https://cybersecuritytracker.ai/?cats=breaches-incidentsCurated cybersecurity news and vulnerability intelligence.Sun, 26 Jul 2026 22:32:50 GMThttps://databreaches.net/2026/07/26/developing-anmed-reports-phone-and-internet-outage-impacting-all-hospital-locations-ers-remain-open?pk_campaign=feed&pk_kwd=developing-anmed-reports-phone-and-internet-outage-impacting-all-hospital-locations-ers-remain-opencst-3229AnMed Health System, which operates four hospitals in Upstate South Carolina and northeast Georgia, experienced a phone and internet outage affecting all locations. Emergency rooms remained operational during the incident despite the connectivity disruption.Sun, 26 Jul 2026 14:10:29 GMThttps://databreaches.net/2026/07/26/a-list-directors-actors-and-celebrities-exposed-in-tribeca-film-festival-data-leak?pk_campaign=feed&pk_kwd=a-list-directors-actors-and-celebrities-exposed-in-tribeca-film-festival-data-leakcst-3230A security researcher discovered four publicly accessible, unencrypted databases connected to the Tribeca Film Festival, including a development database containing over 203,000 records. The databases lacked password protection and exposed sensitive information about festival-associated individuals.Sun, 26 Jul 2026 13:06:14 GMThttps://helpnetsecurity.com/2026/07/26/week-in-review-servicenow-pre-auth-rce-exploited-in-the-wild-hugging-face-breachedcst-3226A weekly news roundup covered multiple security topics, including active exploitation of a ServiceNow pre-authentication remote code execution vulnerability and a breach of Hugging Face. The piece also discussed how organizations increasingly run multiple AI platforms simultaneously across different vendors and departments.Sun, 26 Jul 2026 08:00:34 GMThttps://databreaches.net/2026/07/25/us-house-votes-to-extend-cyber-sharing-law-for-10-years?pk_campaign=feed&pk_kwd=us-house-votes-to-extend-cyber-sharing-law-for-10-yearscst-3218The U.S. House of Representatives voted to extend a key cyberthreat sharing law for 10 years by including the reauthorization in the fiscal year 2027 national defense authorization act. The measure passed narrowly on a 216-212 vote Wednesday and was attached to the $1.15 trillion defense policy bill after the reauthorization had been stalled.Sat, 25 Jul 2026 14:25:16 GMThttps://databreaches.net/2026/07/25/au-sydney-nurse-accused-of-downloading-patients-data-in-alleged-breach-of-trust?pk_campaign=feed&pk_kwd=au-sydney-nurse-accused-of-downloading-patients-data-in-alleged-breach-of-trustcst-3219A registered nurse in northern Sydney has been charged after allegedly downloading patient data without authorization. NSW Police launched an investigation following a report to the agency and subsequently searched a home in Frenchs Forest as part of the inquiry.Sat, 25 Jul 2026 14:24:50 GMThttps://databreaches.net/2026/07/25/no-need-to-hack-when-its-leaking-click-to-pray-edition?pk_campaign=feed&pk_kwd=no-need-to-hack-when-its-leaking-click-to-pray-editioncst-3220The Click To Pray app, a prayer application endorsed by the Pope with hundreds of thousands of users, exposed users' names and email addresses through a data leak. An ethical hacker discovered the exposure, which had persisted for months or longer.Sat, 25 Jul 2026 14:24:35 GMThttps://bleepingcomputer.com/news/artificial-intelligence/openai-confirms-chatgpt-is-down-worldwidecst-3208OpenAI confirmed that ChatGPT experienced a worldwide outage affecting access to the artificial intelligence chatbot. The company did not provide details on the cause or expected resolution timeline in the initial report.Sat, 25 Jul 2026 09:31:09 GMThttps://bleepingcomputer.com/news/security/ontrac-notifies-customers-of-data-breach-after-network-hackcst-3195OnTrac, a parcel delivery company, disclosed that attackers breached its corporate network and potentially accessed customer personal information. The company is notifying affected customers of the incident.Fri, 24 Jul 2026 19:55:01 GMThttps://bleepingcomputer.com/news/security/chick-fil-a-data-breach-affects-more-than-13-000-customerscst-3178Chick-fil-A confirmed that attackers using credential stuffing tactics compromised more than 13,000 customer accounts on its website and mobile app during a three-day period in mid-June. The breach involved unauthorized access to customer data through reused or weak credentials rather than a direct compromise of the company's systems.Fri, 24 Jul 2026 14:04:29 GMThttps://databreaches.net/2026/07/24/suspect-arrested-in-investigation-into-sadistic-764-group?pk_campaign=feed&pk_kwd=suspect-arrested-in-investigation-into-sadistic-764-groupcst-3187A suspect from North Holland was arrested on July 20 in connection