Security Incidents & Threat Telemetry

A spokesperson for the court system told Recorded Future News that the incident did not involve ransomware and the hackers have not issued ransom demands for the stolen data as of Monday.

A 26-year-old Canadian man once described as one of the most consequential cybercrime threat actors of 2024 has pleaded guilty to computer fraud and conspiracy to hack and extort more than 165 organizations that used the cloud data storage provide...

Cloud Software Group and federal regulators issued emergency disclosures for two actively exploited critical zero-day vulnerabilities in Citrix NetScaler ADC and Gateway (CVE-2026-88771 and CVE-2026-88772, CVSS 9.5), enabling unauthenticated remote code execution and webshell deployment across 50,000+ exposed enterprise appliances worldwide.

Joseph Cox reports: The hackers behind the massive FBI breach told 404 Media on Monday they do not intend to publish the data. The breach, in which the hackers stole personal information on “all FBI employees and applicants” including physical add...

Agri Industrial was listed on the Everest ransomware extortion leak portal. Unverified extortion claim alleging unauthorized network access and data compromise.

Atlassian is warning customers of a critical vulnerability, tracked as CVE-2026-21589, that can be exploited for arbitrary file-access in multiple self-hosted Data Center products, including Confluence, Jira, and Bitbucket. [...]

B-accountants was listed on the Everest ransomware extortion leak portal. Unverified extortion claim alleging unauthorized network access and data compromise.

Beni Suef Technological University – BTU was listed on the UmBra ransomware extortion leak portal. Unverified extortion claim alleging unauthorized network access and data compromise.

BNYH was listed on the Qilin ransomware extortion leak portal. Unverified extortion claim alleging unauthorized network access and data compromise.

Ciftay Insaat Taahhut Ve Ticaret Anonim Sirketi was listed on the Qilin ransomware extortion leak portal. Unverified extortion claim alleging unauthorized network access and data compromise.

CORBY ROCK MILL was listed on the Qilin ransomware extortion leak portal. Unverified extortion claim alleging unauthorized network access and data compromise.

Delta Marine was listed on the Qilin ransomware extortion leak portal. Unverified extortion claim alleging unauthorized network access and data compromise.

EDFelectronics was listed on the Panzer ransomware extortion leak portal. EDFelectronics.com is a Polish engineering company that develops specialized electronics and plasma technology for industrial and research applications.

Flydubai was listed on the Everest ransomware extortion leak portal. Unverified extortion claim alleging unauthorized network access and data compromise.

Four Hands LLC was listed on the UmBra ransomware extortion leak portal. Four Hands LLC is a global leader in lifestyle home furnishings, designing and wholesaling innovative, artisanal furniture and decor to top retailers and designers worldwide.

Greggio Argento was listed on the Deadlock ransomware extortion leak portal. Threat actor claims exfiltration of 500GB of internal data files.

Hygrade was listed on the Akira ransomware extortion leak portal. Unverified extortion claim alleging unauthorized network access and data compromise.

J&D Financial was listed on the Qilin ransomware extortion leak portal. Unverified extortion claim alleging unauthorized network access and data compromise.

Kennametal was listed on the Everest ransomware extortion leak portal. Unverified extortion claim alleging unauthorized network access and data compromise.

KOOKABARRA JUICE was listed on the Vexy Ransomware ransomware extortion leak portal. French manufacturer specializing in fresh-pressed fruit juices, detox juices, smoothies, nectars and other fresh fruit products, serving both professionals and co...

magnals.com was listed on the Incransom ransomware extortion leak portal. Unverified extortion claim alleging unauthorized network access and data compromise.

Michael K Shelby, CPA was listed on the Akira ransomware extortion leak portal. Threat actor claims exfiltration of 18GB of internal data files.

Morcon Developments was listed on the Everest ransomware extortion leak portal. Unverified extortion claim alleging unauthorized network access and data compromise.

Over the weekend, Japanese publishing giant Nikkei disclosed that unknown attackers recently breached two employee email accounts and used one to send thousands of phishing emails. [...]

