September 2026 Data Breaches (So far)
31 Aug 2026
Top data breaches of September 2026
Last month was a month of supply chain attacks, and breaches claimed by individual hackers like TheHatman, who listed some of the big names like McDonald’s, Tata Consultancy Services, Vodafone, and Gap.
Massive supply chain breaches like Beacon CRN affected thousands of organizations globally.
As cybercriminals continue to change their tactics and use AI to become more unpredictable, persistent, and undetectable, organizations face bidirectional pressure to improve resilience and compliance.
Here is a look at some of the top data breaches of September 2026:
September latest data breach news
Let us look at some of the top data breaches of September 2026:
Victim: Dyfed-Powys Police
About
Dyfed-Powys Police is Wales’ police force that covers the Ceredigion, Carmarthenshire, Pembrokeshire and Powys counties of the country. It was formed in 1968 and is the third largest police force in the United Kingdom.
Industry
Public sector
What happened?
On September 14, Dyfed-Powys Police discovered that it had become a victim of a cyber attack that caused disruption to its operations and systems.
Impact
The cyber attack disrupted its non-emergency systems and exposed data belonging to staff. The complete impact of the incident is currently under investigation.
Source
Victim: Keio Corporation
About
Keio Corporation is a Tokyo-based private railway operator that was founded in 1948. It is known for its vast railway network that connects Western Tokyo and Sagamihara with Central Tokyo.
Industry
Railway
What happened?
Keio Corporation Group became a victim of a ransomware attack on September 26 that forced it to take some of its systems offline.
Impact
The complete impact of the cyberattack is currently under investigation.
Source
Victim: Times Car
About
Times Car is a car rental service in Japan that offers a range of car models for rent across Japan, including Tokyo, Hokkaido, Okinawa, and Kyoto.
Industry
Car rental
What happened?
On September 25, Times Car reported unauthorized access to its systems and exposure of its data.
Impact
The data breach has exposed data from ~6.6 million user accounts, including full name, physical address, date of birth, department name for corporate members, driver’s license information, identity verification document information, account password, and linked service IDs.
Source
Victim: Dodo Pizza
About
Dodo Pizza is a restaurant chain that was founded in 2011 in Kazakhstan. It operates in over 1500 locations across 29 countries.
Industry
Restaurant
What happened?
Dodo Pizza confirmed that it became a target of a cyberattack that affected its IT systems and exposed its customers.
Impact
The cyberattack exposed data of 68 million users, including their full names, physical addresses, dates of birth, order history, email addresses, and phone numbers.
Source
Victim: SurfShark
About
SurfShark is a Netherlands-based cybersecurity company that was founded in 2018. It is known for its VPN product and its data leak detection system called Alert.
Industry
Cryptocurrency
What happened?
SurfShark reported that it confirmed it detected and contained unauthorized access to its internal servers.
Impact
The nature and quantity of data exposed and the impact of the cyberattack are currently under investigation.
Source
Victim: Bitget
About
Bitget is a cryptocurrency exchange that is registered in Seychelles and was founded in 2018. It is known for its cryptocurrency exchange platform.
Industry
Cryptocurrency
What happened?
On September 24, Bitget’s exchange wallet infrastructure was hacked, and cryptocurrency was stolen from it. It is the largest cryptocurrency theft reported in 2026 so far.
Impact
The company suffered estimated losses of US$387.5 million due to the hack.
Source
Victim: Simba Telecom
About
SIMBA Telecom Pte. Ltd. is a Techview-based telecommunications company that was founded in 2016. It is known for its mobile and fibre broadband services.
Industry
Telecommunications
What happened?
SIMBA Telecom became a victim of a data breach that exposed the personal information of its customers.
Impact
Personal information of 23,549 people has been exposed, including names, dates of birth, mobile numbers, and email addresses.
Source
Victim: Qbusoft
About
Qbusoft is a Gdansk-based software publisher that was founded in 2018. It is known for its software publishing, data processing, hosting, and related services.
Industry
Software
What happened?
On 25 September, Qbusoft reported that on 8th September, it discovered unauthorized access to its systems.
Impact
The data exposed includes names, home addresses, phone numbers, PESEL numbers, and email addresses. The number of records exposed is currently under investigation. Multiple associated organizations, such as the Addiction and Psychiatric Treatment Center, were affected by the breach.
Source
Victim: Charles Keith
About
Charles & Keith Pte. Ltd. is a Tai Seng Link-based fashion label that is known for its handbags, footwear, and fashion accessories. It operates in 37 countries through more than 600 stores.
Industry
Fashion
What happened?
On 24 September, Charles & Keith reported that they discovered unauthorized access to their systems that affected some of their servers.
Impact
The nature and quantity of data exposed are currently under investigation.
Source
Victim: Guardrisk
About
Guardrisk is a Sandton-based insurance company that was founded in 1993. It is known for its cell captive insurance services
Industry
Insurance
What happened?
Guardrisk became a target of a ransomware attack that was orchestrated by the TheGentlemen ransomware group.
Impact
The nature and quantity of data exposed are currently under investigation.
Source
Victim: Hogan Lovells Cadwalader
About
Hogan Lovells Cadwalader is a London-based law firm that was founded in 2026 as a result of a merger between Hogan Lovells and Cadwalader, Wickersham & Taft.
Industry
Legal
What happened?
Hogan Lovells Cadwalader became a target of a ransomware attack carried out by the Silent Ransom Group.
Impact
The nature and quantity of data exposed are currently under investigation.
