Unverified claim. Claimed by Everest.
State now. Since yesterday: +1 tier promotion, +2 known-exploited vulnerability additions, 17 leak-site claims, and 0 confirmed breaches.
Why today matters ·
Incidents
Breaches and leak-site claims
Two kinds of record, always labeled: CONFIRMED breaches published by a regulator, the Securities and Exchange Commission (SEC), or Have I Been Pwned, and CLAIMS posted by ransomware groups on their leak sites, which stay unverified until the affected organization confirms, each linked to its named source.
Why now: 63 leak-site claims were first observed in the last 24 hours.
22,033 confirmed breach records, all time39,232 unverified leak-site claims, all time
63 leak-site claims · last 24 hours762 leak-site claims · Month to date through 2026-11-14 07:14 UTC12,185 leak-site claims · Year to date through 2026-11-14 07:14 UTC69 groups posting claims · Month to date through 2026-11-14 07:14 UTC7 additional claims without a disclosure date
Claims tracked since 2020-01-12. The 24-hour figure is a rolling window; month and year are calendar periods (UTC).
How these numbers are counted
On the first days of a month the 24-hour count can exceed the month-to-date count, because the 24-hour figure rolls while the month is a calendar period.
5,659 confirmed rows from government sources show "Not reported" because the source published no count. The California Attorney General portal, which never publishes one, supplied 5,392 confirmed rows.
Dated confirmed breaches this tracker collected per sector for 2026-11-07 through 2026-11-13, Coordinated Universal Time (UTC), compared with 2026-10-31 through 2026-11-06.
How these are counted
Each row is dated by its own source: a Securities and Exchange Commission (SEC) filing date, a state Attorney General portal's reported date, a Department of Health and Human Services Office for Civil Rights (HHS OCR) submission date, or another government source's own disclosure date. The last column counts disclosures dated in the 24 hours before the data export; a row stored with a date but no time counts when that date is today or yesterday. Rows without a disclosure date are left out of every column, and "Unclassified" collects rows whose sector this tracker has not matched to its sector list, including rows whose source never states one.
| Sector | Confirmed, latest 7 days | Prior 7 days | Change | Last 24 hours |
|---|---|---|---|---|
| Healthcare | 3 | 11 | Down 73% | 0 |
| Business & Professional Services | 2 | 0 | Up from none in the prior 7 days | 0 |
| Legal | 2 | 0 | Up from none in the prior 7 days | 0 |
| Insurance | 1 | 0 | Up from none in the prior 7 days | 1 |
| Technology | 1 | 2 | -1 from 2 | 0 |
| Financial Services | 1 | 0 | Up from none in the prior 7 days | 0 |
| Education | 0 | 3 | -3 from 3 | 0 |
| Agriculture | 0 | 1 | -1 from 1 | 0 |
| Consumer Services | 0 | 1 | -1 from 1 | 0 |
| Unclassified | 3 | 2 | +1 from 2 | 0 |
Showing 10 of 13 sectors with a dated confirmed breach in these windows, ordered by confirmed breaches in the latest 7 days, so sectors that went quiet sort last, except Unclassified, which is always last. Download the data (JSON).
63 leak-site claims were observed in the last 24 hours, and 762 have been observed so far this month.
Newest first, by the date the source gave; each date says what it is (for example, listed by group, filed with the SEC, or submitted to the Department of Health and Human Services Office for Civil Rights, HHS OCR). A row whose source gave no date is placed by the date it was first tracked here, and a source date whose meaning we do not know is labeled "Date meaning unknown".
Unverified claim. Claimed by Qilin.
Unverified claim. Claimed by Qilin.
Qilin claimed Leonard's Express, a freight and logistics services organization, on November 14, 2026.
Unverified claim. Claimed by Qilin.
Industry from the official record for this organization
Unverified claim. Claimed by Qilin.
The University of Texas at Arlington in the education sector was claimed by Qilin on November 14, 2026.
Unverified claim. Claimed by Qilin.
Unverified claim. Claimed by Anubis.
VHV Company was claimed to have been compromised by Anubis on November 14, 2026.
Unverified claim. Claimed by Pixelleaks.
Huangshi Medical Laboratory (黄石医养医学检验) / Ezong Medical Group x Getein JV, a medical laboratory and in vitro diagnostics supply chain organization in China, was claimed compromised by Pixelleaks on November 14, 2026.
Unverified claim. Claimed by Payoutsking.
Unverified claim. Claimed by Byod.
Toyota received a claim from byod on November 13, 2026.
Unverified claim. Claimed by Everest.
Unverified claim. Claimed by Panzer.
RE/MAX Germany, a real estate services organization in Germany, was claimed to be compromised by the Panzer group on November 13, 2026.
Unverified claim. Claimed by Play.
Unverified claim. Claimed by Play.
Unverified claim. Claimed by Play.
Unverified claim. Claimed by Play.
Unverified claim. Claimed by Play.
Unverified claim. Claimed by Play.
Unverified claim. Claimed by Doommageddon.
Koray Topaç Hukuk Bürosu received a claim by Doommageddon on November 13, 2026.
Unverified claim. Claimed by Curious Worm.
Curious Worm claimed access to i*t*r***t.com on November 13, 2026.
Unverified claim. Claimed by Curious Worm.
Curious Worm claimed access to t**a.com on November 13, 2026.
Industry from the official record for this organization
Unverified claim. Claimed by Wallstreet.
Walgreen Co., a U.S. pharmacy and retail sector organization, was claimed by Wallstreet on November 13, 2026.
Unverified claim. Claimed by Hyflock.
TCA Accountants & Bookkeepers, an accounting and financial services firm in Darwin, Australia, was claimed as compromised by Hyflock on November 13, 2026.