Philander Smith University was listed on the EndZone ransomware extortion leak portal. Threat actor claims exfiltration of 500GB of internal data files.

SweetRush was listed on the Panzer ransomware extortion leak portal. Unverified extortion claim alleging unauthorized network access and data compromise.

The Wikimedia Foundation, which hosts Wikipedia, has confirmed that it has discovered activity by rogue OpenAI agents on its platforms, including unsuccessful efforts to compromise Etherpad, a public note-taking tool, and edit Wikipedia pages. "Th...

A...n was listed on the SilentRansomGroup ransomware extortion leak portal. Redacted entry - full company name pending disclosure (FULL DATA TIMER active).

State of California Department of Justice data breach disclosure notice filed by Advantest America.

anwo.cl was listed on the Safepay ransomware extortion leak portal. The company was established in 1984 by Víctor Herrmann and has developed into one of the major HVAC distribution businesses …

bwi-bau.de was listed on the Safepay ransomware extortion leak portal. The organization was established in October 1964 as a subsidiary of the Construction Industry Association of North Rhine-Westphalia. It originally …

Cam Group LLC was listed on the Doommageddon ransomware extortion leak portal. Status: upcoming | Deadline: 2026-10-15T00:00:00Z

Takashi Nakamichi and Ryo Horiuchi report that Daiwa Securities, Japan's second-largest brokerage and investment banking firm, is responding to a breach at one of its vendors. Daiwa Securities Group said information on as many as 110,000 clients m...

dd-automation.ch was listed on the Safepay ransomware extortion leak portal. The company was entered into the Swiss commercial register in 1997 and specializes in electrical engineering, automation systems, conveyor technology, …

Denmark's Central Population Register (CPR) is warning of a data breach that exposed the personal information of approximately 8.8 million registered individuals. [...]

duhaas.sk was listed on the Safepay ransomware extortion leak portal. The company was subsequently transformed into a limited liability company in 1992 and established as a joint-stock company in 1994. …

ENKA Schools was listed on the Doommageddon ransomware extortion leak portal. Status: upcoming | Deadline: 2026-10-15T00:00:00Z

Global Security Concepts was listed on the Qilin ransomware extortion leak portal. Unverified extortion claim alleging unauthorized network access and data compromise.

grundens.com was listed on the Safepay ransomware extortion leak portal. The company's origins can be traced to 1911, when Carl A. Grundén, the son of a fisherman from Grundsund on …

H&L Manufacturing was listed on the Interlock ransomware extortion leak portal. Unverified extortion claim alleging unauthorized network access and data compromise.

halservice.it was listed on the Safepay ransomware extortion leak portal. Established in 1990, the company initially focused on system integration and information-technology services and later expanded into telecommunications following the …

ikhasas.com was listed on the Safepay ransomware extortion leak portal. The group was incorporated as iKHASAS Sdn. Bhd. in 2008 and subsequently expanded beyond construction into property development, hospitality, plantation, …

Millensys was listed on the Medusalocker ransomware extortion leak portal. Organization with 2 emails extracted. Domain: millensys.com

Nelson Mullins Riley & Scarborough was listed on the SilentRansomGroup ransomware extortion leak portal. They offered $8.000.000 to keep the data from being published.

O2 Dental Group was listed on the Interlock ransomware extortion leak portal. Unverified extortion claim alleging unauthorized network access and data compromise.

Onsemi was listed on the Qilin ransomware extortion leak portal. Unverified extortion claim alleging unauthorized network access and data compromise.

State of California Department of Justice data breach disclosure notice filed by Sheppard, Mullin, Richter & Hampton.

sterrer.net was listed on the Safepay ransomware extortion leak portal. The company has operated since 1979 and combines agricultural production with technical services for commercial poultry farms. Its activities include …

stuecheli.ch was listed on the Safepay ransomware extortion leak portal. The firm was founded by architect Werner Stücheli in 1946 and has developed into a third-generation architectural practice. It is …

t-systems.com was listed on the Safepay ransomware extortion leak portal. Headquartered in Germany, the company operates internationally and has locations in 26 countries, employing more than 26,000 people. T-Systems specializes …

Turn5 was listed on the Global Secret Group ransomware extortion leak portal. Threat actor claims exfiltration of 328 GB of internal data files.