Source
Victim: FBI
About
The Federal Bureau of Investigation is a primary federal law enforcement agency of the United States Department of Justice that was founded in 1908. It is the leading organization known for its criminal investigation, counterterrorism, and counterintelligence.
Industry
Public sector
What happened?
The ShinyHunters ransomware group claimed to have stolen terabytes of data from the FBI by exploiting a zero-day flaw in Oracle PeopleSoft server.
Impact
The nature and quantity of data exposed are currently under investigation.
Source
Victim: Fresenius Medical Care
About
Fresenius Medical Care AG & Co. KGaA is a healthcare organization based in Bad Homburg vor der Höhe. It was founded in 1996 and is known for its kidney dialysis services.
Industry
Healthcare
What happened?
Fresenius Medical Care became a target of a ransomware attack that was orchestrated by the ShinyHunters ransomware group.
Impact
The nature and quantity of data stolen are currently under investigation.
Source
Victim: Master of Malts
About
Master of Malts is a Kent-based supplier of premium spirits that was founded in 1985. It is known for its spirits, including whisky, rum, tequila, and vodka.
Industry
Online Retail
What happened?
Ribon, an app connected to the Master of Malts store on BigCommerce, was breached.
Impact
The company reported that customers’ names, email addresses, phone numbers, and addresses have been exposed in the data breach. The quantity of data exposed is currently under investigation.
Source
Victim: Spokane Public Schools
About
Spokane Public Schools is a Washington-based public school district that was founded in 1889. It includes seven high schools, 34 elementary schools, and six middle schools.
Industry
Education
What happened?
Spokane Public Schools reported that on September 21, it experienced a network security incident that forced it to take several of its systems offline.
Impact
The complete impact of the incident is currently under investigation.
Source
Victim: Ikegami Tsushinki
About
Ikagami Tsushinki is a Tokyo-based manufacturing company that was founded in 1948. It is known for the manufacturing of professional and broadcast television equipment.
Industry
Manufacturing
What happened?
Ikegami Tsushinki became a victim of a ransomware attack that was orchestrated by the Qilin ransomware group.
Impact
The exact nature and quantity of data exposed are currently under investigation.
Source
Victim: The Money Store
About
The Money Store is a New Jersey-based residential mortgage lending company that was founded in 1967. It is owned by MLD Mortgage Inc.
Industry
Mortgage
What happened?
The Money Store became a victim of a ransomware attack that was carried out by the Storm 1101 ransomware group.
Impact
The exact nature and quantity of data exposed are currently under investigation.
Source
Victim: Arizona Vascular Medical Equipment
About
Arizona Vascular Medical Equipment is a Mesa-based healthcare organization that is known for its compression therapy, wound healing, patient education, and home medical equipment.
Industry
Healthcare
What happened?
Arizona Vascular Medical Equipment became a target of a ransomware attack that was orchestrated by the Dragonforce ransomware group.
Impact
The nature and quantity of data exposed are currently under investigation.
Source
Victim: Elite Industech
About
Elite Industech Co. Ltd. is a Taiwan-based organization that was founded in 2003. It is known for its waste treatment plant and its electronic waste processing and rare & precious metal recycling services.
Industry
Waste treatment
What happened?
Elite Industech became a target of a ransomware attack that was orchestrated by the Dragonforce ransomware group.
Impact
The nature and quantity of data exposed are currently under investigation.
Source
Victim: CMC Chartered Accountant
About
CMC Expertise is a French Accountancy firm that is known for its accountancy, taxation, and legal services.
Industry
Consultancy
What happened?
CMC Expertise became a target of a ransomware attack that was orchestrated by the Dragonforce ransomware group.
Impact
The group has claimed to have stolen 210 GB of data. The nature and quantity of data exposed are currently under investigation.
Source
Victim: Elsevier
About
Elsevier Inc. is an Amsterdam-based company that was founded in 1880. It is known for Dutch academic publishing and specializes in scientific, technical, and medical content.
Industry
Data analytics
What happened?
Elsevier Inc. became a victim of a cyberattack that redirected visitors from Elsevier’s website, the Evolve education portal, and a manuscript submission portal to the LAPSUS$ group’s page.
Impact
It disrupted operations across multiple universities, including Truman State, Grand Canyon University, and WGU.
Source
Victim: Direct Communications
About
Direct Communication is an Utah based internet service provider that is known for its affordable fiber optic interenet services.
Industry
Internet services
What happened?
Direct Communications was hit by a cyberattack that disrupted internet services across Eagle Mountain.
Impact
The attack disrupted internet services, affecting phone/billing systems and other operations across the city, which forced multiple organizations to close their services, including City Hall.
Source
Victim: The Well Outreach
About
The Well Outreach is a Tennessee-based non-profit organization that was founded in 2006. It is known for its food assistance and community support services through its food pantries, mobile food pantries, student meal programs, and family coaching services.
Industry
Non-profit
What happened?
The Well Outreach became a target of a cyberattack through the compromise of two of its Microsoft email accounts.
Impact
The complete impact of the cyber attack is currently under investigation.
Source
Victim: Mississippi Public University
About
The Mississippi Institutions of Higher Learning is a group of public universities comprising the state’s eight public universities and 23 satellite centers of the state.
Industry
Education
What happened?
Mississippi Institutions of Higher Learning reported on 10 September that it experienced a network security incident that disrupted its student financial aid office.
Impact
The cyberattack forced its student financial aid office to shut down its operations.
Source
Victim: Wyoming Court
About
The Wyoming Judicial Branch is a government organization that was founded in the 1860s and is responsible for administering justice in Wyoming.
