https://cybershitty.com/breaches New entries on the 2026 data breach tracker, each with its sources and confirmed-or-claimed status. en-in https://cybershitty.com/breaches/keio-2026 https://cybershitty.com/breaches/keio-2026 Fri, 25 Sep 2026 18:30:00 GMT Japanese railway operator confirmed ransomware on group servers that disrupted some group business systems, not trains; data access still under investigation. https://cybershitty.com/breaches/renfe-2026 https://cybershitty.com/breaches/renfe-2026 Thu, 24 Sep 2026 18:30:00 GMT Spanish rail operator confirmed an attack via compromised Adif servers; names and emails, later ID numbers and encrypted passwords, possibly affected. https://cybershitty.com/breaches/times-car-2026 https://cybershitty.com/breaches/times-car-2026 Thu, 24 Sep 2026 18:30:00 GMT Park24 confirmed a third party took data from about 6.6M Times Car accounts, including licence images and unrecoverable passwords; card data not leaked. https://cybershitty.com/breaches/pentagon-dmdc-2026 https://cybershitty.com/breaches/pentagon-dmdc-2026 Wed, 23 Sep 2026 18:30:00 GMT Unauthorised users reached a DMDC file-sharing server; unencrypted SSNs and service data of 2.76M living and 294,000 deceased people exposed. https://cybershitty.com/breaches/fbi-jobs-portal-2026 https://cybershitty.com/breaches/fbi-jobs-portal-2026 Mon, 21 Sep 2026 18:30:00 GMT ShinyHunters claims staff data theft via a PeopleSoft flaw; FBI confirms only that it is investigating, and its job portals are offline. https://cybershitty.com/breaches/revolut-2026 https://cybershitty.com/breaches/revolut-2026 Fri, 11 Sep 2026 18:30:00 GMT Revolut handed customer data, including ID documents and statements, to a third party that sent fraudulent requests from a real government email domain. https://cybershitty.com/breaches/idscan-net-2026 https://cybershitty.com/breaches/idscan-net-2026 Mon, 31 Aug 2026 18:30:00 GMT ID-verification firm said an unauthorised party may have copied customer names and licence numbers; Krebs tied it to a service selling 153M+ licences. https://cybershitty.com/post/atf-major-incident-qilin-calea https://cybershitty.com/post/atf-major-incident-qilin-calea Wed, 26 Aug 2026 18:30:00 GMT ATF confirmed a breach of a standalone CALEA-related system, designated a major incident; Qilin claimed it and posted ~6.3GB of unverified files. https://cybershitty.com/post/boston-scientific-cyberattack-guidance https://cybershitty.com/post/boston-scientific-cyberattack-guidance Tue, 25 Aug 2026 18:30:00 GMT Global disruption from late August; CrowdStrike's findings (22 Sep) say entry was via an external network device, with no evidence data was accessed or taken. https://cybershitty.com/breaches/dodo-payments-2026 https://cybershitty.com/breaches/dodo-payments-2026 Sun, 16 Aug 2026 18:30:00 GMT Bengaluru payments firm said attackers used a Metabase flaw to reach an internal analytics system holding some merchant data; a dark-web listing claims more. https://cybershitty.com/breaches/aesto-health-2026 https://cybershitty.com/breaches/aesto-health-2026 Thu, 13 Aug 2026 18:30:00 GMT Health-data archiving vendor reported 9,540,683 people to HHS after unauthorised access to its AWS environment in December 2025. https://cybershitty.com/post/ceva-logistics-cyberattack-european-warehouses https://cybershitty.com/post/ceva-logistics-cyberattack-european-warehouses Sun, 09 Aug 2026 18:30:00 GMT Intrusion from 29 July halted eight European warehouses and exposed shipping data held for clients incl. Bol, De Bijenkorf, ING and Valve. https://cybershitty.com/post/bank-of-baroda-cyber-incident-data-leak-claims https://cybershitty.com/post/bank-of-baroda-cyber-incident-data-leak-claims Mon, 27 Jul 2026 18:30:00 GMT Bank disclosed a cyber incident linked to a possible business email compromise after an anonymous claim of data access; ~1TB leak claims are unverified. https://cybershitty.com/breaches/dentaquest-2026 https://cybershitty.com/breaches/dentaquest-2026 Thu, 16 Jul 2026 18:30:00 GMT Dental benefits