Cybersecurity breach intelligence, incident response analysis, and data breach case studies for security professionals.https://breached.company/en-ushttps://breached.company/fortibleed-73000-fortinet-firewalls-credentials-exposed-2026/https://breached.company/fortibleed-73000-fortinet-firewalls-credentials-exposed-2026/FortiBleed exposes credentials for 73,932 Fortinet firewalls in 194 countries. Researchers confirm some admin logins still work. What to do now.Wed, 17 Jun 2026 09:00:00 GMThttps://breached.company/steam-workshop-wallpaper-engine-malware-campaign-2026/https://breached.company/steam-workshop-wallpaper-engine-malware-campaign-2026/Kaspersky found dozens of malicious Wallpaper Engine items on Steam Workshop delivering infostealers and stealing Steam credentials. Campaign active since late 2025.Tue, 16 Jun 2026 17:00:00 GMThttps://breached.company/dragonforce-backdoor-turn-microsoft-teams-relay-c2-2026/https://breached.company/dragonforce-backdoor-turn-microsoft-teams-relay-c2-2026/Symantec found Backdoor.Turn, a DragonForce RAT that hides C2 traffic in Microsoft Teams TURN relays — the first in-the-wild abuse of Teams relays for C2.Tue, 16 Jun 2026 13:00:00 GMThttps://breached.company/irhythm-data-breach-cardiac-patient-phi-extortion-2026/https://breached.company/irhythm-data-breach-cardiac-patient-phi-extortion-2026/iRhythm disclosed a breach of patient PHI via a third-party app compromised through social engineering, followed by a ransom demand. Affected count undisclosed.Tue, 16 Jun 2026 09:00:00 GMThttps://breached.company/sniperdz-phishing-as-a-service-takedown-interpol-group-ib-2026/https://breached.company/sniperdz-phishing-as-a-service-takedown-interpol-group-ib-2026/Group-IB and INTERPOL dismantled SniperDz, a nine-year phishing-as-a-service platform with 20,000+ domains. Alleged developer 'Guedz' arrested in Algeria.Mon, 15 Jun 2026 17:00:00 GMThttps://breached.company/infinite-campus-shinyhunters-salesforce-breach-137000-staff-2026/https://breached.company/infinite-campus-shinyhunters-salesforce-breach-137000-staff-2026/ShinyHunters leaked 137,000 Infinite Campus school-staff records stolen from a single Salesforce account. Student academic data was not accessed.Mon, 15 Jun 2026 13:00:00 GMThttps://breached.company/council-of-europe-shinyhunters-peoplesoft-extortion-2026/https://breached.company/council-of-europe-shinyhunters-peoplesoft-extortion-2026/ShinyHunters claims it stole ~297GB of HR and payroll data from the Council of Europe and set a June 16 leak deadline. The body says it is investigating.Mon, 15 Jun 2026 09:00:00 GMThttps://breached.company/novo-nordisk-wegovy-pill-approval-clinical-trial-data-breach-2026/https://breached.company/novo-nordisk-wegovy-pill-approval-clinical-trial-data-breach-2026/Novo Nordisk shares rose ~3% as UK approval of the first daily GLP-1 weight-loss pill eclipsed a same-day breach of de-identified clinical-trial patient data.Sun, 14 Jun 2026 22:00:00 GMThttps://breached.company/mackay-sugar-cyberattack-mills-shutdown-queensland-harvest-2026/https://breached.company/mackay-sugar-cyberattack-mills-shutdown-queensland-harvest-2026/A cyberattack shut Mackay Sugar's Farleigh and Racecourse mills in Queensland mid-harvest, halting milling and ordering growers to stop cutting cane.Sun, 14 Jun 2026 20:00:00 GMThttps://breached.company/wfp-gaza-600000-households-data-breach-humanitarian-2026/https://breached.company/wfp-gaza-600000-households-data-breach-humanitarian-2026/A breach of the UN World Food Programme's registration app exposed data on ~600,000 Gaza households — names, IDs, phones, locations — possibly the largest aid-data theft ever.Sun, 14 