with an online sadistic network called '764'. The individual allegedly coerced minors to engage in self-harm and create 'bloodsigns' bearing his username as evidence of compliance.Fri, 24 Jul 2026 13:47:04 GMThttps://darkreading.com/vulnerabilities-threats/vatican-official-prayer-app-leaks-700k-piicst-3167Vatican's official prayer application contained a vulnerable API endpoint that exposed personal information for over 700,000 users worldwide. The exposed data included names, email addresses, location information, and site status that could be accessed without authentication through a standard web browser.Fri, 24 Jul 2026 13:00:00 GMThttps://databreaches.net/2026/07/24/crime-stoppers-assured-people-their-tips-would-be-anonymous-then-more-than-1-million-tips-leaked?pk_campaign=feed&pk_kwd=crime-stoppers-assured-people-their-tips-would-be-anonymous-then-more-than-1-million-tips-leakedcst-3188A breach of Navigate360's systems exposed more than one million tips submitted to Crime Stoppers and law enforcement programs that relied on the company's software for anonymous reporting. The incident undermines trust in anonymous tip submission channels that promised confidentiality to sources.Fri, 24 Jul 2026 12:49:59 GMThttps://databreaches.net/2026/07/24/origin-silent-on-settlement-as-alleged-fired-employee-breach-detail-emerges?pk_campaign=feed&pk_kwd=origin-silent-on-settlement-as-alleged-fired-employee-breach-detail-emergescst-3170Origin Energy has declined to publicly comment on a reported private settlement of a cyber extortion threat. The alleged breach involved unauthorized access through a former employee's credentials, creating concurrent disclosure obligations to regulators, the ASX, and insurers.Fri, 24 Jul 2026 12:08:15 GMThttps://databreaches.net/2026/07/24/t-mobile-violated-wa-data-breach-notification-law-judge-rules?pk_campaign=feed&pk_kwd=t-mobile-violated-wa-data-breach-notification-law-judge-rulescst-3171A King County Superior Court judge ruled that T-Mobile violated Washington state data breach notification law by failing to properly notify customers of a 2024 breach affecting 40 million people whose sensitive personal information was stolen and sold on the dark web. The Washington attorney general's office filed the civil lawsuit against T-Mobile in January 2025. The ruling establishes that T-Mobile's notification practices did not meet the state's legal requirements.Fri, 24 Jul 2026 12:08:06 GMThttps://databreaches.net/2026/07/24/furious-kpmg-boss-expels-senior-partner-over-confidential-documents-in-locker?pk_campaign=feed&pk_kwd=furious-kpmg-boss-expels-senior-partner-over-confidential-documents-in-lockercst-3172KPMG's chief operating officer, Eileen Hoggett, was expelled after an investigation confirmed she and other senior partners illegally accessed sensitive Lendlease board documents and stored them in a work locker. The expulsion followed a whistleblower claim regarding the unauthorized possession of confidential materials.Fri, 24 Jul 2026 12:07:56 GMThttps://databreaches.net/2026/07/24/millions-of-california-bought-cars-can-be-hijacked-via-bluetooth?pk_campaign=feed&pk_kwd=millions-of-california-bought-cars-can-be-hijacked-via-bluetoothcst-3174Researchers at UC San Diego identified Bluetooth vulnerabilities affecting at least 2.2 million vehicles equipped with dealer-installed KARR and SWDS security systems. The flaws allow nearby attackers to unlock doors or disable vehicle ignition through wireless attacks. The full research details are forthcoming.Fri, 24 Jul 2026 12:06:56 GMThttps://bleepingcomputer.com/news/security/man-gets-six-years-for-hacking-750-womens-snapchat-accountscst-3159An Illinois man received a 76-month prison sentence and three years of supervised release for hacking over 750 women's Snapchat accounts to obtain their nude photos. The case illustrates criminal liability for unauthorized account access and theft of intimate images.Fri, 24 Jul 2026 11:17:19 GMThttps://bleepingcomputer.com/news/microsoft/microsoft-365-outage-affects-teams-sharepoint-and-other-servicescst-3100Microsoft experienced a widespread outage affecting Teams, SharePoint, and other Microsoft 365 services, with impact concentrated in North America. The disruption impacted collaboration and productivity tools relied upon by thousands of organizations.Thu, 23 Jul 2026 15:34:43 GMThttps://securityweek.com/chick-fil-a-accounts-get-fried-in-credential-stuffing-attackcst-3109Threat actors used credentials from previous breaches to gain unauthorized access to Chick-fil-A One customer accounts through credential stuffing. The attack relied on reused passwords rather than exploiting a vulnerability in the