Ledger confirmed that wallets sold by its reseller CryptoBilis hid an unauthorized implant, after analysts tied tens of millions of dollars in crypto theft to it.
US K-12 software vendor Frontline Education began notifying school districts that a flaw in a third-party product let attackers access employee data, including Social Security numbers.
Ecommerce platform BigCommerce warned merchants that attackers had compromised credentials for the third-party Ribon and Ribon 1.5 apps, used them to inject malicious scripts into storefronts and accessed shopper names, emails, phone numbers and shipping addresses.
Canadian fintech Wealthsimple confirmed that a supply-chain compromise of a third-party software package exposed personal data — including contact details, government IDs, Social Insurance Numbers and account numbers — for a small fraction of its roughly three million clients.
A wave of security and technology firms disclosed data theft after attackers tracked as UNC6395 abused stolen OAuth tokens from Salesloft's Drift chatbot integration to export data from hundreds of connected Salesforce environments.
Swiss train manufacturer Stadler Rail confirmed that attackers used compromised credentials to steal technical data from a platform shared with a supplier, and refused a ransom demand of about $12.3 million from the Everest gang.
Attackers pushed five malicious releases of the widely used jscrambler npm package under its legitimate maintainer account, each running a preinstall hook that dropped a cross-platform Rust infostealer onto developers' machines.
Attackers compromised a third-party frontend vendor and injected malicious JavaScript into Polymarket's website, tricking users into approving fraudulent transactions and draining about $3 million.
A dormant API credential let attackers compromise competitive-intelligence platform Klue and harvest OAuth tokens for customers' connected apps, exfiltrating Salesforce records from firms including Huntress and Recorded Future in a supply-chain attack later tied to the Icarus extortion group.
Victim
Klue (and customers including Huntress and Recorded Future)
A hijacked contributor account was used to republish 144 packages in the popular @mastra AI-agent npm scope with a malicious typosquatted dependency, easy-day-js, that pulled down a cross-platform remote-access trojan and cryptocurrency stealer onto any developer machine or build system that installed them.
Attackers stole a CDN API key from Awesome Motive and tampered with JavaScript served to the OptinMonster, TrustPulse and PushEngage WordPress plugins, silently creating rogue administrator accounts and planting backdoors on sites whose logged-in admins loaded the malicious code.
Sonatype researchers uncovered 'Atomic Arch,' a supply-chain campaign in which attackers adopted hundreds of orphaned Arch User Repository packages and rewrote their build scripts to install a malicious npm package that drops a Linux credential stealer with optional eBPF rootkit capabilities.
A self-replicating supply-chain worm dubbed Miasma compromised 73 repositories across four Microsoft GitHub organisations, planting configuration files that harvested cloud and developer credentials when the projects were opened in AI coding agents such as Claude Code and Cursor.
Researchers disclosed IronWorm, a Rust-based, self-propagating infostealer that compromised 36 npm packages, stealing developer and CI secrets and republishing trojanized packages using stolen npm publishing credentials.
On 23 May 2026, French digital health insurer Alan warned members that a cyberattack on its third-party claims processor Almerys had exposed their personal data — names, dates of birth, social security numbers and insurance contract details — though payment, password and health data were spared.
Observability vendor Grafana Labs disclosed that an attacker used a GitHub workflow token it had failed to rotate after the TanStack npm supply-chain attack to download its public and private source code, then refused the resulting ransom demand.
OpenAI confirmed in May 2026 that two employee devices were compromised through the TanStack npm supply-chain attack, allowing attackers to exfiltrate limited authentication credentials from internal code repositories that contained its software signing certificates.
Kaspersky revealed that signed installers downloaded from the official DAEMON Tools website had carried a backdoor since 8 April 2026, infecting thousands of machines in more than 100 countries and delivering follow-on implants, including QUIC RAT, to about a dozen selected targets.
On 4 May 2026 a hacker using the alias Lagui published a database of roughly 96,000 La Redoute customers — names, postal addresses, phone numbers, emails and order/delivery histories — that the retailer traced to a January 2026 breach at its logistics partner Relais Colis.
On 29 April 2026, the City of Saint-Étienne and Saint-Étienne Métropole disclosed a security incident at their third-party ticketing provider, prompting the precautionary deactivation of user account passwords and a forced reset for online ticketing customers.
On 19 April 2026, cloud platform Vercel (creator of Next.js) confirmed a security incident traced to a compromised third-party AI tool, exposing non-sensitive environment variables and a limited subset of customer accounts.
French online toy retailer JeuJouet.com warned customers in April 2026 that its Magento e-commerce platform was compromised in a mass exploitation campaign, potentially exposing names, email addresses, account credentials and order data; no banking details were affected.
On 15 April 2026 France's National Police (DGPN) confirmed that its e-campus online training platform, run by a third-party provider, was hacked in mid-March; the group HexDex claimed 176,317 agent profiles including names, professional emails, locations and login histories.
The online ticketing data of visitors to the Château royal de Blois / Maison de la Magie was exposed in the breach of its provider Vivaticket (Tickeasy), leaking names, email and postal addresses, dates of birth, phone and fax numbers and VAT numbers.