Jun 2026 18:00:00 GMThttps://breached.company/great-marlow-school-cyberattack-closure-exams-buckinghamshire-2026/https://breached.company/great-marlow-school-cyberattack-closure-exams-buckinghamshire-2026/Great Marlow School in Buckinghamshire sent most of its 1,428 pupils home for a second day after a suspected malware attack took down its ICT network mid-exams.Sun, 14 Jun 2026 16:00:00 GMThttps://breached.company/nottingham-university-shinyhunters-breach-criminal-probe-2026/https://breached.company/nottingham-university-shinyhunters-breach-criminal-probe-2026/University of Nottingham confirms a criminal probe after ShinyHunters leaked passports, bank details, and addresses of ~454,600 students in a late-May breach.Sun, 14 Jun 2026 14:00:00 GMThttps://breached.company/rabideau-klein-first-horizon-17-million-escrow-wire-fraud-lawsuit-2026/https://breached.company/rabideau-klein-first-horizon-17-million-escrow-wire-fraud-lawsuit-2026/Palm Beach firm Rabideau Klein sues First Horizon Bank after $17.3M vanished from escrow in 13 wire transfers enabled by a social-engineered token reset.Sun, 14 Jun 2026 12:00:00 GMThttps://breached.company/handala-california-water-bakersfield-cyberattack-iran-retaliation-2026/https://breached.company/handala-california-water-bakersfield-cyberattack-iran-retaliation-2026/Iran-linked Handala claims it breached California Water Service billing systems in Bakersfield, Visalia, and Chico, citing retaliation for U.S. strikes at Sirik.Sun, 14 Jun 2026 10:00:00 GMThttps://breached.company/iran-four-banks-cyberattack-black-wolves-disruption-2026/https://breached.company/iran-four-banks-cyberattack-black-wolves-disruption-2026/A cyberattack disrupted four Iranian banks — Melli, Tejarat, Saderat, and EDBI — taking down ATMs and card payments. Black Wolves claimed it; no data leaked.Sun, 14 Jun 2026 08:00:00 GMThttps://breached.company/delaware-north-data-breach-new-hampshire-residents-2026/https://breached.company/delaware-north-data-breach-new-hampshire-residents-2026/Delaware North breach exposed driver's license and state ID numbers for 10,000+ people, including 1,133 NH residents, after a compromised Microsoft account.Sat, 13 Jun 2026 17:00:00 GMThttps://breached.company/st-george-fire-district-sues-general-informatics-cyberattack-negligence-2026/https://breached.company/st-george-fire-district-sues-general-informatics-cyberattack-negligence-2026/St. George Fire Protection District sues vendor General Informatics over a 2023 breach, alleging plaintext passwords, no backups, and reused credentials.Sat, 13 Jun 2026 15:00:00 GMThttps://breached.company/atomic-arch-aur-supply-chain-attack-rootkit-infostealer-2026/https://breached.company/atomic-arch-aur-supply-chain-attack-rootkit-infostealer-2026/Atomic Arch backdoored 400+ Arch Linux AUR packages with a Rust infostealer and eBPF rootkit via a malicious npm dependency. Here's what happened and how to respond.Sat, 13 Jun 2026 13:00:00 GMThttps://breached.company/murray-county-georgia-pays-200000-ransomware-2026/https://breached.company/murray-county-georgia-pays-200000-ransomware-2026/Murray County, Georgia paid $200,000 to ransomware attackers after a May 13 breach hit tax and court systems, choosing payment to prevent data publication.Sat, 13 Jun 2026 11:00:00 GMThttps://breached.company/policing-cybersecurity-911-ransomware-axon-flock-ai-dispatch-2026/https://breached.company/policing-cybersecurity-911-ransomware-axon-flock-ai-dispatch-2026/How ransomware on 911 centers, surveillance-vendor breaches (Axon, Flock, LAPD), and the rise of AI dispatch are reshaping policing's 2026 attack surface.Sat, 13 Jun 2026 09:00:00 