Marutake Co., Ltd.
April 28, 2026
•[ ransomware, unauthorized access, system outage ]
Marutake Co., Ltd., a Japanese pharmaceutical and medical-supplies wholesaler, confirmed that a system outage was caused by ransomware resulting from unauthorized external access. As of its May 8, 2026 third notice, some servers remained impaired, some normal operations were difficult, and full restoration was expected to take considerable time, though the company was using alternative measures to maintain stable supply. Public Japanese security reporting linked the confirmed incident to a The Gentlemen leak-site claim, but Marutake stated that external leakage of personal information had not been confirmed.
East Inc.
April 24, 2026
•[ unauthorized access, internal network, leak-site ]
East Inc. confirmed that it detected unauthorized third-party access to its internal network on April 24, 2026. The company reported the incident to police and relevant authorities and engaged outside security specialists, while stating that external information leakage had not been confirmed. Public Japanese security reporting later linked the confirmed incident to a The Gentlemen leak-site claim, but did not confirm data publication or operational disruption.
New York Life Insurance Company
December 2, 2025
•[ unauthorized access, email compromise, personally identifiable information ]
New York Life Insurance Company discovered unauthorized access to one of its agents' email accounts on December 2, 2025. After securing the account and completing its investigation, the company confirmed on April 8, 2026 that the compromised account contained some clients' personal information, including identifiers, financial information, medical information, and health insurance information. Public reporting did not identify a responsible actor, data volume, ransomware, or operational disruption.
Cardinal Services, Inc.
August 8, 2025
•[ hacking, unauthorized access, data leak ]
Cardinal Services, Inc., Cardinal Employer Organization, and Preferred Employer Solutions reported an external system breach involving unauthorized access to systems during two periods, June 25-26, 2025 and August 8, 2025. The organization discovered the breach on May 12, 2026 and reported it to the Maine Attorney General on May 20, 2026. Public reporting described the incident as hacking affecting 142,323 individuals.
South Alabama Regional Planning Commission
August 6, 2025
•[ hacking, unauthorized access, protected health information ]
South Alabama Regional Planning Commission reported a hacking/IT incident involving unauthorized access to protected health information. Public reporting states that the substitute breach notice did not identify when access was detected or when unauthorized access occurred, but the investigation determined on August 6, 2025 that certain files had been copied from its systems. The incident affected 3,043 individuals.
Pivot Health
March 13, 2026
•[ unauthorized access, cloud security, health insurance information ]
Pivot Health became aware of suspicious activity in its Amazon Web Services environment on or around March 13, 2026. Its investigation determined that an unauthorized actor accessed the AWS environment at various times between February 26, 2026 and March 13, 2026, and that certain information stored in AWS was viewed or copied. The affected data included health insurance and coverage information, identifiers, dates of coverage, and in some cases financial account information. Public reporting did not identify a responsible actor, ransomware, or operational disruption.
ASC Ortho Management Company, LLC d/b/a Aligned Orthopedic Partners
December 16, 2025
•[ email environment breach, unauthorized access, personal information ]
ASC Ortho Management Company, LLC d/b/a Aligned Orthopedic Partners identified unusual activity in its email environment on December 8, 2025 and later determined that an unknown actor had unauthorized access to the email environment between November 16 and December 16, 2025, potentially accessing certain emails and files containing personal and protected health information. Aligned Orthopedic mailed notices to affected individuals on April 17, 2026.
Singing River Health System
December 21, 2025
•[ unauthorized access, data breach, patient information ]
Singing River Health System discovered that an unauthorized party gained access to its computer network between December 19 and December 21, 2025. On February 10, 2026, SRHS learned that the unauthorized party had accessed files containing patient information, and on May 19, 2026 it began mailing notices to affected patients. SRHS also temporarily shut down select systems, including internet access and MyChart, as a defensive containment measure; public reporting did not confirm attacker-caused encryption or destructive disruption.
University of Nebraska Medical Center
February 3, 2026
•[ vulnerability, unauthorized access, data leak ]
University of Nebraska Medical Center learned in February 2026 that its REDCap application contained a vulnerability and took the application offline. UNMC's investigation determined that its REDCap instance was subject to unauthorized access between September 20, 2023 and February 3, 2026, though it could not determine whether personal information housed in REDCap was actually accessed. The incident potentially affected 26,937 individuals whose data varied by research study.
Taiwan High Speed Rail Corporation
April 5, 2026
•[ radio interference, TETRA communications, software-defined radio ]
A 23-year-old university student identified by the surname Lin allegedly interfered with Taiwan High Speed Rail's TETRA radio communications system using software-defined radio equipment and handheld radios. The unauthorized General Alarm signal triggered emergency braking or emergency stop procedures, affecting four high-speed trains for approximately 48 minutes. Public reporting did not identify data theft, ransomware, or a financial motive.
