Incidents in sector:
A database of 32.8 million alleged Condé Nast user records, covering readers of Vogue, The New Yorker, GQ, WIRED and other titles, was offered for sale on a Russian-language cybercrime forum, expanding a December 2025 leak that had exposed 2.3 million WIRED accounts.
HYBE's fan platform Weverse disclosed that a vulnerability in an externally exposed payment API leaked purchase, payment and refund records tied to 422,584 accounts, after South Korea's KISA alerted the company to the flaw.
A breach at AI music generator Suno, made public in July 2026 via 404 Media and Have I Been Pwned, exposed more than 55 million user records.
The ShinyHunters extortion gang published data it claims to have stolen from Madison Square Garden Sports — owner of the New York Knicks and Rangers — after the company missed a ransom deadline.
Attackers abused a verification flaw in Meta's AI-assisted Instagram account-recovery tool, High Touch Support, to trigger password resets and hijack 20,225 accounts before Meta detected and disabled the tool.
South Korean streaming service TVING disclosed that an unauthorized party accessed member data; a later government investigation found that a stolen developer access key had exposed 39.54 million accounts and 361 technical assets including source code.
In May 2026, the corporate travel management company BCD Travel was claimed as a victim of the ShinyHunters "pay or leak" extortion campaign. Data allegedly obtained from BCD was subsequently published publicly in early June and contained 396k unique email addresses.
Disclosed around 22 May 2026, the Haute-Garonne departmental media library network (Média31) was breached via exploited website vulnerabilities, exposing data on roughly 765 users including names, emails, dates of birth, cities and login details.
In May 2026, the real estate services firm Cushman & Wakefield was the target of a "pay or leak" extortion campaign by the ShinyHunters group. Following the threat, the group publicly published data they alleged had been obtained from the firm, consisting mostly of C&W email addresses along with…
Mediaworks Hungary, a media group widely seen as part of Prime Minister Viktor Orbán's pro-government press ecosystem, disclosed a serious cyberattack after the World Leaks extortion group published roughly 15 million files (8.5 TB) including payroll, contracts and internal communications.
On 29 April 2026, French media-criticism association Acrimed disclosed a cyberattack on its online shop that exposed customers' email addresses, encrypted passwords and order history; names, postal addresses, phone numbers and banking details were said to be unaffected.
In April 2026, data allegedly obtained from CTT, Portugal's national postal service, was posted to a public hacking forum. The data included 468k unique email addresses along with names, phone numbers and parcel tracking numbers which can be used to retrieve the tracking history of the parcel.
The Agence Nationale des Fréquences (ANFR), the public authority responsible for managing the radio spectrum in France, has been the victim of a cyberattack
In April 2026, home security firm ADT confirmed a data breach by ShinyHunters, which listed the company on its website as part of a "pay or leak" extortion attempt. The breach impacted 5.5M unique email addresses along with names, phone numbers and physical addresses.
In April 2026, Canada Life was the victim of a "pay or leak" extortion campaign by the ShinyHunters group. The group subsequently published the data which contained over 200k unique email addresses along with names, phone numbers, physical addresses and, in some cases, customer support tickets.
In April 2026, the hacking collective ShinyHunters claimed to have obtained data from Pitney Bowes as part of a broader extortion campaign that also named several other organisations.
In April 2026, the notorious hacking collective ShinyHunters claimed they had obtained a substantial volume of data belonging to the Carnival cruise operator and attempted to extort the organisation to prevent the data from being leaked.
Social network Bluesky suffered roughly a day of outages affecting feeds, notifications, threads and search after what it confirmed was a sophisticated distributed denial-of-service attack; the pro-Iran hacktivist group 313 Team claimed responsibility.
On 16 April 2026, a threat actor known as ChimeraZ claimed to be distributing a roughly 6,600-record database stolen from ETAI (Infopro Digital Automotive), exposing French garages' business identifiers, contact details and hashed account credentials.
Rockstar Games confirmed that a limited amount of non-material company information was accessed in a third-party data breach after ShinyHunters claimed it had reached the studio's Snowflake instances through stolen tokens from analytics provider Anodot and issued a pay-or-leak demand.
In April 2026, the commercial real estate brokerage firm Marcus & Millichap was named as one of multiple alleged victims of the ShinyHunters hacking and extortion group.
In April 2026, the hacking group ShinyHunters claimed they had breached Amtrak. The group typically compromises organisations' Salesforce instances before demanding a ransom and later, if not paid, dumping the data publicly.
In April 2026, the music trivia platform SongTrivia2 suffered a data breach that was subsequently published to a public hacking forum. The data contained a total of 291k unique email addresses sourced from either Google OAuth logins or accounts created on the site, the latter also containing bcrypt…
In March 2026, a breach of one of the many iterations of the BreachForums hacking forum known as "Version 5" was publicly disclosed. The incident exposed 340k unique email addresses along with usernames and argon2 password hashes.