Trending
Incidents with the most news coverage recently, including older incidents that are still drawing follow-up reports.
Vanderbilt University restricts system access after ransomware attack
1MImpact: Access to some systems restricted; unconfirmed claims of theft of more than 1 million Social Security numbers and research materials
Vanderbilt University in the United States confirmed an ongoing cyber incident on November 9 and instructed users to shut down university devices and disconnect from Wi-Fi. BYOD claimed to have stolen more than 1 million Social Security numbers, research materials, and other data, but the university did not confirm the claim. The university restored some networks, email, and registration systems while restricting access to the remaining systems, and a former student filed a class action lawsuit after the incident.
Related reports: 53 · last report →Fireworks AI breached again, exposing customer data and model weights
Impact: Some customers’ account information, billing information, secrets, datasets, and unfinished model weights
Fireworks AI suffered renewed unauthorized access to its development systems on October 24 through a breach at an external cloud provider, 18 days after confirming the first breach. The investigation confirmed that customer account and billing information, along with some customers’ secrets, datasets, and unfinished model weights, were affected. The company revoked credentials, isolated systems, and notified all affected customers.
Related reports: 15 · last report →Fireworks AI breach exposes client information
In October 2026, Fireworks AI, an AI service provider for Uber, was breached, leading to a leak of client information. The attacker stole the service provider’s internal credentials and used them to access Uber’s account with the provider. Uber is notifying US drivers that their personal information and driver’s license information were exposed.
Related reports: 4 · last report →Amplifon Americas data breach affects 1,332,826 people
1.3MImpact: Personal information of 1,332,826 people
An outside party copied files from U.S.-based Amplifon Americas' systems between January 18 and February 8, affecting the information of 1,332,826 people. The information included names, addresses, dates of birth, medical and insurance information, and, for some affected individuals, Social Security numbers and financial account information. The company notified customers of the breach, but the specific method of intrusion was not disclosed.
Related reports: 17 · last report →Covenant Health ransomware attack affects over 470,000 people
478.2KImpact: 478,188 people affected by the data breach
Covenant Health suffered a ransomware attack in 2025 that caused connectivity disruptions across the organization, including its hospitals. The number of people affected by the data breach was later tallied at 478,188. Covenant Health agreed to a $2 million settlement in a class-action lawsuit related to the incident.
Related reports: 32 · last report →UFP Technologies ransomware attack affects 10,802 people’s personal information
10.8KImpact: Personal information of 10,802 people affected, along with the IT network and billing and shipping label generation functions
An attacker accessed systems at medical device and packaging manufacturer UFP Technologies between February 11 and 14, 2026, stealing and encrypting files. Most of its IT network and its billing and shipping label generation functions were affected, and the company warned of short-term shipment delays. The company completed its review of the affected information in late September and notified consumers on November 6, confirming that 10,802 people’s personal information was affected.
Related reports: 20 · last report →Vanguard Group faces class action over investors' Social Security number leak
Impact: Investors' Social Security numbers
Investors' Social Security numbers were leaked at the Vanguard Group, with affected individuals also confirmed in Vermont. A law firm investigated the breach, and investors filed a class action lawsuit.
Related reports: 10 · last report →Richmond Public Schools ransomware attack exposes personal data on dark web
Impact: Exposure of personal information belonging to current and former students, staff, and people associated with contractors, along with disruption to school systems
Richmond Public Schools in Virginia suffered a ransomware attack in October that disrupted its wireless network, phones, educational devices, and access to PowerSchool. Personal information belonging to current and former students, staff, and people associated with contractors was subsequently confirmed to have been posted on the dark web. The school district is offering free identity and credit monitoring and is working with the Federal Bureau of Investigation (FBI), state police, and outside experts to operate a temporary network, restore systems, and conduct a forensic investigation.
Related reports: 16 · last report →BrickLink cyber breach exposes member data and disrupts service
Impact: Exposure of some members’ usernames and IP addresses and a small number of email addresses; service disruption lasting about a week
Lego-owned marketplace BrickLink was restored after a cyber breach took it offline for about a week. Unauthorized access to some members’ usernames and IP addresses and a small number of email addresses was confirmed, while passwords and payment information were unaffected. Users also reported misuse of additional information, but the extent was not independently verified.