Industry
Public sector
What happened?
The Wyoming Judicial Branch discovered that it was hit by a cyberattack that forced it to shut down some of its systems.
Impact
The cyberattack exposed some of the court’s user data, including historical data from retired case management systems of the Wyoming Supreme Court and district courts.
Source
Victim: Stake
About
Stake is a Australian-Curaçaoan gambling organization that was founded in 2017. It is owned by a Netherlands-based company named Medium Rare N.V.
Industry
Gambling
What happened?
A cyberattack on DriveWealth, Stake’s partner for US trading and wallet, led to a data breach at the company(Stake).
Impact
The cyber attack exposed personal information, including names, email addresses, phone numbers, postal addresses, tax status, and tax country. The quantity of data exposed is currently under investigation.
Source
Victim: Touring Club Suisse
About
Touring Club Suisse (TCS) is a Vernier-based mobility club that was founded in 1896. It is a non-profit organization that is known to offer a range of services to its members, including road assistance, driving courses, and insurance.
Industry
Tourism
What happened?
Touring Club Suisse (TCS) became a target of a ransomware attack that was carried out by the Qilin ransomware group.
Impact
The nature and quantity of data stolen are currently under investigation.
Source
Victim: Kansas County
About
Kansas City offers a range of services to its residents online, from mental health, tourism, and education & training-related services to utilities and tax payment services.
Industry
Public sector
What happened?
On 17th September, Kansas County’s government reported that it was hit by a cyberattack that forced it to take its systems offline.
Impact
The full nature of the impact of the incident is currently under investigation.
Source
Victim: ACA Pescara
About
Azienda Comprensoriale Acquedottistica, or ACA, is an Italian water utility that was founded in 1991. It is known for providing drinking water supply, water treatment, and quality testing services.
Industry
Public sector
What happened?
ACA became a target of a ransomware attack that was carried out by the TheGentlemen ransomware group.
Impact
The nature and quantity of data exposed are currently under investigation.
Source
Victim: Diarco
About
Diarco is an Argentinian wholesale sales and distribution company that offers a wide variety of products and services. It operates across more than 90 branches in Argentina.
Industry
Wholesale
What happened?
Diarco became a victim of a ransomware attack that was carried out by the INC Ransom group.
Impact
The nature and quantity of data exposed are currently under investigation.
Source
Victim: Quy Nhon University
About
Quy Nhon University is a Vietnamese university that was founded in 1977. It is known throughout the country for its teacher education and extensive undergraduate courses.
Industry
Education
What happened?
Quy Nhon University became a target of a ransomware attack that was orchestrated by the Vexy ransomware group.
Impact
The nature and quantity of data exposed are currently under investigation.
Source
Victim: Cassias MG Government
About
Cassias MG offers a range of digital services to its residents, offering them access to information from official notifications, education, and public services-related information.
Industry
Public sector
What happened?
Emerador ransomware group has claimed to have stolen data from the Cassias MG Government.
Impact
The nature and quantity of data exposed are currently under investigation.
Source
Victim: ShopDunk
About
ShopDunk is an e-commerce company that is based in Vietnam. It is known for selling a range of electronic products, especially Apple smartphones, tablets, and laptops.
Industry
E-commerce
What happened?
ShopDunk became a target of a ransomware attack that was carried out by the Qilin ransomware group.
Impact
The nature and quantity of data exposed are currently under investigation.
Source
Victim: Zorlu Holding
About
Zorlu Holding is a Turkish conglomerate holding company that was founded in 1953. It is known globally for its specialty in textiles, electronics, white goods, energy, and financial services.
Industry
Conglomerate
What happened?
Zorlu Holding became a victim of a ransomware attack that was orchestrated by the Qilin ransomware group.
Impact
The exact nature and quantity of the data exposed are currently under investigation.
Source
Victim: Mississippi Institutions of Higher Learning
About
Mississippi Institutions of Higher Learning comprises eight public universities, ten off-campus centers, and other locations throughout the country.
Industry
Education
What happened?
On 7 September, Mississippi Institutions of Higher Learning, including the Mississippi Office of Student Financial Aid, discovered that they had been hit by a cyberattack.
Impact
The nature and quantity of data exposed are currently under investigation.
Source
Victim: Alabama Board of Nursing
About
The Alabama Board of Nursing was established by the Alabama Legislature in 1915. It is responsible for licensing qualified nurses in Alabama. It has licensed more than 97000 nurses in the state.
Industry
Education
What happened?
The Alabama Board of Nursing became a target of a cyber attack that forced it to take down some of its systems.
Impact
The cyber attack has impacted the organization’s operations. The full impact of the incident is currently under investigation.
Source
Victim: Ellis County
About
Ellis County offers a range of digital services to its residents from disaster & road closure notices to agendas from important county meetings.
Industry
Public sector
What happened?
On 17th September, Ellis County notified its residents that a ransomware attack impacted portions of its IT systems.
Impact
The complete impact of the incident is currently under investigation.
Source
Victim: Aero Mexico
About
Aeromexico is a Mexico City-based airline that was founded in 1934. It operates across more than 120 destinations in Mexico, Central and Southern America.
Industry
Aviation
What happened?
The Anti-Corruption and Good Government Secretariat of Mexico found an exposed database containing Aeromexico’s customer records on the Telegram network.
Impact
The exposed data contains more than 15 million customer records, including 100000 records of public officials and well-known individuals.
