Major incidents
Hacking, data breach and ransomware incidents, each tracked with the affected organisation, scale and timeline.
New incidents by day
Incidents by type (30 days)
Latest incidents
UK Housing Ombudsman plans case management system recovery after October cyber-attack
Impact: Disruption to the case management system, online complaint forms, landlord portal and webchat. Whether personal information was compromised and the number of people affected remain unconfirmed.
The UK Housing Ombudsman confirmed unauthorised access to data in its case management system supplied by an external provider in October 2026 and took the system offline. In November, it said it would begin recovery work shortly after putting additional security measures in place. Whether personal information was compromised and the full extent of the damage remain under investigation.
Read on Inside Housing ↗Security flaws expose information on UK government websites
Security flaws exposed information on several UK government websites. The specific types of information exposed, the scale of the impact and the response measures have not been confirmed.
Read on WIRED ↗British soldier faces court martial over Estonia mobile phone security incident
A mobile phone security incident occurred in Estonia. A British soldier has been referred to court martial in connection with the incident.
Read on SC Media ↗Kinross Eljamel campaigner faces administrative difficulties after data leak
An Eljamel campaigner in Kinross struggled with complex administrative procedures following a data leak. The types and volume of data leaked, the timing of the incident and the response have not been confirmed.
Read on The Courier ↗Unauthorised access to Northern Ireland school app Equipple raises data exposure concerns
Unauthorised access was discovered in the cloud environment of Equipple, an app used by schools in Northern Ireland to book parent-teacher meetings. Parents’ contact details and pupils’ names, dates of birth and enrolment groups may have been exposed, but the exact number of people affected was not disclosed. Parents were advised to be alert to unexpected emails or phone calls.
Related reports: 3 · last report →Staff impersonation phishing diverts wages at UK's Highland Council
2Impact: £3,321.41 in wages and two payslips
Phishing involving staff impersonation at the UK's Highland Council resulted in £3,321.41 in wages being transferred to an attacker's account. The attacker asked 12 schools to change payroll bank details and obtained two payslips, also acquiring employees' personal and financial information. The incident came to light in a council audit report.
Read on The Press and Journal ↗BP hit by ransomware attack
BP suffered a ransomware attack. The exact timing, extent of the damage and response measures have not been disclosed.
Read on Travel News ↗Gnosis Pay customer data exposed in personal card system breach
Impact: Customer personal data, card details and cryptocurrency wallet addresses exposed; number of people affected undisclosed
Unauthorised access to Gnosis Pay's legacy personal card system on 3 November exposed customer information. Notices to affected customers listed names, addresses, contact details, card numbers, expiry dates, CVVs and linked cryptocurrency wallet addresses. The company said customer funds and its corporate card platform were unaffected and made 3D authentication compulsory for card payments.
Related reports: 19 · last report →ASOS cyber incident exposes customer information and disrupts trading
Impact: Approximately 2–4% decline in gross merchandise value and unauthorised access to basic customer information
ASOS experienced a cyber incident on 6 October 2026, and an external investigation confirmed unauthorised access to basic customer information. ASOS suspended marketing and customer management activities as a precaution, causing disruption primarily to its UK operations. Gross merchandise value fell by approximately 2–4% following the incident.
Related reports: 2 · last report →Data breach at Rushcliffe Spencer Academy
A data breach at Rushcliffe Spencer Academy became known on 5 November 2026. The scale of the breach, the types of information involved, when it occurred and the response have not been confirmed.
Read on shattered.io ↗Royal Cornwall Hospitals NHS Trust exposes health data of 8,003 workers
8kImpact: Sick leave and health information of 8,003 employees and external workers
Sick leave and health information relating to 7,715 employees and 288 external workers remained in hidden pivot tables in an Excel file published by Royal Cornwall Hospitals NHS Trust in response to a freedom of information request, leaving it publicly accessible for around 33 months. No patient information was included. An independent investigation found failures in data sanitisation and review and approval procedures, and the trust acknowledged the emotional distress and loss of trust experienced by affected employees.
