Thousands of Corewell Health Patients Affected by Security Breach
Corewell Health disclosed that its former consulting partner, Pinnacle Holdings, suffered a data breach in 2024, potentially compromising the personal information of thousands of patients. The health system promptly initiated an internal review to determine the scope of exposure and to notify affected individuals. Corewell emphasized that the breach originated with the third‑party vendor, not its own systems. The incident adds to a growing list of healthcare data breaches linked to outsourced services.
Ransomware Attack Totally Cripples Jackson County Sheriff’s Office in Indiana
A ransomware attack crippled the Jackson County Sheriff’s Office IT infrastructure last week. The breach likely began with a phishing email that delivered malicious code, which lay dormant before encrypting files and spreading laterally. The resulting total network outage forced...
Infinite Campus Security Incident Awareness: No Impact to Student Data According to Infinite Campus
Infinite Campus disclosed that a ShinyHunters actor accessed an employee's Salesforce account, exposing only staff directory information and not any student or employee databases. The breach was detected quickly, the compromised account was disabled, and services lacking IP restrictions were...
If Threat Actors Gave You a Chance to Redact the Patient Data They Hacked Before They Leak It, Would You...
Woundtech, a Florida‑based mobile wound‑care provider, suffered a breach in early December 2025 when attackers accessed its AWS environment and exfiltrated 335 GB of data from a 6.7 TB S3 bucket. The leak includes over 928,000 patient IDs, 86,000 fully identified records,...
Weill Cornell Medicine Discloses an Insider Data Breach
Weill Cornell Medicine reported a breach affecting 516 patients after a former employee accessed electronic medical records without authorization. The employee only viewed contact details and visit reasons, with no clinical or financial data disclosed. The hospital notified the patients...
Strengthening Cybersecurity in Canada’s Municipal Sector: A Verified Analysis
The City of Hamilton’s February 2024 ransomware attack crippled 80% of its network and forced the municipality to spend roughly C$18.3 million on response, recovery and upgrades. A demanded ransom of C$18.5 million was refused, and a subsequent C$5 million cyber‑insurance claim was denied...
Jaguar Land Rover’s Cyber Bailout Sets Worrying Precedent, Watchdog Warns
The UK government has pledged a £1.5 billion loan guarantee to rescue Jaguar Land Rover after a crippling cyber‑attack. The Cyber Monitoring Centre’s technical chair warned that the ad‑hoc assistance could set a dangerous precedent for future cyber crises. He argued that without...
Global Cybercrime Crackdown: Over 373,000 Dark Web Sites Shut Down
Operation Alice, a March 2026 Europol‑led initiative, dismantled the largest known network of fraudulent dark‑web platforms, shutting down over 373,000 sites that hosted child sexual abuse material and cyber‑crime‑as‑a‑service tools. German authorities identified the platform’s operator and, together with 22...
University College of Dublin Staff Member Due in Court over Accessing Student Data
A University College Dublin employee in his 50s has been arrested and charged for unlawfully accessing student records, appearing in court today. The investigation, led by Ireland's Garda Síochána, uncovered unauthorized database queries that exposed personal information of dozens of...
Justice Department Disrupts Iranian Cyber Enabled Psychological Operations
The U.S. Justice Department seized four domains used by Iran’s Ministry of Intelligence and Security for cyber‑enabled psychological operations and transnational repression. The sites—Justicehomeland.org, Handala‑Hack.to, Karmabelow80.org, and Handala‑Redwanted.to—were employed to claim hack credit, publish stolen data, and issue death threats...
UMMC Continues Investigating Cyberattack and Recovering From Impact.
University of Mississippi Medical Center (UMMC) shut dozens of clinics for nine days after a ransomware attack crippled its Epic EMR system. The Medusa ransomware gang later posted the breach on its leak site, claiming to have stolen more than...
Russian Hackers Exploit Zimbra Flaw in Ukrainian Govt Attacks
Russian state‑backed APT28 leveraged the high‑severity Zimbra Collaboration Suite flaw CVE‑2025‑66376, a stored XSS that enables unauthenticated remote code execution, to target Ukrainian government entities. The vulnerability was patched in early November, yet attackers continue to exploit unpatched installations. The...
