https://cybersecuritytracker.ai/breachesCurated cybersecurity news and vulnerability intelligence.Sun, 26 Jul 2026 22:32:50 GMThttps://databreaches.net/2026/07/26/developing-anmed-reports-phone-and-internet-outage-impacting-all-hospital-locations-ers-remain-open?pk_campaign=feed&pk_kwd=developing-anmed-reports-phone-and-internet-outage-impacting-all-hospital-locations-ers-remain-opencst-3229AnMed Health System, which operates four hospitals in Upstate South Carolina and northeast Georgia, experienced a phone and internet outage affecting all locations. Emergency rooms remained operational during the incident despite the connectivity disruption.Sun, 26 Jul 2026 14:10:29 GMThttps://databreaches.net/2026/07/26/a-list-directors-actors-and-celebrities-exposed-in-tribeca-film-festival-data-leak?pk_campaign=feed&pk_kwd=a-list-directors-actors-and-celebrities-exposed-in-tribeca-film-festival-data-leakcst-3230A security researcher discovered four publicly accessible, unencrypted databases connected to the Tribeca Film Festival, including a development database containing over 203,000 records. The databases lacked password protection and exposed sensitive information about festival-associated individuals.Sun, 26 Jul 2026 13:06:14 GMThttps://helpnetsecurity.com/2026/07/26/week-in-review-servicenow-pre-auth-rce-exploited-in-the-wild-hugging-face-breachedcst-3226A weekly news roundup covered multiple security topics, including active exploitation of a ServiceNow pre-authentication remote code execution vulnerability and a breach of Hugging Face. The piece also discussed how organizations increasingly run multiple AI platforms simultaneously across different vendors and departments.Sun, 26 Jul 2026 08:00:34 GMThttps://databreaches.net/2026/07/25/us-house-votes-to-extend-cyber-sharing-law-for-10-years?pk_campaign=feed&pk_kwd=us-house-votes-to-extend-cyber-sharing-law-for-10-yearscst-3218The U.S. House of Representatives voted to extend a key cyberthreat sharing law for 10 years by including the reauthorization in the fiscal year 2027 national defense authorization act. The measure passed narrowly on a 216-212 vote Wednesday and was attached to the $1.15 trillion defense policy bill after the reauthorization had been stalled.Sat, 25 Jul 2026 14:25:16 GMThttps://databreaches.net/2026/07/25/au-sydney-nurse-accused-of-downloading-patients-data-in-alleged-breach-of-trust?pk_campaign=feed&pk_kwd=au-sydney-nurse-accused-of-downloading-patients-data-in-alleged-breach-of-trustcst-3219A registered nurse in northern Sydney has been charged after allegedly downloading patient data without authorization. NSW Police launched an investigation following a report to the agency and subsequently searched a home in Frenchs Forest as part of the inquiry.Sat, 25 Jul 2026 14:24:50 GMThttps://databreaches.net/2026/07/25/no-need-to-hack-when-its-leaking-click-to-pray-edition?pk_campaign=feed&pk_kwd=no-need-to-hack-when-its-leaking-click-to-pray-editioncst-3220The Click To Pray app, a prayer application endorsed by the Pope with hundreds of thousands of users, exposed users' names and email addresses through a data leak. An ethical hacker discovered the exposure, which had persisted for months or longer.Sat, 25 Jul 2026 14:24:35 GMThttps://bleepingcomputer.com/news/security/shinyhunters-data-leaks-fuel-2-000-sextortion-email-scamcst-3217Threat actors are leveraging email addresses from ShinyHunters data leaks to conduct sextortion campaigns demanding $2,000 in Bitcoin from recipients. The attackers are exploiting publicly available breach data to target victims with extortion threats.Sat, 25 Jul 2026 14:16:26 GMThttps://thehackernews.com/2026/07/cl0p-affiliates-target-internet-exposed.htmlcst-3213Cl0p-affiliated threat actors are exploiting unauthenticated remote code execution (RCE) vulnerabilities in internet-exposed PTC Windchill and FlexPLM deployments. The attackers chain pre-authentication information disclosure in FlexPLM with server-side flaws in Windchill's login servlet to gain unauthorized