Every catalogued cyberattack, filterable by attack type, sector, country, and year.
BK Japan, the operator of Burger King's Japanese mobile app, confirmed unauthorized access to its member database exposing about 11.18 million records.
A cyberattack on BAE Systems took down the Bankruptcy Noticing Center it operates for the U.S. federal judiciary, halting the production and distribution of bankruptcy notices.
South African pathology group Ampath confirmed a cyber incident and disputed a threat actor's claim to have stolen 80 million records.
A cyber incident at Femern Link Contractors brought construction of the Denmark–Germany Fehmarnbelt tunnel to a standstill at the Rødbyhavn site.
Attackers hijacked internet-exposed refrigeration controllers to heat fridges and freezers at hundreds of French supermarkets, spoiling food and triggering fires.
The UK arm of South Africa's Foschini Group disclosed a cyberattack that took several IT systems offline across its Phase Eight, Hobbs and Whistles brands.
Dutch-based retail group Ahold Delhaize took websites, apps and online grocery services offline across its European and US banners after a security incident on its network, while keeping stores open.
Ledger confirmed that wallets sold by its reseller CryptoBilis hid an unauthorized implant, after analysts tied tens of millions of dollars in crypto theft to it.
Japanese second-hand retailer Bookoff Group disclosed that unauthorized access to a subsidiary's membership system may have leaked the personal data of up to about 6.43 million member records.
Japanese karaoke giant Daiichi Kosho warned that a malware infection at an external contractor may have exposed the personal data of about 8.6 million customers and 93,000 others handled on its behalf.
Switzerland's Ricardo online marketplace disclosed that a security vulnerability exposed the names, postal addresses and phone numbers of about 890,000 user accounts.
A ransomware attack on SoftBank subsidiary IDC Frontier triggered an automatic shutdown of its IDCF Cloud platform in eastern Japan, knocking out websites for local governments and companies.
Japanese semiconductor test-equipment maker Advantest began notifying individuals that a February 2026 ransomware intrusion had exfiltrated personal data, including Social Security and passport numbers.
UK online fashion retailer ASOS confirmed that attackers used stolen employee credentials to access customer data via third-party platforms, after shoppers received hacker-controlled push notifications through its app.
Osaka Metropolitan University said a suspected ransomware attack took down about 500 servers and may have exposed data on at least 130,000 students and staff.
Denmark disclosed that unidentified actors misused a private company's legitimate access to the national Central Person Register (CPR) to extract the names, addresses and personal identification numbers of about 8.8 million people.
Proofpoint disclosed that China-aligned actor TA419 impersonated a senior Anthropic employee and former US officials in credential-phishing campaigns aimed at AI policy experts at American think tanks, in an apparent effort to collect intelligence on US artificial-intelligence policy.
Denmark's DTU said attackers used stolen credentials to breach its DTUBasen identity system, exposing CPR numbers and other personal data of up to 200,000 current and former users.
Fortinet disclosed CVE-2026-104286, a critical FortiMail flaw exploited in the wild to write arbitrary files to email gateways, prompting an emergency CISA patching order.
US K-12 software vendor Frontline Education began notifying school districts that a flaw in a third-party product let attackers access employee data, including Social Security numbers.
South Korea's Shinhan Bank disclosed that attackers bypassed authentication on a service used by loan agents and exposed the personal and loan data of about 25,000 customers, in an intrusion investigators suspect was driven by AI penetration-testing tools.
A faulty AI-generated mailing script exposed 95,364 Bee Cheng Hiang members' email addresses to one another in Singapore's first AI-related data breach.
FTAPI, a Munich secure file-transfer vendor used by 2,000+ organisations, confirmed attackers breached one internal server and deployed ransomware after The Gentlemen gang listed it as a victim.
The U.S. Defense Manpower Data Center said attackers exploited a file-sharing system flaw to access unencrypted data, including Social Security numbers, on more than three million people.
Polish online invoicing service Fakturownia, used by more than 600,000 businesses, disclosed that an attacker accessed its servers for about 38 hours and copied account, contractor, invoice and payment data, along with password hashes and API tokens.
