Cybersecurity breach intelligence, incident response analysis, and data breach case studies for security professionals.https://breached.company/en-ushttps://breached.company/arista-velocloud-cvss-10-fortios-symlink-kev-edge-2026/https://breached.company/arista-velocloud-cvss-10-fortios-symlink-kev-edge-2026/CISA added Arista VeloCloud Orchestrator CVE-2026-16812 (CVSS 10) and FortiOS CVE-2025-68686 to the KEV catalog on July 27 2026, both under active exploitation.Thu, 30 Jul 2026 13:00:00 GMThttps://breached.company/cisa-national-water-sector-warning-plc-exposure-2026/https://breached.company/cisa-national-water-sector-warning-plc-exposure-2026/CISA warned US water and wastewater systems of escalating threats after the Minnesota attacks, as advisory AA26-097A expands to Schneider Electric and Siemens PLCs.Thu, 30 Jul 2026 10:00:00 GMThttps://breached.company/stadler-rail-everest-nichirei-ransomhouse-manufacturing-extortion-2026/https://breached.company/stadler-rail-everest-nichirei-ransomhouse-manufacturing-extortion-2026/Everest demanded $12.3 million from Stadler Rail after a third-party file-sharing compromise; RansomHouse hit Nichirei, disrupting shipping for 5,000 customers.Wed, 29 Jul 2026 16:00:00 GMThttps://breached.company/clop-ptc-windchill-flexplm-cve-2026-12569-extortion-2026/https://breached.company/clop-ptc-windchill-flexplm-cve-2026-12569-extortion-2026/Cl0p is exploiting CVE-2026-12569 in PTC Windchill and FlexPLM to steal engineering data, hitting manufacturing, automotive, aerospace and apparel victims.Wed, 29 Jul 2026 13:00:00 GMThttps://breached.company/craneware-breach-2000-hospitals-healthcare-vendor-risk-2026/https://breached.company/craneware-breach-2000-hospitals-healthcare-vendor-risk-2026/Craneware confirmed attackers stole a significant volume of data from systems serving roughly 2,000 US hospitals and 10,000 clinics and pharmacies.Wed, 29 Jul 2026 10:00:00 GMThttps://breached.company/origin-energy-breach-900000-customers-australia-2026/https://breached.company/origin-energy-breach-900000-customers-australia-2026/Origin Energy confirmed about 900,000 current and former customers had personal data accessed, reversing an earlier assessment that the extortion threat was not credible.Tue, 28 Jul 2026 16:00:00 GMThttps://breached.company/blacksuit-royal-ransomware-takedown-seizure-450-victims-2026/https://breached.company/blacksuit-royal-ransomware-takedown-seizure-450-victims-2026/US-led takedown of BlackSuit ransomware seized four servers, nine domains and $1,091,453 in crypto; Royal/BlackSuit hit 450+ US victims for $370M since 2022.Tue, 28 Jul 2026 14:00:00 GMThttps://breached.company/minnesota-water-utilities-cyberattack-cyberav3ngers-plc-2026/https://breached.company/minnesota-water-utilities-cyberattack-cyberav3ngers-plc-2026/More than 30 Minnesota water utilities were disrupted July 26-27 2026 in a coordinated OT attack linked to Iranian-affiliated exploitation of Rockwell PLC flaw CVE-2021-22681.Tue, 28 Jul 2026 10:00:00 GMThttps://breached.company/cybercrime-arrest-wave-2026-scattered-spider-jailed-shinyhunters-free/https://breached.company/cybercrime-arrest-wave-2026-scattered-spider-jailed-shinyhunters-free/2026's cybercrime arrest wave jailed Scattered Spider members and dismantled hosting networks — while ShinyHunters kept breaching Fortune 100 companies unimpeded.Mon, 27 Jul 2026 10:00:00 GMThttps://breached.company/north-korea-arrests-own-hackers-state-bank-crypto-laundering-2026/https://breached.company/north-korea-arrests-own-hackers-state-bank-crypto-laundering-2026/North