access. This activity is part of an active data extortion campaign.Sat, 25 Jul 2026 10:14:03 GMThttps://thehackernews.com/2026/07/devman-raas-portal-centralizes-payload.htmlcst-3214DevMan operators maintain a web portal that enables affiliates to build ransomware payloads, track earnings, and manage victim information. The Swiss cybersecurity firm PRODAFT tracks the operation under the threat actor name Funky Mantis and reports that the platform centralizes multiple ransomware-as-a-service functions in one location.Sat, 25 Jul 2026 09:53:41 GMThttps://bleepingcomputer.com/news/artificial-intelligence/openai-confirms-chatgpt-is-down-worldwidecst-3208OpenAI confirmed that ChatGPT experienced a worldwide outage affecting access to the artificial intelligence chatbot. The company did not provide details on the cause or expected resolution timeline in the initial report.Sat, 25 Jul 2026 09:31:09 GMThttps://bleepingcomputer.com/news/security/ontrac-notifies-customers-of-data-breach-after-network-hackcst-3195OnTrac, a parcel delivery company, disclosed that attackers breached its corporate network and potentially accessed customer personal information. The company is notifying affected customers of the incident.Fri, 24 Jul 2026 19:55:01 GMThttps://bleepingcomputer.com/news/security/chick-fil-a-data-breach-affects-more-than-13-000-customerscst-3178Chick-fil-A confirmed that attackers using credential stuffing tactics compromised more than 13,000 customer accounts on its website and mobile app during a three-day period in mid-June. The breach involved unauthorized access to customer data through reused or weak credentials rather than a direct compromise of the company's systems.Fri, 24 Jul 2026 14:04:29 GMThttps://databreaches.net/2026/07/24/suspect-arrested-in-investigation-into-sadistic-764-group?pk_campaign=feed&pk_kwd=suspect-arrested-in-investigation-into-sadistic-764-groupcst-3187A suspect from North Holland was arrested on July 20 in connection with an online sadistic network called '764'. The individual allegedly coerced minors to engage in self-harm and create 'bloodsigns' bearing his username as evidence of compliance.Fri, 24 Jul 2026 13:47:04 GMThttps://darkreading.com/vulnerabilities-threats/vatican-official-prayer-app-leaks-700k-piicst-3167Vatican's official prayer application contained a vulnerable API endpoint that exposed personal information for over 700,000 users worldwide. The exposed data included names, email addresses, location information, and site status that could be accessed without authentication through a standard web browser.Fri, 24 Jul 2026 13:00:00 GMThttps://databreaches.net/2026/07/24/crime-stoppers-assured-people-their-tips-would-be-anonymous-then-more-than-1-million-tips-leaked?pk_campaign=feed&pk_kwd=crime-stoppers-assured-people-their-tips-would-be-anonymous-then-more-than-1-million-tips-leakedcst-3188A breach of Navigate360's systems exposed more than one million tips submitted to Crime Stoppers and law enforcement programs that relied on the company's software for anonymous reporting. The incident undermines trust in anonymous tip submission channels that promised confidentiality to sources.Fri, 24 Jul 2026 12:49:59 GMThttps://databreaches.net/2026/07/24/origin-silent-on-settlement-as-alleged-fired-employee-breach-detail-emerges?pk_campaign=feed&pk_kwd=origin-silent-on-settlement-as-alleged-fired-employee-breach-detail-emergescst-3170Origin Energy has declined to publicly comment on a reported private settlement of a cyber extortion threat. The alleged breach involved unauthorized access through a former employee's credentials, creating concurrent disclosure obligations to regulators, the ASX, and insurers.Fri, 24 Jul 2026 12:08:15 GMThttps://databreaches.net/2026/07/24/t-mobile-violated-wa-data-breach-notification-law-judge-rules?pk_campaign=feed&pk_kwd=t-mobile-violated-wa-data-breach-notification-law-judge-rulescst-3171A King County Superior Court judge ruled that T-Mobile violated Washington state data breach notification law