Trending
Incidents with the most news coverage recently, including older incidents that are still drawing follow-up reports.
3AM ransomware encrypts 37 systems on UK school network
Impact: Approximately 37 systems encrypted
A UK school network suffered a 3AM ransomware attack, with approximately 37 systems encrypted. The attackers targeted approximately 50 systems accessed from an unmanaged host. Security researchers suggested that the cyber-attack may have combined human and artificial intelligence capabilities.
Related reports: 22 · last report →Gnosis Pay customer data exposed in personal card system breach
Impact: Customer personal data, card details and cryptocurrency wallet addresses exposed; number of people affected undisclosed
Unauthorised access to Gnosis Pay's legacy personal card system on 3 November exposed customer information. Notices to affected customers listed names, addresses, contact details, card numbers, expiry dates, CVVs and linked cryptocurrency wallet addresses. The company said customer funds and its corporate card platform were unaffected and made 3D authentication compulsory for card payments.
Related reports: 19 · last report →Northflank security breach leads to unauthorised use of customers' AI API keys
Impact: Unauthorised use of some customers' AI API keys and a major service outage
Cloud platform Northflank suffered a security breach and a major service outage, and some customers reported unauthorised use of AI API keys they had stored. Assuming all environment variables may have been decrypted, the company told customers to rotate secrets and credentials and began an investigation with an external incident response team. On 2 November it said there was no sign that data of running workloads had been accessed, and the initial intrusion route and full extent of harm are under investigation.
Related reports: 13 · last report →Bristol school support platform hack exposes 320,000 files
320kImpact: More than 320,000 files published; 39 schools potentially affected
Trading with Schools, a school support platform operated by Bristol City Council in the UK, was breached in September, and school data was stolen. More than 320,000 files were subsequently published on the dark web, and 39 schools are being investigated as potentially affected by the data theft. A total of 88 schools were disconnected from the network, and the council and police are analysing the published material to identify the affected schools and individuals and determine the scope of the leaked information.
Related reports: 10 · last report →Royal Cornwall Hospitals NHS Trust exposes health data of 8,003 workers
8kImpact: Sick leave and health information of 8,003 employees and external workers
Sick leave and health information relating to 7,715 employees and 288 external workers remained in hidden pivot tables in an Excel file published by Royal Cornwall Hospitals NHS Trust in response to a freedom of information request, leaving it publicly accessible for around 33 months. No patient information was included. An independent investigation found failures in data sanitisation and review and approval procedures, and the trust acknowledged the emotional distress and loss of trust experienced by affected employees.
Related reports: 8 · last report →Marks & Spencer cyber-attack exposes customer data and disrupts trading
Impact: Customer data exposure and disruption to payments and online orders; estimated cost of £300 million
A cyber-attack in April 2025 disrupted contactless payments, online orders and click-and-collect services at Marks & Spencer, leading it to suspend online orders. In May, the company disclosed that customer data had been exposed and estimated the cost of the attack at £300 million. Its profit subsequently halved in the first half of 2025, while results published in November 2026 showed that profit had recovered following the cyber-attack.
Related reports: 113 · last report →TFG London cyber-attack leads to unauthorised access to customer and staff personal data
Impact: Customer and employee personal information, including customer contact details, delivery addresses, order information and the last four digits of some payment cards
TFG London, which operates Phase Eight, Hobbs and Whistles, confirmed unauthorised access to customers’ and employees’ personal information during its investigation into a cyber-attack. Customer contact details, delivery addresses, order information and the last four digits of some payment cards were affected, but no evidence was found that usable full card details or passwords had been leaked. Some IT systems remained unavailable on 30 October.
Related reports: 4 · last report →Malware on Shelly Store UK website may have exposed payment information
Impact: Potential exposure of customers' payment information and personal data; scale unknown
British smart home device retailer Shelly Store UK found malicious software on its website and servers and notified customers that their payment information may have been exposed. Card information, names, billing addresses and contact details may have been affected, while whether any data was actually stolen and the period of exposure remain unconfirmed.
