Incidents in sector:
The U.S. Department of Homeland Security confirmed that hackers breached the Homeland Security Information Network, an unclassified platform used to share sensitive information with federal, state, local and private-sector partners.
The National Association of Insurance Commissioners disclosed on 23 June 2026 that attackers exploited an Oracle PeopleSoft zero-day to access part of its environment, and by 25 June the extortion group ShinyHunters had published the stolen data online, claiming more than 3.1 terabytes.
The Qilin ransomware group publicly claimed a June cyberattack on the Central Bank of Libya, threatening to leak stolen data after the bank said the intrusion touched a limited number of systems.
A breach at the third-party vendor that processes Texas hunting and fishing licence sales exposed the driver's licence numbers, passport numbers and contact details of more than three million Texans, though the state said Social Security numbers and financial data were not taken.
The extortion group ShinyHunters claimed it stole roughly 297GB of payroll, HR and financial records belonging to more than 10,000 current and former Council of Europe staff by exploiting the Oracle PeopleSoft zero-day CVE-2026-35273, prompting the intergovernmental body to investigate.
French authorities confirmed that an attacker hijacked a Tchap user account to access public chat rooms on the French state's secure messaging platform, with the intruder claiming to have scraped tens of thousands of accounts and hundreds of thousands of messages.
The UN World Food Programme disclosed that attackers gained unauthorized access to its self-registration application for Palestine, exposing names, ID and phone numbers, and location data for roughly 600,000 households in Gaza in what may be the largest known breach of humanitarian beneficiary data.
On 22 May 2026, the town hall of Eyguiรจres (Bouches-du-Rhรดne, ~7,000 inhabitants) was hit by a Qilin ransomware attack that took down its municipal IT systems and put residents' administrative and personal data at risk of compromise.
In May 2026, the Haute-Garonne departmental digital media library network (media31.mediatheques.fr) confirmed an intrusion after the threat actor AplaGroup exploited critical vulnerabilities and extracted user-account data on roughly 765 people.
The town of Roubaix disclosed a data breach on its Kiosque famille school-services platform after two user accounts were compromised, exposing identity and schooling details of 165 enrolled children and their families; no banking data was affected.
On 9 May 2026, the threat actor AplaGroup claimed an intrusion into Mรฉdia31, the online media-library platform of the Haute-Garonne departmental libraries (France), exposing data on roughly 765 users; the breach was confirmed on 21 May 2026.
On 3 May 2026 the town of Quiberon (Morbihan, France) was hit by a Qilin ransomware attack that encrypted part of its IT systems and exfiltrated personal data; the city refused the ransom and began a gradual, secured rebuild of its infrastructure.
A hacker using the alias Cybernox claims to be putting up for sale a database attributed to the French Ministry of Sports, Youth and
France's Agence du Service Civique disclosed a personal-data breach affecting its volunteer-host training platform, after a database of contacts at accredited organisations โ names, emails, postal addresses, phone numbers and accreditation numbers โ was published on a cybercrime forum.
On 29 April 2026, the City of Saint-รtienne and Saint-รtienne Mรฉtropole disclosed a security incident at their third-party ticketing provider, prompting the precautionary deactivation of user account passwords and a forced reset for online ticketing customers.
A threat actor leaked a database extracted from Bordeaux Mรฉtropole's tourist tax portal, exposing the names, emails, phone numbers and property addresses of around 11,000 holiday-rental declarants; the metropolitan authority later confirmed the breach.
On 26 April 2026, a database of 1,154 user profiles tied to the French Ministry of Ecological Transition was published online, exposing staff names, professional @developpement-durable.gouv.fr email addresses, login dates and group memberships.
On 26 April 2026, the hacker Angel_Batista republished a dataset on about 59,000 French National Gendarmerie members โ names, phone numbers, personal and professional emails, postings and account details โ scraped in 2025 from the inter-ministerial Resana platform.
ANFR, France's national frequency agency, disclosed that an intrusion into its Radiomaritime online service exposed the personal data โ names, postal addresses, phone numbers, emails and dates of birth โ of roughly 330,000 users; a sample was put up for sale online.
Follow-up reporting on the April 2026 breach at France Titres (ANTS), France's secure-identity-document agency: beyond the officially confirmed ~11.7 million exposed accounts, the threat actor now claims access to roughly 600 million lines of data, including plaintext passwords, API and encryption keys, and source code.
The French Ministry of Higher Education, Research and Space has revealed a security incident affecting the data of certain applicants
France Titres (ANTS), the French government agency issuing secure identity documents, disclosed a breach of its moncompte.ants.gouv.fr portal via an IDOR API flaw; officials confirmed 11.7 million accounts exposed (names, dates of birth, emails, addresses), while a hacker claimed up to 19 million records.
On 18 April 2026, a hacker group claimed on a cybercrime forum to be selling 'Smart Card Middleware Desktop' software attributed to IN Groupe (formerly Imprimerie Nationale), the French state-owned maker of secure identity documents.
On 15 April 2026 France's National Police (DGPN) confirmed that its e-campus online training platform, run by a third-party provider, was hacked in mid-March; the group HexDex claimed 176,317 agent profiles including names, professional emails, locations and login histories.