Automovil Club del Ecuador ANETA was listed on the Barracuda ransomware extortion leak portal. Unverified extortion claim alleging unauthorized network access and data compromise.

EdgeEndo® USA was listed on the Booba Project ransomware extortion leak portal. Threat actor claims exfiltration of 103 GB of internal data files.

Far West Contractors was listed on the Deadlock ransomware extortion leak portal. Unverified extortion claim alleging unauthorized network access and data compromise.

State of California Department of Justice data breach disclosure notice filed by Fragomen, Del Rey, Bernsen & Loewy.

Inova Semiconductors GmbH was listed on the Qilin ransomware extortion leak portal. Unverified extortion claim alleging unauthorized network access and data compromise.

Jampac Alimentos was listed on the Akira ransomware extortion leak portal. Threat actor claims exfiltration of 35GB of internal data files.

Main Place Mall was listed on the Netrunner ransomware extortion leak portal. Main Place is part of a mixed development that combines residence, leisure, retail and dining to bring you the ultimate city-suburban lifestyle.

Pacific Tank Lines was listed on the Akira ransomware extortion leak portal. Threat actor claims exfiltration of 13GB of internal data files.

Raleigh Family Medicine was listed on the Booba Project ransomware extortion leak portal. Threat actor claims exfiltration of 1 GB of internal data files.

Sangre de Cristo Electric Association was listed on the Incransom ransomware extortion leak portal. Unverified extortion claim alleging unauthorized network access and data compromise.

Soni Medical Centre was listed on the Booba Project ransomware extortion leak portal. Threat actor claims exfiltration of 5.5 GB of internal data files.

The Official College of Architects of León (COAL) was listed on the Akira ransomware extortion leak portal. Threat actor claims exfiltration of 77GB of internal data files.

Tronex A/S was listed on the Wallstreet ransomware extortion leak portal. Unverified extortion claim alleging unauthorized network access and data compromise.

UNION FA was listed on the Deadlock ransomware extortion leak portal. Unverified extortion claim alleging unauthorized network access and data compromise.

University of Illinois Chicago was listed on the Booba Project ransomware extortion leak portal. Threat actor claims exfiltration of 344 GB of internal data files.

www.kres.cz was listed on the Krybit ransomware extortion leak portal. KRES spol. s r.o. is a Czech company headquartered in Krnov, Moravskoslezský Region, Czech Republic, specializing in wh...

www.pierrefeu.fr was listed on the Krybit ransomware extortion leak portal. Pierrefeu Immobilier is an independent French real estate agency founded in 1963, headquartered in Tarare, in the Nord-O...

www.raajratna.com was listed on the Krybit ransomware extortion leak portal. Raajratna Metal Industries Limited (RMIL) is a leading Indian public limited company incorporated on May 9, 1988, headqu...

Microsoft disclosed an intrusion by Russian foreign intelligence threat group Midnight Blizzard (APT29), accessing senior leadership corporate emails and source code.

Cryptocurrency exchange Bitget has resumed Bitcoin withdrawals suspended after suspected North Korean hackers breached its systems last week and stole over $350 million. [...]

The Dutch Institute for Vulnerability Disclosure (DIVD) says that the breach of its network was possible by exploiting a chain of two zero-day vulnerabilities in the open-source Zammad ticketing system. [...]

Global law firm Greenberg Traurig was compromised by Silent Ransom Group, resulting in the exfiltration and notification of over 126,000 individuals.

Sean Lyngaas and Davis Winkie report: A data breach at the Pentagon’s vast HR system has exposed Social Security numbers and other personal information of current and former military personnel, raising counterintelligence concerns among national s...

State of California Department of Justice data breach disclosure notice filed by Aldrich Services.

ASSOCIATED GASTROENTEROLOGISTS OF CENTRAL NEW YORK, P.C was listed on the Booba Project ransomware extortion leak portal. Threat actor claims exfiltration of 70 GB of internal data files.