45,000 Malicious IP Addresses Taken Down in International Cyber Operation
An INTERPOL‑coordinated effort, Operation Synergia III, dismantled more than 45,000 malicious IP addresses and servers between July 2025 and January 2026. Law enforcement from 72 countries arrested 94 suspects and seized 212 devices, while investigations continue against another 110 individuals. The operation uncovered extensive...
The Broken Records: Tracing the Human Cost of the 2022 British MoD Leak
In February 2022 the UK Ministry of Defence inadvertently released personal data on roughly 18,700 Afghan nationals who had supported British forces and were seeking protection. The breach remained undisclosed for almost two years, and a High Court super‑injunction in September 2023...
Telus Digital Confirms Breach After ShinyHunters Claims 1 Petabyte Data Theft
Canadian BPO provider Telus Digital has confirmed a security incident after the hacker group ShinyHunters alleged stealing nearly one petabyte of data in a breach that spanned several months. The claim, made public in early March 2026, follows a prolonged...
China’s CERT Warns OpenClaw Can Inflict Nasty Wounds
China’s National Computer Network Emergency Response Technical Team (CERT) issued a warning that the OpenClaw agentic AI tool suffers from extremely weak default security configurations. The agency posted on WeChat that the tool can be easily exploited, urging users to...
Lotte Card Fined 9.6 Billion Won for Leaking Users’ Social Registration Numbers
South Korea’s Personal Information Protection Commission fined Lotte Card 9.62 billion won after a hacking attack exposed the resident registration numbers of about 450,000 customers. The breach stemmed from unauthorized access to log files in the card’s online simple‑payment system, affecting data...
Police Scotland Fined £66k for Extracting and Sharing Mobile Phone Data
The Information Commissioner’s Office fined Police Scotland £66,000 after it extracted the entire contents of a suspect’s mobile phone following a crime report and shared the unredacted data with an unauthorised third party. The ICO found the force failed to...
Viral ‘Quittr’ Porn Addiction App Exposed the Masturbation Habits of Hundreds of Thousands of Users
Quittr, a self‑help app marketed to men seeking to curb pornography use, suffered a massive data breach that exposed intimate details, including masturbation frequencies, of hundreds of thousands of users. The company had previously assured users of robust security, yet...
New Report Finds One in Two U.S. School Districts Experienced a Cybersecurity Incident in 2025
Clever released its Cybersecure 2026 Report, surveying nearly 500 U.S. K‑12 administrators and technology professionals. The study found that one in two school districts experienced a cybersecurity incident in 2025. More than 77% of districts rely on Clever’s identity platform...
Whistleblower Claims Ex-DOGE Member Says He Took Social Security Data to New Job
A whistleblower alleges that a former employee of the Social Security Administration’s DOGE Service accessed two highly sensitive agency databases and intended to transfer the data to a private‑sector employer. The SSA Office of Inspector General has opened an investigation...
Insightin Health Discloses Its Second Data Security Incident in Two Years (1)
Insightin Health disclosed a March 4 2026 breach that stemmed from a zero‑day flaw in the GoAnywhere file‑transfer tool, allowing an unauthorized actor to access health‑plan data between September 17‑23 2025. The compromised files contained member names, dates of birth, insurance IDs and, in...
DeKalb County Officials Release Data Breach Notice to Residents
DeKalb County, Indiana, announced that personal data of residents was accessed by an unauthorized individual between August 21 and September 25, 2025. The compromised information may include names combined with Social Security numbers, driver’s license or ID numbers, and financial...
HHS’ Office for Civil Rights Settles HIPAA Investigation of MMG Fusion, LLC Breach Affecting 15 Million Individuals
The U.S. Department of Health and Human Services Office for Civil Rights settled a HIPAA investigation with Maryland‑based software firm MMG Fusion, LLC. The settlement stems from a December 2020 cyber‑attack that exposed protected health information of roughly 15 million individuals...
Nigerian Communication Commission Orders Telecoms to Report Cyber Threats Within 4 Hours
Nigeria’s Communications Commission (NCC) has issued a Cyber Resilience Framework requiring telecom operators to report any cyber‑attack to the regulator within four hours of detection. The rule, effective February 2027, applies to major providers such as MTN Nigeria, Airtel Nigeria, Globacom...