In April 2026, France's Ardรจche department disclosed a breach in which an attacker exploited a flaw at an external service provider and exfiltrated roughly 26 GB across 88,000+ files of RSA welfare-beneficiary data spanning 2017-2026.
France's DGFiP disclosed that an attacker, using a civil servant's usurped credentials, accessed the FICOBA national bank-account registry between late January and early April 2026, exposing IBAN/RIB details, names and addresses for about 1.2 million accounts.
France's OFII immigration agency notified signatories of the Contrat d'intรฉgration rรฉpublicaine that a January 2026 breach via a compromised subcontractor exposed the names, emails, phone numbers and postal addresses of roughly 2.1 million people.
OFII, France's immigration and integration agency, confirmed in April 2026 that a compromised subcontractor exposed personal data of foreigners enrolled in the Republican Integration Contract, with roughly 2.1 million records offered for sale on BreachForums.
On 1 April 2026, more than 506,000 profiles of young people enrolled in France's Missions Locales network were put up for sale on dark web forums, exposing full identities, contact details, and sensitive data on their education, employment, and social circumstances.
On 31 March 2026, Vaucluse Provence Attractivitรฉ โ the Vaucluse dรฉpartement's public tourism and economic-promotion agency โ disclosed a messaging-system compromise that let attackers send fraudulent emails from its official addresses, exposing the names and email addresses of people who had contacted it.
In late March 2026, France's Systรจme d'Information sur les Armes (SIA), the national firearms registry run by the Interior Ministry, was hit by a leak of records on 62,511 weapons and their owners after a company account was compromised and the data put up for sale.
On 27 March 2026 the European Commission confirmed a cyberattack on the cloud infrastructure hosting its Europa.eu web platform; the ShinyHunters extortion group claimed to have stolen 350+ GB of data and leaked over 90 GB, with around 30 EU entities potentially affected.
On 25 March 2026 a security incident was disclosed at the French National Police's E-campus training platform, where an intruder accessed personal data of officers and administrative staff; a hacker claimed a database of 176,317 agent profiles.
In March 2026, the European Commission's Europa.eu web-hosting infrastructure was breached via a stolen AWS key (Trivy supply-chain compromise); ~91.7 GB of data covering 30+ EU entities โ names, emails, email content and documents โ was exfiltrated and leaked by ShinyHunters.
On 24 March 2026, the Mรฉtropole Aix-Marseille-Provence disclosed a data leak stemming from a compromised subcontractor, potentially exposing around 19,728 user accounts, including email addresses, names and passwords.
In late March 2026, a hacker put up for sale data on 62,511 firearms registered in France's Systรจme d'Information sur les Armes (SIA), exposing owners' names, postal addresses, emails, phone numbers, weapon details and transaction histories.
The 262,651 teachers, future teachers and trainee teachers are affected by a data leak tied to the system managing the education authorities. The incident covers a history of severalโฆ
On 17 March 2026, the actor HexDex claimed on DarkForums a leak from the French Annuaire de l'administration, a centralized public-sector directory, exposing the names, phone numbers, professional and personal addresses, and job titles of roughly 60,000 government agents.
Iran-linked hackers breached Los Angeles' transit agency LA Metro in March 2026, stealing at least 700 GB of internal data and disrupting passenger-information and TAP fare systems.
In March 2026, France's Rรฉgion Occitanie disclosed a breach of its Carte Jeune Rรฉgion scheme after a technical service provider was compromised, exposing the personal data of about 310,000 young beneficiaries โ including some 270,000 ID photos of minors โ which the DumpSec group put up for sale on the dark web.
In early March 2026, France's Centre des Monuments Nationaux disclosed a data leak stemming from a ransomware attack on its online ticketing provider, exposing visitors' emails, names, postal addresses, purchase history and hashed passwords, but no banking data.
On 4 March 2026, a threat actor claimed on a hacking forum to be selling a database tied to France's Agence Nationale de la Cohรฉsion des Territoires (ANCT), allegedly exposing professional and contact details of around 15,000 employees and administrative contacts, with a sample posted as proof.
In early March 2026, MDPH 92 โ the Hauts-de-Seine disability services agency โ accidentally exposed around 500 beneficiaries' email addresses by sending a mass post-cyberattack notice with recipients in CC instead of BCC.
On 2 March 2026, the City of Paris confirmed a data breach affecting the Cours d'Adultes de Paris (adult education) platform, exposing names, dates of birth, emails, postal addresses and phone numbers of users registered before May 2025; no passwords or banking data were affected.
On 2 March 2026, a cybercriminal claimed to have breached Tchap, the French state's secure messaging service run by DINUM, exposing data tied to around 10,000 members and naming internal rooms linked to the Interior Ministry and security forces.
On 2 March 2026, Orlรฉans city hall warned ticket buyers that its online booking provider Vivaticket was hit by a RansomHouse ransomware attack; exposed customer data may include names, emails, country, postal code and purchase history, but no banking details.
In late February 2026, France's family-allowance fund CAF disclosed that around 70,000 RSA welfare recipients' dossiers were exposed after the HubEE inter-agency document platform was breached, leaking names, social-security numbers and contact details.