C*ro *nty *es was listed on the Nightspire ransomware extortion leak portal. Data is not available now.

Den Hartog Industries was listed on the Incransom ransomware extortion leak portal. Unverified extortion claim alleging unauthorized network access and data compromise.

DISK PRECISION GROUP - diskprecision.com was listed on the Krybit ransomware extortion leak portal. - Disk Precision Industries Pte Ltd (Singapore, est. 1986) - Spacetech Industrial Pte Ltd (Singapore) - Niteac Eng...

DPL Group was listed on the Akira ransomware extortion leak portal. Threat actor claims exfiltration of 8GB of internal data files.

Dynamic Office Solutions was listed on the Qilin ransomware extortion leak portal. Unverified extortion claim alleging unauthorized network access and data compromise.

EURODITEL/RESOTELECOM was listed on the Krybit ransomware extortion leak portal. Euroditel is a French managed services provider (MSP) specializing in telephony and unified communications. Based in th...

Fortinet is warning customers of a critical FortiMail vulnerability, tracked as CVE-2026-104286, that is being actively exploited in zero-day attacks to execute unauthorized code or commands on vulnerable devices. [...]

FUNAP - Fundação "Prof. Dr. Manoel Pedro Pimentel" was listed on the Booba Project ransomware extortion leak portal. Threat actor claims exfiltration of 26 GB of internal data files.

Graybar Electric Company, Inc. was listed on the Redact ransomware extortion leak portal. Sector: Electrical Equipment | Revenue: $11B USD

Guardian Pharmacy LLC was listed on the Incransom ransomware extortion leak portal. Hacked; more news coming soon. . .

Krycler, Ervin, Taubman & Kaminsky was listed on the Akira ransomware extortion leak portal. Threat actor claims exfiltration of 88GB of internal data files.

LA PONDEROSA was listed on the Emperador ransomware extortion leak portal. Unverified extortion claim alleging unauthorized network access and data compromise.

Laboratorios Roemmers SAICF was listed on the Aurora ransomware extortion leak portal. Threat actor claims exfiltration of 82 GB of internal data files.

State of California Department of Justice data breach disclosure notice filed by Lincoln Property Company Commercial.

State of California Department of Justice data breach disclosure notice filed by Marana Health Center.

Northern Counties Health Care was listed on the Incransom ransomware extortion leak portal. With five community Health Centers, two dental centers, and a certified Home Health Care & Hospice division, NCHC provides health care services to patients...

Post Metal Recycling was listed on the Incransom ransomware extortion leak portal. Unverified extortion claim alleging unauthorized network access and data compromise.

Rimrock Foundation was listed on the Incransom ransomware extortion leak portal. Unverified extortion claim alleging unauthorized network access and data compromise.

Superior Plating Technology CO was listed on the Morpheus ransomware extortion leak portal. Unverified extortion claim alleging unauthorized network access and data compromise.

Wesmar was listed on the Akira ransomware extortion leak portal. Threat actor claims exfiltration of 66GB of internal data files.

State of California Department of Justice data breach disclosure notice filed by American Family Connect Insurance Company.

State of California Department of Justice data breach disclosure notice filed by DriveWealth.

Houston Thyroid & Endocrine Specialists was listed on the N0n ransomware extortion leak portal. Unverified extortion claim alleging unauthorized network access and data compromise.

State of California Department of Justice data breach disclosure notice filed by Nishiyamato Academy.

State of California Department of Justice data breach disclosure notice filed by ProCamps.

Summit Electric Supply was listed on the Vexy Ransomware ransomware extortion leak portal. Unverified extortion claim alleging unauthorized network access and data compromise.

wolfusofsky.de was listed on the Safepay ransomware extortion leak portal. The group provides a broad range of construction and infrastructure services to public and private clients in Rhineland-Palatinate, Saarland, neighboring …

State of California Department of Justice data breach disclosure notice filed by Challenge Financial Services.

State of California Department of Justice data breach disclosure notice filed by City of McMinnville.

