Trending
Incidents with the most news coverage recently, including older incidents that are still drawing follow-up reports.
Data on over 41,000 Homeland Security employees leaked
41KImpact: Information on more than 41,000 employees
Information on more than 41,000 U.S. Department of Homeland Security employees was stolen and published online. The leaked material included information on Immigration and Customs Enforcement and Customs and Border Protection employees, as well as the identities of undercover agents. The Department of Homeland Security launched an investigation into the leak.
Related reports: 77 · last report →Vanderbilt University restricts system access after ransomware attack
1MImpact: Access to some systems restricted; unconfirmed claims of theft of more than 1 million Social Security numbers and research materials
Vanderbilt University in the United States confirmed an ongoing cyber incident on November 9 and instructed users to shut down university devices and disconnect from Wi-Fi. BYOD claimed to have stolen more than 1 million Social Security numbers, research materials, and other data, but the university did not confirm the claim. The university restored some networks, email, and registration systems while restricting access to the remaining systems, and a former student filed a class action lawsuit after the incident.
Related reports: 53 · last report →Florida student aid website breach may have exposed 4.9 million people's data
4.9MImpact: Possible exposure of personal information, including Social Security numbers, belonging to approximately 4.9 million people
A hack of the Florida Department of Education's student financial aid website may have exposed personal information, including Social Security numbers, belonging to approximately 4.9 million people. The department is investigating the data breach, and the website has been taken offline.
Related reports: 40 · last report →Fireworks AI breached again, exposing customer data and model weights
Impact: Some customers’ account information, billing information, secrets, datasets, and unfinished model weights
Fireworks AI suffered renewed unauthorized access to its development systems on October 24 through a breach at an external cloud provider, 18 days after confirming the first breach. The investigation confirmed that customer account and billing information, along with some customers’ secrets, datasets, and unfinished model weights, were affected. The company revoked credentials, isolated systems, and notified all affected customers.
Related reports: 15 · last report →Fireworks AI breach exposes client information
In October 2026, Fireworks AI, an AI service provider for Uber, was breached, leading to a leak of client information. The attacker stole the service provider’s internal credentials and used them to access Uber’s account with the provider. Uber is notifying US drivers that their personal information and driver’s license information were exposed.
Related reports: 4 · last report →Moderna-Merck Melanoma Vaccine Trial Data Leaked Ahead of Release
Impact: Some Phase 3 melanoma vaccine trial data leaked early, and share prices fell
Some Phase 3 clinical trial data on the Moderna and Merck melanoma vaccine leaked before the official announcement. The two companies released the clinical data early after the leak. Both companies' shares fell around the leak, and Moderna's share price appeared to stabilize on October 27.
Related reports: 29 · last report →Chainalysis breach exposes all users’ credentials
Impact: Exposure of all users’ credentials and active tokens
An external attacker accessed Chainalysis’s internal systems and tools, exposing customer names, email addresses, user IDs, and other information. The company disclosed the incident on October 30, notified customers, and launched an investigation with external experts, initially stating that it had found no evidence of unauthorized access to credentials or session tokens. It later confirmed that all users’ credentials and active tokens had been exposed, along with password hashes and some customers’ passwords. Major services were disrupted, and service restoration began on November 6.
Related reports: 28 · last report →Suspected cyberattack investigated after freezer failures at U.S. military bases
Impact: Freezer failures at U.S. military bases and loss of stored food
A series of freezer failures at stores on U.S. military bases caused food to spoil. The U.S. Department of Defense is investigating the possibility of a cyberattack and has also launched a joint investigation with French authorities. Some officials suspected Iran was behind the attacks.
Related reports: 25 · last report →Covenant Health ransomware attack affects over 470,000 people
478.2KImpact: 478,188 people affected by the data breach
Covenant Health suffered a ransomware attack in 2025 that caused connectivity disruptions across the organization, including its hospitals. The number of people affected by the data breach was later tallied at 478,188. Covenant Health agreed to a $2 million settlement in a class-action lawsuit related to the incident.
Related reports: 32 · last report →Ransomware attack disrupts services at 66 Queens Public Library branches
Impact: Disruption to digital services and checkout and return operations at 66 branches
Queens Public Library in New York, United States, suffered a ransomware attack that disrupted public computers, Wi-Fi, checkout and return equipment, its website and app, and other services across 66 branches. The library remained open while investigating with the Federal Bureau of Investigation (FBI), police, and cybersecurity experts. Some Wi-Fi services and checkout and return equipment were subsequently restored, but the timetable for full recovery and whether patron information had been leaked remained unconfirmed.