Disclosed in late February 2026, a compromise of HubEE โ the inter-administrative document-exchange platform operated by France's DINUM โ exposed personal data of RSA welfare claimants, with roughly 70,000 dossiers (about 160,000 documents) affected; no banking data or passwords were exposed.
In February 2026 the LAPSUS$ extortion group claimed the theft of about 420 GB of data from France's Civil Aviation Safety Organisation (OSAC), including ID cards, passports, diplomas, proof-of-address documents and internal files; the data was later leaked in full.
On 20 February 2026, a dataset of roughly 65,000 records on French National Gendarmerie personnel surfaced online, scraped in March 2025 from the inter-ministerial RESANA collaboration platform and exposing names, contact details and job assignments.
On 20 February 2026, a compilation of personal data covering 8,861 staff of the French Ministries of the Interior and Armed Forces โ including names, dates of birth, contact details and internal identifiers โ surfaced on underground forums, part of a wider aggregate of leaks affecting French public agents.
On 20 February 2026, a compiled database exposing 2,393 French state agents โ from the Police, Gendarmerie, Defence ministry, DGSI, DGSE, Customs and the CNIL (including 86 CNIL staff) โ was published on underground forums, leaking identity, contact and professional details aggregated from hundreds of prior breaches.
In February 2026, the French Ministry of Sports, Youth and Community Life had data on roughly 450,000 candidates exfiltrated from its FORรMES sports/youth training platform after a legitimate training organisation's account was compromised, exposing names, contact details and dates and places of birth.
On 19 February 2026 the French Ministry of Sports disclosed that data on roughly 450,000 candidates was exfiltrated from its FORรMES training and diploma platform after a legitimate training-organisation account was compromised, exposing names, contact details and dates and places of birth.
France's tax authority (DGFiP) disclosed on 18 Feb 2026 that an attacker who hijacked a civil servant's credentials accessed FICOBA, the national bank-account registry, exposing identity, address, IBAN and in some cases tax-ID data for about 1.2 million account holders.
France's Ministry of the Economy and Finance disclosed that an intruder who usurped a civil servant's credentials had illegitimately accessed the national bank-account registry FICOBA from late January 2026, exposing the IBAN/RIB details, identity, address and in some cases tax ID of holders of about 1.2 million accounts.
The town hall of Bourg-Achard (Eure, Normandy) disclosed a cyberattack dating to 29 January 2026 that led to a data leak, with municipal room-reservation records among the information exposed; the CNIL, gendarmerie and ANSSI/Normandie Cyber were notified.
A January 2026 breach of Info Jeunes Bourgogne-Franche-Comtรฉ's Carte Avantages Jeunes platform exposed the personal data of roughly 283,000 cardholders, including names, dates of birth, addresses, phone numbers and identity documents, later put up for sale on the dark web.
In early February 2026 the French Office for Biodiversity (OFB) disclosed that an intrusion into its national hunting-licence application exposed personal data of licence candidates, applicants and holders โ including full identity, contact details, nationality and licence numbers.
A leaked file from the City of Paris's municipal adult-education platform (Cours municipaux pour adultes) exposed the personal data of 320,292 registered users, including names, dates of birth, postal addresses, phone numbers and email addresses; no passwords or banking data were involved.
In early February 2026, a hacker put up for sale a database of 66,343 people supported by the CCAS of Dunkerque, exposing names, dates of birth, postal addresses, phone numbers, emails and family-situation details of social-aid beneficiaries.
France's state recruitment portal Choisir le service public disclosed in early February 2026 a breach exposing the application profiles of 377,418 candidates after attackers abused a compromised manager account; names, contact details, birth dates and career data were leaked and offered for sale.
A threat actor claimed to have stolen and put up for sale a database of about 66,343 beneficiaries of the CCAS de Dunkerque, France's municipal social-welfare body, exposing names, emails, phone numbers, dates of birth, addresses and household details.
On 19 January 2026, France's Urssaf disclosed fraudulent access to its DPAE pre-hire declaration API via a compromised partner account, exposing the names, dates of birth, employer SIRET and hire dates of around 12 million employees hired in the past three years.
Accounts linked to Apec Rรฉgion Occitanie (Montpellier / Nรฎmes / Toulouse) are reportedly affected by a leak, according to a claim on Breachforums that mentions a scope of around 3,000 profiles. Toโฆ
In early January 2026, France's immigration and integration agency OFII disclosed a breach traced to a subcontractor handling integration-contract language courses; attackers exposed identity, contact and immigration-status data on foreign residents and advertised 2.1 million records for sale.
On 1 January 2026, a database of around 2.1 million records belonging to France's OFII / ANEF "รtrangers en France" immigration portal was put up for sale on BreachForums, exposing foreign nationals' identities, contact details, family situation and residence-permit data after a subcontractor was compromised.
In late December 2025, the LAPSUS$ Group claimed a breach of France's Ministry of Agriculture and Food, leaking roughly 60 GB (97,210 files) of FTP credentials, SQL databases and system logs spanning 32 departments and 19 business applications.
In late December 2025, the town hall of Lens (Pas-de-Calais, France) disclosed an intrusion into its information system that paralysed municipal services for about a week, blocking staff software and telephone lines; the attack vector was undisclosed and data theft was not confirmed.