firm began notifying at least 15M people of May network access exposing SSNs, Medicaid/Medicare IDs and dental data. https://cybershitty.com/breaches/abbott-2026 https://cybershitty.com/breaches/abbott-2026 Wed, 15 Jul 2026 18:30:00 GMT Abbott confirmed unauthorised access to legacy Exact Sciences cancer-diagnostics systems; ShinyHunters claims 30M customer rows. https://cybershitty.com/post/reliance-infrastructure-kudankulam-data-breach https://cybershitty.com/post/reliance-infrastructure-kudankulam-data-breach Wed, 15 Jul 2026 18:30:00 GMT Reliance confirmed a 'partial breach' of a Yotta-hosted server after files tied to Kudankulam nuclear plant work appeared on a leak site. https://cybershitty.com/breaches/umang-2026 https://cybershitty.com/breaches/umang-2026 Mon, 13 Jul 2026 18:30:00 GMT Researchers found flaws exposing EPFO UANs, LPG bookings and plaintext Aadhaar numbers via linked services; MeitY said data in affected APIs is now encrypted. https://cybershitty.com/breaches/national-testing-agency-2026 https://cybershitty.com/breaches/national-testing-agency-2026 Tue, 07 Jul 2026 18:30:00 GMT MediaNama found about 15.5 lakh CUET-UG 2026 candidate records offered for sale; NTA says it shares data only via DigiLocker and authorised APIs. Origin unclear. https://cybershitty.com/post/adapthealth-breach-4-1-million-patients https://cybershitty.com/post/adapthealth-breach-4-1-million-patients Wed, 01 Jul 2026 18:30:00 GMT Home medical equipment provider disclosed June data theft via a contractor's session; later reported 4,115,802 people affected to HHS. https://cybershitty.com/breaches/idrbt-2026 https://cybershitty.com/breaches/idrbt-2026 Sun, 28 Jun 2026 18:30:00 GMT Unauthenticated APIs in the RBI-mandated .bank.in registrar exposed data on 5,576 bank staff for 13+ months; CERT-In said the issue was fixed. https://cybershitty.com/breaches/lastpass-2026 https://cybershitty.com/breaches/lastpass-2026 Mon, 22 Jun 2026 18:30:00 GMT Password manager said support-case data with names and contact details was stolen via the Klue breach; vaults and its own systems unaffected. https://cybershitty.com/post/bajaj-auto-ransomware-attack https://cybershitty.com/post/bajaj-auto-ransomware-attack Mon, 22 Jun 2026 18:30:00 GMT Automaker told stock exchanges ransomware hit its systems and tech subsidiary; operations continued and it did not say if data was taken. https://cybershitty.com/post/tata-electronics-cyber-incident-world-leaks-claims https://cybershitty.com/post/tata-electronics-cyber-incident-world-leaks-claims Sun, 21 Jun 2026 18:30:00 GMT Apple and Tesla supplier confirmed a cyber incident after ~630GB (204,000+ files) of alleged company data was posted online. https://cybershitty.com/breaches/klue-2026 https://cybershitty.com/breaches/klue-2026 Thu, 18 Jun 2026 18:30:00 GMT Competitive-intel vendor said a 2022 pilot credential was reused to reach customer Salesforce data, hitting LastPass, Jamf and others. https://cybershitty.com/breaches/ultrahuman-2026 https://cybershitty.com/breaches/ultrahuman-2026 Mon, 01 Jun 2026 18:30:00 GMT Wearables maker told users in June that credentials stolen from an employee laptop gave read-only access to contact, purchase and fitness data on 27 March. https://cybershitty.com/breaches/pay-tel-communications-2026 https://cybershitty.com/breaches/pay-tel-communications-2026 Wed, 27 May 2026 18:30:00 GMT UpGuard found an open cloud server with 300,000+ callers' IDs at the prison payphone firm; Pay Tel says it closed it by 14 May and only researchers accessed it. https://cybershitty.com/breaches/carnival-corporation-2026 https://cybershitty.com/breaches/carnival-corporation-2026 Tue, 26 May 2026 18:30:00 GMT Cruise operator told Maine's AG that just under 6M people had names, contact details, birth dates and state ID numbers exposed after an April attack. https://cybershitty.com/breaches/uk-visa-portal-2026 https://cybershitty.com/breaches/uk-visa-portal-2026 Tue, 26 May 2026 18:30:00 GMT A private visa-help site exposed at least 100,000 