by failing to properly notify customers of a 2024 breach affecting 40 million people whose sensitive personal information was stolen and sold on the dark web. The Washington attorney general's office filed the civil lawsuit against T-Mobile in January 2025. The ruling establishes that T-Mobile's notification practices did not meet the state's legal requirements.Fri, 24 Jul 2026 12:08:06 GMThttps://databreaches.net/2026/07/24/furious-kpmg-boss-expels-senior-partner-over-confidential-documents-in-locker?pk_campaign=feed&pk_kwd=furious-kpmg-boss-expels-senior-partner-over-confidential-documents-in-lockercst-3172KPMG's chief operating officer, Eileen Hoggett, was expelled after an investigation confirmed she and other senior partners illegally accessed sensitive Lendlease board documents and stored them in a work locker. The expulsion followed a whistleblower claim regarding the unauthorized possession of confidential materials.Fri, 24 Jul 2026 12:07:56 GMThttps://databreaches.net/2026/07/24/millions-of-california-bought-cars-can-be-hijacked-via-bluetooth?pk_campaign=feed&pk_kwd=millions-of-california-bought-cars-can-be-hijacked-via-bluetoothcst-3174Researchers at UC San Diego identified Bluetooth vulnerabilities affecting at least 2.2 million vehicles equipped with dealer-installed KARR and SWDS security systems. The flaws allow nearby attackers to unlock doors or disable vehicle ignition through wireless attacks. The full research details are forthcoming.Fri, 24 Jul 2026 12:06:56 GMThttps://bleepingcomputer.com/news/security/man-gets-six-years-for-hacking-750-womens-snapchat-accountscst-3159An Illinois man received a 76-month prison sentence and three years of supervised release for hacking over 750 women's Snapchat accounts to obtain their nude photos. The case illustrates criminal liability for unauthorized account access and theft of intimate images.Fri, 24 Jul 2026 11:17:19 GMThttps://bleepingcomputer.com/news/security/clop-ransomware-targets-windchill-flexplm-in-data-theft-attackscst-3151The Clop ransomware group is conducting data theft extortion attacks against publicly accessible instances of PTC Windchill and FlexPLM product lifecycle management platforms. These attacks represent an expansion of the group's targeting beyond previously observed patterns.Fri, 24 Jul 2026 07:36:39 GMThttps://helpnetsecurity.com/2026/07/24/emea-healthcare-ransomware-activitycst-3148A Flare researcher analyzed ransomware leak-site activity targeting healthcare organizations across the EMEA region from 2024 to 2026 and found that ransomware groups are systematically attacking the entire healthcare supply chain, not just hospitals. The attacks extend beyond hospitals and clinics to include telemedicine providers, diagnostic laboratories, pharmacies, and other ecosystem participants. While hospital breaches receive media attention, attacks on peripheral healthcare entities often remain unreported despite comparable damage.Fri, 24 Jul 2026 05:30:33 GMThttps://helpnetsecurity.com/2026/07/24/ransomware-attack-trends-2026-reportcst-3150Black Kite's 2026 Ransomware Report finds a fragmented ransomware landscape with 61 new groups entering the market between April 2025 and March 2026, averaging more than one new group per week. Unlike previous years defined by dominant actors or major incidents, 2026 shows multiple ransomware playbooks scaling simultaneously with no signs of slowdown.Fri, 24 Jul 2026 04:30:22 GMThttps://recordedfuture.com/blog/ransomware-is-the-scoreboardcst-3190Recorded Future documented 13,000 ransomware victims over two years, with groups like Interlock and RansomHub continuing successful attacks despite existing defensive technologies such as attack path management tools. The article argues that defenders struggle because they focus on compliance checklists and vulnerability lists rather than modeling their environment as an interconnected graph of assets, configurations, and credentials that attackers actually traverse, and proposes that AI agents continuously