On 22 December 2025 a database attributed to the French justice system (justice.fr) recirculated online, exposing personal, professional and banking data โ including IBAN/BIC โ of 1,100+ magistrates, judges, lawyers and judicial staff.
On 19 December 2025 France's Ministry of Sports confirmed a breach of a system tied to the Pass'Sport aid scheme, exposing data on about 3.5 million households โ names, dates of birth, contact details, social security, INE and CAF numbers โ published on a criminal forum.
In December 2025, attackers compromised professional email accounts at France's Ministry of the Interior and accessed sensitive police files including the TAJ criminal-records and FPR wanted-persons databases; the ministry confirmed a few dozen files were exfiltrated while attackers claimed data on 16.4 million people.
On 1 December 2025, France Travail and the Missions Locales network disclosed that an attacker who hijacked a local-mission agent's account accessed records of about 1.6 million young people, exposing names, dates of birth, social security numbers and contact details.
Personal data of 394 La Rochelle residents who booked civil-status appointments was exposed after an attacker exploited a flaw in Synbird, the town hall's third-party appointment-scheduling provider, which serves roughly 1,300 French communes.
Personal data of residents who booked identity-document appointments through the RDV360 platform was exposed when the third-party provider was breached in late 2025, affecting Chatou town hall among roughly 1,300 French municipalities.
In November 2025, the city of Quimper (France) was caught in a supply-chain breach of appointment-booking provider RDV360, exposing roughly 12,000 contact records (name, postal code, email, phone) of residents who booked ID-card or passport renewals since April 2024.
Saint-Aubin d'Aubignรฉ town hall disclosed on 24 November 2025 that residents' contact details were exposed through its appointment-booking provider RDV360, one of ~1,300 French municipalities hit in a third-party breach of ID/passport booking data.
On 19 Nov 2025, Alfortville town hall notified residents that their contact details were exposed in a breach of its appointment-booking provider RDV360, part of a supply-chain attack hitting ~1,300 French municipalities and ~14M records.
On 18 November 2025, users of Resana โ France's interministerial collaborative platform run by DINUM โ were notified of a data exfiltration after attackers logged in with a compromised account. Up to roughly one million public agents were potentially exposed, triggering ransom emails to civil servants.
In November 2025, Synbird โ the SaaS provider handling municipal appointment bookings for around 1,300 French communes โ disclosed a breach in which an attacker abused a weakly-secured PDF export to exfiltrate residents' contact details and appointment information.
Around 50,000 residents who booked ID-card or passport appointments in Brest had personal contact details exposed after a supply-chain breach of the RDV360 appointment-booking platform used by the town hall.
In November 2025, Pajemploi โ the Urssaf service used by French households to declare and pay childcare workers โ disclosed a data theft affecting up to 1.2 million employees, exposing names, social security numbers, dates/places of birth, postal addresses and Pajemploi/accreditation numbers.
In late October 2025, France Travail โ France's public employment agency โ disclosed a breach in which attackers used credentials harvested by infostealer malware to access job-seeker accounts and exfiltrate sensitive personal, identity and financial data; about 16,479 affected records were catalogued.
On 6 October 2025, France Travail โ France's national public employment agency โ was hit by one of several 2025 data leaks, with personal records of roughly 5,500 job seekers exposed, including names, France Travail IDs, registration categories, email addresses, RSA welfare status and CIR identifiers.
On 25 September 2025, a leak attributed to France Travail, France's public employment agency, exposed the personal data of about 9,971 job seekers, including their email addresses, names and the email address of their assigned advisor.
In August 2025, the Swedish system supplier Miljรถdata was the victim of a ransomware attack. Following the attack, data was subsequently published on the dark web and included 870k unique email addresses across various compromised files.
On 12 August 2025, France Travail, France's public employment agency, disclosed unauthorized access to its employer-facing job portal that exposed the contact details of business users โ names, email addresses, phone numbers and an internal technical identifier.
France Travail disclosed on 22 July 2025 that an intrusion via its Kairos platform exposed the personal data of around 340,000 job seekers, including names, postal and email addresses, phone numbers, France Travail IDs and jobseeker status; passwords and bank details were not affected.
Weeks after the CNSS breach, the hacktivist Jabaroot leaked roughly 4 terabytes of data โ millions of property certificates, title deeds, ID cards, passports, and banking documents โ from Morocco's national land conservation agency ANCFCC.
The Czech government publicly attributed a years-long cyber-espionage campaign against an unclassified network of its Ministry of Foreign Affairs to APT31, a group linked to China's Ministry of State Security. The intrusion, active since at least 2022, targeted designated critical national infrastructure.
A hacktivist using the alias Jabaroot leaked more than 53,000 PDF files and CSV databases from Morocco's National Social Security Fund, exposing national ID numbers, salaries, and banking details for nearly 2 million employees across some 500,000 companies.
On 26 February 2025, Nord Emploi โ the Nord department's RSA return-to-employment support platform โ was hit by a data leak exposing personal and social-support records of roughly 200,000 benefit recipients, including identity, contact, CAF/RSA and detailed welfare-accompaniment data.
