Unverified claim. Claimed by EndZone.
Full stored descriptionAccela.com, a cloud-based software platform serving state and local governments, was claimed to be compromised by EndZone on September 18, 2026.
State now. Changed: +2 tier promotions, 0 known-exploited vulnerability additions, 18 leak-site claims, and 0 confirmed breaches since yesterday.
Why today matters
Incidents
Breaches and leak-site claims
Compare confirmed breaches with clearly labelled, unverified leak-site claims, each linked to its named source.
Confirmed breaches and unverified leak-site claims in one labeled feed. Confirmed breaches come from the California Attorney General breach portal, the Department of Health and Human Services Office for Civil Rights (HHS OCR, including its 42 CFR Part 2 substance-use records), Securities and Exchange Commission (SEC) 8-K cyber-incident filings, and the Have I Been Pwned breach directory. Leak-site claims come from RansomLook and, as a failover, ransomware.live. Claims are always labeled and never presented as fact.
Why now: 12 leak-site claims were first observed in the last 24 hours.
13,380 confirmed breach records, all time6,477 unverified leak-site claims, all time
12 leak-site claims · last 24 hours416 leak-site claims · Month to date through 2026-09-18 17:00 UTC6,468 leak-site claims · Year to date through 2026-09-18 17:00 UTC58 groups posting claims · Month to date through 2026-09-18 17:00 UTC7 additional claims without a disclosure date
Claims tracked since 2024-04-19. The 24-hour figure is a rolling window; month and year are calendar periods (UTC), so on the first days of a month the 24-hour count can exceed the month-to-date count.
Of 13,380 confirmed breaches, 5,394 show "Not reported" for individuals affected because the portal published no count: all 5,393 California Attorney General rows plus 1 other government-source row. The gap is the source's, not omission on our part.
What changed
This page does not publish a page-specific change count. Open the daily comparison for newly confirmed breaches and newly observed leak-site claims.
Details
The labels separate confirmed incidents from claims, and the filters below narrow the source-linked records.
Ordered by the source-provided record date when present, even when its meaning is unknown; otherwise, by when this tracker first saw the record. Every displayed date states which event it represents.
Unverified claim. Claimed by EndZone.
Full stored descriptionAT&T, a telecommunications sector organization, was claimed to be compromised by EndZone on September 18, 2026.
Unverified claim. Claimed by Spirals.
Full stored descriptionANYTHINGIT, an IT asset disposition and e-waste management organization, was claimed as compromised by Spirals on September 18, 2026.
Unverified claim. Claimed by Killsec.
Full stored descriptionGiti Corp was claimed to be compromised by killsec on September 18, 2026.
Unverified claim. Claimed by Panzer.
Full stored descriptionUniversität Hamburg, a research and educational institution in Germany, was named in a claim by Panzer on September 18, 2026.
Unverified claim. Claimed by Panzer.
Full stored descriptionInovapy, a technology sector organization, was claimed by Panzer on September 18, 2026.
Unverified claim. Claimed by Panzer.
Full stored descriptionStim, a video surveillance solutions provider in France, was claimed compromised by Panzer on September 18, 2026.
Unverified claim. Claimed by SilentRansomGroup.
Full stored descriptionC... received a claim from SilentRansomGroup on September 17, 2026.
Unverified claim. Claimed by KryBit.
Full stored descriptionHarput Yapı, a residential real estate developer and construction company based in Istanbul, was claimed by krybit on September 17, 2026.
Unverified claim. Claimed by KryBit.
Full stored descriptionDiakoniewerk Apolda gGmbH, a social welfare organization in Germany, was claimed by krybit on September 17, 2026.
Unverified claim. Claimed by Qilin.
Full stored descriptionVigatec was claimed by qilin on September 17, 2026.
Unverified claim. Claimed by Qilin.
Full stored descriptionQilin claimed Invincible GG on September 17, 2026.
Unverified claim. Claimed by Chaos.