Russian Ransomware Administrator Pleads Guilty to Wire Fraud Conspiracy
Evgenii Ptitsyn, the administrator of the Phobos ransomware platform, pleaded guilty to wire‑fraud conspiracy in a Maryland federal court. Phobos ransomware was used by affiliates to compromise more than 1,000 public and private entities worldwide, extracting over $39 million in ransom...
Coruna: The Mysterious Journey of a Powerful iOS Exploit Kit
Google Threat Intelligence Group uncovered a powerful iOS exploit kit called Coruna, covering iOS 13.0 through 17.2.1 with five full exploit chains and 23 vulnerabilities that use non‑public techniques. The kit first appeared in targeted surveillance operations, then in Ukrainian‑focused...
1,700 Dutch Police Officers Get Reminder Not to Access Files without Legitimate Purpose
The Dutch National Police identified roughly 1,700 officers who accessed internal systems without a clear operational need and will receive reminder letters. The audit was sparked by a query into the violent death of 17‑year‑old Lisa from Abcoude, which appeared...
Evoke Wellness at Hilliard Updates Its Breach Notification
Evoke Wellness at Hilliard submitted a confusing breach notification to the Maine Attorney General, claiming a July 2024 insider incident was only discovered in August 2025 and affecting 261 patients. Earlier reports documented a former employee stealing data in 2024, with 240‑plus...
Data From Insight Hospital and Medical Center Leaked on Dark Web
Insight Hospital and Medical Center disclosed that an unauthorized actor accessed its network from August 22 to September 11, 2025, compromising extensive personal and health data. The breach involved roughly 360 GB of files—about 900,000 records—including names, Social Security numbers, and medical images. On...
Wisconsin K-12 District Hit by Weeklong Outage
The Denmark School District in Wisconsin experienced a five‑day internet outage after a reported cyber incident that appears to be a ransomware attack claimed by the group INC Ransom. The attackers say they encrypted roughly 70.76 GB of district data and posted...
Hacktivists Claim to Have Hacked Homeland Security to Release ICE Contract Data
Hacktivist collective “Department of Peace” announced a breach of the U.S. Department of Homeland Security, releasing a trove of Immigration and Customs Enforcement (ICE) contract records via DDoSecrets. The dump contains details on more than 6,000 vendors, including major defense...
Shutdown Stalls Compliance Plans for Cyber Breach Reporting Rule
A partial shutdown of the Department of Homeland Security is delaying the finalization of the Cyber Incident Reporting for Critical Infrastructure Act rule, which would impose stricter breach‑notification requirements on critical‑infrastructure firms. The agency announced in February that it was...
CISA Releases New Guidance on Assembling Multi-Disciplinary Insider Threat Management Teams
CISA issued new guidance on Jan. 28, 2026 for assembling multi‑disciplinary insider‑threat management teams. The resource introduces the POEM (Plan, Organize, Execute, Maintain) framework to align physical security, cybersecurity, personnel awareness, and community partnerships. While aimed at critical‑infrastructure operators, the guidance is...
Connecticut Senate Bill Raises the Stakes on Data Breach Response
Connecticut Senate Bill 117, titled An Act Concerning Breaches of Security Involving Electronic Personal Information, mandates that entities experiencing a massive data breach—defined as affecting at least 100,000 state residents—retain a qualified third‑party forensic examiner. The bill requires a detailed...
KT, LG Uplus Face Lingering Fallout over Hacking Incidents
Korea's telecom giants KT and LG Uplus are still dealing with the repercussions of recent hacking incidents. KT has extended the deadline for customers to claim early‑termination‑fee refunds to June 30 after many missed the Jan. 31 cutoff. LG Uplus is under investigation for...
Former Nuance Employee Admits Breaching More than 1.2M Geisinger Patient Records
Max Vance, a former Nuance Communications employee, admitted to illegally extracting protected health information from Geisinger Health System, affecting over 1.2 million patients. The breach continued after his termination, indicating he retained access to the provider’s network. Vance pleaded guilty in...