Related reports: 4 · last report →PwC Employee Learning Records Leaked in Attack on Third-Party Site
Impact: Employee learning records
PwC confirmed a cyber security incident in which employee learning records were leaked through an attack on a third-party site. The Everest ransomware group claimed to have stolen 590 GB of PwC data, but the confirmed scale of the leak has not been disclosed.
Related reports: 4 · last report →Synnovis ransomware attack disrupts London hospital care and leaks patient data
900kImpact: More than 900,000 patients affected; about 1,600 surgery and care appointments cancelled in one week
UK pathology provider Synnovis was hit by a ransomware attack in 2024 that disrupted transfusions, surgery and care at London hospitals. Patient names, dates of birth, NHS numbers and test results that could be linked to some individuals were stolen, and more than 900,000 patients were affected. Hospitals used paper records, and after finishing its analysis of the stolen data, Synnovis began notifying affected healthcare organisations in November 2025.
Related reports: 38 · last report →Around 15,000 drivers allowed to pursue Arnold Clark data breach claims
Arnold Clark suffered a personal data breach following a cyber-attack. In April 2026, around 15,000 drivers were allowed to proceed with claims relating to the incident.
Related reports: 4 · last report →Unauthorised access to Northern Ireland school app Equipple raises data exposure concerns
Unauthorised access was discovered in the cloud environment of Equipple, an app used by schools in Northern Ireland to book parent-teacher meetings. Parents’ contact details and pupils’ names, dates of birth and enrolment groups may have been exposed, but the exact number of people affected was not disclosed. Parents were advised to be alert to unexpected emails or phone calls.
Related reports: 3 · last report →Baanx Crypto Life customer data accessed without authorisation twice
Impact: Crypto Life customer data
Baanx's Crypto Life customer data was accessed without authorisation on two occasions through a third-party service provider and an internal management system. The affected information may include names, contact details, transaction histories, hashed passwords and Social Security numbers. No evidence of access to customer funds was found.
Related reports: 3 · last report →ASOS Customer Data Accessed and Hack Alert Sent Through App
Impact: Customers' personal data including names and contact details; number of people affected unknown
Unauthorised access to customer data occurred at UK fashion retailer ASOS, and an abnormal notification claiming a hack and threatening a data leak was sent to customers' app. ASOS confirmed unauthorised access to customers' names and contact details. It later emerged that the sample obtained by the attacker also included dates of birth and search histories, showing the damage was broader than first disclosed.
Related reports: 37 · last report →Jaguar Land Rover cyber-attack causes data leak and production halt
Impact: Data leak and prolonged production halt; company costs exceeding $220 million
Jaguar Land Rover suffered a cyber-attack in 2025 that led to a data leak and a prolonged production shutdown. The shutdown also affected parts supply and vehicle sales, and the company's direct costs reportedly exceeded $220 million. Resumption of UK production was reported in November 2025, and the possibility of Russian hackers and a state-sponsored attack was later raised.
Related reports: 100 · last report →ASOS cyber incident exposes customer information and disrupts trading
Impact: Approximately 2–4% decline in gross merchandise value and unauthorised access to basic customer information
ASOS experienced a cyber incident on 6 October 2026, and an external investigation confirmed unauthorised access to basic customer information. ASOS suspended marketing and customer management activities as a precaution, causing disruption primarily to its UK operations. Gross merchandise value fell by approximately 2–4% following the incident.
Related reports: 2 · last report →Ransomware exposes children's data at Ogi Networks and Data Cymru
Impact: Exposure of children's data
Children's data was exposed in ransomware attacks on Ogi Networks and Data Cymru. The UK Information Commissioner's Office issued reprimands to both organisations.