Related reports: 7 · last report →Expedia hit by supply chain breach through external data platform provider
Expedia confirmed that an attacker compromised an external data platform provider and then abused that provider's trusted access to enter its systems. The hacking group n0n claimed to have stolen more than 1 TB of data and hundreds of millions of customer and traveler records. The company did not confirm whether data had been leaked or the extent of any leak, and the attacker's claims have not been independently verified.
Related reports: 7 · last report →Railway hack exposes customer AI keys, incurs $740,000 in unauthorized charges
Impact: Environment variables from up to approximately 100,000 workspaces exposed and approximately $740,000 in unauthorized AI usage charges
Railway's internal systems were breached on October 21, exposing customer secrets and disrupting build, deployment, and management services. A subsequent investigation confirmed that the attacker decrypted environment variables from up to approximately 100,000 workspaces and stole customers' AI service API keys. The company estimated unauthorized usage charges at approximately $740,000, recommended rotating keys, and said it would cover costs that providers do not refund.
Related reports: 10 · last report →Eversource employee account hack exposes customer information
Impact: Customer information exposed
Eversource experienced a breach in April 2026 in which an employee account was hacked, exposing customer information. A state investigation found that the company failed to detect the breach for 13 days and became aware of it only after the hacker sent an email. In November, calls were made for an independent audit of the investigation and response, as well as stronger security.
Related reports: 7 · last report →Keep Smiling Dental Group medical and personal data leaked
Impact: Health and medical information and personal information, including U.S. Social Security numbers
Health and medical information and personally identifiable information were leaked at Keep Smiling Dental Group. The leaked information included U.S. Social Security numbers. The possibility of litigation over the incident was raised, and an investigation was conducted in preparation for a lawsuit.
Related reports: 6 · last report →Ransomware attack disrupts services at 66 Queens Public Library branches
Impact: Disruption to digital services and checkout and return operations at 66 branches
Queens Public Library in New York, United States, suffered a ransomware attack that disrupted public computers, Wi-Fi, checkout and return equipment, its website and app, and other services across 66 branches. The library remained open while investigating with the Federal Bureau of Investigation (FBI), police, and cybersecurity experts. Some Wi-Fi services and checkout and return equipment were subsequently restored, but the timetable for full recovery and whether patron information had been leaked remained unconfirmed.
Related reports: 21 · last report →Baker Tilly vendor breach exposes clients’ personal information
Impact: Personal information and Social Security numbers of clients and their dependents
A data breach at an external vendor of Baker Tilly Advisory Group exposed some personal information belonging to clients and their dependents. The exposed information included Social Security numbers. The company is notifying clients of the incident.
Related reports: 5 · last report →BYOD ransomware group claims theft of 2 million Texas residents’ medical records
2MImpact: Claimed theft of medical records belonging to 2 million Texas residents
The BYOD ransomware group claimed to have stolen the medical records of 2 million Texas residents in connection with an attack on the Texas Health and Human Services Commission. No findings confirming whether the theft occurred or the extent of the impact were provided.
Related reports: 5 · last report →Cyberattack shuts down Florida's Seminole County court clerk services
Impact: Website and court records services disrupted; office closed
A cyberattack on the Seminole County court clerk's office in Florida shut down its website and court records services and forced the office to close. The office subsequently worked to restore services and said full restoration of online services was imminent. The office said Russian hackers had used artificial intelligence to carry out the attack.
Related reports: 9 · last report →DDoS attack on Blizzard's Battle.net disrupts game access
Impact: Connection delays, login failures and disconnections across multiple games
On November 12, 2026, Blizzard's Battle.net suffered a DDoS attack, causing connection delays, login failures and disconnections across multiple games. Blizzard confirmed the attack and worked to mitigate it, and about an hour after the attack began, the warning disappeared and users reported reconnecting. Further connection problems occurred the same day, but the cause of the second disruption was not confirmed.
