Breaches & attacks

Dashlane ◐Partly patched

Beginning May 31 2026 attackers brute-forced six-digit 2FA codes to register new devices on Dashlane accounts and downloaded encrypted vaults for fewer than 20 personal accounts. Dashlane said its own systems were not compromised and worked with affected customers.

Instructure Canvas (Free-for-Teacher) ◐Partly patched

In May 2026 Instructure confirmed a security incident involving Canvas Free-for-Teacher after ShinyHunters claimed theft of data tied to hundreds of millions of users. Exposed data included names, emails, student IDs and some private messages; Instructure said it had no evidence passwords or financial/government IDs were taken.

Anthropic Claude Mythos Preview (vendor environment) –No fix needed

In April 2026 Anthropic said it was investigating reports that unauthorized users accessed its unreleased vulnerability-discovery tool Claude Mythos Preview through a third-party vendor environment rather than a direct Anthropic system compromise (Bloomberg / CRN reporting).

Stryker corporate Microsoft / endpoint environment –No fix needed

In March 2026 medical-tech company Stryker suffered a disruptive attack on its Microsoft environment. Iran-linked Handala claimed responsibility, alleging mass device wipes after domain-admin compromise. CISA warned organizations to harden endpoint management. Stryker reported being fully operational by early April.

LexisNexis Legal & Professional (legacy systems / React frontend claim)

In March 2026 LexisNexis confirmed a breach of legacy servers exposing customer business contact and related data. Threat actor FulcrumSec claimed access via an unpatched React frontend “React2Shell” (CVE-2025-55182) into AWS infrastructure. LexisNexis said the matter was contained and mostly deprecated pre-2020 data.

Ivanti EPMM deployments (EU institutions)

February 2026: European Commission and Dutch DPA/Judicial Council confirmed breaches through critical Ivanti Endpoint Manager Mobile zero-days. Dutch incident exposed work contact data; Commission said it contained its breach within nine hours.

Singapore major telecom providers ◐Partly patched

In February 2026 Singapore’s CSA revealed China-linked UNC3886 had breached all four major telecom providers in a months-long espionage campaign using zero-days and rootkits. Singapore ran operation CYBER GUARDIAN to evict the actors.

Crunchbase –No fix needed

In January 2026 ShinyHunters targeted Crunchbase and later published more than 2 million records after ransom refusal, including names, contacts, addresses and internal documents.

Mixpanel (analytics vendor); OpenAI API platform users –No fix needed

Mixpanel detected a smishing campaign on November 8, 2025 that led to an export of some customers' analytics data. OpenAI said limited API-platform user data was exposed (names, emails, coarse location, browser/OS, org and user IDs), but no chats, prompts, API keys, passwords or payment data. OpenAI removed Mixpanel from production.

Discord customer support (third-party vendor / ticketing) –No fix needed

An attacker got into a third-party customer-service system Discord used, exposing data of users who had contacted Support or Trust & Safety. About 70,000 users may have had government ID photos (from age-verification appeals) accessed. Discord named the vendor as 5CA, which denied its systems were hacked.

Red Hat Consulting self-managed GitLab –No fix needed

The Crimson Collective broke into a self-managed GitLab instance used by Red Hat Consulting and claimed about 570 GB from 28,000 repos, including roughly 800 Customer Engagement Reports with infrastructure, config and credential details. Red Hat confirmed the access and said its products, supply chain and hosted services were not affected. ShinyHunters later joined the extortion.

Asahi Group Holdings (Japan operations) –No fix needed

A ransomware attack on September 29, 2025 stopped Asahi Group's order processing, shipments and call centres in Japan and briefly halted its six Japanese beer plants. Asahi confirmed ransomware and possible data theft; Qilin claimed the attack and leaked files it said were stolen.

Collins Aerospace MUSE (airport check-in and boarding) –No fix needed

Ransomware hit RTX's Collins Aerospace MUSE passenger-processing software on September 19, 2025, breaking electronic check-in, bag drop and boarding at several European airports. Airports fell back to manual check-in and handwritten boarding passes; Brussels was still disrupted days later. ENISA confirmed it was ransomware.

SonicWall MySonicWall cloud backup –No fix needed

SonicWall and Mandiant confirmed that a state-sponsored actor used an API call to pull firewall configuration backup files for all customers using MySonicWall cloud backup, after first saying fewer than 5% were affected. The files include credentials and network details, so customers had to reset firewall, VPN, directory and API secrets.

Ingram Micro (Xvantage, Impulse, ordering systems) –No fix needed

SafePay ransomware hit IT distributor Ingram Micro around July 3, 2025, taking down its website, ordering systems, the Xvantage platform and Impulse licensing. Ingram Micro took systems offline and restored order processing globally by July 9-10.

Qantas contact-centre (third-party platform) –No fix needed

A cyber criminal accessed a third-party customer-service platform used by a Qantas contact centre. After deduplication, 5.7M unique customers were affected: names, emails, frequent-flyer details, and for some phone numbers, birth dates, addresses, gender and meal preferences. No passwords, PINs, card or passport data were taken.

Salesforce customer instances (social engineering, not a Salesforce vulnerability) –No fix needed

UNC6040 phoned employees posing as IT support and talked them into authorizing a modified Salesforce Data Loader app, then bulk-exported their Salesforce data. Google's own corporate Salesforce instance (prospective Ads customer contacts) was hit in June 2025. Extortion followed under the ShinyHunters name (UNC6240).

