Confirmed
Hypertherm: files taken via Oracle EBS vulnerability
A previously unknown Oracle E-Business Suite vulnerability was exploited and files were obtained from Hypertherm’s EBS application in August 2025.
Company Data Breaches and Security Incidents
Search incidents by company, country, industry, year and attack method. Review affected data, impact, verification status, company responses and sources.
Investigating
Grayback Forestry reports possible file copying in intrusion
Possible data leak: Systems were accessed January 5–6, 2026 and files were likely copied.
Investigating
Urasoe City: data of about 9,100 students and guardians may have leaked after contractor HDD loss at Minatogawa JHS
Possible data leak: A contractor portable HDD used in Minatogawa Junior High file-server recovery was found missing on February 10, 2026; the city disclosed on March 13.
Confirmed
Jacobson Adler: files copied in network intrusion
An unauthorised actor accessed the network October 12–26, 2025 and copied files that may include names, SSNs and financial-account information.
Confirmed
Earthbound: data acquired without authorisation
Data was acquired without authorisation in an incident on or about December 18, 2025.
Confirmed
Aichi Prefecture: contractor mis-sent 151 seminar applicants’ email addresses
On March 10, 2026 contractor Japan Research Institute sent a seminar notice to 151 applicants with To instead of Bcc; the prefecture disclosed on March 11.
Confirmed
Nelson Worldwide network intrusion affected files with personal data
Unauthorised network access on or about February 18, 2026 affected files containing personal information.
Investigating
OSI Systems: files on network may have been accessed
After becoming aware of suspicious activity in its network, OSI found that certain files may have been accessed without authorisation; it completed its review of the affected files on February 10, 2026.
Investigating
Saison Fundex: leaseback customer data may have leaked via contractor Aoyama Main Kikaku ransomware
After contractor Aoyama Main Kikaku suffered ransomware on January 12, 2026, Saison Fundex disclosed on March 10 (updated June 1) that Saison leaseback customer data may be in scope.
Confirmed
Norwich University discloses personal data to third party by email
On January 23, 2026, personally identifiable information was inadvertently disclosed to a third party by email.
Investigating
Sellers Publishing reports possible exposure of names and SSNs
Possible data leak: An unauthorised user potentially accessed systems; names and SSNs may have been affected.
Confirmed
Yamagata University: faculty ages left undeleted on website documents, 2,149 entries (with duplicates)
Faculty ages that should have been removed before publishing installation-plan documents were left on the website; disclosed March 10, 2026.
Investigating
PPC Event Services reports possible data theft
Possible data leak: Information on systems may have been viewed or taken without authorisation on August 4, 2025.
Confirmed
MetLife: group customer file emailed to wrong customer’s HR administrator
On January 29, 2026, a MetLife associate inadvertently emailed a file to a human resources administrator at another MetLife group customer; the recipient notified MetLife the same day and confirmed deletion.
Confirmed
Automobile Club of Southern California: licence numbers exposed in driving-school software vendor incident
Vendor DanubeNet, Inc. (Driving School Solutions), a driving-school management software provider, had unauthorised access to records between July 10 and August 19, 2025; the club learned of it on December 22, 2025 and identified records with names and driver’s permit/licence numbers.
Investigating
Melvin Mora & Associates: tax client data may have been exposed
Possible data leak: In late February 2026, the firm’s 2025 client data environment was affected by a breach; the investigation identified 13 clients whose information was used to file fraudulent tax returns, which were blocked by the IRS and California Franchise Tax Board.
Investigating
Ericsson reports possible exposure at service provider
Possible data leak: A limited subset of files on a service provider’s system may have been accessed or acquired between April 17 and 22, 2025.
Confirmed
INPIT: contractor Shiga Invention Association mis-sent expert and external-director personal data
On February 26, 2026 the Shiga IP support-desk contractor emailed an expert list to external directors by mistake; INPIT disclosed on March 6.
Investigating
Maniscalco Wealth Management reports possible exposure via email account
Possible data leak: An employee email account was accessed October 23–30, 2025; personal information in it may have been exposed.
Investigating
White Essence Meguly: registrant personal data may have leaked after site intrusion
Possible data leak: After finding an intrusion on the Meguly job-site server on February 18, 2026, White Essence issued a first notice on March 6 and an April 17 update saying database theft was likely.