restaurant chain's systems.Thu, 23 Jul 2026 14:55:19 GMThttps://therecord.media/australia-origin-energy-data-breachcst-3113Origin Energy, a major Australian energy supplier, confirmed that customer data was compromised in a recent breach and is investigating the scope of the incident to determine how many Australians were affected.Thu, 23 Jul 2026 13:20:00 GMThttps://bleepingcomputer.com/news/microsoft/microsoft-working-to-fix-exchange-online-mailbox-quarantine-issuecst-3069Microsoft is addressing an issue with Exchange Online that has been incorrectly quarantining customer mailboxes since Sunday. The company is working to resolve the problem and restore normal service for affected users.Thu, 23 Jul 2026 09:20:10 GMThttps://databreaches.net/2026/07/22/id-kootenai-county-notifies-residents-of-data-breach?pk_campaign=feed&pk_kwd=id-kootenai-county-notifies-residents-of-data-breachcst-3057Kootenai County is notifying residents of a ransomware attack discovered on March 30, 2026, that compromised personal information on its computer network. The county took immediate action to secure and restore its systems following the detection.Thu, 23 Jul 2026 00:45:56 GMThttps://databreaches.net/2026/07/22/tn-data-breach-delays-start-of-sumner-county-school-year?pk_campaign=feed&pk_kwd=tn-data-breach-delays-start-of-sumner-county-school-yearcst-3058Sumner County Schools in Tennessee discovered a data breach in its computer network and postponed the start of the school year to resolve the incident before students return. The breach was identified earlier in the week, prompting district officials to revise the calendar.Thu, 23 Jul 2026 00:25:52 GMThttps://databreaches.net/2026/07/22/instructure-incident-driving-58-percent-of-breach-notices-in-2026?pk_campaign=feed&pk_kwd=instructure-incident-driving-58-percent-of-breach-notices-in-2026cst-3059A single Instructure incident generated 471 million breach notices in the first half of 2026, accounting for 58 percent of all breach notifications despite 1,029 total compromises being reported during that period. The Identity Theft Resource Center documented this concentration of impact from one major breach event among organizations handling large datasets.Wed, 22 Jul 2026 23:12:10 GMThttps://bleepingcomputer.com/news/security/upbound-says-hack-caused-13-million-in-fraudulent-acima-leasescst-3047Threat actors who compromised Upbound Group's systems used stolen data to fraudulently originate approximately $13 million in Acima leases. The breach highlighted the exposure of customer information and the downstream financial impact when stolen credentials are weaponized for unauthorized transactions.Wed, 22 Jul 2026 21:43:39 GMThttps://bleepingcomputer.com/news/security/south-korea-discloses-data-breach-impacting-diplomats-worldwidecst-3048South Korea's National Diplomatic Academy suffered a ten-month breach of its online education system, exposing personal information of current and former Ministry of Foreign Affairs employees and diplomats stationed abroad. The incident remained undetected for an extended period before disclosure.Wed, 22 Jul 2026 20:06:54 GMThttps://microsoft.com/en-us/security/blog/2026/07/22/real-world-incident-response-microsoft-and-axa-xl-strengthen-cyber-resiliencecst-3041Microsoft and AXA XL have established a partnership to integrate Microsoft Defender Experts Cybersecurity Incident Response services into AXA XL's cyber insurance offerings for policyholders. The collaboration aims to coordinate technical response, business decisions, and insurance coverage in parallel during incidents rather than sequentially, reducing response delays and risk. The model emphasizes pre-crisis alignment among security, executive, legal, and insurance teams to streamline decision-making when incidents occur.Wed, 22 Jul 2026 16:00:00 GMThttps://securityweek.com/suno-paidwork-data-breaches-affect-tens-of-millions-of-accountscst-3015Data breaches at Suno and Paidwork exposed personally identifiable information and financial data from tens of millions of accounts. Attackers leaked names, email addresses, phone numbers, passwords, and financial information from both platforms.Wed, 22 Jul 2026 15:02:11 GMThttps://bleepingcomputer.com/news/security/chick-fil-a-discloses-data-breach-after-credential-stuffing-attackscst-2975Chick-fil-A disclosed a data breach affecting customer accounts compromised through credential stuffing attacks. The restaurant chain is notifying affected customers as part of its response to the incident.Wed, 22 Jul 2026 06:40:29 GMThttps://databreaches.net/2026/07/21/milford-new-hampshire-confirms-unauthorized-activity-withholds-details-of-suspected-cyberattack?pk_campaign=feed&pk_kwd=milford-new-hampshire-confirms-unauthorized-activity-withholds-details-of-suspected-cyberattackcst-2974Milford, New