Related reports: 8 · last report →Northern Ireland dental firm fails to notify patients for over five months after data breach
A dental firm in Northern Ireland suffered a data breach. The firm did not inform patients of the breach for more than five months after the incident.
Read on TheDetail.tv ↗UK authorities warn of rise in cyber-attacks targeting infrastructure vulnerabilities
UK authorities warned that cyber-attacks targeting vulnerabilities in infrastructure would increase. They cited an incident involving supermarket refrigeration equipment as an early example.
Read on Reuters ↗Bristol school support platform hack exposes 320,000 files
320kImpact: More than 320,000 files published; 39 schools potentially affected
Trading with Schools, a school support platform operated by Bristol City Council in the UK, was breached in September, and school data was stolen. More than 320,000 files were subsequently published on the dark web, and 39 schools are being investigated as potentially affected by the data theft. A total of 88 schools were disconnected from the network, and the council and police are analysing the published material to identify the affected schools and individuals and determine the scope of the leaked information.
Related reports: 10 · last report →Liverpool hospital investigates suspected unauthorised access to Southport attack patient records
2Impact: Two suspected instances of unauthorised access to patient records
A hospital in Liverpool, UK, is investigating suspected unauthorised access by staff to records of patients from the Southport attack. The investigation concerns two potential instances of unauthorised access.
Read on DataBreaches.net ↗Baanx Crypto Life customer data accessed without authorisation twice
Impact: Crypto Life customer data
Baanx's Crypto Life customer data was accessed without authorisation on two occasions through a third-party service provider and an internal management system. The affected information may include names, contact details, transaction histories, hashed passwords and Social Security numbers. No evidence of access to customer funds was found.
Related reports: 3 · last report →Malware on Shelly Store UK website may have exposed payment information
Impact: Potential exposure of customers' payment information and personal data; scale unknown
British smart home device retailer Shelly Store UK found malicious software on its website and servers and notified customers that their payment information may have been exposed. Card information, names, billing addresses and contact details may have been affected, while whether any data was actually stolen and the period of exposure remain unconfirmed.
Related reports: 4 · last report →Former GCHQ Intern Fails to Get Sentence Reduced Over Data Leak
A former intern at the UK's GCHQ was sentenced over an information leak case. An attempt to reduce the sentence afterwards was not accepted.
Read on Law360 ↗Northflank security breach leads to unauthorised use of customers' AI API keys
Impact: Unauthorised use of some customers' AI API keys and a major service outage
Cloud platform Northflank suffered a security breach and a major service outage, and some customers reported unauthorised use of AI API keys they had stored. Assuming all environment variables may have been decrypted, the company told customers to rotate secrets and credentials and began an investigation with an external incident response team. On 2 November it said there was no sign that data of running workloads had been accessed, and the initial intrusion route and full extent of harm are under investigation.
Related reports: 13 · last report →EWM Group Hit by Aurora Ransomware Attack
EWM Group was hit by a ransomware attack by Aurora. The date of the attack, the scale of the damage and the response have not been confirmed.
Read on SOCRadar ↗
Most affected organisations
- Meta 17
- OpenAI 16
- Microsoft 11
- Google 10
- Samsung Electronics 10
- T-Mobile 9
- Apple 9
- US Department of Defense 8
- Anthropic 8
- McDonald's 8
- Binance 6
- Nissan 6
- Ministry of Foreign Affairs 6
- Ministry of the Interior and Safety 6
- X 6
- Volkswagen 6
- Trezor 5
- Nexon 5
- Hugging Face 5
- UK Government 5
- University of Pennsylvania 5
- US Department of Homeland Security 5
- Federal Bureau of Investigation (FBI) 5
- AT&T 5
- Israel Defense Forces 5
- DeepSeek 5
- Comcast 5
- US government 5
- French government 5
- WhatsApp 5
- Dell 5
- Schneider Electric 5
- Western Sydney University 5
- Uber 4
- Texas Health and Human Services Commission 4
- KT 4
- T1 4
- Cloudflare 4
- Oracle 4
- Flock 4