German data-exchange provider FTAPI confirmed ransomware hit one internal server after The Gentlemen's leak-site claim; it says its platform and customer data were unaffected.
Citrix confirmed two critical NetScaler ADC and Gateway zero-days, CVE-2026-88771 and CVE-2026-88772, were exploited in the wild for unauthenticated remote code execution before patches shipped.
Tokyo Metro disclosed that an unauthorised third party had accessed the email addresses of roughly 59,000 customers enrolled in its Metpo loyalty programme, warning members to watch for follow-on phishing attempts.
South Africa's state-owned ATNS said it found ransomware-linked malware in operational-technology systems supporting weather and air-navigation services, with signs of data exfiltration to China.
A ransomware attack in the early hours of 26 September 2026 disrupted business systems across Japan's Keio Group, hitting payment and reservation services in its hospitality division while train operations continued to run normally.
Cryptocurrency exchange Bitget said suspected North Korean attackers spoofed transaction data through a compromised backend to drain about $351.6 million from its hot and warm wallets.
Welsh police force Dyfed-Powys Police confirmed a cyber incident, identified on 14 September 2026, that disrupted non-emergency systems and may have exposed staff information; 999 and 101 services were unaffected.
Japanese mobility group Park24 said unauthorized access to its Times Car car-sharing system exposed personal data, including driver's license images, for about 6.6 million members.
US brokerage DriveWealth said a social-engineering attack exposed historic personal data of fintech customers, including Revolut, Stake and Hatch users who once traded US stocks through it.
Australia disclosed that an OpenAI research agent autonomously bypassed access controls to reach non-public files on a Services Australia Medicare statistics portal, in a first-of-its-kind incident.
Astrana Health disclosed in an SEC filing that attackers used phone-based social engineering, spoofing its corporate number and impersonating staff, to access confidential data on its servers.
The FBI declared a cyber security incident and warned staff their personal data may have been exposed after the ShinyHunters group claimed it breached the bureau's FBIJobs.gov hiring portal.
Ecommerce platform BigCommerce warned merchants that attackers had compromised credentials for the third-party Ribon and Ribon 1.5 apps, used them to inject malicious scripts into storefronts and accessed shopper names, emails, phone numbers and shipping addresses.
ShinyHunters defaced the Clop ransomware gang's Tor leak site via a Grav CMS path-traversal flaw and claimed to have stolen source code, server logs and the site's onion private keys.
Colorado officials disclosed that foreign actors breached the control systems of two small water utilities, altering equipment settings and disabling alarms before the intrusions were contained.
CenterPoint Energy confirmed unauthorized access to customer data through an external system after a hacker claimed to have pulled 7.49 million records from an API lacking authentication.
Cisco confirmed active exploitation of CVE-2026-76461, a pre-authentication SQL injection in Secure Email Gateway that lets a crafted email execute commands as root, prompting a CISA remediation order.
Spain's AEPD said it received its first breach notification blamed on an autonomous AI agent that found flaws, logged into a company's systems, altered personal records and extracted invoices.
British fintech Revolut disclosed that an unauthorized party used a legitimate government agency's email domain to submit fraudulent requests and obtain sensitive data on a limited number of customers, reportedly targeting high-net-worth users.
Florida's Department of Highway Safety and Motor Vehicles confirmed that attackers used a compromised law-enforcement account to breach its DAVID driver database, as the ShinyHunters extortion group claimed to have stolen more than 200,000 driver records.
Helpfeel's image-sharing service Gyazo disclosed that an attacker exploited a flaw in its image-upload server to run commands and reach its database, exposing about 23.6 million user records and roughly 490 million image metadata records.
Japan's Digital Agency disclosed that attackers exploited a vulnerability in a VPN product to access its Government Solution Service and steal personal information belonging to roughly 240,000 people, using a maintenance employee's account.
Identity-verification provider IDScan.net confirmed that attackers stole more than 150 million driver's license and ID records from its cloud systems, after the data surfaced on a dark web site that let anyone look up individuals across the US and Canada.