Investigating
Apollo reports possible data impact from social-engineering incident
A social-engineering incident potentially impacted personal information including names.
Data breaches
Search incidents by company, country, industry, year and attack method. Review affected data, impact, verification status, company responses and sources.
Confirmed
Turner Construction: files with employee personal data accessed
On July 27, 2026, Turner confirmed unauthorised access to files containing names, SSNs (US), SINs (Canada), dates of birth, salary, direct-deposit bank details, home addresses and, for some, passport numbers.
Confirmed
Frontline Education: personal data obtained via third-party software flaw
A vulnerability in third-party software allowed unauthorised access to part of the environment from August 14, 2026, and personal data was obtained.
Confirmed
UMMC network intrusion affected patient information
An unauthorised party accessed UMMC’s network in February 2026, affecting patient names and health-related information.
Confirmed
Upbound Group: files obtained from cloud applications
Between July 3 and 6, 2026, an unauthorised third party accessed and obtained files in cloud applications containing personal information.
Confirmed
SM Energy: files with personal data obtained
In a cybersecurity incident around May 15, 2026, an unauthorised third party accessed systems and obtained files containing names, postal and email addresses, phone numbers and SSNs/TINs.
Investigating
ASOS: accounts accessed with externally obtained credentials; data may have been affected
On July 28, 2026, unusual account activity was detected; on July 29 ASOS confirmed a third party may have accessed accounts with credentials obtained outside ASOS. Names, email, addresses, phone and partial card details may have been affected.
Confirmed
AssetMark: customer files downloaded via employee credentials
Suspicious activity tied to employee login credentials led to an unauthorised user accessing and downloading files with customer information on May 15, 2026.
Confirmed
Baker McKenzie: files obtained via social engineering
On August 14 and 17, 2026, a threat actor socially engineered two users and obtained a limited number of files.