Source
Victim: The National Cancer Centre Singapore (NCCS)
About
The National Cancer Centre offers holistic and multi-disciplinary cancer treatment and patient care. It treats 70 percent of the public sector oncology cases.
Industry
Healthcare
What happened?
While sending an invitation to the Living with HBOC event on September 18, NCCS used the CC function instead of the BCC function that keeps recipients hidden.
Impact
This data breach due to human error exposed the names, e-mail addresses, and workplaces of 467 people with the genetic condition.
Source
Victim: BigCommerce
About
Commerce.com Inc. is a Sydney-based ecommerce company that was founded in 2003. It is known for its ecommerce platform BigCommerce that offers software-as-a-service services to retailers.
Industry
eCommerce
What happened?
Between 13 and 17 September, a hacker used compromised credentials to access data in BigCommerce environments.
Impact
The nature and quantity of data exposed are currently under investigation.
Source
Victim: Kakao Games
About
Kakao Games Corp. is a Jeju-based video game publisher which is part of Kakao. It is known for the development and publishing of PC, mobile, and VR games.
Industry
Video games
What happened?
The company reported that on September 12, they discovered unauthorized access to their Partners and RINK services.
Impact
The data exposed includes third-party identification codes linked to 140 customers, third-party IDs used for external connections in RINK, Kakao Games’ own identification codes, and country codes in Partners.
Source
Victim: Land Transportation Franchising and Regulatory Board
About
The Land Transportation Franchising and Regulatory Board is a government agency of the Republic of the Philippines that was founded in 1987.
Industry
Public sector
What happened?
LTFRB’s Electronic Support System (LESS) went offline, followed by a security breach. The LESS is a digital platform that is used to process applications, handle transactions, and provide support to motorists.
Impact
The cyber attack forced the suspension of all LESS platform-related services. The complete impact of the incident is currently under investigation.
Source
Victim: Data Hub Pvt. Ltd.
About
DataHub Pvt. Ltd. is Nepal’s primary data center and cloud service provider, operating data centers in Kathmandu and Butwal. It is a trusted provider for BFIs, enterprises, NGOs, corporate houses, and ICT companies.
Industry
Public sector
What happened?
Data Hub Pvt. Ltd., which hosts a data center for 72 brokerage houses registered under Nepal Stock Exchange (NEPSE), was hit by a ransomware attack.
Impact
The attack disrupted Trade Management Systems, CDSC-related clearing systems, payment gateways, and other interconnected services. It forced Nepal’s Stock Market to shut down on 21 September, 2026.
Source
Victim: Macquarie Group
About
Macquarie is a Sydney-based financial services provider that was founded in 1969. It is known for its investment banking and financial services.
Industry
Financial services
What happened?
Storm Ransomware group listed Macquarie Corporation on its leak site on September 1, 2026, with a warning to publish data by 16 September, 2026.
Impact
The nature and quantity of data exposed are currently under investigation.
Source
Victim: RelyComply
About
RelyComply is a regulatory technology company that is based in South Africa. It was founded in 2020 and is known for its Anti-Money Laundering (AML), KYC, and KYB services for financial institutions.
Industry
Software
What happened?
RelyComply became a target of a ransomware attack that was orchestrated by the Direwolf ransomware group.
Impact
The ransomware group has claimed to have stolen 200GB of data from the company, including information for identity verification, transaction monitoring, compliance screening, and credential management. The data breach has also affected associated customers of RelyComply, including Standard Bank and SA Home Loan Bank.
Source
Victim: St. James Anglican School Perth
About
St. James Anglican School is an Alkimos-based co-educational primary and secondary day school catering to Kindergarten to Year 12 students.
Industry
Education
What happened?
St. James Anglican School discovered that hackers gained access to their systems and had stolen data.
Impact
The hackers have stolen students’ and families’ personal information, including names, email addresses, phone numbers, bank account details, student medical records, and photographs of current and former students.
Source
Victim: RelyComply
About
RelyComply is a regulatory technology company that is based in South Africa. It was founded in 2020 and is known for its Anti-Money Laundering (AML), KYC, and KYB services for financial institutions.
Industry
Software
What happened?
RelyComply became a target of a ransomware attack that was orchestrated by the Direwolf ransomware group.
Impact
The ransomware group has claimed to have stolen 200GB of data from the company, including information for identity verification, transaction monitoring, compliance screening, and credential management. The data breach has also affected associated customers of RelyComply, including Standard Bank and SA Home Loan Bank.
Source
Victim: Suffolk County House of Correction and Nashua Street Jail
About
Suffolk County is a New York-based county that offers multiple informational and administrative services to its citizens.
Industry
Public sector
What happened?
On 17th September, the system provider for Suffolk County reported that two of its prison systems have been affected by a cybersecurity incident.
Impact
Prisoner health data and medical records from the Suffolk County House of Correction and Nashua Street Jail have been exposed.
Source
Victim: Helpfeel/Gyazo
About
Helpfeel Inc. is a Kyoto-based software development company that was founded in 2007. It is known for its screen/image/video capture and sharing tool called Gyozo.
Industry
Software
What happened?
A hacker exploited a vulnerability in Gyazo’s image upload server to gain unauthorized access to the information of its users.
Impact
The hacker stole 23.6 million user records, including names, email addresses, password hashes, user and device IDs, Xintegration tokens, profile information, usage statistics, and billing information.
Source
Victim: Nipigon District Memorial Hospital
About
Nipigon District Memorial Hospital is an Ontario-based healthcare provider that offers a range of healthcare services, from 24/7 emergency services, urgent care, and outpatient laboratory services to diagnostic imaging and physiotherapy services.
