Privacy Headlines

DataBreaches.net · 10/4/2026

Lee Hyo-jin reports: President Lee Jae Myung on Sunday ordered a thorough investigation into a string of recent data breaches at financial institutions, as artificial intelligence (AI)-powered cyberattacks increasingly target them. According to Cheong Wa Dae, Lee was briefed on recent data breaches at financial and public institutions and their responses to the incidents. “The... Source

DataBreaches.net · 10/4/2026

The Slate Valley Unified School District in Fair Haven, Vermont, has been responding to a security incident since September 3. On October 2, Kairos threat actors contacted DataBreaches to alert us to the incident and their response to the district’s claim that they believed student data had not been compromised. They were also angry that... Source

DataBreaches.net · 10/3/2026

The following is a machine translation of a press release by Italy’s privacy guarantor: Healthcare data: The Privacy Guarantor fines IQVIA 7 million euros. The data of one million patients of 800 family doctors are not anonymous. The Italian Data Protection Authority has fined IQVIA Solutions Italy Srl €7 million. The company, part of a... Source

DataBreaches.net · 10/3/2026

Jana Winter, Raphael Satter, and A.J. Vicens report: A key member of the ShinyHunters hacking group, ‌which claims to have stolen data on every FBI employee, was detained this week in Jordan, three people familiar with the matter told Reuters. Two of ​the sources said he was cooperating with the FBI to identify ​his fellow... Source

DataBreaches.net · 10/3/2026

Bill Toulas reports: More than 543,000 credentials exposed in public GitHub repositories were still valid in July despite the platform’s security measures to prevent accidental leaks of sensitive data. Data pulled from scanning 224 million repositories and more than 58 billion files show that the median time a unique credential remained publicly accessible was 784... Source

DataBreaches.net · 10/2/2026

Joseph Topping reports: The City of Vicksburg, Mississippi, has shut down its computer systems after a ransomware attack, potentially delaying in-person utility payments while emergency response and utility service continue. Mayor Willis Thompson told The Vicksburg Post that the city had disconnected its internet operations. “We had to bring our internet operations down, just for... Source

DataBreaches.net · 10/1/2026

DataBreaches has reported on a group known as KillSec for almost two years. This time, we get to report on their arrest. The European Union Agency for Criminal Justice Cooperation issued this press release today: An international group of authorities from nine countries, coordinated by Eurojust and Europol, has successfully shut down a ransomware group... Source

DataBreaches.net · 10/1/2026

KOIN in Oregon reports: Three clicks. That’s all Chuck Dornon said it took to reach private McMinnville records that should never have been public on the dark web. “Anything and everything that the city’s done is out there,” Dornon said. “This is probably the easiest form of information I’ve come across in a breach.” The... Source

DataBreaches.net · 10/1/2026

Datawater reports: Two critical NetScaler zero-days, CVE-2026-88771 and CVE-2026-88772, were used against organizations worldwide before a patch existed. CISA’s deadline is today. Patching alone will not tell you whether you were already breached. Threat level: Critical What: Two unauthenticated remote-code-execution flaws in Citrix NetScaler ADC and NetScaler Gateway, both CVSS 9.5. Status: Exploited as zero-days.... Source

DataBreaches.net · 9/30/2026

WFXR in Virginia reports: The City of Radford announced tonight (9/29) the city is currently dealing with an internet outage due to a potential data breach. City leadership says it reached out to cybersecurity professionals and legal counsel upon becoming aware of the incident. Both state and federal law enforcement have also been notified, and... Source

DataBreaches.net · 9/30/2026

Hadley Barndollar of masslive.com reports: A “cybersecurity incident” has occurred involving the electronic health record system for Suffolk County’s two jails, the system provider confirmed Thursday. Computer Systems Integrated Inc., which runs the EHRs-C platform containing prisoner health data and medical records, said it is aware of and investigating an incident involving the Suffolk County... Source

DataBreaches.net · 9/29/2026

Anyone following the recent arrest of Pepijn van der Stap, the previously convicted hacker known as “Umbreon,” was likely shocked today when the prosecution announced that he was being charged with two counts of attempted incitement to murder. Here’s what we know so far. A 24-year-old Dutch national who previously served time for hacking-related crimes... Source

DataBreaches.net · 9/29/2026

Joseph Cox reports: The hackers behind the massive FBI breach told 404 Media on Monday they do not intend to publish the data. The breach, in which the hackers stole personal information on “all FBI employees and applicants” including physical addresses, job roles, names of spouses, and medical records, represents a significant national security and... Source