GMThttps://breached.company/dragonforce-cartel-june-2026-global-victims-areco-hong-kong-parkview-2026/https://breached.company/dragonforce-cartel-june-2026-global-victims-areco-hong-kong-parkview-2026/DragonForce posts June 2026 victims across Sweden, Hong Kong, and the UAE, extending its white-label ransomware cartel beyond 2025 UK retail attacks.Fri, 12 Jun 2026 10:00:00 GMThttps://breached.company/shinyhunters-oracle-peoplesoft-zero-day-cve-2026-35273-universities-2026/https://breached.company/shinyhunters-oracle-peoplesoft-zero-day-cve-2026-35273-universities-2026/ShinyHunters exploited Oracle PeopleSoft zero-day CVE-2026-35273 (CVSS 9.8) to breach 100+ orgs, mostly universities; Nottingham confirms ~455K records.Thu, 11 Jun 2026 14:00:00 GMThttps://breached.company/audia6-crypto-laundering-takedown-europol-336-million-2026/https://breached.company/audia6-crypto-laundering-takedown-europol-336-million-2026/Europol dismantled AudiA6, a crypto-laundering service that washed €336M+ for ransomware gangs since 2021; two admins arrested in Georgia.Thu, 11 Jun 2026 09:00:00 GMThttps://breached.company/the-gentlemen-ransomware-krebs-attribution-yapaev-2026/https://breached.company/the-gentlemen-ransomware-krebs-attribution-yapaev-2026/Krebs links The Gentlemen ransomware operator to Alexander Yapaev of Izhevsk, Russia (handle Hastalamuerte); group ranks #2 by 2026 victim count.Wed, 10 Jun 2026 10:00:00 GMThttps://breached.company/servicenow-unauthenticated-api-customer-data-exposure-2026/https://breached.company/servicenow-unauthenticated-api-customer-data-exposure-2026/ServiceNow patched an unauthenticated REST API flaw that let users query customer instance data; no CVE assigned, affected instance count undisclosed.Tue, 09 Jun 2026 13:00:00 GMThttps://breached.company/qilin-check-point-vpn-zero-day-cve-2026-50751-cisa-emergency-directive-2026/https://breached.company/qilin-check-point-vpn-zero-day-cve-2026-50751-cisa-emergency-directive-2026/Qilin exploited Check Point VPN zero-day CVE-2026-50751 (CVSS 9.3); CISA gave federal agencies three days to patch by June 11, 2026.Tue, 09 Jun 2026 09:00:00 GMThttps://breached.company/stuxnet-unit-8200-israel-cybersecurity-ecosystem-venture-capital-2026/https://breached.company/stuxnet-unit-8200-israel-cybersecurity-ecosystem-venture-capital-2026/From Stuxnet to Wiz's $32B exit: how Israel's Unit 8200 became the backbone of global cybersecurity — and why the Pentagon now calls it a 'critical' threat.Sun, 07 Jun 2026 17:00:00 GMThttps://breached.company/hezbollah-pager-explosion-operation-grim-beeper-supply-chain-attack/https://breached.company/hezbollah-pager-explosion-operation-grim-beeper-supply-chain-attack/How Mossad's Operation Grim Beeper booby-trapped Hezbollah's pagers and walkie-talkies via a years-long supply-chain front — the definitive breakdown.Sun, 07 Jun 2026 12:00:00 GMThttps://breached.company/dia-israel-counterintelligence-critical-spyware-us-officials-2026/https://breached.company/dia-israel-counterintelligence-critical-spyware-us-officials-2026/The DIA raised Israel's counterintelligence threat to 'critical' after spyware was found on U.S. officials' phones — its highest rating for any ally. Inside the espionage row.Sun, 07 Jun 2026 00:00:00 GMThttps://breached.company/charter-spectrum-shinyhunters-vishing-salesforce-breach-2026/https://breached.company/charter-spectrum-shinyhunters-vishing-salesforce-breach-2026/Charter Communications (Spectrum) confirms a ShinyHunters breach via a vishing attack on a Microsoft Entra account; HIBP lists 4.9M email addresses exposed.Sat, 06 Jun 2026 14:00:00 