Hampshire confirmed unauthorized activity affecting town systems beginning July 15 but has not disclosed specific details about the suspected cyberattack. The town issued alerts to residents about the incident, though the full scope and nature of the compromise remain unclear.Wed, 22 Jul 2026 00:01:07 GMThttps://databreaches.net/2026/07/21/cyberattack-against-maine-telecom-disrupted-municipal-internet-service-in-23-towns?pk_campaign=feed&pk_kwd=cyberattack-against-maine-telecom-disrupted-municipal-internet-service-in-23-townscst-2967A cyberattack against a Maine telecommunications company on Sunday disrupted internet service across 23 towns in the midcoastal region. At least one municipal government, including the town of Damariscotta, experienced service loss as a result of the incident.Tue, 21 Jul 2026 19:07:18 GMThttps://therecord.media/spain-fines-23andme-3-million-cyber-failings-data-breachcst-2958Spain's data protection authority fined 23andMe approximately 2.9 million euros for security failures that enabled a 2023 breach impacting 6.9 million users globally, with over 2,600 Spanish residents affected. The penalty reflects regulatory enforcement against inadequate safeguards that allowed unauthorized access to personal genetic data.Tue, 21 Jul 2026 17:10:00 GMThttps://techcrunch.com/2026/07/21/ai-music-generator-suno-breach-affects-55m-users-per-have-i-been-pwnedcst-2945A breach of Suno, an AI music generator, exposed personal information including names, phone numbers, and physical addresses for 55 million users. The incident was reported through the Have I Been Pwned breach notification service.Tue, 21 Jul 2026 14:48:18 GMThttps://youtube.com/watch?v=fwnEN-OIH_wcst-2916A security issue called FortiBleed has resulted in the exposure of approximately 74,000 Fortinet login credentials. The incident appears to affect Fortinet products and services used by organizations worldwide.Tue, 21 Jul 2026 13:21:42 GMThttps://databreaches.net/2026/07/21/personal-data-of-all-south-korean-diplomats-believed-leaked-in-unprecedented-cyberattack?pk_campaign=feed&pk_kwd=personal-data-of-all-south-korean-diplomats-believed-leaked-in-unprecedented-cyberattackcst-2940South Korea's Foreign Ministry reported that personal data of nearly all diplomatic personnel was compromised in a cyberattack on the Korea National Diplomatic Academy's data system, affecting up to 10,000 administrative and intelligence records. The ministry characterized the incident as unprecedented in scope.Tue, 21 Jul 2026 12:58:07 GMThttps://databreaches.net/2026/07/21/nysdfs-secures-50-million-penalty-from-swedbank-for-withholding-information-from-investigators?pk_campaign=feed&pk_kwd=nysdfs-secures-50-million-penalty-from-swedbank-for-withholding-information-from-investigatorscst-2941The New York Department of Financial Services (NYSDFS) secured a $50 million penalty from Swedbank for withholding information from investigators. The settlement relates to ongoing investigations stemming from the Panama Papers leak of 2016, which exposed the law firm Mossack Fonseca's role in facilitating financial secrecy schemes. Swedbank's non-cooperation with regulators constituted a significant compliance violation.Tue, 21 Jul 2026 12:53:29 GMThttps://databreaches.net/2026/07/21/suno-data-breach-had-a-breach-in-2025-why-is-it-first-being-known-now?pk_campaign=feed&pk_kwd=suno-data-breach-had-a-breach-in-2025-why-is-it-first-being-known-nowcst-2942AI music generation platform Suno experienced a data breach in November 2025 that remained unreported until July 2026. The incident exposed user data, with details initially disclosed by 404 Media and later documented on the Have I Been Pwned breach notification service.Tue, 21 Jul 2026 12:53:16 GMThttps://databreaches.net/2026/07/21/seoul-notifies-4-62-million-of-ttareungyi-data-breach-offers-free-passes?pk_campaign=feed&pk_kwd=seoul-notifies-4-62-million-of-ttareungyi-data-breach-offers-free-passescst-2943Seoul's metropolitan government is notifying approximately 4.62 million residents of a data breach affecting Ttareungyi, the city's public bike-sharing service. Affected individuals will receive text notifications and compensation including 30-day passes to the service.Tue, 21 Jul 2026 12:53:07 GMThttps://securityweek.com/clover-health-investments-discloses-data-breachcst-2889Clover Health Investments disclosed a data breach in which attackers used social engineering to compromise employee accounts containing personal and health information.Tue, 21 Jul 2026 09:36:51 