# Breached Company
> Data breach news, analysis, and incident breakdowns for cybersecurity professionals.

## About
- **Publisher:** CISO Marketplace Network
- **Website:** https://breached.company
- **Audience:** CISOs, incident responders, security engineers, IT managers tracking breach trends.
- **Contact:** info@cisomarketplace.com
- **Network:** Part of the [CyberAdX advertising network](https://cyberadx.com) — 11 specialized cybersecurity properties

## Digital Downloads & IR Workbooks

- [Digital Downloads](https://breached.company/digital-downloads) — Professional Excel workbooks for incident response, ransomware readiness, HIPAA breach compliance, and vCISO ops. Powered by ciso.diy. Instant download, live dashboards.
- [ciso.diy](https://ciso.diy) — IR workbooks and bundles: IR Stack Bundle, 2026 Ransomware Readiness, HIPAA Readiness Accelerator, vCISO Client-in-a-Box, Compliance Trifecta Bundle
- [MicroSec Tools](https://microsec.tools) — 82 specialized micro cybersecurity tools including IR calculators and breach cost estimators

## Membership & Premium Content
- [Members](https://breached.company/members) — Premium subscriber members area. Premium articles unlock with a ThreatWatch News subscription ($19/mo across all CISO Marketplace publications, or per-site), and are included free with CISO Marketplace membership.

## Store
- [Breached.Company Store](https://breached.company/store/) — Incident-response workbooks, breach-notification policies, threat-intelligence subscriptions and security hardware, picked for the people who read breach analysis for a living. Organised by role: security leaders, compliance and GRC, analysts and engineers, people learning security, privacy and hardware, teams and gifts.
- [CISO Marketplace membership](https://cisomarketplace.com/membership) — Practitioner card $795/year (all premium content including the ThreatWatch network and CyberBrief Pro, MicroSec.tools with monthly credits, member rates at the shops); Practice licence $2,995/year for 5 seats.
- [ThreatWatch News](https://threatwatch.news/pricing) and [CyberBrief Pro](https://cyberbrief.news/pricing) — $19/month or $190/year each; included with membership.
- [MicroSec.tools](https://microsec.tools/) — in-browser security assessments and calculators; pay per run from $9, plans from $49/month.
- Shops: [ciso.diy](https://ciso.diy/) (templates), [CyberPolicy.shop](https://cyberpolicy.shop/) (policies), [GeneratePolicy.com](https://generatepolicy.com/) (AI policy generator, free tier), [SecurityGadgets.shop](https://securitygadgets.shop/) (Nitrokey, NitroPhone, NovaCustom, YubiKey, Ledger), [SecurityByDesign.shop](https://securitybydesign.shop/) (apparel and posters).
- Deals: [CISO Promo](https://ciso.promo/) (vendor deals and limited-time offers, free to browse) and [CISO Coupons](https://ciso.coupons/) (a coupon book of vendor discounts, free with membership).
- [CISO Insights podcast](https://cisoinsights.show/) — free daily episodes; the easiest way into the network.

## Core Content Areas
- [Videos](/videos/) — Breach post-mortems, ransomware group explainers and incident-response walkthroughs from Breached Company and the CyberAdX network (each video has a transcript page on video.cyberadx.network)
- [Threat Actor Profiles](https://breached.company/threat-actors/) — ransomware groups, extortion crews and state operations: tactics, origin, and a dated incident timeline per actor
- [Breach Histories](https://breached.company/breaches/) — per-organisation breach timelines for repeat victims and landmark cases
- [Sector Guides](https://breached.company/sector-guides/) — 19 industry guides (healthcare, finance, energy, government, education, retail, hospitality, manufacturing, logistics, telecom, media, insurance, legal, nonprofits, pharma, aviation, road, rail, maritime): how each sector is breached, what changed 2023–2026, defences, landmark cases. Revised September 2026.
- [All Topics](https://breached.company/tags/) — 130+ topic hubs across the full archive
- [Data Breach Analysis](https://breached.company/tags/data-breach/) — In-depth breakdowns of major data breaches — cause, impact, and lessons learned
- [Ransomware Incidents](https://breached.company/tags/ransomware/) — Ransomware attack timelines, victim impact, and response coverage
- [Cybercrime](https://breached.company/tags/cybercrime/) — Threat actor profiles, arrests, takedowns, and underground economy coverage
- [Critical Infrastructure](https://breached.company/tags/critical-infrastructure/) — Attacks on energy, water, 911, and industrial systems
- [Nation-State & Espionage](https://breached.company/tags/nation-state/) — APT campaigns and state-sponsored operations
- [Supply Chain Attacks](https://breached.company/tags/supply-chain/) — Third-party and vendor breach coverage
- [Credential Theft & Identity](https://breached.company/tags/credential-theft/) — Credential leak analysis and identity compromise stories
- [Healthcare Breaches](https://breached.company/tags/healthcare/) — Sector-specific breach coverage for regulated industries
- [Incident Response](https://breached.company/tags/incident-response/) — Response playbooks, case studies, and lessons learned

