57 casos · pág. 3/3
Ridgeway Pharmacy Ltd, a Victor, Montana mail order and community pharmacy, disclosed that a security incident involving its third-party designed and developed website exposed the personal and health information of 258,920 customers. The company became aware of the exposure on August 21, 2026. Forensic experts confirmed the incident was l…
Ticketmaster confirmed a security incident that exposed personal data of customers in Brazil who bought tickets in 2025. The company notified affected users by email and reported the case to the Brazilian data protection authority (ANPD). According to the company, the incident involved a third-party data analytics tool. The investigation,…
Mid Florida Dermatology & Plastic Surgery, a 33-location medical group in central Florida, reported to the HHS Office for Civil Rights a breach affecting 85,585 individuals. An unauthorized third party accessed its network from March 26 to March 30, 2026, and patient files may have been viewed or acquired. Two other healthcare incidents w…
Boston Children's Health Physicians (BCHP) and its managed IT provider XTIUM (formerly Axispoint Technology Solutions Group) settled with the New York and Connecticut Attorneys General over an August 2024 breach affecting almost 890,000 individuals. The settlement carries a $4 million penalty, of which $2.7 million is payable (New York $2…
An actor using the handle ChimeraZ claims to be selling a dataset from LOOF (Livre Officiel des Origines Félines), the French organization that registers pedigree cats and maintains official feline genealogical records. The listing advertises about 654,000 lines, roughly 330,000 animal records, about 40,000 people and 90,555 files totalin…
Scammers abused a legitimate spend-management platform as part of a fraud operation. They used its notification system to send phishing messages and its open-banking account linking to validate stolen banking credentials. Group-IB documented the activity in a client environment after the platform reported suspicious payment notifications …
In August 2026, French intellectual property software and services company Questel was targeted in a ShinyHunters "pay or leak" extortion campaign. The group published a large corpus of data it claimed to have taken from the company. The data is largely corporate contact information tied to sales leads, support cases and marketing activit…
An actor using the handle malconguerra2 claims to be sharing a dataset allegedly from KFC Venezuela, advertised at roughly 1.55 million records. The detailed description lists 1,542,021 JSON records totaling 17.5 GB. A visible sample shows customer and transaction fields: full names, email addresses, phone numbers, physical addresses, ord…
An actor using the handle Shenron claims to have released a dataset tied to APICRYPT Messaging, a secure healthcare messaging system created in 1996 and managed by the APICEM association. The listing advertises 852,757 rows covering 60,911 users, and marks the breach and release as occurring in 2026. The visible sample contains healthcare…
Conduent has agreed to an $80 million settlement of the consolidated class action In Re Conduent Business Services Data Breach Litigation, filed in the U.S. District Court for the District of New Jersey on October 16, 2026 and confirmed in an 8-K filing with the SEC (infosecurity-magazine.com). The suit stems from the 2024 breach at Condu…
Nikkei Inc., the Japanese media group that owns The Nikkei and the Financial Times, disclosed a breach of a cloud service used for system development. On October 7, attackers used previously stolen credentials to gain unauthorized access. As of October 16, about 1.83 million items of personal information had leaked. The company reported t…
Japanese media group Nikkei (publisher of The Nikkei and the Financial Times) disclosed a data breach affecting about 1.83 million records held in a cloud service used for system development. On the morning of October 7, attackers used previously compromised credentials to access the service. About 1.68 million records held only non-ident…
Nikkei Inc. disclosed a third data breach in about a month, exposing 1.83 million records stored in the cloud. Attackers used stolen credentials to access a development system in the early hours of October 7. About 150,000 records contained at least one of: full names, email addresses, physical addresses, phone numbers or dates of birth, …
A threat actor using the handle Alduin claims to be selling a customer dataset from Climb Up, described as the largest network of indoor climbing gyms in France. The listing advertises approximately 151,000 records covering customers across 29 locations, with data spanning January 2016 to March 2026. The seller asks for offers in XMR only…
An actor using the handle Erich claims to have breached an unnamed conference-space company with an estimated $80-100 million in annual revenue. The actor says the compromise came through a support panel and that access is still active. The post cites 24,753 tickets, 387,388 comments, 274,294 system notes, 113,094 real replies, 115,948 at…
Indian stock brokerage Angel One confirmed in July 2024 that data leaked online came from a breach that occurred in April 2023. The leak holds 7.9M user records covering 6.8M unique email addresses. It was added to Have I Been Pwned on 7 Oct 2026. Angel One stated the breach "has no impact on client securities, funds, or credentials". The…
In August 2026, the digital health company Sharecare was targeted in a ShinyHunters "pay or leak" extortion campaign. The group subsequently published data it claimed was taken from Sharecare's systems, containing 318k unique email addresses. Most of the data consists of B2B sales and marketing records, including names, physical addresses…