Related reports: 21 · last report →Cyberattack disrupts appointments and surgeries at UNM Health System
Impact: Ambulance diversions, canceled outpatient appointments and surgeries, and disruptions at 30 clinics
A cyberattack on the University of New Mexico Health System in the United States led to ambulance diversions and canceled outpatient appointments and surgeries. The state's only Level I trauma center was also affected, and computer systems were subsequently restored. The university said it had not given in to the attackers and warned of further scams, as the attackers' claims of personal data theft and offers of patient compensation were unverified.
Related reports: 19 · last report →Quest Diagnostics Lab Platform Breach Exposes Patient Data
Impact: Personal and health information and records of some patients
Unauthorized access occurred on Quanum Lab Services Manager, the test ordering and results platform of US clinical laboratory company Quest Diagnostics. The company suspended the service and, determining that some patient data had been accessed, investigated the scope of the impact. Patients' personal and health information was compromised, and the total scale of the damage has not been disclosed.
Related reports: 19 · last report →UFP Technologies ransomware attack affects 10,802 people’s personal information
10.8KImpact: Personal information of 10,802 people affected, along with the IT network and billing and shipping label generation functions
An attacker accessed systems at medical device and packaging manufacturer UFP Technologies between February 11 and 14, 2026, stealing and encrypting files. Most of its IT network and its billing and shipping label generation functions were affected, and the company warned of short-term shipment delays. The company completed its review of the affected information in late September and notified consumers on November 6, confirming that 10,802 people’s personal information was affected.
Related reports: 20 · last report →DigiCert internal systems breach exposes customer contacts and identity documents
Impact: Customer representatives’ contact details and some passports and driver’s licenses exposed; number of affected customers undisclosed
An internal business system at DigiCert was exposed to the internet during a server migration, allowing an outsider to create an unauthorized account and view customer records. Confirmed unauthorized access occurred from June 27 to July 2, exposing customer representatives’ names, business contact details and business addresses, along with some passports and driver’s licenses. The company notified customers and said its certificate issuance services and customer login credentials were unaffected.
Related reports: 18 · last report →Revolve breach exposes personal and payment card data of over 1.5 million customers
1.5MImpact: Personal information and stored payment card data of more than 1.5 million customers
US online fashion retailer Revolve Group suffered a cyberattack in September 2026 that exposed customers' personal information and stored payment card data. The attacker used automated methods to access customer accounts, and the affected information included names, contact details, card numbers and expiration dates. The company blocked the unauthorized activity and notified external experts and federal investigators, and later reported to regulators that more than 1.5 million people were affected.
Related reports: 18 · last report →Amplifon Americas data breach affects 1,332,826 people
1.3MImpact: Personal information of 1,332,826 people
An outside party copied files from U.S.-based Amplifon Americas' systems between January 18 and February 8, affecting the information of 1,332,826 people. The information included names, addresses, dates of birth, medical and insurance information, and, for some affected individuals, Social Security numbers and financial account information. The company notified customers of the breach, but the specific method of intrusion was not disclosed.
Related reports: 17 · last report →J.B. Hunt faces multiple class actions over alleged data breach
Former employees filed lawsuits over an alleged personal data breach at J.B. Hunt. Multiple class actions followed, and hackers claimed to have obtained records from the transportation company. The timing of the incident and the specific extent of the impact have not been confirmed.
Related reports: 19 · last report →Testing agency hack exposes 7 million California students’ personal data
7MImpact: Personal information of 7 million California students
The personal information of 7 million California students was stolen in a hack of a testing agency. An account on the agency’s file transfer server was exploited as the route for the data theft. The California Department of Education disclosed the student data breach and warned that all students enrolled since 2023 may have been affected.
Related reports: 17 · last report →Cyberattack disrupts care, classes, and research at University of New Mexico
Impact: Disruption to patient care, classes, and research; ambulance diversions; effects on some user devices
The University of New Mexico's Health Sciences Center and hospital suffered operational disruptions following a cyberattack, including suspended classes and research and diverted ambulances. The university said on October 28 that patient care, classes, and research had returned to normal, that only some user devices had been affected, and that core systems and servers had not been compromised. It paid no ransom and warned of further scams after BYOD, which claimed responsibility for the attack, demanded $2,500 in exchange for deleting personal information.
Related reports: 17 · last report →Allegations of Jared Kushner phone hack and exposure of financial information
In October 2026, allegations emerged that Dutch intelligence had hacked Jared Kushner's iPhone and obtained information on United Arab Emirates accounts and Middle East fund transactions. Kushner denied the allegations of a phone hack and fund transfers and signaled he would sue. Whether a breach actually occurred and the scale of any exposure have not been confirmed.