documents incl. passports and selfies via a cloud storage flaw, TechCrunch found. https://cybershitty.com/breaches/charter-communications-2026 https://cybershitty.com/breaches/charter-communications-2026 Mon, 25 May 2026 18:30:00 GMT Charter confirmed a breach; ShinyHunters claims vishing and Salesforce access and 40M records. Charter says no sensitive personal data or CPNI was taken. https://cybershitty.com/breaches/cbse-2026 https://cybershitty.com/breaches/cbse-2026 Thu, 21 May 2026 18:30:00 GMT Student researchers showed admin access to CBSE's marking portal; CBSE said on 26 May it was a test site, then on 1 June that the vulnerabilities were contained. https://cybershitty.com/breaches/hdfc-asset-management-company-2026 https://cybershitty.com/breaches/hdfc-asset-management-company-2026 Sun, 17 May 2026 18:30:00 GMT Fund house reported a cyber incident found 16 May; Bombay HC barred use of data the Morpheus group claims to hold. HDFC AMC has not confirmed data loss. https://cybershitty.com/breaches/reqrea-2026 https://cybershitty.com/breaches/reqrea-2026 Thu, 14 May 2026 18:30:00 GMT A public cloud bucket held over 1M passports, licences and selfies from a hotel check-in system; the firm secured it and is reviewing exposure. https://cybershitty.com/breaches/instructure-2026 https://cybershitty.com/breaches/instructure-2026 Thu, 30 Apr 2026 18:30:00 GMT Canvas maker confirmed two intrusions exposing usernames, emails, enrolments and messages; it later said it reached an agreement with the attacker. https://cybershitty.com/breaches/vercel-2026 https://cybershitty.com/breaches/vercel-2026 Sat, 18 Apr 2026 18:30:00 GMT Vercel said an attacker took over an employee's Google account via a compromised Context.ai OAuth app and read non-sensitive environment variables. https://cybershitty.com/breaches/duales-2026 https://cybershitty.com/breaches/duales-2026 Wed, 01 Apr 2026 18:30:00 GMT Toronto money-transfer app left an Amazon storage server of customer licences and passports public; files locked after TechCrunch alert. https://cybershitty.com/breaches/european-commission-2026 https://cybershitty.com/breaches/european-commission-2026 Thu, 26 Mar 2026 18:30:00 GMT The Commission disclosed a breach on 27 March; CERT-EU later said a stolen AWS key from the Trivy supply-chain compromise led to theft of ~92GB of data. https://cybershitty.com/breaches/carecloud-2026 https://cybershitty.com/breaches/carecloud-2026 Mon, 23 Mar 2026 18:30:00 GMT Health IT firm disclosed a March intrusion into an EHR environment; in August it reported about 3.7M patients' records stolen to HHS. https://cybershitty.com/breaches/stryker-2026 https://cybershitty.com/breaches/stryker-2026 Tue, 10 Mar 2026 18:30:00 GMT Stryker confirmed a global disruption of its Microsoft environment; pro-Iran group Handala claimed it wiped devices and took 50TB of data. https://cybershitty.com/breaches/bhavnagar-district-co-operative-bank-2026 https://cybershitty.com/breaches/bhavnagar-district-co-operative-bank-2026 Tue, 10 Mar 2026 18:30:00 GMT Police say the accused changed mobile numbers linked to four accounts and pushed ~1,170 NEFT transfers, siphoning ₹7.34 crore; ₹2.04 crore frozen. https://cybershitty.com/breaches/fbi-2026 https://cybershitty.com/breaches/fbi-2026 Thu, 05 Mar 2026 18:30:00 GMT FBI confirmed intrusion into an unclassified system holding pen-register surveillance returns, exposing targets' phone numbers; later a major incident. https://cybershitty.com/breaches/davaindia-pharmacy-2026 https://cybershitty.com/breaches/davaindia-pharmacy-2026 Thu, 12 Feb 2026 18:30:00 GMT Insecure admin APIs exposed ~17,000 online orders and control of 883 stores, a researcher disclosed in February; the flaw was fixed in 2025 after a CERT-In report. https://cybershitty.com/breaches/crunchbase-2026 https://cybershitty.com/breaches/crunchbase-2026 Sun, 25 Jan 2026 18:30:00 GMT Crunchbase confirmed documents were exfiltrated from its corporate network; ShinyHunters claims 2M+ records and says it used social engineering.