On 19 February 2025, the Vienne Departmental Fire and Rescue Service (SDIS 86) in France suffered a website compromise that exposed an internal database, including user logins, hashed passwords and email addresses, along with sensitive station and emergency-intervention information.
Attackers exfiltrated Kenya's national company-registry data from the Business Registration Service โ including ownership and beneficial-owner records touching President Ruto and the Kenyatta family's firms โ and offered it for sale on the dark web.
On 31 December 2024, the DragonForce ransomware gang listed Cogitis โ a French inter-municipal IT syndicate serving local authorities โ on its leak site, claiming around 81 GB of exfiltrated data including internal files and personal data tied to the public bodies it supports.
In November 2024, the Chambres d'agriculture d'Occitanie โ France's regional public chambers of agriculture โ were hit by a malware/ransomware-type cyberattack that spread across their interconnected national network and rendered the workstations of roughly 1,000 regional staff unusable.
A threat actor advertised a database said to hold around 37 million records from Peru's national identity registry RENIEC, including DNI numbers, names, birth data, and addresses; RENIEC disputed that its systems were breached.
China-linked Salt Typhoon infiltrated at least nine U.S. telecom providers โ Verizon, AT&T, T-Mobile, Spectrum, Lumen, Consolidated, Windstream โ including the CALEA lawful-intercept systems used for court-authorised wiretaps. Metadata for over a million users was exposed; the U.S. Treasury sanctioned a linked PRC contractor.
On 13 September 2024, France's Assurance retraite (Cnav) disclosed a breach of its PPAS social-action partner portal, exposing data on about 370,000 pension beneficiaries including names, addresses, social security numbers and approximate income.
The Brain Cipher ransomware group encrypted Indonesia's Temporary National Data Centre (PDNS 2), disrupting 282 government services across more than 200 agencies and demanding an $8 million ransom the government refused to pay.
An attacker exploited an unpatched vulnerability in a remote access server to breach the City of Helsinki's Education Division, exposing personal data of tens of thousands of students, guardians, and staff, plus sensitive welfare records.
In April 2024, a substantial volume of data was taken from the Bangladeshi IT services provider Tappware and published to a popular hacking forum. Comprising of 95k unique email addresses, the data also included extensive labour information on local citizens including names, physical addresses, jobโฆ
Unauthorized websites such as XpressVerify and AnyVerify were caught selling Nigerians' National Identification Numbers, Bank Verification Numbers, passports, and other personal data for as little as โฆ100 โ exploiting improperly governed API access to the NIMC identity database.
On 8 March 2024, France's national employment agency France Travail disclosed a data breach exposing the personal data of up to 43 million jobseekers registered over the previous 20 years, including names, dates of birth, social security numbers and contact details.
LockBit 3.0 encrypted the data centres of Italian cloud provider Westpole, taking down PA Digitale's Urbi platform โ which serves 1,300 Italian public administrations including 540 municipalities, the Quirinale presidency, ISTAT, the Bank of Italy, and the Ministry of Environment. Payroll, citizen services, and local-government workflows were degraded for weeks.
Rhysida ransomware operators destroyed servers, demanded ~ยฃ600,000, and leaked 600 GB of internal data when the British Library refused to pay. The main catalogue did not return online โ read-only โ until January 2024. Recovery is consuming 40% of the Library's financial reserves.
A Telegram bot offered up the names, photos, parents' names, phone numbers and addresses of Bangladeshi voters on demand from a 10-digit NID number, leaked through one of 174 organisations with access to the Election Commission's National ID server.
A ransomware attack crippled roughly 80% of the Hong Kong Consumer Council's computer systems, with attackers exfiltrating about 65GB of data and demanding a US$500,000 ransom that the watchdog refused to pay.
A ransomware attack on regional cloud provider IFX Networks cascaded into more than 50 Colombian state and private entities โ including the Ministry of Health, the Judiciary, and the Superintendency of Industry and Commerce โ and affected 762 organisations across Latin America.
A ransomware attack on Sri Lanka's Lanka Government Cloud encrypted around 5,000 gov.lk email accounts โ including the Cabinet Office โ and, because backups were also encrypted, permanently destroyed roughly three months of government email.
Chinese state-linked hackers exploited unpatched Microsoft Exchange ProxyShell flaws to dwell undetected in the UK Electoral Commission's systems for over a year, accessing electoral-register data on roughly 40 million voters.
Attackers exploited an Ivanti Endpoint Manager Mobile zero-day (CVE-2023-35078, CVSS 10.0) to breach a shared ICT platform used by 12 Norwegian government ministries, with exploitation traced back to at least April 2023.
The pro-Russian hacktivist group Anonymous Sudan flooded Kenya's eCitizen government portal with DDoS traffic, knocking out access to roughly 5,000 public services and disrupting M-Pesa, electricity tokens and visa processing for days.
A misconfigured Bangladeshi government birth-and-death registration website exposed the names, addresses, phone numbers and national ID numbers of more than 50 million citizens, discovered accidentally via a Google search.
Turkey's central e-Government portal was harvested for the records of an estimated 85 million citizens and residents, with ID numbers, addresses, phone numbers, family links, health and financial data sold online and updated in near real time.
Cl0p exploited CVE-2023-34362 in Progress Software's MOVEit Transfer to mass-extort over 2,700 organizations, including the BBC, British Airways, and the U.S. Department of Energy.