Industry
Healthcare
What happened?
Nipigon District Memorial Hospital became a victim of a ransomware attack that exposed the personal and healthcare information of its patients.
Impact
The hospital has confirmed that the exposed information contains personal and health information of its patients. The quantity of data exposed is currently under investigation.
Source
Victim: SA Home Loans
About
SA Home Loans is a KwaZulu-Natal-based finance company that was founded in 1999. It is known for its mortgages, credit life insurance, homeowners insurance, and personal loans.
Industry
Financial services
What happened?
SA Home Loans was breached due to a data breach at its vendor, RelyComply, which conducts verification checks, anti-money laundering screening, and compliance with the Financial Intelligence Centre Act.
Impact
The nature and quantity of data compromised is currently under investigation.
Source
Victim: Swiss Bitcoin Pay
About
Swiss Bitcoin Pay is a payment processing merchant based in Switzerland known for its non-custodial merchant payment platform for Bitcoin. The company’s application is used by more than 1000 merchants across 21 countries.
Industry
Cryptocurrency payment
What happened?
Swiss Bitcoin Pay reported that it discovered unauthorized access to its systems that forced it to temporarily shut down its systems.
Impact
The complete impact of the incident is currently under investigation.
Source
Victim: Avelogic
About
Avelogic is a Singaporean software solutions developer that was founded in 2006. It is known for its HRMS and Payroll solutions among small and medium-sized companies.
Industry
Software
What happened?
On September 14, Avelogic reported that it detected unauthorized access to its systems.
Impact
The complete impact of the incident is currently under investigation.
Source
Victim: CenterPoint Energy
About
CenterPoint Energy is a Texas-based electric and natural gas utility company that was founded in 1882. It is part of the Fortune 500 companies and one of the biggest utility companies in the United States.
Industry
Utilities
What happened?
CenterPoint disclosed unauthorized access to one of its external systems. It discovered that a hacker claimed to have stolen millions of records from its systems.
Impact
The hacker claimed to have stolen 7.49 million records of CenterPoint customer data, including customer names, phone numbers, service & billing addresses, account numbers, premise IDs, billing amounts, due dates, autopay & billing status, rate class, email addresses, driver’s license numbers, and the last four digits of Social Security Numbers.
Source
Victim: Hilltop National Bank
About
Hilltop is a Casper based bank that offers a range of banking services and products. It operates through seven branches in the country and is known for its personal banking services.
Industry
Banking
What happened?
Hilltop Bank became a target of a cyber attack that forced it to take its services offline.
Impact
The full nature of the impact of the incident is currently under investigation.
Source
Victim: Veradigm
About
Varadigm Inc. is a Chicago-based healthcare technology company that was founded in 1982. It is known for its practice management and electronic healthcare record technology products.
Industry
Technology
What happened?
Varadigm became a target of a ransomware attack that was orchestrated by the Gentlemen ransomware group.
Impact
The stolen data includes personal data, including Social Security Numbers of its patients. The complete nature and quantity of data exposed is currently under investigation.
Source
Victim: IDScan
About
IDScan is a software developer known for its platform that is designed to detect fake IDs and frauds. It offers a range of solutions through its platform from ID fraud prevention to age verification.
Industry
Software
What happened?
IDScan reported that hackers accessed their customer data stored in its cloud platform.
Impact
The company reported over 153 million driver’s license scans were leaked by the hackers.
Source
Victim: Kimberly Clark
About
Kimberley Clark Corporation is a Wisconsin based manufacturer that was founded in 1872. It is known for its consumer goods and personal care products.
Industry
Manufacturing
What happened?
Kimberly Clark became a target of a ransomware attack that was orchestrated by the Shiny Hunters ransomware group.
Impact
The nature and quantity of data exposed is currently under investigation.
Source
Victim: Revolut
About
Revolut Group Holdings Ltd. is a London-based financial services provider that was founded in 2015. It is known for its digital banking services offered through a mobile app.
Industry
Financial services
What happened?
The data exposed includes names, phone numbers, email addresses, dates of birth, passports, driver’s license, verification selfies,and financial information like account statements, and transaction histories.
Impact
The nature and quantity of data exposed is currently under investigation.
Source
Victim: Caridro Val De Loire
About
Caridro Val De Loire is a French manufacturing company that was founded in 2008. It is known for the manufacturing of the bodywork for heavy trucks and utility vehicles.
Industry
Manufacturing
What happened?
Caridro Val De Loire became a target of a ransomware attack that was orchestrated by the Qilin ransomware group.
Impact
The nature and quantity of data exposed is currently under investigation.
Source
Victim: Monroe
About
Monroe High School (MHS) is a Monroe based public high school that is part of the School District of Monroe.
Industry
Education
What happened?
Monroe High School became a victim of a cyber attack that affected some parts of its operations.
Impact
The complete impact of the incident is currently under investigation.
Source
Victim: Mathspace
About
Mathspace is an edtech software developer based in Sydney that was founded in 2010. It is known for its online mathematics program for elementary, primary, and secondary school students.
Industry
Education
What happened?
A security vulnerability in Mathspace’s self-hosted Metabase installation was exploited by attackers to gain administrative access without logging in.
Impact
The cyber incident exposed information on its 1,079,819 users across Australia and New Zealand, including their names, email addresses, and account details.
Source
Victim: Westfield Public Schools
About
The Westfield Public Schools is a New Jersey-based chain of public schools that serves pre-kindergarten to twelfth grade students.
Industry
Education
What happened?