GMThttps://breached.company/lithuania-centre-of-registers-breach-600000-records-migration-credentials-2026/https://breached.company/lithuania-centre-of-registers-breach-600000-records-migration-credentials-2026/Lithuania investigates theft of 600,000+ Centre of Registers records via compromised Migration Department credentials, with officials suspecting Russian intelligence.Sat, 06 Jun 2026 11:30:00 GMThttps://breached.company/http2-bomb-cve-2026-49975-remote-dos-nginx-apache-iis-envoy-pingora-2026/https://breached.company/http2-bomb-cve-2026-49975-remote-dos-nginx-apache-iis-envoy-pingora-2026/HTTP/2 Bomb (CVE-2026-49975) is a remote DoS in NGINX, Apache, IIS, Envoy and Cloudflare Pingora discovered by OpenAI Codex. Patches, mitigations and impact.Sat, 06 Jun 2026 09:00:00 GMThttps://breached.company/meta-ai-support-bot-instagram-account-takeover-2026/https://breached.company/meta-ai-support-bot-instagram-account-takeover-2026/Hackers tricked Meta's AI support bot into hijacking high-profile Instagram accounts, including the Obama White House account, by asking it to reset passwords. Here's how.Fri, 05 Jun 2026 00:00:00 GMThttps://breached.company/doj-scam-center-strike-force-disruption-week-2026/https://breached.company/doj-scam-center-strike-force-disruption-week-2026/DOJ's Scam Center Strike Force and tech giants disrupted 1.4M scam accounts and froze $3.8M in crypto in a coordinated strike on Southeast Asian pig-butchering rings.Thu, 04 Jun 2026 00:00:00 GMThttps://breached.company/aleksei-volkov-yanluowang-initial-access-broker-sentenced-2026/https://breached.company/aleksei-volkov-yanluowang-initial-access-broker-sentenced-2026/Russian initial access broker Aleksei Volkov, who fed dozens of US networks to the Yanluowang ransomware crew, sentenced to 81 months and $9.16M restitution.Wed, 03 Jun 2026 00:00:00 GMThttps://breached.company/noah-christopher-fluxstress-netdowner-ddos-bangkok-arrest-2026/https://breached.company/noah-christopher-fluxstress-netdowner-ddos-bangkok-arrest-2026/German national Noah Christopher, operator of the Fluxstress and Netdowner DDoS-for-hire platforms, arrested in Bangkok on 74 warrants and facing extradition to Germany.Tue, 02 Jun 2026 00:00:00 GMThttps://breached.company/may-2026-ransomware-report-646-victims-qilin-2026/https://breached.company/may-2026-ransomware-report-646-victims-qilin-2026/May 2026 ransomware: 646 victims, down 16% — the year's lowest month. Qilin #1 for the fifth month, TheGentlemen #2, manufacturing the top sector. Full breakdown.Mon, 01 Jun 2026 00:00:00 GMThttps://breached.company/llm-agent-post-exploitation-marimo-cve-2026-39987-sysdig-2026/https://breached.company/llm-agent-post-exploitation-marimo-cve-2026-39987-sysdig-2026/Sysdig documented the first in-the-wild LLM agent post-exploitation attack: CVE-2026-39987 Marimo RCE to PostgreSQL database exfiltration in 4 automated pivots and under 2 minutes.Fri, 29 May 2026 12:00:00 GMThttps://breached.company/greyvibe-russian-apt-ukraine-ai-withsecure-2026/https://breached.company/greyvibe-russian-apt-ukraine-ai-withsecure-2026/WithSecure attributed GREYVIBE — a new Russian-linked APT using ChatGPT and Gemini to attack Ukraine — targeting military, government, and civilian organizations since August 2025.Fri, 29 May 2026 00:00:00 GMThttps://breached.company/carnival-cruise-shinyhunters-6-million-breach-2026/https://breached.company/carnival-cruise-shinyhunters-6-million-breach-2026/Carnival Corporation confirmed ShinyHunters breached 5.99 million customers in April 2026 via social engineering. Passport numbers and government IDs exposed. Notifications sent May 28.Thu, 28 May 2026 00:00:00 