The Play ransomware gang breached Swiss IT supplier Xplain and leaked around 65,000 documents on the darknet, including sensitive Federal Administration files from the justice, police, and defence departments.
Play ransomware breached Swiss IT services provider Xplain, exfiltrating 1.3 million files. Approximately 65,000 documents belonging to the Swiss Federal Administration โ including classified content, personal data, and readable passwords โ were published on Play's dark-web leak site in June 2023.
China-based Storm-0558 forged authentication tokens using a stolen Microsoft consumer signing key and read email at approximately 25 organisations โ including the US State Department, the Department of Commerce, and the U.S. Ambassador to China. The 'cascade of errors' that enabled it became a defining case for cloud-provider key custody.
A hacker using the alias '9Near' threatened to leak the personal data of 55 million Thais, allegedly sourced via the government's Mor Prom health app; an army sergeant was later identified and surrendered.
In February 2023, the Russian telecommunications provider Convex was hacked by "Anonymous" who subsequently released 128GB of data publicly, alleging it revealed illegal government surveillance. The leaked data contained 150k unique email, IP and physical addresses, names and phone numbers.
In December 2022, Indiaโs government-approved online travel agency RailYatri suffered a data breach. The incident impacted over 31M customers and exposed 23M unique email addresses. Also impacted were names, genders, phone numbers and tickets purchased, including travel information and fares.
The hacktivist group Guacamaya breached the Chilean armed forces' Estado Mayor Conjunto, exfiltrating over 400,000 emails from 162 military accounts spanning a decade and exposing sensitive national-defense intelligence and operational documents.
Ransomware encrypted the Microsoft and VMware ESXi servers of Chile's National Consumer Service (SERNAC), disrupting its systems and online services and prompting the government CSIRT to issue a state-wide cybersecurity alert.
Greece's 'Predatorgate' wiretapping scandal exposed the use of Intellexa/Cytrox's Predator spyware and parallel legal surveillance against journalists, politicians and officials, toppling intelligence chiefs and ending in landmark 2026 convictions.
Iran's Ministry of Intelligence and Security, operating as 'HomeLand Justice', spent 14 months dwelling in Albanian government networks before launching ransomware-style file encryption and disk-wiping malware. Albania suspended online public services and became the first country in history to sever diplomatic ties with another state over a cyberattack.
An exposed Shanghai Public Security Bureau database left a hacker known as 'ChinaDan' offering 23 terabytes of data on roughly 1 billion Chinese residents โ names, national ID numbers, phone numbers, addresses and police case records โ for 10 bitcoin, in what is widely regarded as the largest government data breach in Chinese history.
The BlackCat/ALPHV ransomware gang encrypted around 3,000 computers of Austria's Carinthia state government and demanded $5 million, halting passport issuance, traffic-fine processing and COVID-19 contact tracing for weeks. The state refused to pay and rebuilt from backups.
Conti encrypted 27 Costa Rican government institutions including the Ministry of Finance, paralyzing tax collection and customs for months. President Chaves declared a national emergency โ the first cyber-incident state of emergency in history.
On the eve of Russia's invasion, a destructive wiper disguised as ransomware corrupted master boot records and files across dozens of Ukrainian government, IT and non-profit organisations, defacing official websites and signalling the cyber dimension of the coming war.
A Hive ransomware attack on Newfoundland and Labrador's health-care network crippled IT systems across the province, forcing the cancellation of thousands of appointments and procedures in what officials called the worst cyberattack in Canadian history.
An attacker used a compromised government VPN account to query Argentina's RENAPER national ID database for all 45 million Argentines. Photos and ID details for the president, soccer star Lionel Messi, and other public figures were posted to Twitter as proof. The data went on sale on a dark-web forum.
A hacker accessed Argentina's RENAPER national identity registry through a stolen government VPN credential, obtaining ID-card data and photographs on the country's entire population of roughly 45 million citizens.
In October 2021, the Singaporean recruitment website Protemps suffered a data breach that exposed almost 50,000 unique email addresses. The impacted data includes names, email and physical addresses, phone numbers, passport numbers and passwords stored as unsalted MD5 hashes, among troves of otherโฆ
An unsecured Elasticsearch database left the passport numbers, visa data and arrival-card details of more than 106 million foreign visitors to Thailand openly accessible on the internet.
Attackers compromised the data centre of Pakistan's Federal Board of Revenue by exploiting a pirated copy of Microsoft Hyper-V, taking down all tax-authority websites and putting network access for 360 virtual machines up for sale on a Russian dark-web forum.
A RansomEXX ransomware attack encrypted the datacenter of Italy's Lazio Region, knocking the COVID-19 vaccination booking portal offline for days and triggering a domestic terrorism investigation.
A ransomware attack on South Africa's state-owned logistics firm Transnet shut down operations at Durban, Ngqura, Port Elizabeth and Cape Town container terminals, forcing the operator to declare force majeure. Durban โ 60% of Southern Africa's containerised trade โ reverted to paper-based clearance for cargo for a week.
Hungary's national security service used NSO Group's Pegasus spyware to covertly hack the phones of investigative journalists, lawyers, and government critics, with more than 300 Hungarian numbers appearing on a leaked target list.