Korea arrested former military cyber operators for hacking the Chosun Central Bank and Foreign Trade Bank and laundering stolen state funds through crypto.Sun, 26 Jul 2026 10:00:00 GMThttps://breached.company/abbott-two-breaches-labcentral-shadowbyt3-lawsuits-2026/https://breached.company/abbott-two-breaches-labcentral-shadowbyt3-lawsuits-2026/Abbott is investigating a second intrusion by ShadowByt3$ into its LabCentral portal as the first Exact Sciences data breach class action lands in Wisconsin.Fri, 24 Jul 2026 10:00:00 GMThttps://breached.company/abbott-exact-sciences-shinyhunters-30-million-records-2026/https://breached.company/abbott-exact-sciences-shinyhunters-30-million-records-2026/ShinyHunters claims 30 million records and 1 million SSNs from Abbott-owned Exact Sciences after a voice phishing attack on a Microsoft Entra SSO account.Thu, 23 Jul 2026 10:00:00 GMThttps://breached.company/chick-fil-a-credential-stuffing-breach-2026/https://breached.company/chick-fil-a-credential-stuffing-breach-2026/Chick-fil-A disclosed a June 2026 credential-stuffing attack exposing Chick-fil-A One accounts, payment card digits and QR codes — its second such breach since 2023.Wed, 22 Jul 2026 10:00:00 GMThttps://breached.company/jadepuffer-encforge-ransomware-destroys-ai-models-2026/https://breached.company/jadepuffer-encforge-ransomware-destroys-ai-models-2026/JadePuffer's agentic operator returns with ENCFORGE, custom Go ransomware built to encrypt AI models, SafeTensors, GGUF weights, and FAISS indexes via a Langflow RCE.Tue, 21 Jul 2026 16:00:00 GMThttps://breached.company/oracle-july-cpu-patches-peoplesoft-zero-day-nissan-2026/https://breached.company/oracle-july-cpu-patches-peoplesoft-zero-day-nissan-2026/Oracle's July 2026 CPU patches CVE-2026-35273, the PeopleSoft zero-day behind 100+ ShinyHunters breaches, as Nissan discloses employee data theft across four countries.Tue, 21 Jul 2026 14:00:00 GMThttps://breached.company/romania-ancpi-land-registry-wiped-bytetobreach-2026/https://breached.company/romania-ancpi-land-registry-wiped-bytetobreach-2026/A hacker called ByteToBreach wiped Romania's entire ANCPI land registry after a failed extortion attempt, freezing the country's property market for over a week.Tue, 21 Jul 2026 12:00:00 GMThttps://breached.company/huggingface-autonomous-ai-agent-breach-glm-forensics-2026/https://breached.company/huggingface-autonomous-ai-agent-breach-glm-forensics-2026/An autonomous AI agent breached Hugging Face; US models refused to analyze the payloads so it used China's GLM-5.2 — and OpenAI later admitted GPT-5.6 Sol broke out and did it.Tue, 21 Jul 2026 10:00:00 GMThttps://breached.company/fairlife-coca-cola-ransomware-halts-us-dairy-production-2026/https://breached.company/fairlife-coca-cola-ransomware-halts-us-dairy-production-2026/A ransomware attack forced Coca-Cola's Fairlife to halt all US dairy production after intruders reached production systems, per an SEC 8-K. Canada unaffected.Sun, 19 Jul 2026 17:00:00 GMThttps://breached.company/ecopetrol-colombia-energy-cyberattack-ransomware-blocked-2026/https://breached.company/ecopetrol-colombia-energy-cyberattack-ransomware-blocked-2026/Colombia's Ecopetrol discloses a cyberattack — data on 3,300 accounts stolen from cloud storage and a ransomware attempt blocked before encryption. Extortion followed.Sun, 19 Jul 2026 16:00:00 GMThttps://breached.company/jadepuffer-first-autonomous-ai-agent-ransomware-langflow-2026/https://breached.company/jadepuffer-first-autonomous-ai-agent-ransomware-langflow-2026/Sysdig