Unverified claim. Claimed by Storm.
Full stored descriptionApplied Composites, an aerospace and defense manufacturer based in Lake Forest, California, United States, was claimed by storm on September 24, 2026.
State now. Changed: +47 tier promotions, 0 known-exploited vulnerability additions, 1358 leak-site claims, and 0 confirmed breaches since yesterday.
Why today matters
Incidents
Breaches and leak-site claims
Compare confirmed breaches with clearly labelled, unverified leak-site claims, each linked to its named source.
Confirmed breaches and unverified leak-site claims in one labeled feed. Confirmed breaches come from the California Attorney General breach portal, the Department of Health and Human Services Office for Civil Rights (HHS OCR, including its 42 CFR Part 2 substance-use records), Securities and Exchange Commission (SEC) 8-K cyber-incident filings, and the Have I Been Pwned breach directory. Leak-site claims come from RansomLook and, as a failover, ransomware.live. Claims are always labeled and never presented as fact.
Why now: 60 leak-site claims were first observed in the last 24 hours.
13,409 confirmed breach records, all time9,897 unverified leak-site claims, all time
60 leak-site claims · last 24 hours693 leak-site claims · Month to date through 2026-09-24 15:38 UTC7,440 leak-site claims · Year to date through 2026-09-24 15:38 UTC79 groups posting claims · Month to date through 2026-09-24 15:38 UTC7 additional claims without a disclosure date
Claims tracked since 2021-01-01. The 24-hour figure is a rolling window; month and year are calendar periods (UTC), so on the first days of a month the 24-hour count can exceed the month-to-date count.
Of 13,409 confirmed breaches, 5,404 show "Not reported" for individuals affected because the portal published no count: all 5,403 California Attorney General rows plus 1 other government-source row. The gap is the source's, not omission on our part.
What changed
This page does not publish a page-specific change count. Open the daily comparison for newly confirmed breaches and newly observed leak-site claims.
Details
The labels separate confirmed incidents from claims, and the filters below narrow the source-linked records.
Ordered by the source-provided record date when present, even when its meaning is unknown; otherwise, by when this tracker first saw the record. Every displayed date states which event it represents.
Unverified claim. Claimed by Storm.
Full stored descriptionMagna Legal Services, a consulting and litigation support services organization headquartered in Philadelphia, Pennsylvania, United States, was claimed by storm on September 24, 2026.
Unverified claim. Claimed by Wallstreet.
Full stored descriptionwallstreet claimed the Catholic University of El Salvador, a private educational institution in El Salvador, on September 24, 2026.
Unverified claim. Claimed by Qilin.
Full stored descriptionDao Group, a software organization, was claimed by qilin on September 24, 2026.
Unverified claim. Claimed by Qilin.
Full stored descriptionAll Tech Machine & Engineering was claimed by qilin on September 24, 2026.
Unverified claim. Claimed by Qilin.
Full stored descriptionInversiones Bolívar was claimed by qilin on September 24, 2026.
Unverified claim. Claimed by Qilin.
Full stored descriptionZig Inge Group, a real estate sector organization, was claimed by qilin on September 24, 2026.
Unverified claim. Claimed by Akira.
Full stored descriptionStrack Companies was claimed by akira on September 24, 2026.
Unverified claim. Claimed by Akira.
Full stored descriptionWallatec was claimed by akira on September 24, 2026.
Unverified claim. Claimed by INC Ransom.
Full stored descriptionGrupo Caberj was claimed by inc ransom on September 24, 2026. No further details were available from the leak-site post.
Unverified claim. Claimed by Zawoo.
Full stored descriptionAgiliance, a French accounting and business advisory organization, appeared on zawoo's leak site on September 24, 2026.
Unverified claim. Claimed by Zawoo.
Full stored descriptionHEOLIS was claimed by zawoo on September 24, 2026.
Unverified claim. Claimed by Zawoo.
Full stored descriptionFRANCARE Industries, a technical-supply and engineering firm in France, was claimed by zawoo on September 24, 2026.