Personal data on an estimated 279 million Indonesians โ more than the country's living population โ was scraped from the national health-insurance agency BPJS Kesehatan and offered for sale on the RaidForums hacking forum.
Conti operators tricked an HSE user into downloading a booby-trapped Excel attachment; the resulting ransomware forced the Health Service Executive to shut down all of Ireland's healthcare IT systems and exfiltrated 700 GB including COVID-19 vaccination PHI. Recovery cost exceeded โฌ100 million.
China-linked group Hafnium chained four Exchange Server zero-days (ProxyLogon) to plant web shells and steal email; after Microsoft's emergency patch, mass exploitation by multiple groups compromised an estimated 60,000+ organisations worldwide.
In February 2021, the Lithuanian car-sharing service CityBee announced they'd suffered a data breach that exposed 110k customers' personal information. The breach exposed names, email addresses, government issued IDs and passwords stored as unsalted SHA-1 hashes.
Insiders at the Dutch municipal health service GGD stole personal data โ including BSN national ID numbers โ from the CoronIT and HPzone COVID-19 systems and sold it on Telegram, Snapchat and Wickr for โฌ30-โฌ60 per person.
A state-sponsored cyber-espionage operation attributed to China's APT31 breached the internal IT systems of the Finnish Parliament in 2020, compromising email accounts belonging to members of parliament.
Attackers exploited a zero-day in the legacy Accellion File Transfer Appliance to breach New Zealand's central bank, accessing commercially and personally sensitive files; the cleanup cost the Reserve Bank around NZ$3.5 million.
Russian SVR operators trojanized SolarWinds Orion build infrastructure, distributing a backdoored update to 18,000 customers including the U.S. Treasury, Commerce, DHS, State, and Energy departments. The defining state cyberespionage operation of the decade.
The RansomExx gang encrypted more than 1,000 servers at Brazil's Superior Tribunal de Justiรงa, paralysing the country's second-highest court for over a week in the most severe cyberattack ever against a Brazilian public institution.
A phishing campaign compromised 47 Service NSW staff email accounts, exposing 738 GB of data and roughly 3.8 million documents; about 104,000 customers had personal information including driver's licences and birth certificates stolen.
Russia-linked APT28 (Fancy Bear) brute-forced and accessed email accounts of Norwegian members of parliament and staff in August 2020, exfiltrating data in an operation Norway publicly attributed to the GRU.
Netwalker ransomware encrypted the systems of Argentina's national immigration agency, halting all border crossings for about four hours and prompting a $4 million ransom demand that the government refused to pay.
In August 2020, Experian South Africa suffered a data breach which exposed the personal information of tens of millions of individuals. Only 1.3M of the records contained email addresses, whilst most contained government issued identity numbers, names, addresses, occupations and employers, amongstโฆ
A sophisticated, weeks-long intrusion hit Austria's Foreign Ministry over the 2020 New Year, attributed by Austrian media to the Russia-linked Turla APT. The ministry, which runs around 100 diplomatic missions, fought a prolonged espionage operation before declaring its systems cleaned.
In December 2019, the booking website Sonicbids suffered a data breach which they attributed to "a data privacy event involving our third-party cloud hosting services". The breach contained 752k user records including names and usernames, email addresses and passwords stored as PBKDF2 hashes.
DoppelPaymer ransomware paralysed corporate IT systems at Mexican state oil company Pemex, freezing payments and communications for weeks. Attackers demanded 565 BTC (~$5M). Pemex refused to pay; total recovery cost reached approximately $71 million.
In July 2019, a massive data breach of the Bulgarian National Revenue Agency began circulating with data on 5 million people. Allegedly obtained in June, the data was broadly shared online and included taxation information alongside names, phone numbers, physical addresses and 471 thousand uniqueโฆ
A single SQL injection against a rarely-used VAT service let an attacker exfiltrate tax, income, health and pension records on more than 6 million people โ almost the entire adult population of Bulgaria.
In approximately March 2019, the online Brazilian travel agency Hurb (formerly Hotel Urbano) suffered a data breach. The data subsequently appeared online for download the following year and included over 20 million customer records with email and IP addresses, names, dates of birth, phone numbersโฆ
Confidential records of 14,200 HIV-positive people from Singapore's national HIV registry were stolen and leaked online by a foreigner who obtained them through his partner, a Ministry of Health doctor with privileged access.
In May 2018, the South African website for viewing traffic fines online known as ViewFines suffered a data breach. Over 934k records containing 778k unique email addresses were exposed and included names, phone numbers, government issued IDs and passwords stored in plain text.
A multi-year cyber-espionage campaign tied to the Lebanese General Directorate of General Security (GDGS) stole hundreds of gigabytes of data from thousands of victims across 21+ countries using trojanized Android apps and desktop malware.
Tribune India journalists demonstrated that paid intermediaries could provide full Aadhaar records โ including biometric-linked identity data on roughly 1.1 billion Indian residents โ for 500 rupees per record.
A flaw in Infineon's RSA key-generation library (ROCA, CVE-2017-15361) made it theoretically possible to forge digital identities for some 750,000 Estonian ID-cards, forcing a nationwide certificate suspension and emergency remote re-keying.