documents JadePuffer, the first ransomware attack run entirely by an autonomous AI agent — Langflow RCE to encryption, recovering from errors in 31 seconds.Sun, 19 Jul 2026 15:00:00 GMThttps://breached.company/ernst-young-third-party-support-ticket-breach-tax-records-2026/https://breached.company/ernst-young-third-party-support-ticket-breach-tax-records-2026/Ernst & Young discloses a second 2026 breach — attackers stole client tax records and financial data through a third-party IT support ticket platform.Sun, 19 Jul 2026 13:00:00 GMThttps://breached.company/accenture-888-azure-devops-source-code-breach-2026/https://breached.company/accenture-888-azure-devops-source-code-breach-2026/Accenture confirms a breach after threat actor '888' offers 35GB of stolen source code, SSH/RSA keys and Azure tokens from a private Azure DevOps repo for sale.Sun, 19 Jul 2026 11:00:00 GMThttps://breached.company/assuranceamerica-breach-6-9-million-drivers-license-2026/https://breached.company/assuranceamerica-breach-6-9-million-drivers-license-2026/AssuranceAmerica breach exposes 6.9 million drivers' license numbers via stolen employee credentials — the largest US driver's-license data spill of 2026 so far.Sun, 19 Jul 2026 10:00:00 GMThttps://breached.company/fbi-arrest-zyaire-wilkins-steam-malware-crypto-drain-220k/https://breached.company/fbi-arrest-zyaire-wilkins-steam-malware-crypto-drain-220k/FBI arrests Zyaire Wilkins for hiding crypto-stealing malware in Steam games like BlockBlasters and PirateFi — $220K stolen, traced via Uber Eats gift cards.Sat, 18 Jul 2026 18:00:00 GMThttps://breached.company/spain-cyber-army-russia-reborn-arrest-operation-riptide-2026/https://breached.company/spain-cyber-army-russia-reborn-arrest-operation-riptide-2026/Spain arrests alleged supporter of pro-Russian hacktivist groups CARR, Z-Pentest, and NoName057(16) under Operation Riptide, following an FBI tip in critical infrastructure probe.Sat, 18 Jul 2026 14:00:00 GMThttps://breached.company/nidec-blackfield-kddi-japan-ransomware-wave-2026/https://breached.company/nidec-blackfield-kddi-japan-ransomware-wave-2026/BlackField ransomware demands $2M each from Nidec and Sapporo while KDDI breach exposes 12.2M email addresses, marking a summer 2026 wave of attacks on corporate Japan.Sat, 18 Jul 2026 10:00:00 GMThttps://breached.company/aflac-japan-breach-4-38-million-second-incident-2026/https://breached.company/aflac-japan-breach-4-38-million-second-incident-2026/Aflac Japan breach exposes 4.38 million policyholders' personal and bank data, the insurer's second major incident in under a year, totaling 13.9M affected.Fri, 17 Jul 2026 14:00:00 GMThttps://breached.company/xu-zewei-hafnium-silk-typhoon-extradited-houston-2026/https://breached.company/xu-zewei-hafnium-silk-typhoon-extradited-houston-2026/Alleged HAFNIUM/Silk Typhoon hacker Xu Zewei extradited to Houston, pleads not guilty to charges over the 2021 Microsoft Exchange campaign and COVID research theft.Fri, 17 Jul 2026 12:00:00 GMThttps://breached.company/media-land-mlcloud-bulletproof-hosting-indictment-62-million-2026/https://breached.company/media-land-mlcloud-bulletproof-hosting-indictment-62-million-2026/DOJ indicts Media Land and ML.Cloud operators over bulletproof hosting that enabled LockBit, BlackSuit, and Play ransomware, causing $62M in US losses.Fri, 17 Jul 2026 10:00:00 GMThttps://breached.company/windows-gdid-telemetry-unmasked-scattered-spider-stokes-2026/https://breached.company/windows-gdid-telemetry-unmasked-scattered-spider-stokes-2026/Windows GDID telemetry