recomputing attack paths at adversarial speed could improve defense.Fri, 24 Jul 2026 00:00:00 GMThttps://bleepingcomputer.com/news/microsoft/microsoft-365-outage-affects-teams-sharepoint-and-other-servicescst-3100Microsoft experienced a widespread outage affecting Teams, SharePoint, and other Microsoft 365 services, with impact concentrated in North America. The disruption impacted collaboration and productivity tools relied upon by thousands of organizations.Thu, 23 Jul 2026 15:34:43 GMThttps://securityweek.com/chick-fil-a-accounts-get-fried-in-credential-stuffing-attackcst-3109Threat actors used credentials from previous breaches to gain unauthorized access to Chick-fil-A One customer accounts through credential stuffing. The attack relied on reused passwords rather than exploiting a vulnerability in the restaurant chain's systems.Thu, 23 Jul 2026 14:55:19 GMThttps://therecord.media/australia-origin-energy-data-breachcst-3113Origin Energy, a major Australian energy supplier, confirmed that customer data was compromised in a recent breach and is investigating the scope of the incident to determine how many Australians were affected.Thu, 23 Jul 2026 13:20:00 GMThttps://blog.talosintelligence.com/chaos-msarat-living-off-the-browser-to-build-covert-c2-channelcst-3081Cisco Talos discovered msaRAT, a Rust-based remote access trojan attributed to the Chaos ransomware group that establishes command-and-control communications exclusively through Chrome DevTools Protocol rather than direct network connections. The malware is delivered via a malicious MSI installer disguised as a Windows update and leverages the browser, Cloudflare Workers, and Twilio TURN relays to create a covert WebRTC DataChannel for C2 communications. Chaos is a ransomware-as-a-service group active since February 2025 that uses phishing, vishing, and legitimate tools for post-compromise activities before deploying encryption.Thu, 23 Jul 2026 10:00:38 GMThttps://bleepingcomputer.com/news/microsoft/microsoft-working-to-fix-exchange-online-mailbox-quarantine-issuecst-3069Microsoft is addressing an issue with Exchange Online that has been incorrectly quarantining customer mailboxes since Sunday. The company is working to resolve the problem and restore normal service for affected users.Thu, 23 Jul 2026 09:20:10 GMThttps://darkreading.com/cyberattacks-data-breaches/ransomware-attack-japanese-frozen-food-chaincst-3055A cyberattack on a Japanese food and logistics company disrupted frozen food distribution to thousands of clients, including major restaurant chains such as Kentucky Fried Chicken. The incident affected supply chains across multiple food service operators dependent on the firm's distribution network.Thu, 23 Jul 2026 01:00:00 GMThttps://databreaches.net/2026/07/22/id-kootenai-county-notifies-residents-of-data-breach?pk_campaign=feed&pk_kwd=id-kootenai-county-notifies-residents-of-data-breachcst-3057Kootenai County is notifying residents of a ransomware attack discovered on March 30, 2026, that compromised personal information on its computer network. The county took immediate action to secure and restore its systems following the detection.Thu, 23 Jul 2026 00:45:56 GMThttps://databreaches.net/2026/07/22/tn-data-breach-delays-start-of-sumner-county-school-year?pk_campaign=feed&pk_kwd=tn-data-breach-delays-start-of-sumner-county-school-yearcst-3058Sumner County Schools in Tennessee discovered a data breach in its computer network and postponed the start of the school year to resolve the incident before students return. The breach was identified earlier in the week, prompting district officials to revise the calendar.Thu, 23 Jul 2026 00:25:52 GMThttps://databreaches.net/2026/07/22/instructure-incident-driving-58-percent-of-breach-notices-in-2026?pk_campaign=feed&pk_kwd=instructure-incident-driving-58-percent-of-breach-notices-in-2026cst-3059A single Instructure incident generated 471 million breach notices in the first half of 2026, accounting for 58 percent of all breach notifications despite 