A botched IT outsourcing deal exposed Sweden's entire vehicle and driver-licence database โ including data on protected identities, police, and military personnel โ to foreign IT workers without security clearance, triggering a national political crisis.
Attackers planted malware on Qatar's state news agency in April 2017 and exploited it on 24 May to publish fabricated quotes attributed to the Emir, providing the pretext used by Saudi Arabia, the UAE, Bahrain, and Egypt to launch a blockade of Qatar.
Two laptops stored at the fallback venue for Hong Kong's 2017 Chief Executive election were stolen, exposing the personal data โ including ID-card numbers โ of all 3.7 million registered voters.
In March 2017, a 27GB database backup file named "Master Deeds" was sent to HIBP by a supporter of the project. Upon detailed analysis later that year, the file was found to contain the personal data of tens of millions of living and deceased South African residents.
A targeted intrusion into Singapore's Ministry of Defence I-net web-surfing system stole the NRIC numbers, phone numbers and birth dates of 850 national servicemen and staff in the country's first publicly disclosed breach of a government defence network.
In January 2016, a large number of unpatched vBulletin forums were compromised by an actor known as "CrimeAgency". A total of 140 forums had data including usernames, email addresses and passwords (predominantly stored as salted MD5 hashes), extracted and then distributed.
A reactivated Shamoon (Disttrack) wiper destroyed thousands of computers across Saudi government bodies including the General Authority of Civil Aviation, overwriting master boot records with the image of a drowned Syrian child.
In September 2016, the new eThekwini eServices website in South Africa was launched with a number of security holes that lead to the leak of over 98k residents' personal information and utility bills across 82k unique email addresses.
In July 2016, a hacker known as Phineas Fisher hacked Turkey's ruling party (Justice and Development Party or "AKP") and gained access to 300k emails. The full contents of the emails were subsequently published by WikiLeaks and made searchable.
Russian GRU Units 26165 (APT28) and 31165 (APT29) compromised the Democratic National Committee, Hillary Clinton campaign, and DCCC. Stolen emails were selectively released via 'DCLeaks', 'Guccifer 2.0', and WikiLeaks to influence the 2016 U.S. presidential election.
A misconfigured MongoDB database left the full Mexican national voter roll โ 93.4 million records including names, addresses, birthdates and national ID numbers โ publicly accessible on Amazon's cloud with no password, for months.
A 6.6 GB database containing the national ID numbers, full names, parents' names, addresses, and dates of birth of 49.6 million Turkish citizens was dumped in cleartext online, exposing nearly the entire adult population.
Hackers defaced the Philippine Commission on Elections website and leaked its entire voter registration database โ records on roughly 55 million voters, including 15.8 million fingerprints and 1.3 million overseas passport numbers โ in one of the largest government breaches ever.
The Russia-linked Sandworm group used spear-phishing, BlackEnergy3, and KillDisk to remotely flip breakers at three Ukrainian regional electricity distribution companies, cutting power to approximately 230,000 customers for 1โ6 hours. It is the first publicly acknowledged successful cyberattack on an electric power grid in history.
Chinese state operators exfiltrated background-investigation forms (SF-86s) for 21.5 million U.S. federal employees and contractors โ the most-damaging intelligence-loss cyber incident in U.S. government history.
A targeted phishing email carrying malware breached the Japan Pension Service, leaking the names, IDs, addresses, and birth dates of about 1.25 million pension enrollees and forcing a national rethink of public-sector cybersecurity.
Russian GRU Unit 26165 (APT28 / Fancy Bear) compromised the Bundestag's parliamentary network, exfiltrating ~16 GB of data including emails from Chancellor Merkel's parliamentary office. Forced a full Bundestag IT estate rebuild.
In April 2015, the Telecom Regulatory Authority of India (TRAI) published tens of thousand of emails sent by Indian citizens supporting net neutrality as part of the SaveTheInternet campaign.
In May 2014, over 25,000 user accounts were breached from the Asian lesbian, gay, bisexual and transgender website known as "Fridae". The attack which was announced on Twitter appears to have been orchestrated by Deletesec who claim that "Digital weapons shall annihilate all secrecy withinโฆ
In 2013 (exact date unknown), the Chinese e-commerce service JD suffered a data breach that exposed 13GB of data containing 77 million unique email addresses. The data also included usernames, phone numbers and passwords stored as SHA-1 hashes.
In July 2018, the Belgian social networking site Netlog identified a data breach of their systems dating back to November 2012 (PDF). Although the service was discontinued in 2015, the data breach still impacted 49 million subscribers for whom email addresses and plain text passwords were exposed.
An intruder gained total control of Dutch certificate authority DigiNotar, issuing more than 500 fraudulent SSL certificates โ including a wildcard for *.google.com used to wiretap some 300,000 Iranian Gmail users โ and triggering the company's collapse.
In October 2010, the Irish bookmaker Paddy Power suffered a data breach that exposed 750,000 customer records with nearly 600,000 unique email addresses.
A three-week wave of distributed denial-of-service attacks crippled Estonian government, banking, and media websites amid a dispute with Russia, becoming the first cyber assault on an entire nation-state and the birthplace of NATO's cyber-defence doctrine.