DataBreaches.net · 9/29/2026

Andrey Mihayloff reports: Dodo Pizza has confirmed a cyberattack on its IT systems, admitting that attackers may have accessed personal data of a portion of its customer base. The company reported the breach to Roskomnadzor and stated that access to the system has since been blocked. According to the company, the exposed data may include:... Source

DataBreaches.net · 9/28/2026

Numerous major law firms have fallen prey to the Silent Ransom Group this year. Now DataBreaches provides exclusive details on SRG’s recent attacks on Hogan Lovells Cadwalader. Yes, that’s “attacks,” plural. When New York City’s oldest law firm, Cadwalader, Wickersham & Taft, merged with Hogan Lovells in 2022, it combined two powerhouse firms. Yet despite... Source

DataBreaches.net · 9/28/2026

September 25 – U.S. Department of Justice: Cameron John Wagenius, 22, a former Army soldier who was most recently stationed in Texas, was sentenced today to 70 months in prison and ordered to pay $294,978 in restitution for conspiring to hack into telecommunications companies’ databases, access sensitive records, and extort the companies by threatening to... Source

DataBreaches.net · 9/27/2026

Tom McArthur and Louise Parry report: Ten NHS staff have been removed from duty or suspended after a data breach involving the digital medical records of three-year-old Noah Woods. Launching an “urgent” investigation, Dr Martin Mansfield, deputy chief medical officer at East Suffolk and North Essex NHS Foundation Trust, said that any unauthorised access of... Source

DataBreaches.net · 9/27/2026

Rhea Yasmine reports: Personal information of more than 23,500 Simba customers has been compromised in a data breach, the telco said in a statement on Sept 25. The data involved included names, identity card numbers, dates of birth, mobile numbers, and e-mail addresses belonging to 23,549 people, who had registered for Simba’s services. No credit... Source

DataBreaches.net · 9/26/2026

Polish healthcare entities have been the victims of cyberattacks recently. First, it was the MyDr system. Now it’s a software manufacturer that markets the Medyc software used by Polish healthcare providers. Stanisław Kaleta reports: Poland has been hit by another medical data cyberattack, weeks after an unprecedented breach exposed the personal information of almost 19... Source

DataBreaches.net · 9/26/2026

Sean Lyngaas and Davis Winkie report: A data breach at the Pentagon’s vast HR system has exposed Social Security numbers and other personal information of current and former military personnel, raising counterintelligence concerns among national security experts. “Unauthorized users” gained access to a vulnerable computer server belonging to the Defense Manpower Data Center (DMDC) beginning... Source

DataBreaches.net · 9/26/2026

Zack Whittaker reports today’s nominee for the “No need to hack when it’s leaking” honors: Thousands of databases hosted by development platform Supabase are exposing people’s sensitive information to the public web, new security research by cybersecurity firm UpGuard has found. UpGuard told TechCrunch that it found around 16,000 databases on which some degree of... Source

DataBreaches.net · 9/26/2026

Suzanne Smiley reports another update on litigation stemming from the American Medical Collection Agency breach. A bipartisan coalition of 44 state attorneys general on Thursday announced that they settled a lawsuit against Labcorp in exchange for a $2.3 million fine and a promise of sweeping data security reforms in the wake of a 2019 data... Source

DataBreaches.net · 9/25/2026

Roxanne Libatique writes: An OpenAI agent accessed Australian government health data in June 2026. The government was not told until September. That gap – nearly three months between breach and disclosure – is not just a political problem. It is a cyber insurance problem, and one that brokers with public sector and health sector clients... Source

DataBreaches.net · 9/24/2026

Alexander Martin reports: An OpenAI agent gained “unauthorized access” to “non-public files” from an Australian government health website in June, Prime Minister Anthony Albanese said Wednesday. The agent — an AI system designed to carry out tasks autonomously — accessed a public portal for Medicare statistics, Albanese said at a press conference in New York... Source

DataBreaches.net · 9/24/2026

Brandi Makuski reports: Stevens Point officials are investigating a possible cyberattack after several city computer servers went offline early Wednesday, disrupting municipal phone and email services and leaving employees unable to access some city systems. District 4 Councilwoman Andrea Olson said city IT employees notified staff and council members of a cyberattack in a 6:51... Source