GMThttps://breached.company/forticlient-ems-cve-2026-35616-ekz-infostealer-2026/https://breached.company/forticlient-ems-cve-2026-35616-ekz-infostealer-2026/FortiClient EMS CVE-2026-35616 (CVSS 9.1) is being actively exploited to deliver EKZ Infostealer disguised as a Fortinet update. CISA KEV listed. Patch immediately.Wed, 27 May 2026 12:00:00 GMThttps://breached.company/ghost-cms-cve-2026-26980-clickfix-700-websites-2026/https://breached.company/ghost-cms-cve-2026-26980-clickfix-700-websites-2026/CVE-2026-26980: A CVSS 9.4 SQL injection in Ghost CMS allowed attackers to compromise 700+ sites including Harvard and Oxford with ClickFix malware. Patch immediately.Wed, 27 May 2026 00:00:00 GMThttps://breached.company/trapdoor-supply-chain-npm-pypi-crates-credential-stealer-2026/https://breached.company/trapdoor-supply-chain-npm-pypi-crates-credential-stealer-2026/TrapDoor supply chain attack hit npm, PyPI, and Crates.io with 34 malicious packages that steal crypto wallets, SSH keys, and poison CLAUDE.md files to manipulate AI coding assistants.Tue, 26 May 2026 12:00:00 GMThttps://breached.company/fbi-silent-ransom-group-law-firms-in-person-attack-2026/https://breached.company/fbi-silent-ransom-group-law-firms-in-person-attack-2026/FBI FLASH alert: Silent Ransom Group is physically sending operatives into law firm offices posing as IT staff. 38+ firms breached, 100+ total attacks in an escalating extortion campaign.Tue, 26 May 2026 00:00:00 GMThttps://breached.company/alphv-blackcat-us-cybersecurity-pros-guilty-plea-2026/https://breached.company/alphv-blackcat-us-cybersecurity-pros-guilty-plea-2026/A Sygnia incident responder and DigitalMint ransomware negotiator pleaded guilty to running ALPHV/BlackCat attacks against US hospitals. Both face 20 years for attacking the victims they were supposed to help.Mon, 25 May 2026 15:00:00 GMThttps://breached.company/sicoob-nuget-supply-chain-attack-brazil-banking-2026/https://breached.company/sicoob-nuget-supply-chain-attack-brazil-banking-2026/A malicious NuGet package impersonated the Sicoob banking SDK to steal PFX certificates and Pix credentials from Brazilian fintech developers. ~500 downloads before takedown.Mon, 25 May 2026 12:00:00 GMThttps://breached.company/trellix-source-code-breach-ransomhouse-2026/https://breached.company/trellix-source-code-breach-ransomhouse-2026/RansomHouse hacked Trellix, stealing source code from the cybersecurity firm's repository. The April 2026 breach affects 53,000+ customers across 185 countries.Mon, 25 May 2026 00:00:00 GMThttps://breached.company/kimwolf-jacob-butler-update-dod-targeting-canadian-charges-may26-hearing/https://breached.company/kimwolf-jacob-butler-update-dod-targeting-canadian-charges-may26-hearing/Kimwolf update: Jacob Butler faces both US and Canadian charges, a May 26 custody hearing, and newly disclosed DOJ details confirm Kimwolf customers targeted US Department of Defense networks.Sun, 24 May 2026 00:00:00 GMThttps://breached.company/laravel-lang-supply-chain-attack-composer-700-versions-2026/https://breached.company/laravel-lang-supply-chain-attack-composer-700-versions-2026/A supply chain attack on May 22–23 poisoned 700+ historical release tags across four Laravel-Lang Composer packages, delivering a credential stealer that activates on install across PHP environments.Sat, 23 May 2026 12:00:00 GMThttps://breached.company/panasonic-avionics-coinbasecartel-data-breach-2026/https://breached.company/panasonic-avionics-coinbasecartel-data-breach-2026/CoinbaseCartel claims Panasonic Avionics Corporation in its latest data exfiltration breach, now totaling 118 victims. The group never encrypts — making conventional ransomware defenses useless against it.Sat, 23 May 2026 00:00:00 GMT