Search incidents by company, country, industry, year and attack method. Review affected data, impact, verification status, company responses and sources.
Possible data leak: Canvass’s My Page server for software tickets/licences was hit by ransomware early on January 6; an interim report followed on January 9 and a January 29 investigation report assessed leak risk.
In early December 2025, Money Mart learned an unauthorised third party had accessed certain files in a third-party application; while the investigation continues, it believes personal information was accessed and acquired.
Possible data leak: The city announced on January 9 that on 29 Dec 2025 association PCs were remotely controlled for about 30 minutes after a fake virus alert, with an e-money remittance loss.
An unauthorised party obtained images of government IDs that customers provided to verification vendor Veriff, possibly with addresses and dates of birth.
Possible data leak: A first report on January 8 said the academic-affairs system was accessed without authorisation on 22 Dec 2025 and encrypted by ransomware.
An unauthorised third party accessed some systems and acquired files on October 24, 2025.
A production error at print vendor HC3 may have included account information in another customer’s printed statement.
Around December 24, 2025, the firm identified suspicious activity in its systems; the investigation found an unauthorised third party may have accessed or acquired stored data.
On January 7 the centre’s Hitobito Miura portal sent an event notice whose program bug put member emails in other recipients’ To fields; a January 9 follow-up stated the count.
Unauthorised access to a faculty member’s personal Google account may have exposed 423 items concerning event applicants and successful graduate applicants, plus historical email information.
Files may have been accessed or acquired in an August 19, 2025 network disruption.
Systems were accessed and files taken from the network beginning October 11, 2025.
A September 17, 2025 phishing attack let a third party reach servers holding personal data and deploy encrypting malware; personal information may have been accessed.
Possible data leak: CAC announced on January 5 that it had stopped Academic Support Navi after a malicious program was placed on its web server from 18–25 Dec 2025; later reports confirmed abuse of administrator privileges.
FFSLA identified a data security incident affecting its network; after document review, on December 5, 2025 it found personal data had been accessed or acquired without authorisation between February 9 and 10, 2025.
Possible data leak: Network data could have been accessed or acquired after unusual activity in early August 2025.
In connection with the Oracle E-Business Suite incident, an unauthorised party temporarily accessed and copied records on an Informa Oracle system, including historical employment information, between August 11 and 18, 2025 (before Oracle disclosed the vulnerability); Informa identified this in November 2025.
Following the March 20 cyber incident, investigation confirmed exfiltration of patient personal information. The exact first-publication day, count and complete data-field scope are unknown and are not invented.
On March 27, 2026, an unauthorised third party gained read-only access to an internal analytics system; affected data included contact and account details, order and transaction history and some fitness data.
On May 12, 2026, an unauthorised third party acquired names, contact details, SSNs and brief self-reported health descriptions from the Salesforce instance.