South Korean Authorities Accidentally Hand Hackers $4.8M in Crypto
South Korea's National Tax Service mistakenly published a photo containing the mnemonic recovery phrase of a seized cryptocurrency wallet. Hackers used the exposed phrase to transfer approximately $4.8 million worth of digital assets to their own accounts. The blunder underscores a...
UK Court of Appeal Rules on the Concept of Personal Data in the Context of Data Security
On 19 February 2026 the UK Court of Appeal decided DSG Retail Ltd v The Information Commissioner, holding that a controller’s data‑security duty covers all information it treats as personal, even if an attacker cannot identify individuals. The ruling, based...
NL: Hackers Had Access to Prison Staff Data for Five Months
Hackers infiltrated the Dutch prisons agency DJI and accessed staff data for at least five months, according to a radio investigation by Argos. The compromised information includes employee email addresses, phone numbers and security certificates. The breach was uncovered after...
Cisco Says Hackers Have Been Exploiting a Critical Bug to Break Into Big Customer Networks Since 2023
Cisco disclosed that a critical vulnerability in its Catalyst SD‑WAN platform has been actively exploited since 2023. The flaw carries a CVSS rating of 10.0, granting attackers remote code execution and full administrative control. Hackers have used the bug to...
Clalit Probes Suspected Cyberattack After Iranian-Linked Hackers Leak Patient Files
Clalit Health Services, Israel’s largest HMO, announced it is probing a suspected cyberattack after the Iranian‑linked group Handala claimed to have breached its systems. The hackers released thousands of documents containing patients' personal and medical information on public platforms. Clalit...
South Korea Considers Updates to Data and Cyber Laws
South Korea is preparing amendments to its Network Act and Personal Information Protection Act after a wave of high‑profile data breaches in telecommunications, retail and finance. The revisions aim to tighten data protection, reinforce security governance, and boost the effectiveness...
Greater Pittsburgh Orthopaedic Associates Disclosed a 2025 Breach, but Was There Also One in 2024?
Greater Pittsburgh Orthopaedic Associates disclosed a data breach that began around August 10, 2025, affecting tens of thousands of patients. The group reported 35,000 records to HHS in August 2025, but a February 2026 filing to the Maine Attorney General raised the figure...
Hackers Threaten to Leak 8 Million People’s Stolen Data if Dutch Telecom Odido Won’t Pay Ransom
Dutch telecom operator Odido confirmed a breach by the Shinyhunters cyber‑criminal group, which claims to have exfiltrated data on up to eight million customers. The attackers are demanding more than one million euros in ransom and have issued a final...
Some Patients Listed as “Charlie Kirk” Or Dead After Major NZ Health App MediMap Hacked
New Zealand health‑tech firm MediMap was forced offline after an unauthorized intrusion altered patient records, including changing names to “Charlie Kirk” and marking individuals as deceased. The breach affected dozens of providers in aged‑care, disability, hospice and community settings, prompting the...
Top NATO Allies Believe Cyberattacks on Hospitals Are an Act of War. They’re Still Struggling to Fight Back.
A new POLITICO poll reveals that citizens in the United States, Canada and other key NATO allies overwhelmingly consider cyberattacks on hospitals to be acts of war. Despite this public sentiment, NATO’s official response remains measured, emphasizing diplomatic channels and...
The Hospitality Sector Continues to Be Lucrative Targets
The hospitality sector faced three data breaches this week. Choice Hotels International disclosed a social‑engineering attack that accessed franchisee and applicant records, including names and Social Security numbers, despite multi‑factor authentication. Wynn Resorts is alleged to have had 800,000 employee...
This Is How You Do It: Dentist Speaks Out After Practice Hit by Cyber Attack
Grange Dental Care in Northern Ireland suffered a cyber attack on Thursday morning, resulting in fraudulent invoice emails being sent from its system. The breach was identified at 9:50 am, and the dentist immediately alerted his IT provider, who halted the...
Discord’s Age Verification Data Has a Frontend Leak — Now What?
Discord’s new age‑verification system, powered by identity vendor Persona, has a critical frontend exposure. Security researchers discovered that verification components are reachable on the public web, potentially revealing users’ age‑related data. The flaw adds urgency to Discord’s 2026 compliance roadmap,...