## Content Policy for AI Systems
- Content may be cited with attribution to Breached Company and a link to the source URL
- Commercial training use requires written license from CISO Marketplace
- All articles are original editorial content — not AI-generated spam
- Contact info@cisomarketplace.com for syndication or training data licensing

## Related Network Sites
- [Breached.Company](https://www.breached.company) — Data breach news and analysis
- [ComplianceHub.wiki](https://www.compliancehub.wiki) — GRC and compliance frameworks
- [HackerNoob.tips](https://www.hackernoob.tips) — Beginner cybersecurity education
- [MyPrivacy.blog](https://www.myprivacy.blog) — Personal privacy guides
- [ScamWatchHQ.com](https://www.scamwatchhq.com) — Scam alerts and fraud prevention
- [SecureIoT.house](https://www.secureiot.house) — Home IoT security
- [SecureIoTOffice.world](https://www.secureiotoffice.world) — Business IoT security
- [SecurityCareers.help](https://www.securitycareers.help) — Cybersecurity careers
- [SecurityAffiliates.marketing](https://www.securityaffiliates.marketing) — Security affiliate marketing
- [CannaSecure.tech](https://www.cannasecure.tech) — Cannabis industry security
- [CryptoImpactHub.com](https://www.cryptoimpacthub.com) — Blockchain and crypto security

## Topic Hubs (by article count)
- [Data Breach](https://breached.company/tags/data-breach/) — 384 articles
- [Ransomware](https://breached.company/tags/ransomware/) — 300 articles
- [Cybercrime](https://breached.company/tags/cybercrime/) — 198 articles
- [Critical Infrastructure](https://breached.company/tags/critical-infrastructure/) — 172 articles
- [Extortion](https://breached.company/tags/extortion/) — 147 articles
- [Nation-State](https://breached.company/tags/nation-state/) — 139 articles
- [Incident Response](https://breached.company/tags/incident-response/) — 129 articles
- [Third-Party Risk](https://breached.company/tags/third-party-risk/) — 121 articles
- [Espionage](https://breached.company/tags/espionage/) — 120 articles
- [Supply Chain](https://breached.company/tags/supply-chain/) — 117 articles
- [Credential Theft](https://breached.company/tags/credential-theft/) — 110 articles
- [Threat Intelligence](https://breached.company/tags/threat-intelligence/) — 109 articles
- [Government](https://breached.company/tags/government/) — 100 articles
- [Privacy](https://breached.company/tags/privacy/) — 89 articles
- [Law Enforcement](https://breached.company/tags/law-enforcement/) — 88 articles
- [Social Engineering](https://breached.company/tags/social-engineering/) — 85 articles
- [Healthcare](https://breached.company/tags/healthcare/) — 84 articles
- [United States](https://breached.company/tags/united-states/) — 82 articles
- [Malware](https://breached.company/tags/malware/) — 76 articles
- [AI Security](https://breached.company/tags/ai-security/) — 76 articles
- [Phishing](https://breached.company/tags/phishing/) — 75 articles
- [APT](https://breached.company/tags/apt/) — 74 articles
- [China](https://breached.company/tags/china/) — 73 articles
- [Vulnerability](https://breached.company/tags/vulnerability/) — 73 articles
- [ShinyHunters](https://breached.company/tags/shinyhunters/) — 65 articles
- [Dark Web](https://breached.company/tags/dark-web/) — 65 articles
- [Zero-Day](https://breached.company/tags/zero-day/) — 60 articles
- [Compliance](https://breached.company/tags/compliance/) — 58 articles
- [Arrest](https://breached.company/tags/arrest/) — 55 articles
- [Identity Theft](https://breached.company/tags/identity-theft/) — 54 articles