The Westfield Public Schools became a victim of a ransomware attack that was carried out by the INC Ransomware group.
Impact
The data exposed includes financial data and contract-related information. The quantity of data exposed is currently under investigation.
Source
Victim: Springfield and Massachusetts public schools
About
Springfield and Massachusetts public schools are large and diverse school districts that are based in Massachusetts.
Industry
Education
What happened?
A data breach forced multiple public schools in Massachusetts to cancel their classes on 8th September.
Impact
The full scope and impact of the data breach are currently under investigation.
Source
Victim: Everette, Massachusetts
About
Everett City offers multiple informational services related to tourism, public services, and business-related information to its residents.
Industry
Public sector
What happened?
Everett City reported that it became a target of a cyberattack that impacted its network and systems.
Impact
The cyberattack has disrupted its network and systems and has forced employees to relocate to another center to ensure resumption of essential services.
Source
Victim: Red Star Oil
About
Red Star Oil is a privately owned oil and gas company that was founded in 1947. It is known for its unbranded fuels and assorted motor oils.
Industry
Oil and gas
What happened?
Red Star Oil became a target of a ransomware attack that was orchestrated by the Play ransomware group.
Impact
The ransomware group has claimed to have stolen private and personal confidential data, clients’ documents, budget, payroll, IDs, taxes, and financial information. The quantity of information exposed is currently under investigation.
Source
Victim: The Department of Information and Communications Technology
About
The Department of Information and Communications Technology (DICT) is the executive department of the Philippine government that plans, develops, and promotes the country’s information and communications technology (ICT).
Industry
Public sector
What happened?
On September 8th, the Department of Information and Communications Technology reported that they have been forced to take the Department of Migrant Workers and Department of Labor and Employment websites offline due to a cyberattack.
Impact
The cyber incident forced the Department of Information and Communication Technology to take the DOLE and DMW websites down. The full nature of the incident is currently under investigation.
Source
Victim: Florida Department of Motor Vehicles
About
The Florida Department of Highway Safety and Motor Vehicles (FLHSMV) is a government agency that is responsible for providing highway safety and security.
Industry
Publio sector
What happened?
The Florida Department of Motor Vehicles became a victim of a ransomware attack that was carried out by the ShinyHunters ransomware group.
Impact
The ransomware group has claimed to have stolen 200000 records from the Driver and Vehicle Information Database (DAVID), including addresses, Social Security numbers, birth dates, license IDs, expiration dates, and registered vehicles.
Source
Victim: Medela
About
Medela is a Baar-based medical equipment manufacturing company that is known for its research-based breast milk feeding products to more than 100 countries worldwide.
Industry
Medical equipment manufacturing
What happened?
Medela became a target of a ransomware attack that was carried out by the ShinyHunters ransomware group.
Impact
The nature and quantity of data exposed are currently under investigation.
Source
Victim: Reichenau
About
Reichenau is a South Germany-based island that offers multiple informational services to its residents through its website, from local government services and civic information to administration-related information.
Industry
Public sector
What happened?
Reichenau became a target of a ransomware attack that was carried out by the SafePay ransomware group.
Impact
The nature and quantity of data exposed are currently under investigation.
Source
Victim: Hollard Insurance Group
About
Hollard is a South African insurance company that offers a range of short-term and long-term insurance products, including business and general insurance.
Industry
Insurance
What happened?
Hollard became a victim of a ransomware attack that was orchestrated by TheGentlemen ransomware group.
Impact
The nature and quantity of data exposed are currently under investigation.
Source
Victim: Drogueria Saporiti Sacifia
About
Drogueria Saporiti S.A.C.I.F.I.A is a company founded in 1968 that is known for wholesale distribution of proprietary drugs, prescription drugs, and toiletries.
Industry
Pharmaceutical
What happened?
Droguria Saporiti became a victim of a ransomware attack that was carried out by TheGentlemen ransomware group.
Impact
The nature and quantity of data exposed are currently under investigation.
Source
Victim: University of San Francisco
About
The University of San Francisco is a Jesuit research university. It caters to around 10200 students from multiple locations, including Manhattan and Tokyo.
Industry
Education
What happened?
The University of San Francisco became a victim of a ransomware attack that was orchestrated by TheGentlemen ransomware group.
Impact
The cyberattack has compromised the university’s systems. The nature and quantity of data exposed are currently under investigation.
Source
Victim: Sharp Office
About
Sharp Office is an Australian office technology supplier that is known for its photocopiers. For five decades, it has been catering to the office needs of some of the biggest clients across industries.
Industry
Technology
What happened?
Sharp Office became a victim of a ransomware attack that was orchestrated by TheGentlemen ransomware group.
Impact
The nature and quantity of data exposed are currently under investigation.
Source
Victim: Instituto de Cancerología
About
Instituto de Cancerología is a Colombian state-owned healthcare institution that specializes in offering services for comprehensive care for cancer patients. It also conducts research and offers training.
Industry
Healthcare
What happened?
Instituto de Cancerología became a victim of a ransomware attack that was orchestrated by the Krybit ransomware group.
Impact
The nature and quantity of data exposed are currently under investigation.
Source
Victim: Springfield Public Schools
About
Springfield Public Schools is a chain of public schools based in Pittsburgh.
Industry
Education
What happened?
Springfield Public Schools were forced to close due to a cyber incident that disrupted their systems.
Impact
The cyber incident forced multiple Springfield Public Schools to close. The full nature of the impact of the cyber incident is currently under investigation.