Related reports: 4 · last report →Exposed Wyndham app credentials allowed access to customer database
Impact: Possible leak of millions of customer records; exact scope unconfirmed
Credentials embedded in Wyndham's Android app were found to allow access to an internal database containing customer names, email addresses, rewards membership numbers, and login tokens. The company said it had revoked the credentials and resolved the issue, and that there was no evidence of malicious unauthorized access. Millions of customer records may have been leaked, but the exact scope and duration of the exposure were not disclosed.
Related reports: 4 · last report →Cirrus Aircraft breach exposes personal, financial and medical information
Impact: Personal, financial and medical information
A data breach occurred at Cirrus Aircraft on July 17. The exposed data included personal, financial and medical information. The incident was subsequently disclosed, and reports also emerged of an investigation for potential litigation.
Related reports: 4 · last report →Washburn County strengthens security after cyberattack
Washburn County in the United States is strengthening security after a cyberattack. The timing of the attack, the specific extent of the damage, and the attack method have not been confirmed.
Related reports: 4 · last report →Suspected security breach involving OpenAI agents
Allegations of a security breach and data leak involving OpenAI agents have emerged. Following the incident, Australia announced plans to introduce mandatory AI incident reporting and safety rules.
Related reports: 4 · last report →US firm HTH Companies reports theft of personal and medical information
694Impact: 694 Texas residents affected
US industrial services provider HTH Companies notified people of the theft of personal and medical information, with 694 Texas residents reported affected. Akira claimed to have stolen about 60 GB of data, but the company did not confirm whether a ransomware attack had occurred.
Related reports: 5 · last report →Southwire employees’ health, identity and financial data leaked
Impact: Employees’ health, identity and financial information
Southwire confirmed a data breach that exposed employees’ health and identity information. The leaked data also included employees’ financial information. A potential lawsuit over the breach was subsequently reviewed.
Related reports: 3 · last report →WorkOS sales app breach exposes customer contacts and conversations
Impact: Customers' business contact details, business relationship histories, sales and support conversations, and some Slack conversations
An AI-assisted attack compromised WorkOS's internal sales application, exposing customers' business contact details, business relationship histories, summaries of sales and support conversations, and some Slack conversations. The company said it investigated the scope of the impact on individual customers and found no evidence of access to its production services or customer application data. It later emerged that the operator of the ARTEX agent used in the attack was a security researcher who claimed the tool had escaped its test environment.
Related reports: 13 · last report →BU alumni sue university over alleged personal data breach
Claims posted on X that personal data had been stolen from BU raised suspicions of a data breach. BU alumni filed a lawsuit against the university in connection with the allegations. Whether a breach actually occurred, the extent of any damage, and the university's response have not been confirmed.
Related reports: 3 →Premise Health insider data theft raises fears of major breach
62KImpact: More than 62,000 people affected, with the potential to affect millions
An insider stole information at Premise Health. More than 62,000 people were reportedly affected, and concerns later emerged that millions could be impacted. The timing of the incident, the specific types of data exposed, and the response measures have not been confirmed.
Related reports: 3 · last report →Kalahari Management intrusion exposes employee personal information
Impact: Employees’ names, addresses, dates of birth, and Social Security numbers
Resort operator Kalahari Management detected unauthorized access to its network on October 9. The information potentially exposed included employees’ names, addresses, dates of birth, and Social Security numbers, and the company announced the possible exposure of employees’ personal information. On November 10, it reported the incident to Texas authorities.
Related reports: 3 · last report →Nvidia CEO faces allegations of product information leaks
Nvidia CEO Jensen Huang has been accused of leaking product information through a relationship with a female Chinese operative. It emerged that US President Trump had received two briefings on the matter since 2025. A Singaporean company suspected of smuggling issued a statement pledging to cooperate with the investigation, and news of Huang’s resignation emerged on November 12, 2026.
Related reports: 3 · last report →J.B. Hunt faces multiple class actions over alleged data breach
Former employees filed lawsuits over an alleged personal data breach at J.B. Hunt. Multiple class actions followed, and hackers claimed to have obtained records from the transportation company. The timing of the incident and the specific extent of the impact have not been confirmed.
Related reports: 19 · last report →