Incidents in sector:
Japanese karaoke giant Daiichi Kosho warned that a malware infection at an external contractor may have exposed the personal data of about 8.6 million customers and 93,000 others handled on its behalf.
A ransomware attack on SoftBank subsidiary IDC Frontier triggered an automatic shutdown of its IDCF Cloud platform in eastern Japan, knocking out websites for local governments and companies.
Japanese semiconductor test-equipment maker Advantest began notifying individuals that a February 2026 ransomware intrusion had exfiltrated personal data, including Social Security and passport numbers.
Fortinet disclosed CVE-2026-104286, a critical FortiMail flaw exploited in the wild to write arbitrary files to email gateways, prompting an emergency CISA patching order.
US K-12 software vendor Frontline Education began notifying school districts that a flaw in a third-party product let attackers access employee data, including Social Security numbers.
FTAPI, a Munich secure file-transfer vendor used by 2,000+ organisations, confirmed attackers breached one internal server and deployed ransomware after The Gentlemen gang listed it as a victim.
Polish online invoicing service Fakturownia, used by more than 600,000 businesses, disclosed that an attacker accessed its servers for about 38 hours and copied account, contractor, invoice and payment data, along with password hashes and API tokens.
German data-exchange provider FTAPI confirmed ransomware hit one internal server after The Gentlemen's leak-site claim; it says its platform and customer data were unaffected.
Citrix confirmed two critical NetScaler ADC and Gateway zero-days, CVE-2026-88771 and CVE-2026-88772, were exploited in the wild for unauthenticated remote code execution before patches shipped.
Cryptocurrency exchange Bitget said suspected North Korean attackers spoofed transaction data through a compromised backend to drain about $351.6 million from its hot and warm wallets.
Ecommerce platform BigCommerce warned merchants that attackers had compromised credentials for the third-party Ribon and Ribon 1.5 apps, used them to inject malicious scripts into storefronts and accessed shopper names, emails, phone numbers and shipping addresses.
Cisco confirmed active exploitation of CVE-2026-76461, a pre-authentication SQL injection in Secure Email Gateway that lets a crafted email execute commands as root, prompting a CISA remediation order.
Helpfeel's image-sharing service Gyazo disclosed that an attacker exploited a flaw in its image-upload server to run commands and reach its database, exposing about 23.6 million user records and roughly 490 million image metadata records.
Identity-verification provider IDScan.net confirmed that attackers stole more than 150 million driver's license and ID records from its cloud systems, after the data surfaced on a dark web site that let anyone look up individuals across the US and Canada.
Healthcare technology firm Veradigm disclosed that attackers used credentials stolen from a third-party vendor to reach a customer-service API and copy patient data, after The Gentlemen ransomware gang claimed to hold roughly 3.5 million records.
Online mathematics learning platform Mathspace disclosed that attackers exploited a vulnerability in its self-hosted Metabase reporting system to download contact data on 1,079,819 students, staff, parents and guardians in Australia and New Zealand.
HYBE's fan platform Weverse disclosed that a vulnerability in an externally exposed payment API leaked purchase, payment and refund records tied to 422,584 accounts, after South Korea's KISA alerted the company to the flaw.
Chess.com began notifying about 4,500 users that their personal information was exposed after an external threat actor gained unauthorised access to a third-party file-transfer application the platform used.
A wave of security and technology firms disclosed data theft after attackers tracked as UNC6395 abused stolen OAuth tokens from Salesloft's Drift chatbot integration to export data from hundreds of connected Salesforce environments.
Healthcare data migration and archiving vendor Aesto Health reported that an intruder accessed part of its Amazon Web Services environment in December 2025, exposing the medical and identity data of 9,540,683 patients across dozens of provider clients.
Pharmaceutical distribution giant McKesson disclosed a cybersecurity incident involving unauthorized access to third-party applications and the exfiltration of data belonging to a subset of customers in its Oncology & Multispecialty and Medical-Surgical business units.
Manchester Airports Group disclosed a data security incident in which an unauthorized third party obtained personal details relating to around 8.7 million customers of car-park, lounge and in-airport Wi-Fi services across its Manchester, Stansted and East Midlands airports.
Houston-based genetic-testing company Baylor Genetics disclosed a data breach affecting about 2.8 million people after an unauthorized party accessed portions of its network and exfiltrated sensitive health and personal information.
Kansas-based water and wastewater control-systems supplier Micro-Comm was hit by the Barracuda ransomware group, which claimed to have stolen roughly 644 GB of data, prompting FBI scrutiny amid heightened concern over attacks on the U.S. water sector.