Full stored descriptionExpress Employment Professionals was claimed by Chaos on September 17, 2026.
Unverified claim. Claimed by BrainCipher.
Full stored descriptionBrainCipher claimed hoyletanner.com on September 17, 2026.
Unverified claim. Claimed by BrainCipher.
Full stored descriptionAECOM, a global infrastructure and engineering services firm, was claimed as breached by BrainCipher on September 17, 2026.
Unverified claim. Claimed by Qilin.
Full stored descriptionQilin claimed Techwise on September 17, 2026.
Unverified claim. Claimed by Qilin.
Full stored descriptionThe Gran Hotel Ingles was claimed by qilin on September 17, 2026.
Unverified claim. Claimed by BrainCipher.
Full stored descriptionBrainCipher claimed xpera.ca on September 17, 2026.
Unverified claim. Claimed by Akira.
Full stored descriptionPractice Management, a healthcare sector organization, was claimed by the Akira group on September 17, 2026.
Unverified claim. Claimed by Akira.
Full stored descriptionVetta Digital Serviços, a digital solutions organization in the energy sector, was claimed on September 17, 2026 by akira.
Unverified claim. Claimed by Akira.
Full stored descriptionJavep Chevrolet, a vehicle sales organization, was claimed by akira on September 17, 2026.
Unverified claim. Claimed by Metaencryptor.
Full stored descriptionBeckman Coulter, Inc, a healthcare sector organization in the United States, was claimed by metaencryptor on September 17, 2026.
Unverified claim. Claimed by Metaencryptor.
Full stored descriptionAECOM, a global infrastructure consulting and engineering company in the United States, was claimed by metaencryptor on September 17, 2026.
Unverified claim. Claimed by Metaencryptor.
Full stored descriptionPromantra, Inc., a healthcare technology and business process services company in the United States, was claimed by metaencryptor on September 17, 2026.
Unverified claim. Claimed by Vexy Ransomware.
Full stored descriptionSTP Fashion Lab, a womenswear company in Italy, has been claimed by Vexy Ransomware on September 17, 2026.
Unverified claim. Claimed by Emperador.
Full stored descriptionWestbridge Institute of Technology, Inc., an education sector organization, was claimed by emperador on September 17, 2026.
Unverified claim. Claimed by INC Ransom.
Full stored descriptionAppliance Factory & Mattress Kingdom, a retail organization, was claimed by incransom on September 17, 2026.
Unverified claim. Claimed by INC Ransom.
Full stored descriptionDiarco, an HR and staffing company headquartered in Argentina, was claimed by incransom on September 17, 2026.
Unverified claim. Claimed by Shinyhunters.
Full stored descriptionQi**** was claimed by shinyhunters on September 17, 2026.
Unverified claim. Claimed by ShadowByt3$.
Full stored descriptionShadowByt3$ claimed HandyTrac Greystar AZ on September 16, 2026.
Unverified claim. Claimed by Emperador.
Full stored descriptionRDA MOTORS S.P.A., an Italian automotive organization, was claimed by emperador on September 16, 2026.
Unverified claim. Claimed by Blacknevas.
Full stored descriptionOptimum First Mortgage (Pear's acting group's promotional blog), a Financial Services sector organization, was claimed by blacknevas on September 16, 2026.
Unverified claim. Claimed by Emperador.
Full stored descriptionemperador claimed on September 16, 2026 to have breached SEVENOAKS s.r.o., a technology sector organization based in Czech Republic.
Unverified claim. Claimed by Kairos.
Full stored descriptionLeisure Coast Kitchens, a kitchens and bathrooms company, was claimed by kairos on September 16, 2026.
Unverified claim. Claimed by Qilin.
Full stored descriptionReddrop Group was claimed to have been compromised by qilin on September 16, 2026.
Unverified claim. Claimed by Qilin.
Full stored descriptionIn The Company of Huskies was claimed by qilin on September 16, 2026.