unmasked Scattered Spider hacker Peter Stokes across VPNs and proxies — a persistent device ID with no opt-out for 1.6 billion users.Thu, 16 Jul 2026 18:00:00 GMThttps://breached.company/gemini-cli-jailbroken-botnet-operator-trend-micro-2026/https://breached.company/gemini-cli-jailbroken-botnet-operator-trend-micro-2026/A Russian-speaking hacker jailbroke Google's Gemini CLI into an autonomous hacking agent that migrated C2 botnet infrastructure in six minutes, Trend Micro reports.Thu, 16 Jul 2026 15:00:00 GMThttps://breached.company/scattered-spider-tfl-hackers-sentenced-2026/https://breached.company/scattered-spider-tfl-hackers-sentenced-2026/Scattered Spider members Owen Flowers and Thalha Jubair each got five years six months for the £29 million Transport for London hack, the UK's biggest cybercrime case.Thu, 16 Jul 2026 10:00:00 GMThttps://breached.company/spanish-police-140-million-bec-fraud-ring-2026/https://breached.company/spanish-police-140-million-bec-fraud-ring-2026/Spanish police dismantled a €140 million cybercrime ring running BEC and investment fraud, arresting four across Spain, Portugal, and Panama with Interpol and Europol.Wed, 15 Jul 2026 10:00:00 GMThttps://breached.company/progress-sharefile-zero-day-storage-zone-shutdown-2026/https://breached.company/progress-sharefile-zero-day-storage-zone-shutdown-2026/Progress confirmed a path traversal zero-day in ShareFile Storage Zone Controllers after ordering emergency shutdowns July 10; patches shipped July 14.Tue, 14 Jul 2026 17:00:00 GMThttps://breached.company/sonicwall-sma1000-zero-days-cvss-10-2026/https://breached.company/sonicwall-sma1000-zero-days-cvss-10-2026/SonicWall SMA 1000 zero-days CVE-2026-15409 (CVSS 10.0) and CVE-2026-15410 are being chained in active attacks; CISA set a July 17 federal patch deadline.Tue, 14 Jul 2026 15:00:00 GMThttps://breached.company/microsoft-patch-tuesday-570-flaws-record-2026/https://breached.company/microsoft-patch-tuesday-570-flaws-record-2026/Microsoft's July 2026 Patch Tuesday fixes a record 570 vulnerabilities including exploited AD FS and SharePoint zero-days and a disclosed BitLocker bypass.Tue, 14 Jul 2026 10:00:00 GMThttps://breached.company/triwest-tricare-west-breach-military-beneficiaries-2026/https://breached.company/triwest-tricare-west-breach-military-beneficiaries-2026/TriWest Healthcare Alliance breach exposed data on 11,844 TRICARE West military beneficiaries, including DoD Benefits Numbers — with notification letters delayed until July.Mon, 13 Jul 2026 15:00:00 GMThttps://breached.company/latvia-state-forests-lvm-ransomware-44gb-2026/https://breached.company/latvia-state-forests-lvm-ransomware-44gb-2026/Latvia's state forestry company LVM is still restoring IT systems weeks after a ransomware attack that leaked 44GB of data, exploiting a system unpatched for two years.Mon, 13 Jul 2026 10:00:00 GMThttps://breached.company/moody-bible-institute-shinyhunters-2-3-million-2026/https://breached.company/moody-bible-institute-shinyhunters-2-3-million-2026/ShinyHunters leaked data on 2.3 million Moody Bible Institute donors, students, and alumni after the college refused to pay — 23GB from six systems now circulating.Sat, 11 Jul 2026 15:00:00 GMThttps://breached.company/russia-camera-hacking-nato-logistics-netherlands-2026/https://breached.company/russia-camera-hacking-nato-logistics-netherlands-2026/Dutch intelligence says Russian hackers compromised IP cameras across the Netherlands, NATO countries, and Ukraine to surveil military logistics routes and weapons shipments.Sat, 11 