45 million in total expenses related to recovery, legal fees, and customer notification. The breach exposed nearly half a million customer records, and operations were temporarily disrupted though water services continued. Southern Water confirmed data exfiltration via its internal investigation and regulator notifications.
Balochistan Police
February 27, 2024
•[ espionage, malware, government ]
Between February 27, 2024, and December 5, 2025, one or more unnamed suspected China-linked operators maintained PlugX, ShadowPad, and Cobalt Strike command-and-control activity involving Balochistan Police network appliances and web servers. In late 2024, an operator uploaded malicious cms_plugin.exe variants to the police Complaint Management System, including a Rust stager and a .NET implant that loaded AsyncRAT, creating a malware-delivery path to police and public users. SentinelLabs did not name the actor and warned that the shared or commodity tooling may represent more than one operator; no theft of the records stored on the affected systems was confirmed.
Amazon
May 15, 2024
•[ hack, leak, technology ]
Amazon confirms a data breach involving employee information after data allegedly stolen during the May 2023 MOVEit attacks is leaked on a hacking forum.
Undisclosed individual
August 18, 2024
•[ social, financial, phishing ]
A Washington, D.C. crypto investor lost over 4,100 bitcoin (over $240M) on Aug. 18, 2024 after callers posing as Google and Gemini support got access to his Google Drive and security codes. Ringleader Malone Lam faced a plea hearing; 18 people were charged.
Hot Topic
October 21, 2024
•[ leak, retail, technology ]
An alleged data breach exposes the personal information of 56,904,909 accounts for Hot Topic, Box Lunch, and Torrid customers, but the threat actors claims to have stolen 350 million records.
Undisclosed ransomware-as-a-service group
January 1, 2025
•[ ransomware, healthcare, transportation ]
CSE identified an undisclosed ransomware-as-a-service group responsible for more than 25 incidents affecting Canadian transportation, healthcare, pharmaceutical, and business organizations. Working with Five Eyes partners and law enforcement, CSE rendered the group's infrastructure inoperable and deleted a large amount of stolen data advertised for sale. CSE separately reported disruptions against parts of the infrastructure of 10 ransomware groups but did not state whether this group was included among them.
Hewlett Packard Enterprise (HPE)
January 16, 2025
•[ hack, technology ]
The threat actor IntelBroker claims to have targeted Hewlett-Packard Enterprise (HPE) again, having access to the companys internal infrastructure.
Telus
February 1, 2025
•[ hack, technology ]
Canadian telecom Telus notified some consumer customers in Sep 2026 that an attacker used compromised credentials to access their accounts between Feb 2025 and Jun 2026, viewing personal and billing data. Telus reset credentials, notified police and offered ID protection.
Undisclosed U.S. industrial automation company
March 1, 2025
•[ espionage, manufacturing, technology ]
CISA and the FBI reported that foreign cyber actors on the network of an unnamed U.S. industrial automation integrator serving utilities and transport firms collected about 800 files of customer SCADA data, ICS device details and schematics in March-April 2025.
Undisclosed Ukrainian organization
April 2, 2025
•[ espionage, phishing, malware ]
On April 2, 2025, a phishing email sent from a compromised account induced a victim at an undisclosed Ukrainian organization to open a malicious Remote Desktop Protocol file and connect to actor-controlled infrastructure. Google Threat Intelligence Group observed Turla deploy the StockStay.MarketMaker downloader to the victim device, which retrieved the StockStay backdoor from compromised Ukrainian government infrastructure. The victim's identity and any acquired information were not disclosed.
Ministry of iTaukei Affairs
April 4, 2025
•[ hack, government, technology ]
The Ministry of iTaukei Affairs official Facebook page was hacked and defaced by unauthorized users posting content such as Hollywood movie clips. No sensitive or internal data was compromised; cybersecurity teams are working to restore control.
4chan
April 14, 2025
•[ leak, hack, technology ]
Several gigabytes of internal 4chan backend data, including moderator emails, hashed passwords, and source code, were stolen and leaked online; brief service outage reported; no ransom or financial motive indicated.