Unverified claim. Claimed by Wallstreet.
Full stored descriptionOdyssey Charter School, Inc., a nonprofit education organization in Florida, was claimed by Wallstreet on September 16, 2026.
Unverified claim. Claimed by Wallstreet.
Full stored descriptionRoshd Sanat, an Iranian industrial company in the energy sector, was claimed by Wallstreet on September 16, 2026.
Unverified claim. Claimed by Qilin.
Full stored descriptionQilin claimed Thorndale Foundation on September 16, 2026.
Unverified claim. Claimed by Qilin.
Full stored descriptionThema Foundries was claimed by qilin on September 16, 2026.
Unverified claim. Claimed by Akira.
Full stored descriptionBlossomland Accounting, an accounting services organization in the United States, was claimed by akira on September 16, 2026.
Unverified claim. Claimed by Akira.
Full stored descriptionBee Maid Honey, an Agriculture sector organization, was claimed by akira on September 16, 2026.
Unverified claim. Claimed by Akira.
Full stored descriptionManders, a contractor in the Washington Metropolitan Area, was claimed by akira on September 16, 2026.
Unverified claim. Claimed by Arcusmedia.
Full stored descriptionThe Agricultural Research Development Agency (ARDA), a public organization in Thailand, was claimed by arcusmedia on September 16, 2026.
Unverified claim. Claimed by Panzer.
Full stored descriptionNielsen Design was claimed by Panzer on September 16, 2026.
Unverified claim. Claimed by Qilin.
Full stored descriptionAarsleff was named in a claim by qilin on September 16, 2026.
Unverified claim. Claimed by Dragonforce.
Full stored descriptionCommunity Property Management, a property management firm, was claimed to be compromised by dragonforce on September 16, 2026.
Unverified claim. Claimed by Dragonforce.
Full stored descriptionOwen Leigh Optometry, a Healthcare sector organization, was claimed by dragonforce on September 16, 2026.
Unverified claim. Claimed by Vexy Ransomware.
Full stored descriptionVexy Ransomware claimed the compromise of Hashimoto Jimuki, a Japanese office equipment, IT equipment, services, office furniture, meeting and conferencing systems, and computer support provider on September 15, 2026.
Unverified claim. Claimed by Safepay.
Full stored descriptionMarlin HVAC, a mechanical services organization, was claimed by safepay on September 15, 2026.
No breach entries match your current filters. Reset search and filters to show all breach entries.
Per-incident affected-count reconciliation across government breach sources is not currently possible. The Maine Attorney General portal has been offline since 2026-06-12, and the California Attorney General publishes no affected-persons count. Where one incident is reported to more than one source it is cross-linked, and every count shown is only the number that source itself reported.
A "No longer listed" badge means the victim was present on the leak site and is now absent from the claiming group's current listing, confirmed across two consecutive checks. It is an observation only. It is not a confirmation that the organization paid, negotiated, or resolved the incident, and a group that takes down its own site can cause it. Removal is tracked for RansomLook claims, the only source that publishes a full per-group listing. A claim from another source carries no badge because its removal is not tracked, which is not evidence the victim is still listed.
Browse every record in stable static pages, for search engines and no-JavaScript access to the full corpus.
Leak-site claim data:RansomLook(CC BY 4.0), withransomware.liveas a failover, credited voluntarily (it carries no attribution obligation). Claims are unverified until the affected organization confirms an incident. Confirmed breaches come from the California Attorney General breach portal, theHHS OCR Breach Portal(including its 42 CFR Part 2 records), theMaine Attorney Generalbreach portal (offline since 2026-06-12; no rows are currently in this index), Securities and Exchange Commission 8-K filings, andHave I Been Pwned(CC BY 4.0).
How this is computed
Confirmed incidents come from the named government and breach-directory sources. Leak-site entries remain unverified claims. Windows use the recorded disclosure or observation date, and missing dates remain explicit.
Method reviewed on .