1,029 total compromises being reported during that period. The Identity Theft Resource Center documented this concentration of impact from one major breach event among organizations handling large datasets.Wed, 22 Jul 2026 23:12:10 GMThttps://therecord.media/stadler-refuses-everest-ransom-demandcst-3075Stadler Rail, a Swiss train manufacturer, declined to pay a $12.3 million ransom demand from cybercriminals who obtained technical data through a compromised supplier's file-sharing platform.Wed, 22 Jul 2026 23:00:00 GMThttps://bleepingcomputer.com/news/security/upbound-says-hack-caused-13-million-in-fraudulent-acima-leasescst-3047Threat actors who compromised Upbound Group's systems used stolen data to fraudulently originate approximately $13 million in Acima leases. The breach highlighted the exposure of customer information and the downstream financial impact when stolen credentials are weaponized for unauthorized transactions.Wed, 22 Jul 2026 21:43:39 GMThttps://bleepingcomputer.com/news/security/south-korea-discloses-data-breach-impacting-diplomats-worldwidecst-3048South Korea's National Diplomatic Academy suffered a ten-month breach of its online education system, exposing personal information of current and former Ministry of Foreign Affairs employees and diplomats stationed abroad. The incident remained undetected for an extended period before disclosure.Wed, 22 Jul 2026 20:06:54 GMThttps://bleepingcomputer.com/news/security/swiss-rail-giant-stadler-rejects-123m-ransom-demand-after-cyberattackcst-3032Swiss rail manufacturer Stadler Rail was targeted by the Everest ransomware group, which demanded $12.3 million following a breach of a shared data exchange platform with a supplier. Stadler has rejected the ransom demand. The incident affected the company's IT systems and exposed sensitive business information.Wed, 22 Jul 2026 16:59:17 GMThttps://microsoft.com/en-us/security/blog/2026/07/22/real-world-incident-response-microsoft-and-axa-xl-strengthen-cyber-resiliencecst-3041Microsoft and AXA XL have established a partnership to integrate Microsoft Defender Experts Cybersecurity Incident Response services into AXA XL's cyber insurance offerings for policyholders. The collaboration aims to coordinate technical response, business decisions, and insurance coverage in parallel during incidents rather than sequentially, reducing response delays and risk. The model emphasizes pre-crisis alignment among security, executive, legal, and insurance teams to streamline decision-making when incidents occur.Wed, 22 Jul 2026 16:00:00 GMThttps://halcyon.ai/blog/ransomware-response-authority-who-is-in-chargecst-3031Organizations face simultaneous decision-making pressures when ransomware incidents occur outside business hours, requiring clear cross-functional authority structures to respond effectively. The article outlines the need for defined ownership across multiple response tracks to avoid delays and coordination failures during critical incidents.Wed, 22 Jul 2026 15:45:20 GMThttps://therecord.media/nichirei-japan-food-logistics-cyberattack-recoverycst-3020Nichirei Logistics Group, a major Japanese food distribution company, has restored warehouse operations and frozen food shipments following a disruption. A cybercriminal group claimed responsibility for causing the incident through a cyberattack.Wed, 22 Jul 2026 15:40:00 GMThttps://bleepingcomputer.com/news/security/how-enterprise-genai-can-amplify-ransomware-risk-and-how-to-contain-itcst-3011Enterprise generative AI systems can amplify ransomware risk when AI assistants inherit excessive permissions or operate with compromised identities. Organizations can mitigate this exposure through identity controls, governance frameworks, and least-privilege access models that balance security with AI adoption.Wed, 22 Jul 2026 15:30:00 GMThttps://techcrunch.com/2026/07/22/if-you-pay-a-hackers-ransom-chances-are-that-theyll-come-back-for-morecst-3028Security researchers observe that paying ransoms to attackers creates perverse