Search incidents by company, country, industry, year and attack method. Review affected data, impact, verification status, company responses and sources.
Possible data leak: Mail-server intrusion confirmed May 19, 2026 (first notice May 27). Final report found no clear theft evidence but could not rule out exposure of mail counterparts and a legacy EC database.
After vendor Medica Publishing’s ransomware event, the university disclosed on May 27, 2026 possible exposure of 105 2022 nursing seniors’ data.
A scholarship admin system launched April 20, 2026 allowed other schools to view awardee data via certain operations; noticed May 1 and disclosed May 27.
Possible data leak: Unauthorized access to web/mail servers confirmed May 1, 2026 (first notice May 27; final June 22). cPanel/WHM vulnerability yielded admin rights. Theft traces rated low but exposure cannot be ruled out.
A May 27, 2026 newsletter data-join flaw showed another customer’s name/nickname to some recipients. Address, phone, cards and test results were not confirmed leaked.
On March 21, 2026, a threat actor group accessed and encrypted the network at one office; forensics confirmed access to network data, which may have included contractors’, employees’ and dependents’ names, addresses, SSNs and dates of birth.
On May 19, 2026 from 09:00–09:27 a Google Form “show summary” setting let other applicants view responses; disclosed May 26.
On March 29, 2026, an unauthorised email sent via email provider Klaviyo and an export of stored customer information were identified; names, emails, phone numbers and postal addresses were included.
On May 25, 2026 a staff PC was remotely controlled after a fake warning; possible exposure of stored faculty/student data was disclosed May 26.
On May 25, 2026 a shared-system status mail put partner addresses in To: instead of Bcc; disclosed May 26 (distinct from the Hokulink member incident).
On April 23, 2026, the company confirmed personal information may have been accessed or taken from certain hotel systems between November 19 and 22, 2025.
Around July 25, 2025, ERMI learned an unauthorised individual may have accessed some employee email accounts; files may have been accessed or removed between about February 15 and August 14, 2025, and around April 17, 2026 they were found to contain personal information.
A May 20, 2026 review found missing access controls on TDA portal personal-data areas and prior CSV downloads in logs; disclosed May 25.
On Nov 11, 2025 students viewed student-info materials a teacher left in a classroom after a meeting; after parent handling a May 22, 2026 press release followed (distinct from the Nishinari temporary-loss incident).
A County employee improperly forwarded work emails to a personal email account; some contained client names, case numbers, dates of birth, addresses and SSNs.
On May 22, 2026 an info-session mail was sent with addresses in To:, exposing prospect emails to each other.
After CAMPFIRE reported a server intrusion, the club warned on May 22, 2026 that parade-project supporter personal data may have leaked.
An unauthorised actor accessed the online shopping platform and may have acquired payment transaction data from October 31 to December 12, 2025, including names, addresses, card numbers, expiration dates and security codes.
Cardinal learned of unauthorised access around June 30, 2025 and again on August 8, 2025; on May 12, 2026 it found that systems accessed on June 25–26 and around August 8, 2025 contained names, dates of birth, SSNs, driver’s licence/state ID numbers, financial account, medical and health insurance information, digital signatures and biometric information.
After ICC reported an intrusion affecting bulk-collection systems, the school told guardians on May 20, 2026 that bank-account fields may have been exposed.