Unverified claim. Claimed by Zawoo.
Full stored descriptionZawoo claimed on September 24, 2026 to have compromised AMB (Ateliers de Menuiseries Bidet), a manufacturing organization based in France.
Unverified claim. Claimed by Qilin.
Full stored descriptionGDM Pipelines was claimed by qilin on September 24, 2026.
Unverified claim. Claimed by Qilin.
Full stored descriptionAgora coopérative agricole was claimed by qilin on September 24, 2026.
Unverified claim. Claimed by KryBit.
Full stored descriptionAir Tanzania Company Limited was claimed by krybit on September 24, 2026.
Unverified claim. Claimed by KryBit.
Full stored descriptionwww.jonesthegrocer.com was claimed by krybit on September 24, 2026.
Unverified claim. Claimed by Dragonforce.
Full stored descriptionArizona Vascular Medical Equipment, Inc was claimed by dragonforce on September 24, 2026.
Unverified claim. Claimed by Dragonforce.
Full stored descriptionBMGP Groupe, a synthetic resins and high-performance materials manufacturer in France, was claimed by dragonforce on September 24, 2026.
Unverified claim. Claimed by Dragonforce.
Full stored descriptionElite Industech Co., Ltd, a waste treatment organization based in Taiwan, was claimed by dragonforce on September 24, 2026.
Unverified claim. Claimed by Dragonforce.
Full stored descriptionHEC Group was claimed by dragonforce on September 24, 2026.
Unverified claim. Claimed by Shinyhunters.
Full stored descriptionshinyhunters issued a statement regarding an undisclosed organization on September 24, 2026.
Unverified claim. Claimed by The Gentlemen.
Full stored descriptionENKEI*, a light-alloy aluminum wheels manufacturer for automakers in the United States, was claimed compromised by the gentlemen on September 24, 2026.
Unverified claim. Claimed by The Gentlemen.
Full stored descriptionCharles Keith, a Singapore-based fashion brand, was claimed by the gentlemen on September 24, 2026.
Unverified claim. Claimed by The Gentlemen.
Full stored descriptionLigue se Grupo was claimed by the gentlemen on September 24, 2026.
Unverified claim. Claimed by Barracuda.
Full stored descriptionSolucioning S.A., a company in the oil production sector, was claimed by Barracuda on September 24, 2026.
Unverified claim. Claimed by EndZone.
Full stored descriptioneTeam Inc., a workforce solutions and business transformation company, was the subject of a claim by EndZone on September 24, 2026.
Unverified claim. Claimed by Emperador.
Full stored descriptionOnTrac, a transportation and retail company, was claimed by emperador on September 23, 2026.
Unverified claim. Claimed by Barracuda.
Full stored descriptionAbtach Ltd., a Pakistani company, was claimed compromised by Barracuda on September 23, 2026.
Unverified claim. Claimed by Space Bears.
Full stored descriptionTomix / Grupo JOPER was claimed by space bears on September 23, 2026.
Unverified claim. Claimed by Brain Cipher.
Full stored descriptionGoldstarfinancial.com had a claimed breach by brain cipher on September 23, 2026.
Unverified claim. Claimed by BrainCipher.
Full stored descriptionBrainCipher claimed the compromise of Goldstarfinancial.com on September 23, 2026.
Unverified claim. Claimed by Payoutsking.
Full stored descriptionM****n was claimed by payoutsking on September 23, 2026. No further details were available from the leak-site post.
Unverified claim. Claimed by Rhysida.
Full stored descriptionLegis, a Latin American legal and business publisher, was claimed by rhysida on September 23, 2026.
Unverified claim. Claimed by Lockbit5.
Full stored descriptionanery.com.br was claimed by lockbit5 on September 23, 2026.
Unverified claim. Claimed by Spirals.
Full stored descriptionSpirals claimed on September 23, 2026 to have breached Asyad Group, a logistics organization in Oman.
Unverified claim. Claimed by Clop.