Source
Victim: Healing Paper/Gangnam Unni
About
Gangnam Unni is a beauty and aesthetic medicine company based in Seoul. It is known for its platform that connects people seeking skin care and cosmetic treatments to clinics.
Industry
Aesthetic medicine
What happened?
Healing Paper, the parent company of Gangnam Unni, reported that it was breached and that personal data of its customers has been exposed.
Impact
The data exposed includes personal data of 220000 Gangnam Unni users, including their full names, phone numbers, email addresses, dates of birth, gender, country/region of residence, social network login IDs, IP addresses and device information, consultation photos & consultation details, treatment information & procedure dates, clinic & medical practitioner information, treatment information, and payment-related information.
Source
Victim: Weverse
About
Weverse is a software company that is known for its mobile and web platform that goes by the same name. It was created by the Hybe Corporation in 2019.
Industry
Software
What happened?
Weverse confirmed that a security vulnerability in 422584 accounts has exposed their data.
Impact
The data exposed includes internal identifiers and transaction-related information of 422584 user accounts.
Source
Victim: Cartrack Holdings
About
Cartrack Holdings is a South African fleet management solution provider that was founded in 2004.
Industry
Fleet management
What happened?
Cartrack Holdings became a victim of a ransomware attack that was carried out by the Direwolf ransomware group.
Impact
The nature and quantity of data exposed are currently under investigation.
Source
Victim: Natural Resources Wales
About
Natural Resources Wales is the primary body for managing Wales’ natural resources. It was formed in 2013 and is sponsored by the Welsh Government.
Industry
Public
What happened?
Natural Resources Wales disclosed a personal data breach that exposed data of its former and current employees by inadvertently publishing a spreadsheet.
Impact
The data exposed contains data of people employed between April 2013 and March 2018.
Source
Victim: UC Berkley
About
The University of California is a Berkeley-based public land-grant research university that was founded in 1868. It offers a range of courses to more than 45000 students annually.
Industry
Education
What happened?
On September 2, UC Berkley reported that it experienced a cyberattack that affected its systems.
Impact
The cyber attack impacted several of the university’s systems. The full nature and impact of the incident are currently under investigation.
Source
Victim: MSM Unify (Laul Global)
About
MSM Unify is a Canadian education-related service provider that is known for its education marketplace and student recruitment platform.
Industry
Education
What happened?
A threat actor who goes by the name Kazu has claimed to have stolen data from MSM Unify and published it on a data breach forum.
Impact
The threat actor has claimed to have stolen 1.45 TB of data, including passport copies, secondary school transcripts, higher secondary school transcripts, English proficiency scorecards, and other personal data like birth certificates.
Source
Victim: Philippines Port Authority
About
The Philippine Ports Authority (PPA) is the primary body that is responsible for the financing, management, and operations of all the public ports in the Philippines. It comes under the Department of Transportation, Government of the Philippines.
Industry
Public
What happened?
The Philippine Ports Authority became a target of a ransomware attack that was orchestrated by the Qilin ransomware group.
Impact
The nature and quantity of data exposed are currently under investigation.
Source
Victim: Bauman Law Group
About
Bauman Law Group P.C. is a New York-based legal service provider known for its litigation, employment law, cryptocurrency law, and general counsel-related services.
Industry
Legal
What happened?
Bauman Law Group P.C. became a victim of a ransomware attack that was carried out by the Qilin ransomware group.
Impact
The nature and quantity of data exposed are currently under investigation.
Source
Victim: D-max Engineering
About
D-MAX Engineering Inc. is a San Diego-based engineering consulting firm that was founded in 1996. It is known for its stormwater-related services and consulting.
Industry
Environmental services
What happened?
D-max Engineering became a target of a ransomware attack that was carried out by the Spacebears ransomware group.
Impact
The nature and quantity of data exposed are currently under investigation.
Source
Victim: America’s Food Basket
About
America’s Food Basket is a New York-based chain of grocery stores that was founded in 2007. It operates through a chain of 70 stores across New York, Florida, Pennsylvania, Massachusetts, Connecticut, and Rhode Island.
Industry
Retail
What happened?
America’s Food Basket became a target of a ransomware attack that was carried out by the Wallstreet ransomware group.
Impact
The nature and quantity of data exposed are currently under investigation.
Source
Victim: SITES Medical
About
SITES Medical is an Indiana-based manufacturer that specializes in the design and manufacturing of orthopedic implant products. It is known for its highly cost-effective devices.
Industry
Healthcare
What happened?
SITES Medical became a target of a ransomware attack that was claimed by the Storm threat group.
Impact
The threat group has claimed to have stolen employee and business data. The quantity of data exposed is currently under investigation.
Source
Victim: Wolfram Research
About
Wolfram Research is an Illinois-based technology company that was founded in 1987. It is known for its technical computing program, Wolfram Mathematica, which was released in 1988.
Industry
Software
What happened?
Wolfram Research became a target of a ransomware attack that was carried out by the Direwolf ransomware group.
Impact
The nature and quantity of data exposed are currently under investigation.
Source
Victim: Heilbronn University of Applied Sciences
About
Heilbronn University of Applied Sciences is a Heilbronn-based university that is one of the major institutions of Higher education in the state of Baden-Württemberg.
Industry
Education
What happened?
Heilbronn University became a target of a ransomware attack that was carried out by the Panzer ransomware group.
Impact
The nature and quantity of data exposed are currently under investigation.
Source
Victim: TIPS HUB – KENYAN Betting platform
About
Tips Hub is a Kenyan betting platform that focuses on offering fans tips for successful bets on football games. It also offers game predictions on upcoming games of global football leagues.