Blanchard Training and Development, Inc.
March 3, 2026
•[ unauthorized access, PII, financial information ]
Blanchard Training and Development, Inc. identified unusual activity in its network environment on March 4, 2026, and later determined that an unauthorized individual may have copied certain information between March 3 and March 4. DataBreach indexed 494,404 rows tied to Blanchard, including names, contact information, addresses, and bank account information.
Undisclosed Vietnamese ministry-level agency 2
May 22, 2026
•[ data breach, cyberattack, unauthorized access ]
Vietnamese cybersecurity authorities said hackers infiltrated one of two ministry-level agency systems containing millions of user records. VNCERT investigated the incidents on May 21-22, 2026, and reported that existing SOC monitoring systems at the affected agencies failed to detect the attacks.
Unimed
April 14, 2026
•[ unauthorized access, data theft, ransomware ]
Unknown attackers gained unauthorized access to parts of Unimed's IT infrastructure on April 14, 2026 and stole patient billing data processed for German hospitals and clinics. Affected institutions included university hospitals in Cologne, Freiburg, Heidelberg, Tbingen, Ulm, Dsseldorf, Mainz, Saarland, Oldenburg, Hannover, Gttingen, and others. Reporting indicated the attackers intended broader system encryption, but this was stopped; hospitals said their clinical systems and patient care were not affected.
Unnamed third-party software services vendor used by The Oncology Institute
November 19, 2024
•[ third-party breach, unauthorized access, healthcare data ]
On May 20, 2026, Kroll, acting as third-party administrator for an unnamed vendor used by The Oncology Institute, notified the company that the vendor had detected unauthorized third-party access to certain vendor information systems, including systems affecting The Oncology Institute patient data. The vendor was not publicly named, though reporting identified TriZetto Provider Solutions as a possible candidate. If the incident is TriZetto-related, unauthorized access began on November 19, 2024 and the broader TriZetto breach affected 3,433,965 individuals; the number of affected The Oncology Institute patients was not publicly reported. The Oncology Institute said its own systems were not subject to unauthorized access.
Los Angeles County Metropolitan Transportation Authority
March 16, 2026
•[ unauthorized access, infrastructure disruption, state-sponsored ]
Los Angeles County Metropolitan Transportation Authority detected unauthorized activity on March 16, 2026 and restricted parts of its internal network while reviewing and restoring systems. Rail and bus service continued, but some customer-facing services, including arrival information displays and TAP card reload functions, were disrupted. Ababil of Minab claimed responsibility, and Gambit Security linked the operation to Iranian state-associated infrastructure.
MediCopy Services, Inc.
January 13, 2026
•[ unauthorized access, data leak, healthcare ]
An unauthorized actor accessed MediCopy Services' cloud-based file-sharing platform on January 13, 2026, and downloaded files related to release-of-information requests for certain Deaconess patients, including patients of Deaconess Henderson Hospital, Deaconess Union County Hospital, and surrounding clinics. Deaconess stated that its own IT systems and electronic medical record system were not impacted.
Radiology Associates of Richmond
July 25, 2025
•[ data breach, unauthorized access, protected health information (PHI) ]
An unauthorized actor accessed Radiology Associates of Richmond's network environment on or about July 25, 2025, and files containing protected health information were acquired. RAR began notifying affected individuals on May 21, 2026; filings reported 266,183 affected individuals.
Central Board of Secondary Education
May 21, 2026
•[ unauthorized access, payment gateway vulnerability, price manipulation ]
The CBSE revaluation portal's payment system was hit by an unauthorized malicious attack linked to the HDFC payment gateway integration when the portal went live. Approximately 50 students gained unauthorized access or were affected after displayed fee amounts were manipulated, causing payable amounts in some cases to range from Re 1 to nearly Rs 67,000-68,000. Public reporting did not identify the individuals or confirm theft of student data.
Windows93 / Myspace93
January 1, 2021
•[ data leak, plaintext passwords, credential theft ]
In January 2021, trusted members of the Windows93 Discord community allegedly abused access to a Myspace93 beta application to exploit and download server files, including an unencrypted credential store. The compromised data was later leaked in June 2021 and contained 46,105 Myspace93 accounts with usernames, plaintext passwords, email addresses, and IP addresses.
Presidential Office of the Republic of North Macedonia
May 21, 2026
•[ insider threat, espionage, data theft ]
An unnamed IT administrator in the Presidential Office of the Republic of North Macedonia was reportedly suspected of copying, decrypting, encrypting, and storing confidential state data from presidential administration computer systems, with allegations that the material may have been intended for a foreign intelligence service. Public reporting did not name the administrator, identify the foreign service, quantify the data, or confirm operational disruption.