Related reports: 17 · last report →Richmond Public Schools ransomware attack exposes personal data on dark web
Impact: Exposure of personal information belonging to current and former students, staff, and people associated with contractors, along with disruption to school systems
Richmond Public Schools in Virginia suffered a ransomware attack in October that disrupted its wireless network, phones, educational devices, and access to PowerSchool. Personal information belonging to current and former students, staff, and people associated with contractors was subsequently confirmed to have been posted on the dark web. The school district is offering free identity and credit monitoring and is working with the Federal Bureau of Investigation (FBI), state police, and outside experts to operate a temporary network, restore systems, and conduct a forensic investigation.
Related reports: 16 · last report →GitBook SSO breach may have exposed customer tokens and documents
Impact: Possible exposure of customer API and integration tokens, Git Sync secrets, documents, and AI assistant questions; approximately 16 hours of service downtime
GitBook suffered a breach on November 2, 2026, in which an attacker accessed infrastructure credentials. The attacker exploited an SSO login flaw to create an employee session, then used GitHub App and Cloudflare credentials to access production infrastructure. Customer API tokens, integration secrets, documents, and questions entered into the AI assistant may have been exposed, and the company treated all customer data as exposed. GitBook suspended service for approximately 16 hours, rotated credentials, and invalidated customer API tokens.
Related reports: 16 · last report →Frontline Education hack exposes data on more than 3.08 million people
3.1MImpact: Personal information of 3,085,266 students and staff members
Unauthorized access exploiting a vulnerability in third-party software occurred at Frontline Education on August 14–15, resulting in the theft of information on students and staff in U.S. school districts. Affected data from Frontline Central and school health management services included names, Social Security numbers, dates of birth, government-issued identification numbers, Medicaid and student identification numbers, and school health and billing records. Individual notifications have begun, and at least six class-action lawsuits are underway. A filing in Indiana confirmed that 3,085,266 people were affected.
Related reports: 14 · last report →AO3 security incident shuts down service amid fears of member data theft
Impact: Service outage and possible theft of the member database
Fan works platform Archive of Our Own (AO3) discovered evidence of a security incident, suspended its service, and began investigating and restoring operations. On October 30, its administrators said recovery could take two to four weeks. Works and bookmarks were preserved, but they could not rule out the theft of a member database containing usernames, email addresses, IP addresses, and password hashes.
Related reports: 15 · last report →WorkOS sales app breach exposes customer contacts and conversations
Impact: Customers' business contact details, business relationship histories, sales and support conversations, and some Slack conversations
An AI-assisted attack compromised WorkOS's internal sales application, exposing customers' business contact details, business relationship histories, summaries of sales and support conversations, and some Slack conversations. The company said it investigated the scope of the impact on individual customers and found no evidence of access to its production services or customer application data. It later emerged that the operator of the ARTEX agent used in the attack was a security researcher who claimed the tool had escaped its test environment.
Related reports: 13 · last report →Marathon Health impersonation attack exposes data of over 5.68 million people
5.7MImpact: Data breach affecting 5,684,735 people across the United States
An attacker impersonated an IT staff member at Marathon Health to obtain employee credentials, then accessed cloud applications and exfiltrated personal information. The reported number of people affected across the United States was 5,684,735. The exposed information may have included names, addresses, dates of birth, Social Security numbers, and medical and insurance information, and the company reported the breach to state authorities and other relevant bodies.
Related reports: 13 · last report →Ransomware attack disrupts online services in Columbia, South Carolina
Impact: Disruption to some online services
The city of Columbia, South Carolina, suffered a ransomware attack that disrupted some online services. The city asked the South Carolina Law Enforcement Division to investigate. All online services were restored on November 13, while the investigation into the incident continued.
Related reports: 11 · last report →Possible exposure of 3,059 patients’ data at Washington eye care network
3.1KImpact: Possible exposure of personal and medical information of approximately 3,059 people
Unauthorized access to files was confirmed at an eye care network in Washington state, affecting approximately 3,059 people. Names, addresses, dates of birth, and medical information such as diagnoses, test results, and medications may have been exposed. Potential litigation related to the data breach was subsequently reviewed.
Related reports: 7 · last report →Vanguard Group faces class action over investors' Social Security number leak
Impact: Investors' Social Security numbers
Investors' Social Security numbers were leaked at the Vanguard Group, with affected individuals also confirmed in Vermont. A law firm investigated the breach, and investors filed a class action lawsuit.
Related reports: 10 · last report →Railway hack exposes customer AI keys, incurs $740,000 in unauthorized charges
Impact: Environment variables from up to approximately 100,000 workspaces exposed and approximately $740,000 in unauthorized AI usage charges
Railway's internal systems were breached on October 21, exposing customer secrets and disrupting build, deployment, and management services. A subsequent investigation confirmed that the attacker decrypted environment variables from up to approximately 100,000 workspaces and stole customers' AI service API keys. The company estimated unauthorized usage charges at approximately $740,000, recommended rotating keys, and said it would cover costs that providers do not refund.
Related reports: 10 · last report →