Incidents in sector:
Ledger confirmed that wallets sold by its reseller CryptoBilis hid an unauthorized implant, after analysts tied tens of millions of dollars in crypto theft to it.
South Korea's Shinhan Bank disclosed that attackers bypassed authentication on a service used by loan agents and exposed the personal and loan data of about 25,000 customers, in an intrusion investigators suspect was driven by AI penetration-testing tools.
Polish online invoicing service Fakturownia, used by more than 600,000 businesses, disclosed that an attacker accessed its servers for about 38 hours and copied account, contractor, invoice and payment data, along with password hashes and API tokens.
Cryptocurrency exchange Bitget said suspected North Korean attackers spoofed transaction data through a compromised backend to drain about $351.6 million from its hot and warm wallets.
US brokerage DriveWealth said a social-engineering attack exposed historic personal data of fintech customers, including Revolut, Stake and Hatch users who once traded US stocks through it.
British fintech Revolut disclosed that an unauthorized party used a legitimate government agency's email domain to submit fraudulent requests and obtain sensitive data on a limited number of customers, reportedly targeting high-net-worth users.
Canadian fintech Wealthsimple confirmed that a supply-chain compromise of a third-party software package exposed personal data — including contact details, government IDs, Social Insurance Numbers and account numbers — for a small fraction of its roughly three million clients.
Hackers used stolen IT-vendor credentials to break into the Pix transaction-processing environment of Brazilian fintech Sinqia, a subsidiary of Evertec, and attempted to move more than $130 million in fraudulent real-time payments before the activity was halted.
Apollo Global Management disclosed that a phone-based social-engineering attack gave intruders access to its cloud systems for four days in July 2026, exposing names, dates of birth, contact details, home addresses and Social Security numbers as part of a wider campaign targeting financial firms.
Crypto-wallet maker SafePal disclosed that an authorization flaw in an order-tracking plugin let one customer view others' order records, exposing names, contact details and purchase information for about 39,798 customers without touching wallet keys or funds.
Nigerian lender Zenith Bank confirmed on 4 August 2026 that attackers had accessed a limited set of customer information, including email addresses and phone numbers.
An extortion crew calling itself Triple X listed India's state-owned Bank of Baroda on its dark-web site, claiming to have stolen about 1TB of customer and internal data.
Lease-to-own company Upbound Group disclosed in an SEC filing that customer data obtained in cybersecurity incidents was used to open fraudulent Acima lease agreements, causing about $13 million in losses in the second quarter of 2026.
Ernst & Young is notifying clients after intruders broke into an external IT support platform and downloaded documents containing tax-filing and financial data, including Social Security numbers.
U.S. auto insurer AssuranceAmerica began notifying about 6.9 million people in July 2026 that a March intrusion, traced to a phishing attack on a single employee, exposed their driver's license numbers and other personal data.
Aflac disclosed that attackers who breached its Japanese subsidiary's policyholder portal exfiltrated the personal information of roughly 4.38 million customers and insurance agents.
Attackers compromised a third-party frontend vendor and injected malicious JavaScript into Polymarket's website, tricking users into approving fraudulent transactions and draining about $3 million.
The National Association of Insurance Commissioners disclosed on 23 June 2026 that attackers exploited an Oracle PeopleSoft zero-day to access part of its environment, and by 25 June the extortion group ShinyHunters had published the stolen data online, claiming more than 3.1 terabytes.
The Qilin ransomware group publicly claimed a June cyberattack on the Central Bank of Libya, threatening to leak stolen data after the bank said the intrusion touched a limited number of systems.
A cyberattack against the shared communications infrastructure used by Bank Melli, Bank Saderat, Bank Tejarat and the Export Development Bank of Iran knocked ATMs, point-of-sale terminals and online banking offline, though officials said no customer data was accessed.
Dental benefits administrator DentaQuest confirmed a network breach after the extortion group ShinyHunters leaked roughly 234 GB of stolen data, exposing personal, identity, and health-insurance information tied to about 2.6 million accounts.
On 23 May 2026, French digital health insurer Alan warned members that a cyberattack on its third-party claims processor Almerys had exposed their personal data — names, dates of birth, social security numbers and insurance contract details — though payment, password and health data were spared.
A threat actor put a database from ATOA — a French real-estate tokenization and fractional-investment fintech — up for sale on a dark web forum, exposing roughly 23,685 user and financial records plus 326 full KYC archives containing passports, ID cards and banking details.
In May 2026, an actor using the alias lazasec claimed to have breached CARMF, France's pension and benefits fund for self-employed doctors, leaking a database of up to 2.4 million records with names, contributor codes, postal addresses and last-declaration dates; CARMF said the exposed data was public and non-sensitive.