Related reports: 2 · last report →NHS ransomware attack disrupts treatment and exposes patient data
5.4mImpact: 5.4 million patient records exposed, more than 1,100 operations postponed, and a contribution to a patient's death
A blood testing company serving London hospitals was hit by a ransomware attack, disrupting NHS blood transfusions and operations and exposing patient information. More than 1,100 operations were postponed, approximately 200 of which involved cancer treatment. The NHS confirmed the online publication of stolen data and investigated, and it later emerged that 5.4 million patient records had been exposed and that the attack had contributed to a patient's death.
Related reports: 29 · last report →UK Housing Ombudsman plans case management system recovery after October cyber-attack
Impact: Disruption to the case management system, online complaint forms, landlord portal and webchat. Whether personal information was compromised and the number of people affected remain unconfirmed.
The UK Housing Ombudsman confirmed unauthorised access to data in its case management system supplied by an external provider in October 2026 and took the system offline. In November, it said it would begin recovery work shortly after putting additional security measures in place. Whether personal information was compromised and the full extent of the damage remain under investigation.
Read on Inside Housing ↗South Lanarkshire Council faces group action over 2023 data leak
15kImpact: Personal information of approximately 15,000 current and former employees leaked
This is a follow-up on group litigation over an incident on 11 April 2023, when South Lanarkshire Council leaked the personal information of approximately 15,000 current and former employees while responding to a freedom of information request. The leaked information included names, salaries, National Insurance numbers, job titles and workplaces. On 9 July 2026, the court authorised a group action over the incident.
Read on Law Society of Scotland ↗Security flaws expose information on UK government websites
Security flaws exposed information on several UK government websites. The specific types of information exposed, the scale of the impact and the response measures have not been confirmed.
Read on WIRED ↗British soldier faces court martial over Estonia mobile phone security incident
A mobile phone security incident occurred in Estonia. A British soldier has been referred to court martial in connection with the incident.
Read on SC Media ↗Kinross Eljamel campaigner faces administrative difficulties after data leak
An Eljamel campaigner in Kinross struggled with complex administrative procedures following a data leak. The types and volume of data leaked, the timing of the incident and the response have not been confirmed.
Read on The Courier ↗Staff impersonation phishing diverts wages at UK's Highland Council
2Impact: £3,321.41 in wages and two payslips
Phishing involving staff impersonation at the UK's Highland Council resulted in £3,321.41 in wages being transferred to an attacker's account. The attacker asked 12 schools to change payroll bank details and obtained two payslips, also acquiring employees' personal and financial information. The incident came to light in a council audit report.
Read on The Press and Journal ↗BP hit by ransomware attack
BP suffered a ransomware attack. The exact timing, extent of the damage and response measures have not been disclosed.
Read on Travel News ↗Data breach at Rushcliffe Spencer Academy
A data breach at Rushcliffe Spencer Academy became known on 5 November 2026. The scale of the breach, the types of information involved, when it occurred and the response have not been confirmed.
Read on shattered.io ↗Northern Ireland dental firm fails to notify patients for over five months after data breach
A dental firm in Northern Ireland suffered a data breach. The firm did not inform patients of the breach for more than five months after the incident.
Read on TheDetail.tv ↗UK authorities warn of rise in cyber-attacks targeting infrastructure vulnerabilities
UK authorities warned that cyber-attacks targeting vulnerabilities in infrastructure would increase. They cited an incident involving supermarket refrigeration equipment as an early example.
Read on Reuters ↗Liverpool hospital investigates suspected unauthorised access to Southport attack patient records
2Impact: Two suspected instances of unauthorised access to patient records
A hospital in Liverpool, UK, is investigating suspected unauthorised access by staff to records of patients from the Southport attack. The investigation concerns two potential instances of unauthorised access.
Read on DataBreaches.net ↗Confidential UK Biobank health records exposed online
Impact: Confidential health records
Confidential health records from the UK Biobank project were exposed online. The timing and scale of the exposure, its cause and the response have not been confirmed.
Related reports: 5 · last report →