On March 30, 2025, Hennessy Advisors discovered suspicious activity affecting access to certain systems and data. In late December 2025 it learned that data including personal information of certain Hennessy Funds investors had been accessed and released without authorisation, and on February 5, 2026, after reviewing the released information, it confirmed unauthorised access to notified individuals’ information.
On December 24, 2025, QualDerm detected unauthorised activity on certain systems; the investigation found an unauthorised actor accessed a limited number of systems between December 23 and 24, 2025 and removed certain stored information.
Unauthorised access and data transfer involving a web application occurred between July 25 and September 2, 2025, including names and contact details such as address and email.
On January 14, 2026, social engineering gave access to an MFA-protected application with franchisee and applicant records, including names, contacts, SSNs and dates of birth.
On August 11, 2025, TAK became aware of suspicious activity in its network; the investigation found an unauthorised third party accessed certain systems between August 2 and 12, 2025 and acquired certain files.
Figure discovered unauthorised activity on its systems and found evidence that on January 28, 2026 data containing personal information was obtained through queries on company databases storing loan and loan inquiry data. It found no evidence of unauthorised access to customer accounts or funds.
Possible data leak: On February 13, 2026, TENGA USA discovered an unauthorised party had accessed one employee’s work email account; between 12am and 1am PT that day the party used it to send spam to contacts in the account history.
An unauthorised third party accessed the company’s network and acquired certain files in January 2024; review found they included information related to orders from a business customer (data owner name templated).
On December 14, 2025, AltaMed experienced a cybersecurity incident that limited access to certain systems while care continued; its investigation found employees’ names, addresses, SSNs and compensation information may have been accessed.
The firm experienced a network disruption on June 9, 2025; the investigation found an unknown actor acquired certain data without authorisation on or about June 8, 2025.
In September 2025, the firm detected suspicious activity on certain systems; the investigation found an unauthorised party accessed parts of its environment on September 18, 2025 and copied data. The firm says the same event affected thousands of organisations using the same firewall technology.
Possible data leak: Suspicious activity in a secure file-management system used for billing services to Vikor Scientific and other labs may have affected patient information.