Incidents by attack type:
UK online fashion retailer ASOS confirmed that attackers used stolen employee credentials to access customer data via third-party platforms, after shoppers received hacker-controlled push notifications through its app.
Astrana Health disclosed in an SEC filing that attackers used phone-based social engineering, spoofing its corporate number and impersonating staff, to access confidential data on its servers.
British fintech Revolut disclosed that an unauthorized party used a legitimate government agency's email domain to submit fraudulent requests and obtain sensitive data on a limited number of customers, reportedly targeting high-net-worth users.
Apollo Global Management disclosed that a phone-based social-engineering attack gave intruders access to its cloud systems for four days in July 2026, exposing names, dates of birth, contact details, home addresses and Social Security numbers as part of a wider campaign targeting financial firms.
After RingCentral refused to pay an extortion demand, the ShinyHunters group dumped a data archive exposing names, email addresses, phone numbers and physical addresses linked to roughly 1.6 million customer accounts, stolen via a social-engineering intrusion earlier in the summer.
French intellectual property management company Questel confirmed that a voice-phishing attack gave ShinyHunters access to part of its Microsoft 365 environment, after the group leaked data that breach indexes tie to about 1.7 million records.
U.S. home security provider Brinks Home confirmed a cybersecurity incident after ShinyHunters claimed it stole 4.9 million Salesforce records and support chat logs through a Microsoft Entra voice-phishing call.
Cardiac monitoring company iRhythm Technologies disclosed in an SEC filing that attackers used social engineering to exfiltrate proprietary data and patient health information from third-party-hosted business applications, then demanded payment to keep it private.
French authorities confirmed that an attacker hijacked a Tchap user account to access public chat rooms on the French state's secure messaging platform, with the intruder claiming to have scraped tens of thousands of accounts and hundreds of thousands of messages.
The world's largest cruise operator began notifying almost 6 million people that an attacker who socially engineered an employee had copied names, contact details, dates of birth and passport and driver's license numbers, weeks after ShinyHunters leaked data it claimed to have stolen.
U.S. cable and broadband provider Charter Communications confirmed a data breach after ShinyHunters threatened to leak customer records it said it exported from Charter's Salesforce environment following a voice-phishing attack on an employee's Microsoft Entra account.
An attacker posing as a customer infected DigiCert support workstations via chat and harvested EV code signing initialization codes; 60 certificates were revoked, some used to sign Zhong Stealer.
Solana-based perpetual futures exchange Drift Protocol lost roughly $280 million after an attacker abused Solana durable nonces to seize the administrative powers of its Security Council, in a theft that blockchain analysts linked to North Korea.
On 29 January 2026, Match Group — parent of Hinge, Match and OKCupid — disclosed a breach after the ShinyHunters group used a vishing attack to hijack an employee Okta SSO account; exposed PII included names, dates of birth, phone numbers and IP addresses.
In August 2025, Google confirmed that a Salesforce CRM instance holding contact data for small-business Google Ads prospects was breached by ShinyHunters (UNC6040) via a vishing attack, exposing roughly 2.55 million records of business names, emails and phone numbers.
A junior developer at C&M Software — a Central Bank-authorized provider of Pix instant-payment connectivity — was paid roughly R$5,000 to hand over credentials. Attackers used the access to drain approximately R$800 million ($148 million) from reserve accounts at six Brazilian financial institutions in 2.5 hours.
On 8 March 2024, France's national employment agency France Travail disclosed a data breach exposing the personal data of up to 43 million jobseekers registered over the previous 20 years, including names, dates of birth, social security numbers and contact details.
A teenage Lapsus$ member breached Rockstar Games' internal Slack and developer systems via social engineering, then leaked roughly 90 in-development clips of the unreleased Grand Theft Auto VI — one of the largest leaks in video-game history.
An 18-year-old affiliated with Lapsus$ socially engineered an Uber contractor, defeated MFA through an hour-long push-bombing campaign, then found hardcoded admin credentials on an internal share that unlocked Uber's AWS, G-Suite, Slack, and HackerOne dashboards.
The Lapsus$ extortion group compromised a laptop belonging to a support engineer at Okta subprocessor Sitel, gaining a 25-minute window of access in January 2022 that touched two customer tenants. The breach only became public when Lapsus$ posted screenshots in March.
Over 700 customers of the Philippines' largest bank, BDO Unibank, lost money through unauthorized online transfers routed to UnionBank accounts under the alias 'Mark Nagoyo'; five suspects were later arrested and BDO reimbursed victims.
A phishing campaign compromised 47 Service NSW staff email accounts, exposing 738 GB of data and roughly 3.8 million documents; about 104,000 customers had personal information including driver's licences and birth certificates stolen.
A fraudster posing as a legitimate Experian client obtained the personal data of 24 million South Africans and 793,749 businesses in what became one of the largest data breaches in South African history.
Attackers used phone spear-phishing against Twitter employees to reach an internal admin 'agent' tool, hijacked 130 high-profile accounts including Obama, Musk, Bezos, and Apple, and posted a Bitcoin-doubling scam that netted roughly $118,000.