Full stored descriptionALDOGROUP.COM(ALDOSHOES.COM), a Retail sector organization, was claimed by clop on September 23, 2026. No further details were available from the leak-site post.
Unverified claim. Claimed by Clop.
Full stored descriptionBRILLONCONSUMER.COM(BRILLONCONSUMER.COM), a Consumer Services sector organization, was claimed by clop on September 23, 2026. No further details were available from the leak-site post.
Unverified claim. Claimed by Clop.
Full stored descriptionSUUNTO.CN(SUUNTO.COM), a Consumer Services sector organization, was claimed by clop on September 23, 2026. No further details were available from the leak-site post.
Unverified claim. Claimed by Clop.
Full stored descriptionSMAPCENTER-UAH.EDU, an Education sector organization, was claimed by clop on September 23, 2026. No further details were available from the leak-site post.
Unverified claim. Claimed by Clop.
Full stored descriptionDAD-CO.TH was claimed by clop on September 23, 2026. No further details were available from the leak-site post.
Unverified claim. Claimed by Clop.
Full stored descriptionCLOUD-CLEARWAYGROUP.COM was claimed by clop on September 23, 2026. No further details were available from the leak-site post.
Unverified claim. Claimed by Clop.
Full stored descriptionHODERO-HOLDINGS-LTD was claimed by clop on September 23, 2026. No further details were available from the leak-site post.
Unverified claim. Claimed by Clop.
Full stored descriptionKVHELI-WORDPRESS.COM was claimed by clop on September 23, 2026. No further details were available from the leak-site post.
Unverified claim. Claimed by Clop.
Full stored descriptionCCCM-BC.CA was claimed by clop on September 23, 2026. No further details were available from the leak-site post.
Unverified claim. Claimed by Clop.
Full stored descriptionBRINKS-CO.NZ, a Business & Professional Services sector organization, was claimed by clop on September 23, 2026. No further details were available from the leak-site post.
Unverified claim. Claimed by Clop.
Full stored descriptionSAUL-ORG.UK was claimed by clop on September 23, 2026. No further details were available from the leak-site post.
Unverified claim. Claimed by Clop.
Full stored descriptionCCED-COM.OM was claimed by clop on September 23, 2026. No further details were available from the leak-site post.
Unverified claim. Claimed by Clop.
Full stored descriptionINFINIGATE.CH(INFINIGATE.CO.UK), a Technology sector organization, was claimed by clop on September 23, 2026. No further details were available from the leak-site post.
No breach entries match your current filters. Reset search and filters to show all breach entries.
Per-incident affected-count reconciliation across government breach sources is not currently possible. The Maine Attorney General portal has been offline since 2026-06-12, and the California Attorney General publishes no affected-persons count. Where one incident is reported to more than one source it is cross-linked, and every count shown is only the number that source itself reported.
A "No longer listed" badge means the victim was present on the leak site and is now absent from the claiming group's current listing, confirmed across two consecutive checks. It is an observation only. It is not a confirmation that the organization paid, negotiated, or resolved the incident, and a group that takes down its own site can cause it. Removal is tracked for RansomLook claims, the only source that publishes a full per-group listing. A claim from another source carries no badge because its removal is not tracked, which is not evidence the victim is still listed.
Browse every record in stable static pages, for search engines and no-JavaScript access to the full corpus.
Leak-site claim data:RansomLook(CC BY 4.0), withransomware.liveas a failover, credited voluntarily (it carries no attribution obligation). Claims are unverified until the affected organization confirms an incident. Confirmed breaches come from the California Attorney General breach portal, theHHS OCR Breach Portal(including its 42 CFR Part 2 records), theMaine Attorney Generalbreach portal (offline since 2026-06-12; no rows are currently in this index), Securities and Exchange Commission 8-K filings, andHave I Been Pwned(CC BY 4.0).
How this is computed
Confirmed incidents come from the named government and breach-directory sources. Leak-site entries remain unverified claims. Windows use the recorded disclosure or observation date, and missing dates remain explicit.
Method reviewed on .