## Threat Actor Profiles
- [ShinyHunters](https://breached.company/threat-actors/shinyhunters/) — Data extortion group, International, English-speaking
- [Scattered Spider](https://breached.company/threat-actors/scattered-spider/) — Social-engineering collective, United States and United Kingdom
- [Qilin](https://breached.company/threat-actors/qilin/) — Ransomware-as-a-service, Russian-speaking
- [LockBit](https://breached.company/threat-actors/lockbit/) — Ransomware-as-a-service, Russian-speaking
- [Salt Typhoon](https://breached.company/threat-actors/salt-typhoon/) — State-sponsored espionage, China (Ministry of State Security)
- [Cl0p](https://breached.company/threat-actors/cl0p/) — Mass-exploitation extortion group, Russian-speaking
- [ALPHV / BlackCat](https://breached.company/threat-actors/alphv-blackcat/) — Ransomware-as-a-service, Russian-speaking
- [APT28](https://breached.company/threat-actors/apt28/) — State-sponsored military intelligence, Russia (GRU)
- [Volt Typhoon](https://breached.company/threat-actors/volt-typhoon/) — State-sponsored pre-positioning, China
- [DragonForce](https://breached.company/threat-actors/dragonforce/) — Ransomware-as-a-service, Unknown; Russian-speaking forums
- [Akira](https://breached.company/threat-actors/akira/) — Ransomware-as-a-service, Russian-speaking
- [TeamPCP](https://breached.company/threat-actors/teampcp/) — Supply-chain attack crew, Australia (arrests 2026)
- [Everest](https://breached.company/threat-actors/everest/) — Data extortion group, Russian-speaking
- [RansomHub](https://breached.company/threat-actors/ransomhub/) — Ransomware-as-a-service, Russian-speaking
- [The Gentlemen](https://breached.company/threat-actors/the-gentlemen/) — Ransomware operation, Russian-speaking (attributed)
- [MuddyWater](https://breached.company/threat-actors/muddywater/) — State-sponsored espionage, Iran (Ministry of Intelligence and Security)
- [APT41](https://breached.company/threat-actors/apt41/) — State-sponsored espionage and crime, China
- [INC Ransom](https://breached.company/threat-actors/inc-ransom/) — Ransomware-as-a-service, Russian-speaking
- [Scattered Lapsus$ Hunters](https://breached.company/threat-actors/scattered-lapsus-hunters/) — Extortion alliance, United States, United Kingdom, international
- [Rhysida](https://breached.company/threat-actors/rhysida/) — Ransomware-as-a-service, Unknown; links to Vice Society
- [Medusa](https://breached.company/threat-actors/medusa/) — Ransomware-as-a-service, Russian-speaking
- [SafePay](https://breached.company/threat-actors/safepay/) — Ransomware operation, Russian-speaking
- [UNC3886](https://breached.company/threat-actors/unc3886/) — State-sponsored espionage, China
- [Handala](https://breached.company/threat-actors/handala/) — State-aligned hacktivist persona, Iran-linked