Industry
Online betting
What happened?
A threat actor has claimed to have breached the Tips Hub administrator account through weak credentials.
Impact
The hacker has claimed to have stolen data related to account balances, betting data, SportPesa Mega codes, internal betting tips, and stored message IDs.
Source
Victim: Luminis Health
About
Luminis Health is a non-profit healthcare system based in Maryland. It was formed as a result of a merger between Doctors Community Medical Center and Anne Arundel Medical Center.
Industry
Healthcare
What happened?
On September 1, Luminis notified the public that it became a target of a cyberattack that impacted its systems.
Impact
The attack forced the hospital to cancel its treatments and has rerouted its patients to other hospitals. The nature and quantity of data exposed are currently under investigation.
Source
Victim: Greenberg Traurig
About
Greenberg Traurig is a Miami-based law firm that was founded in 1967. It was the eighth-largest law firm in the United States in 2025 and is known to have the largest office in New York City.
Industry
Legal
What happened?
Greenberg Traurig became a target of a ransomware attack that was orchestrated by the Silent Ransomware group.
Impact
The nature and quantity of data exposed are currently under investigation.
Source
Victim: Ville de libercourt
About
Libercourt is a commune based in Northern France that offers multiple informational and municipal services to its residents.
Industry
Public sector
What happened?
Ville de Libercourt became a target of a ransomware attack that was claimed by the Kairos ransomware group.
Impact
The group has claimed to have stolen 817 GB of data, including identity card and payslip-related data.
Source
Victim: LIC India
About
LIC India is a Mumbai-based life insurance company that was founded in 1956. It is the largest government-owned insurance company in India.
Industry
Public sector
What happened?
LIC India became a target of a ransomware attack that was claimed by the Medusalocker ransomware group.
Impact
The nature and quantity of data exposed are currently under investigation.
Source
Victim: PTT Oil and Retail
About
PTT Public Company Limited is a state-owned petroleum and natural gas company that was founded in 1978. It is known for its extensive network of gas pipelines in the Gulf of Thailand.
Industry
Oil & gas
What happened?
PTT Oil and Retail became a target of a ransomware attack that was orchestrated by the Direwolf ransomware group.
Impact
The nature and quantity of data stolen are currently under investigation.
Source
Victim: THQ Nordic
About
THQ Nordic GmbH is an Austria-based video game publisher that was founded in 2011. It is part of the Embracer Group and is known for its licensed games from entertainment companies.
Industry
Video games
What happened?
THQ Nordic became a victim of a ransomware attack orchestrated by the Direwolf ransomware group.
Impact
The nature and quantity of data exposed is currently under investigation.
Source
Victim: PT Intraco Penta Tbk
About
PT Intraco Penta Tbk is a Jakarta-based manufacturing company that was founded in 1970. They are also dealers of several world-class heavy equipment & spare parts brands.
Industry
Machinery manufacturing
What happened?
PT Intraco Penta Tbk became a target of a ransomware attack that was carried out by the Direwolf ransomware group.
Impact
The nature and quantity of data exposed is currently under investigation.
Source
Victim: Transportes Montejo S.A.S
About
Transportes Montejo is a Venezuela-based logistics company that was founded in 1953. It is known for its extra heavy and extra dimensional cargo lifting & transport services.
Industry
Logistics
What happened?
Transportes Montejo became a victim of a ransomware attack that was orchestrated by the Nightspire ransomware group.
Impact
The nature and quantity of data exposed is currently under investigation.
Source
Victim: Italtel
About
Italtel is a Milan-based telecommunications company that was founded in 1921. It is a known service provider to multiple sectors, including media, energy & utilities, transportation, and digital health.
Industry
Telecommunications
What happened?
Italtel became a victim of a ransomware attack that was carried out by the Everest ransomware group.
Impact
The nature and quantity of exposed data are currently under investigation.
Source
Victim: RiseUP
About
RiseUP is a non-profit organization based in Denver that was founded in 1973. It focuses on serving children and adults with intellectual and developmental disabilities and neurodiversity.
Industry
Non-profit
What happened?
RiseUP became a target of a ransomware attack that was orchestrated by the Everest ransomware group.
Impact
The nature and quantity of exposed data are currently under investigation.
Source
Victim: Blossom Health
About
Blossom Health is a New York-based mental health care provider that offers its services by partnering with psychiatrists in the United States. They are known for their AI and telehealth technology that is used by clinics and patients across the country.
Industry
Telehealth
What happened?
A hacker has claimed to have gained access to Blossom Health’s clients’ records and has demanded $30000 in Bitcoin by September 4th.
Impact
Over 29600 unique client records have been exposed, including their full names, phone numbers, home addresses, dates of birth, and sensitive company documents.
Source
Victim: Gale Credit Union
About
Gale Credit Union is a Galesburg-based financial institution that is known for offering financial services in multiple counties including Knox, Warren, Henry, Mason, and Tazewell. It is a known provider of mortgage, vehicle, and student loans.
Industry
Finance
What happened?
Gale Credit Union has become a target of a ransomware attack that was carried out by the Akira ransomware group.
Impact
The nature and quantity of exposed data are currently under investigation.
Source
To be continued
In August, we saw how some of the most devastating data breaches impacted some of the biggest companies.
Keep checking this space as we update our list of August’s top data breaches with a closer look at how they happened and their impact.
Note: Our list only highlights the breaches that have either occurred in 2026 or been reported/disclosed in 2026. All breaches reported in previous years, as of 2026, will be excluded from the list.