incentives, as threat actors have no genuine reason to cease targeting an organization once payment is made. The dynamic mirrors traditional extortion, where capitulation signals vulnerability rather than resolution.Wed, 22 Jul 2026 15:29:41 GMThttps://securityweek.com/suno-paidwork-data-breaches-affect-tens-of-millions-of-accountscst-3015Data breaches at Suno and Paidwork exposed personally identifiable information and financial data from tens of millions of accounts. Attackers leaked names, email addresses, phone numbers, passwords, and financial information from both platforms.Wed, 22 Jul 2026 15:02:11 GMThttps://databreaches.net/2026/07/22/greedy-ransomware-crews-return-for-seconds-after-victims-cough-up-first-extortion-payments?pk_campaign=feed&pk_kwd=greedy-ransomware-crews-return-for-seconds-after-victims-cough-up-first-extortion-paymentscst-3027A Proofpoint survey of UK organizations found that 58 percent of those hit by ransomware paid the initial extortion demand. Among organizations that paid, 22 percent were targeted again by the same or different threat actors seeking additional payments.Wed, 22 Jul 2026 14:34:35 GMThttps://bleepingcomputer.com/news/security/chick-fil-a-discloses-data-breach-after-credential-stuffing-attackscst-2975Chick-fil-A disclosed a data breach affecting customer accounts compromised through credential stuffing attacks. The restaurant chain is notifying affected customers as part of its response to the incident.Wed, 22 Jul 2026 06:40:29 GMThttps://databreaches.net/2026/07/21/milford-new-hampshire-confirms-unauthorized-activity-withholds-details-of-suspected-cyberattack?pk_campaign=feed&pk_kwd=milford-new-hampshire-confirms-unauthorized-activity-withholds-details-of-suspected-cyberattackcst-2974Milford, New Hampshire confirmed unauthorized activity affecting town systems beginning July 15 but has not disclosed specific details about the suspected cyberattack. The town issued alerts to residents about the incident, though the full scope and nature of the compromise remain unclear.Wed, 22 Jul 2026 00:01:07 GMThttps://reliaquest.com/blog/human-in-the-loop-vs-human-on-the-loopcst-3203The article contrasts human-in-the-loop and human-on-the-loop oversight models for AI-driven security operations centers (SOCs). Human-in-the-loop, which requires analyst approval for every AI action, creates bottlenecks at scale when SOCs handle thousands of daily alerts. Human-on-the-loop, where AI acts autonomously while humans monitor and can intervene, offers better efficiency for mid-risk, reversible decisions while reserving human pre-approval for irreversible, high-consequence actions like system isolation.Wed, 22 Jul 2026 00:00:00 GMThttps://bleepingcomputer.com/news/security/police-dismantle-kratos-phishing-platform-arrest-developercst-2969German and US authorities dismantled the Kratos phishing-as-a-service platform and arrested its developer in Indonesia. The operation targeted the infrastructure supporting a platform that enabled phishing campaigns globally. Law enforcement cooperation disrupted a significant threat delivery mechanism.Tue, 21 Jul 2026 23:07:33 GMThttps://darkreading.com/cyberattacks-data-breaches/ransomware-is-accelerating-not-aicst-2964Researchers attribute the acceleration of ransomware attacks to ecosystem fragmentation, new threat actors entering the market, and expanding targeting of organizations with weaker defenses, rather than artificial intelligence-driven acceleration.Tue, 21 Jul 2026 21:48:05 GMThttps://databreaches.net/2026/07/21/cyberattack-against-maine-telecom-disrupted-municipal-internet-service-in-23-towns?pk_campaign=feed&pk_kwd=cyberattack-against-maine-telecom-disrupted-municipal-internet-service-in-23-townscst-2967A cyberattack against a Maine telecommunications company on Sunday disrupted internet service across 23 towns in the midcoastal region. At least one municipal government, including the town of Damariscotta, experienced service loss as a result of the incident.Tue, 21 Jul 2026 19:07:18 GMT