Andrey Mihayloff reports: Dodo Pizza has confirmed a cyberattack on its IT systems, admitting that attackers may have accessed personal data of a portion of its customer base. The company reported the breach to Roskomnadzor and stated that access...

Authorities in the Netherlands have arrested a 23-year-old convicted cybercriminal on suspicion of aiding in data thefts and extortions by the prolific hacker group ShinyHunters. In the days immediately following the suspect's arrest, remaining Sh...

Oregon Department of Justice formal data breach disclosure notice filed by Lamb Weston affecting 7,175 Oregon residents.

State of California Department of Justice data breach disclosure notice filed by Poppins Payroll Company.

A U.S. Army soldier who pleaded guilty to hacking into multiple telecommunications companies and stealing mobile call and text metadata for more than 100 million AT&T customers in 2024 was sentenced to 70 months in federal prison today and ordered...

Numerous major law firms have fallen prey to the Silent Ransom Group this year. Now DataBreaches provides exclusive details on SRG's recent attacks on Hogan Lovells Cadwalader. Yes, that's "attacks," plural. When New York City's oldest law firm, C...

Keio Corporation (Keio), a major private railway operator in Japan, said its network was hit by a ransomware attack over the weekend, disrupting some of its business systems. [...]

State of California Department of Justice data breach disclosure notice filed by San Bernardino County on behalf of Arrowhead Regional Medical Center.

Japanese car-sharing service Times Car has confirmed that approximately 6.6 million user accounts were compromised in a cyberattack disclosed late last week. [...]

Upbound Group disclosed unauthorized acquisition of customer records and internal documents subsequently leveraged in fraudulent attempts.

Tom McArthur and Louise Parry report: Ten NHS staff have been removed from duty or suspended after a data breach involving the digital medical records of three-year-old Noah Woods. Launching an "urgent" investigation, Dr Martin Mansfield, deputy c...

The Psychedelic Stealer malware distributed via compromised Ukrainian websites using ClickFix-style Cloudflare verification checks is part of a wider malware-as-a-service (MaaS) platform called Lunex. The new findings come from Ontinue, which desc...

Suzanne Smiley reports another update on litigation stemming from the American Medical Collection Agency breach. A bipartisan coalition of 44 state attorneys general on Thursday announced that they settled a lawsuit against Labcorp in exchange for...

State of California Department of Justice data breach disclosure notice filed by Financial Administrative Support Services.

State of California Department of Justice data breach disclosure notice filed by Gallagher Transport International.

State of California Department of Justice data breach disclosure notice filed by Kings United Way.

State of California Department of Justice data breach disclosure notice filed by MedImpact Healthcare Systems.

State of California Department of Justice data breach disclosure notice filed by OneMain Financial Group.

State of California Department of Justice data breach disclosure notice filed by 5Star Life Insurance Company.

State of California Department of Justice data breach disclosure notice filed by Blanchard Training & Development.

State of California Department of Justice data breach disclosure notice filed by HILT-Trust 2020-A and its underlying trusts and affiliates.

State of California Department of Justice data breach disclosure notice filed by NSE Insurance Agencies.

State of California Department of Justice data breach disclosure notice filed by Peña and Bromberg.

Healthcare management company Astrana Health filed Form 8-K Item 1.05 disclosing a cybersecurity intrusion at its Astrana Health Management subsidiary.

State of California Department of Justice data breach disclosure notice filed by Fairwinds Credit Union.

State of California Department of Justice data breach disclosure notice filed by Modoc Medical Center.

State of California Department of Justice data breach disclosure notice filed by Ethan Conrad Properties.

State of California Department of Justice data breach disclosure notice filed by Friesen Group.

State of California Department of Justice data breach disclosure notice filed by Fun For Less Tours.

State of California Department of Justice data breach disclosure notice filed by Ridgeway Pharmacy.

State of California Department of Justice data breach disclosure notice filed by United Underwriters.

State of California Department of Justice data breach disclosure notice filed by The Office of the Los Angeles City.

State of California Department of Justice data breach disclosure notice filed by Opportune.