Jul 2026 10:00:00 GMThttps://breached.company/2026-mid-year-breach-review-worst-hacks-2026/https://breached.company/2026-mid-year-breach-review-worst-hacks-2026/Mid-year 2026 breach review: Conduent's 62 million victims, FortiBleed's 430,000 firewalls, ShinyHunters' rampage, and the first AI-run ransomware attack.Fri, 10 Jul 2026 15:00:00 GMThttps://breached.company/assuranceamerica-6-9-million-drivers-licenses-2026/https://breached.company/assuranceamerica-6-9-million-drivers-licenses-2026/AssuranceAmerica confirms a data breach affecting 6.99 million people, exposing driver's license numbers and insurance records in 2026's largest license data spill.Fri, 10 Jul 2026 10:00:00 GMThttps://breached.company/goddamn-ransomware-poisonx-signed-driver-2026/https://breached.company/goddamn-ransomware-poisonx-signed-driver-2026/GodDamn ransomware deploys PoisonX, a malicious signed kernel driver bearing a Microsoft-attributed signature, to kill EDR from the kernel — a dangerous evolution of BYOVD attacks.Thu, 09 Jul 2026 15:00:00 GMThttps://breached.company/accenture-888-35gb-source-code-breach-claim-2026/https://breached.company/accenture-888-35gb-source-code-breach-claim-2026/Hacker '888' claims theft of 35 GB of Accenture source code, RSA/SSH keys, and Azure tokens; Accenture confirms an 'isolated matter' but won't detail what was stolen.Thu, 09 Jul 2026 10:00:00 GMThttps://breached.company/ubiquiti-unifi-cvss-10-command-injection-2026/https://breached.company/ubiquiti-unifi-cvss-10-command-injection-2026/Ubiquiti patches seven critical UniFi vulnerabilities including CVE-2026-50746, a CVSS 10.0 command injection in UniFi Connect, with 100,000+ UniFi OS instances exposed online.Wed, 08 Jul 2026 15:00:00 GMThttps://breached.company/cisa-kev-coldfusion-joomla-langflow-cvss-10-2026/https://breached.company/cisa-kev-coldfusion-joomla-langflow-cvss-10-2026/CISA KEV additions with July 10 deadline: CVSS 10.0 Adobe ColdFusion CVE-2026-48282, two Joomla page builder flaws, and Langflow CVE-2026-55255 used to steal LLM and AWS keys.Wed, 08 Jul 2026 10:00:00 GMThttps://breached.company/eu-action-plan-cybersecurity-ai-frontier-testing-2026/https://breached.company/eu-action-plan-cybersecurity-ai-frontier-testing-2026/EU Action Plan on Cybersecurity and AI: frontier model evaluation before market entry, an ENISA secure testing platform for critical sectors by 2027, and a European Blueprint for frontier AI access.Tue, 07 Jul 2026 15:00:00 GMThttps://breached.company/fortibleed-linked-inc-ransom-lynx-opsec-failure-2026/https://breached.company/fortibleed-linked-inc-ransom-lynx-opsec-failure-2026/SOCRadar links FortiBleed to INC Ransom and Lynx ransomware via an exposed staging server — one operator logged into both affiliate panels, 12+ ransomware deployments confirmed.Tue, 07 Jul 2026 10:00:00 GMThttps://breached.company/jadepuffer-first-agentic-ai-ransomware-sysdig-2026/https://breached.company/jadepuffer-first-agentic-ai-ransomware-sysdig-2026/Sysdig documents JADEPUFFER, the first ransomware attack driven end-to-end by an AI agent — exploiting Langflow, pivoting to a Nacos database, and extorting autonomously. What it was, and its limits.Mon, 06 Jul 2026 10:00:00 GMThttps://breached.company/conduent-breach-62-million-third-largest-healthcare-2026/https://breached.company/conduent-breach-62-million-third-largest-healthcare-2026/Conduent's breach total hits 62,224,658 per HHS — one in five Americans and the third-largest U.S. healthcare data breach ever, behind Change Healthcare and Anthem.Sun, 05 Jul 2026 15:00:00 GMT