GMThttps://bleepingcomputer.com/news/security/est-e-lauder-discloses-data-breach-via-oracle-e-business-flawcst-2875Estée Lauder disclosed a data breach resulting from attackers exploiting a vulnerability in Oracle E-Business Suite, which the company deployed for HR operations. The breach affected customer data stored within systems accessible through the compromised application.Mon, 20 Jul 2026 22:39:30 GMThttps://bleepingcomputer.com/news/security/hackers-steal-237-million-in-crypto-from-ostium-in-off-chain-attackcst-2868Ostium, a trading platform, lost $23.75 million when an attacker compromised off-chain infrastructure that supplied price data to the protocol, enabling the theft from its liquidity provider vault. The attack exploited the dependency on external systems to feed critical information into the platform's operations.Mon, 20 Jul 2026 22:22:56 GMThttps://therecord.media/south-korea-cyberattack-foreign-ministrycst-2842Unidentified attackers gained access to an online education system operated by South Korea's diplomatic academy and maintained presence for nine months, during which they exfiltrated personal information of current and former Ministry of Foreign Affairs staff. The incident went undetected until discovered through an investigation.Mon, 20 Jul 2026 15:15:00 GMThttps://helpnetsecurity.com/2026/07/20/paidwork-data-breach-23-million-userscst-2845Paidwork, a microtask platform that pays users for activities like watching ads and completing surveys, suffered a breach exposing data for over 23 million users. The incident affected a large user base reliant on the platform for modest earnings from online tasks.Mon, 20 Jul 2026 14:52:29 GMThttps://helpnetsecurity.com/2026/07/20/italy-windtre-1-7-million-finecst-2832Italy's data protection authority fined WINDTRE, a major Italian telecom operator, €1.7 million for serious data security shortcomings that enabled two separate breaches in February 2025. The attackers used social engineering techniques, impersonating support technicians to gain access, and exfiltrated personal data from over 365,000 customers.Mon, 20 Jul 2026 13:19:05 GMThttps://techcrunch.com/2026/07/20/hugging-face-confirms-breach-affected-internal-datasets-and-credentials-urges-users-to-take-actioncst-2834Hugging Face confirmed a breach that exposed internal datasets and credentials, prompting the company to advise users to rotate access tokens and review account activity. The incident affected data stored on the platform and required immediate user action to secure compromised authentication materials.Mon, 20 Jul 2026 12:39:28 GMThttps://securityweek.com/new-index-tracks-material-breaches-and-refuses-to-add-up-the-lossescst-2829A cybersecurity executive named Richard Bird created an index designed to track material breaches for use by security professionals, journalists, policymakers, and the general public. The index deliberately avoids aggregating financial loss figures across incidents.Mon, 20 Jul 2026 11:46:50 GMThttps://databreaches.net/2026/07/20/broken-promises-of-anonymity-four-months-later-still-no-transparency-now-were-seeking-accountability?pk_campaign=feed&pk_kwd=broken-promises-of-anonymity-four-months-later-still-no-transparency-now-were-seeking-accountabilitycst-2849Navigate360 disclosed that 8.3 million anonymous tips were exposed in a breach on March 18, 2026. Four months after the incident, the company has provided limited transparency and downstream programs relying on its platform have remained silent. DataBreaches.net is pursuing accountability through state and federal regulators.Mon, 20 Jul 2026 11:36:04 GMThttps://securityweek.com/ernst-young-data-breach-affects-personal-financial-informationcst-2830Ernst and Young experienced a data breach involving a third-party management platform, resulting in the theft of names, addresses, Social Security numbers, and credit or debit card details. The incident exposed both personal and financial information of affected individuals.Mon, 20 Jul 2026 11:27:38 GMThttps://therecord.media/software-provider-for-us-hospitals-customer-data-breachcst-2831Craneware, a software provider serving more than 2,000 US hospitals, disclosed that unauthorized access to a subset of its data environment was detected, prompting the company to engage external forensic investigators to assess the breach.Mon, 20 Jul 2026 11:00:00 GMThttps://bleepingcomputer.com/news/microsoft/microsoft-working-to-fix-wsus-server-sync-delays-and-timeoutscst-2825Microsoft is addressing a known issue that disrupted Windows Server Update Services (WSUS) synchronization for more than a week. The company is actively working on a fix for the affected infrastructure.Mon, 20 Jul 2026 10:47:28 GMT