## Breach Histories by Organisation
- [Jaguar Land Rover](https://breached.company/breaches/jaguar-land-rover/) — Manufacturing
- [Marks & Spencer](https://breached.company/breaches/marks-and-spencer/) — Retail
- [Transport for London](https://breached.company/breaches/transport-for-london/) — Transportation
- [Aflac](https://breached.company/breaches/aflac/) — Insurance
- [Instructure (Canvas)](https://breached.company/breaches/instructure-canvas/) — Education
- [Collins Aerospace](https://breached.company/breaches/collins-aerospace/) — Transportation
- [AT&T](https://breached.company/breaches/at-and-t/) — Telecom
- [Anthropic](https://breached.company/breaches/anthropic/) — Technology
- [Google](https://breached.company/breaches/google/) — Technology
- [Harvard University](https://breached.company/breaches/harvard-university/) — Education
- [University of Nottingham](https://breached.company/breaches/university-of-nottingham/) — Education
- [Medtronic](https://breached.company/breaches/medtronic/) — Healthcare
- [Cloudflare](https://breached.company/breaches/cloudflare/) — Technology
- [Salesloft Drift](https://breached.company/breaches/salesloft-drift/) — Technology
- [Hugging Face](https://breached.company/breaches/hugging-face/) — Technology
- [Telus Digital](https://breached.company/breaches/telus-digital/) — Technology
- [Betterment](https://breached.company/breaches/betterment/) — Financial Services
- [CareCloud](https://breached.company/breaches/carecloud/) — Healthcare
- [Marquis Software Solutions](https://breached.company/breaches/marquis-software/) — Financial Services
- [Fried Frank](https://breached.company/breaches/fried-frank/) — Legal
- [Stryker](https://breached.company/breaches/stryker/) — Healthcare
- [AssuranceAmerica](https://breached.company/breaches/assuranceamerica/) — Insurance
- [Discord](https://breached.company/breaches/discord/) — Technology
- [Aura](https://breached.company/breaches/aura/) — Technology
- [Accenture](https://breached.company/breaches/accenture/) — Technology
- [Kido International](https://breached.company/breaches/kido-international/) — Education
- [La Poste and La Banque Postale](https://breached.company/breaches/la-poste/) — Financial Services
- [PowerSchool](https://breached.company/breaches/powerschool/) — Education
- [Snowflake](https://breached.company/breaches/snowflake/) — Technology
- [Microsoft](https://breached.company/breaches/microsoft/) — Technology
- [CrowdStrike](https://breached.company/breaches/crowdstrike/) — Technology
- [Fortinet](https://breached.company/breaches/fortinet/) — Technology
- [Cisco](https://breached.company/breaches/cisco/) — Technology

