Search incidents by company, country, industry, year and attack method. Review affected data, impact, verification status, company responses and sources.
On February 27, 2025, Clawson became aware of suspicious network activity; the investigation found certain files may have been accessed or copied without authorisation between February 27 and 28, 2025.
Around August 7, 2025, DBS identified suspicious activity in its email environment; the investigation found an unauthorised actor accessed the email system and potentially downloaded certain emails and files.
Unauthorised access occurred 27 Nov–13 Dec 2025; possible exfiltration was seen on 13 Dec and, after review, emails and hashed passwords were confirmed leaked in a January 21, 2026 notice.
Possible data leak: A network compromise identified on December 8, 2025 could have compromised personal information.
Possible data leak: After finding encrypted servers on January 12 and judging it ransomware, the firm issued a first notice on January 16 and updates on March 10 and April 6.
On June 30, 2025, IOA discovered certain internal systems had been affected by a security incident; the investigation found an unauthorised party gained access through a phishing email and data may have been accessed or acquired between June 25 and 30, 2025.
A December 14, 2025 credential-stuffing attack may have accessed user accounts.
Information in systems was subject to unauthorised access or acquisition beginning November 27, 2025; personal data may have been affected.
Possible data leak: Investigation of unusual activity around August 19, 2025 found information suggesting an unknown actor accessed the network.
After card-brand alerts the store was stopped and disclosed on January 16; a April 27 update said payment-page tampering may have leaked purchaser data for 25 Mar 2021–8 Nov 2024.
Around September 26, 2025, SPCorp experienced unauthorised access to its network; after investigation and document review it determined on January 7, 2026 that personal information may have been accessed and/or acquired.
On October 29, 2025, a limited amount of data, including names and dates of birth, was downloaded from a cloud application.
The network was accessed from about August 28 to September 12, 2025; personal data may have been accessed or acquired.
An unauthorised party accessed certain Monroe University systems between December 9 and 23, 2024 and acquired copies of some network files; on September 30, 2025 the university determined they contained personal information.
On December 12, 2025, SAFE Credit Union experienced an incident that led to the unintended disclosure of certain member information.
coastline announced on January 13 that member data in its Smaregi App Market app had been taken without authorisation. Smaregi said on January 8 and 13 that its own systems were not breached and the data was held by the external vendor.
The firm experienced a network security incident on January 31, 2025; forensic investigation found an unauthorised third party may have accessed certain personal information.
GSPlatformCo detected unauthorised access to data hosted on one of the systems it used to store customer information; the data was a snapshot from April 2025, and the company says its current environment is secure.
On August 16, 2025, the company observed unusual network activity; the investigation found certain files were potentially accessed without authorisation between July 25 and August 26, 2025.
An unauthorised actor transferred files from Eurail’s network on December 26, 2025. The California notice lists names and passport numbers; the company’s public statement said names, dates of birth, gender, email, home address, phone numbers and passport/ID numbers may be involved.