Unverified claim. Claimed by Aoqin Leaks.
Tyfone, a financial services organization in the United States, was claimed compromised by Aoqin Leaks on November 13, 2026.
Unverified claim. Claimed by Aoqin Leaks.
Unverified claim. Claimed by Aoqin Leaks.
Airblue, a private airline operating in Pakistan, was claimed by Aoqin Leaks on November 13, 2026.
Unverified claim. Claimed by INC Ransom.
Unverified claim. Claimed by Akira.
Replogle Globes, a globe manufacturer and retailer headquartered in Hillside, Illinois, was claimed as breached by Akira on November 13, 2026.
Unverified claim. Claimed by Akira.
Paragon Mechanical, a mechanical contracting organization in the United States, was claimed by Akira on November 13, 2026.
Unverified claim. Claimed by N0n.
Company #216, a prepaid utilities and airtime platform in Botswana, was claimed by N0n on November 13, 2026.
Unverified claim. Claimed by N0n.
Company #213, an electrical contracting organization in Qatar, was claimed by N0n on November 13, 2026.
Unverified claim. Claimed by N0n.
Company #212, an education sector organization in Ethiopia, was claimed by N0n on November 13, 2026.
Unverified claim. Claimed by N0n.
Texas Truck Center, a commercial truck dealership in the United States, was listed on the n0n leak site on November 13, 2026.
Unverified claim. Claimed by N0n.
Native Touch Inc., a mobile advertising and audience data organization in Canada, was claimed by N0n on November 13, 2026.
Unverified claim. Claimed by N0n.
LEO Pharma A/S, a pharmaceutical company operating in dermatology and thrombosis in Denmark, was claimed by N0n on November 13, 2026.
Unverified claim. Claimed by N0n.
Female Daily Network, a digital beauty community and commerce organization in Indonesia, was claimed by N0n on November 13, 2026.
Unverified claim. Claimed by N0n.
LiveRamp, a data collaboration and identity resolution organization in the United States, was claimed by N0n on November 13, 2026.
Unverified claim. Claimed by N0n.
n0n claimed DraftKings, a digital sports entertainment and gaming organization in the United States, on November 13, 2026.
Unverified claim. Claimed by Interlock.
K&A Industries, a secure identity architecture company, was claimed to be breached by Interlock on November 13, 2026.
Unverified claim. Claimed by Everstake.
ki***o.com, operating in the industrial machinery and equipment sector, had data claimed by Everstake on November 13, 2026.
Unverified claim. Claimed by Aoqin.
Unverified claim. Claimed by INC Ransom.
Sportsman's Guide, an e-commerce retailer in the sporting goods sector, faced a claim attributed to inc ransom on November 13, 2026.
Unverified claim. Claimed by Bravox.
Unverified claim. Claimed by Bravox.
AWO Bundesverband, a workforce development and vocational training organization in Germany, was claimed by Bravox on November 13, 2026.
Unverified claim. Claimed by The Gentlemen.
Unverified claim. Claimed by Leakeddata.
A&O Shearman, a global law firm, was claimed by Leakeddata on November 13, 2026.
Unverified claim. Claimed by Interlock.
Garden Valley School Division, a public school district in Manitoba, was claimed to be compromised by Interlock on November 13, 2026.
Unverified claim. Claimed by Dark Project.
Unverified claim. Claimed by Pixelleaks.
SPI Corp / SPI Energy group, a petroleum staffing and maintenance back-office accounting services organization in the Republic of Congo, was claimed compromised by Pixelleaks on November 13, 2026.
Unverified claim. Claimed by Pixelleaks.
pixelleaks claims BEAM Society in the green-building certification sector in Hong Kong on November 13, 2026.
No breach entries match your current filters. Reset search and filters to show all breach entries.
Per-incident affected-count reconciliation across government breach sources is limited by what each source publishes: HHS OCR reports a nationwide count; the Washington, Oregon, and Maryland Attorneys General each report only their own state's residents affected; the Maine Attorney General portal has been offline since 2026-06-12; and the California Attorney General publishes no affected-persons count. Where one incident is reported to more than one source it is cross-linked, and every count shown is only the number that source itself reported, labelled with the population it counts.
A "No longer listed" badge means the victim was present on the leak site and is now absent from the claiming group's current listing, confirmed across two consecutive checks. It is an observation only. It is not a confirmation that the organization paid, negotiated, or resolved the incident, and a group that takes down its own site can cause it. Removal is tracked for RansomLook claims, the only source that publishes a full per-group listing. A claim from another source carries no badge because its removal is not tracked, which is not evidence the victim is still listed.
Browse every record in stable static pages, for search engines and no-JavaScript access to the complete set.
Leak-site claim data: RansomLook (CC BY 4.0), with ransomware.live as a failover, credited and linked as its terms require (Source: Ransomware.live). Claims are unverified until the affected organization confirms an incident. Confirmed breaches come from the California Attorney General breach portal (newest disclosure 2026-11-13), the HHS OCR Breach Portal (including its 42 CFR Part 2 records; newest disclosure 2026-10-16), the Maine Attorney General breach portal (offline since 2026-06-12; no rows are currently in this index), the Washington Attorney General breach notifications directory (newest disclosure 2026-11-09), the Oregon Attorney General breach directory (newest disclosure 2026-10-29), the Maryland Attorney General security breach notice lists (newest disclosure 2025-03-21), Securities and Exchange Commission 8-K filings (newest disclosure 2026-10-13), and Have I Been Pwned (CC BY 4.0; newest disclosure 2026-11-12).
How this is computed
Confirmed incidents come from the named government and breach-directory sources. Leak-site entries remain unverified claims. Windows use the recorded disclosure or observation date, and missing dates remain explicit.
Method reviewed on .