Coinbase customer support systems –No fix needed

Criminals bribed overseas support staff to pull customer data (names, contact details, partial financial data, ID images, balances and transactions), then demanded $20M. Coinbase refused, offered a matching bounty, and estimated $180M to $400M in costs. No passwords, private keys or funds were accessed directly.

Marks & Spencer (retail IT, VMware ESXi) –No fix needed

Scattered Spider got in through social engineering of a third-party IT provider and encrypted M&S's VMware ESXi hosts with DragonForce ransomware over Easter 2025. Contactless payments, Click & Collect and online ordering broke; online orders were paused from April 25 to June 10. M&S put the hit at about £300M of operating profit.

Oracle Cloud Classic (Gen 1) login/IDM servers –No fix needed

A hacker using the name rose87168 claimed in March 2025 to have stolen about 6 million SSO and LDAP records from Oracle Cloud login servers. Oracle first denied an OCI breach, then told customers privately that two obsolete servers (reportedly Oracle Cloud Classic / Gen 1) were accessed, exposing usernames and hashed or encrypted passwords.

DeepSeek backend (ClickHouse)

Wiz found two DeepSeek ClickHouse instances open to the internet without authentication. Its query interface allowed arbitrary SQL and exposed a log_stream table with over a million entries, including plaintext chat history, API keys and backend details. DeepSeek locked it down within an hour of being told.

US telecommunications carriers –No fix needed

PRC-affiliated actors (publicly called Salt Typhoon) compromised networks at multiple US telecommunications companies. The FBI and CISA said they stole customer call records, got into the private communications of a limited number of people mainly involved in government or political activity, and copied information subject to US law enforcement wiretap requests. Allied agencies then published hardening guidance for communications infrastructure.

Internet Archive (archive.org) –No fix needed

Attackers defaced archive.org with a JavaScript alert and stole a 6.4GB user authentication database: 31 million unique email addresses, screen names and bcrypt-hashed passwords. The newest record was from 2024-09-28. The data was shared with Have I Been Pwned. Around the same time the site was knocked offline by DDoS attacks.

National Public Data –No fix needed

Data stolen from background-check broker National Public Data, nearly 2.7 billion plaintext records with names, mailing addresses and Social Security numbers of people in the US, was leaked for free on a hacking forum. It had first been offered for sale in April 2024 by an actor called USDoD.

Hugging Face Spaces –No fix needed

Hugging Face detected unauthorized access to its Spaces platform, specifically Spaces secrets, and suspected a subset had been read. It revoked affected HF tokens, emailed impacted users, removed org tokens, moved Spaces secrets to a KMS, and told users to rotate keys and switch to fine-grained tokens.

Dropbox Sign –No fix needed

A threat actor got into the Dropbox Sign (formerly HelloSign) production environment through a compromised service account in an automated system-configuration tool. It accessed customer emails, usernames, phone numbers, hashed passwords, API keys, OAuth tokens and MFA data. Dropbox reset passwords, logged users out and coordinated rotation of all API keys and OAuth tokens. It found no access to documents or payment information.

Microsoft corporate email (Microsoft 365) –No fix needed

Russia's Midnight Blizzard (APT29) password-sprayed a legacy, non-production Microsoft test tenant without MFA, then abused an OAuth app to read email of Microsoft senior leadership and security staff. Microsoft detected the attack on 2024-01-12. Stolen emails included correspondence with US federal agencies, so CISA issued Emergency Directive 24-02 ordering agencies to analyze the exposed emails and reset any compromised credentials.

Cloudflare internal Atlassian environment –No fix needed

A suspected nation-state attacker used one access token and three service account credentials stolen in the October Okta breach, which Cloudflare had failed to rotate, to get into Cloudflare's Atlassian Confluence, Jira and Bitbucket. Cloudflare said customer data and systems were not affected.

Xfinity (Comcast)

Comcast's Xfinity said attackers used Citrix Bleed (CVE-2023-4966) on its NetScaler devices between Oct 16 and 19, 2023, before mitigation, and took usernames and hashed passwords. Some customers also lost names, contact details, last four SSN digits, birth dates and security questions. A Maine filing put the count at 35,879,455.

23andMe –No fix needed

Attackers used reused passwords to log into about 14,000 23andMe accounts, then scraped the DNA Relatives profiles those accounts could see. Data on about 6.9 million people was exposed and sold on hacking forums.

Retool (cloud) –No fix needed

An attacker phished a Retool employee by SMS, then called them with a deepfaked voice to get an MFA code. Because Google Authenticator synced codes to the employee's Google account, the attacker got their MFA codes too, and took over 27 cloud customer accounts, all in crypto.

JumpCloud (directory / device management SaaS) –No fix needed

A spear-phishing attack let a nation-state actor into JumpCloud's infrastructure. The attacker abused its command framework to target a small set of customers. JumpCloud force-rotated all customer API keys, and researchers tied the attack to North Korea, aimed at crypto companies.

Microsoft Azure Storage (SAS token in a GitHub repo)

A public GitHub repo of Microsoft AI training models shared an Azure Storage SAS token with full-control permissions on a whole storage account. It exposed 38TB of internal data, including workstation backups, secrets and Teams messages. Wiz found and reported it.

T-Mobile US –No fix needed

T-Mobile said an attacker had abused a single API since around Nov 25, 2022. They pulled names, billing addresses, emails, phone numbers, birth dates and plan details for about 37 million accounts until T-Mobile detected it on Jan 5, 2023.