Confirmed
STS Aviation Group: personal data obtained in intrusion
An intrusion around August 5, 2025 let an unauthorised third party obtain personal data including names, contacts and dates of birth.
Company Data Breaches and Security Incidents
Search incidents by company, country, industry, year and attack method. Review affected data, impact, verification status, company responses and sources.
Confirmed
Yphantides law firm: files acquired in intrusion
An unauthorised party accessed the network and acquired files containing personal information.
Confirmed
Neuro Wellness Spa: patient file emailed to wrong patient
On August 24, 2026, a file with patient information was inadvertently emailed to another patient; it may include service dates, providers and billing details.
Confirmed
MLD Mortgage (The Money Store): loan files accessed and acquired
An unauthorised party accessed and acquired information including mortgage origination, underwriting and closing files on September 8–9, 2026.
Investigating
JM Bullion reports possible personal-data impact
Suspicious activity affected the network between April 12 and 14, 2026; names and other personal data may be impacted.
Confirmed
ABPM: intruder accessed environment with personal data
An unauthorised actor gained access to the network environment, affecting personal information.
Confirmed
Tulare Joint Union HSD: files copied in intrusion
Unauthorised activity was identified August 28, 2026 and on August 30 files and folders were confirmed copied or downloaded.
Confirmed
Magna Hospitality Group: files copied in intrusion
An unauthorised actor accessed systems May 22–24, 2025 and copied files.
Confirmed
Blueberry Pediatrics: patient data stolen via Metabase flaw
A Metabase vulnerability was exploited and a copy of some patient data was obtained between August 9 and 12, 2026; it may include names, health-plan details, dates of birth and health information.
Investigating
Alisal Union School District reports possible data download
Information in the network may have been accessed or downloaded without authorisation around June 19, 2026.
Confirmed
Harman Fitness: network intrusion affected personal data
A September 4, 2025 network intrusion affected names and, where provided, SSNs, driver’s licence or state ID and passport numbers.
Confirmed
Sheppard Mullin: documents disclosed after attorney was socially engineered
On August 31, 2026, one attorney fell victim to sophisticated social engineering, resulting in certain documents being disclosed to an unknown third party.
Investigating
Aldrich reports possible exposure after email account compromise
An employee email account was accessed by an unknown individual on August 22–23, 2026; personal information in the account may have been affected.
Investigating
Nishiyamato Academy reports possible personal-data exposure
Unauthorised network access was identified around March 27, 2026; potentially impacted files contained personal data.
Investigating
American Family Connect: driver’s licence numbers may have been obtained via quoting flow
Between June 30 and August 20, 2026, a third party used personal data obtained elsewhere to generate auto-insurance quotes and may have acquired driver’s licence numbers in the process.
Confirmed
DriveWealth: personal data exfiltrated
Unauthorised network access on September 4–5, 2026 resulted in names and other data being exfiltrated.
Investigating
Poppins Payroll reports possible access via Metabase flaw
On September 3, 2026, unauthorised access to a system via the Metabase vulnerability may have exposed personal information.
Investigating
City of McMinnville reports possible data copying
Information may have been accessed and copied without authorisation between June 1 and July 18, 2026.
Confirmed
Buchalter: limited firm data acquired without authorisation
On August 28, 2026, Buchalter learned a limited amount of its data was subject to unauthorised acquisition, including information relating to San Bernardino County matters.
Investigating
MedImpact reports possible member-data impact
Unauthorised activity was identified October 18, 2025; members’ data was among potentially impacted data.