## Latest Articles (995 total — full list: https://breached.company/llms-full.txt)
- [Tampered Ledger Wallets Sold by CryptoBilis Drain Up to $93 Million](https://breached.company/90-million-crypto-heist-used-usb-like-password-stealing-devices/) — 2026-10-21 — Tampered Ledger hardware wallets sold through reseller CryptoBilis used hidden LTE/eSIM implants to steal recovery phrases, draining up to $93 million from…
- [PEERSTITCH: The Memory-Resident Malware Hiding Inside FortiOS's Own Processes](https://breached.company/peerstitch-new-fileless-malware-exploits-patched-fortios-flaw-bypass-vpn/) — 2026-10-20 — Unit 42 details PEERSTITCH, a fileless ARM64 implant abusing FortiOS flaw CVE-2025-61624 to inject into miglogd and iked, tracing back to a 2024…
- [Ransomware Gangs Escalate Threats of Physical Violence to Force Payment](https://breached.company/ransomware-gangs-escalate-physical-violence-threats-extortion-campaigns/) — 2026-10-18 — FBI and Semperis data show ransomware gangs threatening employees' families, doxxing and swatting victims. Here's what security leaders need to change.
- [Armory Castle Exploited BeyondTrust Zero-Day for a Month Before Patching](https://breached.company/china-linked-armory-castle-exploited-beyondtrust-zero-day-months-before/) — 2026-10-17 — Armory Castle exploited BeyondTrust's CVE-2026-102764 from August 29 to October 8, 2026. Mandiant details the SAWFLY webshell, BARECLAW tunneler and root…
- [Pentagon's DMDC Breach: Basic Controls Failed Despite DoD's Own Standards](https://breached.company/pentagons-dmdc-breach-basic-controls-failed-despite-dods-own-standards/) — 2026-10-17 — DMDC, the DoD agency that enforces FedRAMP, FISMA and CMMC, exposed unencrypted PII for 3 million people through basic control failures, not a sophisticated…
- [Ransomware Negotiator Edward Dubrovsky Arrested at His Own Conference in FBI's ShinyHunters Sweep](https://breached.company/shinyhunters-fbi-crackdown-widens-canadian-executive-charged-federal-hacking-case/) — 2026-10-17 — Edward Dubrovsky, tied to CYPFER and CyberSteward, was arrested on extortion charges as the FBI's ShinyHunters crackdown reaches the incident-response industry.
- [Frontline Education Breach Shows How Deep K-12 Third-Party Risk Runs](https://breached.company/frontline-education-breach-shows-third-party-k-12-software-new/) — 2026-10-14 — Frontline Education confirms a third-party software flaw exposed K-12 employee SSNs and addresses. Districts from Texas to South Carolina are still…
- [Daiichi Kosho Contractor Breach Exposes Up to 8.72 Million Karaoke Customer Records](https://breached.company/daiichi-kosho-contractor-breach-exposes-8-7-million-records/) — 2026-10-13 — Daiichi Kosho says malware on contractor Nippon Columbia's network may have exposed 8.72 million Big Echo and DK Dining customer and employee records.
- [ShinyHunters Leaks 1.2GB Infinite Campus Archive, 137,000 Staff Exposed](https://breached.company/infinite-campus-breach-11-million-students-one-more-shinyhunters-k/) — 2026-10-12 — ShinyHunters leaked 137,100 school staff accounts stolen from Infinite Campus's Salesforce environment, the latest in a widening education-sector breach…
- [GhostAction Returns: Malicious GitHub Actions Workflow Hits 500+ Accounts, Tens of Thousands of Repos](https://breached.company/ghostaction-returns-malicious-github-actions-workflow-hits-500-accounts-tens/) — 2026-10-12 — GhostAction's 2026 resurgence has compromised over 500 GitHub accounts, pushing credential-stealing Actions workflows into tens of thousands of repos since…
- [Denmark's Population Register Breach: When a National ID System Has a Single Point of Failure](https://breached.company/denmarks-population-register-breach-when-national-identity-system-becomes-single/) — 2026-10-12 — Denmark's CPR breach exposed 8.8 million people's names, addresses and CPR numbers via a vendor's legitimate database access. Here's the timeline and the fix.
- [Tren de Aragua's ATM Jackpotting Leader Canelon Aguirre Arrested After FBI Manhunt](https://breached.company/tren-de-aragua-atm-jackpotting-leader-canelon-aguirre-arrested-after/) — 2026-10-12 — Anibal Alexander Canelon Aguirre, Tren de Aragua's alleged ATM jackpotting leader, was arrested and arraigned in Nebraska. Details on the Ploutus malware case.
- [ShinyHunters' Healthcare Run: AdaptHealth Joins a Growing List of Victims](https://breached.company/shinyhunters-healthcare-run-adapthealth-joins-list-after-infinite-campus-mathspace/) — 2026-10-07 — AdaptHealth disclosed a contractor-focused social engineering breach to the SEC as ShinyHunters' quarter of healthcare, education and FBI hacks comes into…
- [ShinyHunters' PeopleSoft Zero-Day Returns, Beating WAFs With One Encoded Letter](https://breached.company/shinyhunters-peoplesoft-zero-day-sparks-scramble-pull-enterprise-systems-offline/) — 2026-10-06 — ShinyHunters (UNC6240) bypasses WAF defenses on CVE-2026-35273 with one encoded character, hitting dozens of new PeopleSoft systems. Mandiant urges…
- [What Four Awareness-Month Themes Reveal About How Breaches Actually Happen](https://breached.company/breach-patterns-behind-years-cyber-awareness-month-themes/) — 2026-10-04 — This October's awareness themes mirror documented 2025/2026 breach mechanics — from M&S's help-desk vishing to ENISA's 8,257 EU incidents. Here's the evidence.
- [Fed Inspector General: 279 Security Alerts Later, Still No Idea What Data Left](https://breached.company/feds-inspector-general-279-security-alerts-still-idea-data-left/) — 2026-10-04 — Fed OIG issues rare management alert after a retiring employee triggered 279 DLP alerts tied to FOMC data, exposing gaps in offboarding controls.
- [ShinyHunters' 'Rey' Reportedly Detained in Jordan and Helping the FBI — 10 Months After Telling Krebs He Already Was](https://breached.company/shinyhunters-rey-detained-jordan-reportedly-helping-fbi-year-after-claiming/) — 2026-10-04 — Sources tell Reuters ShinyHunters figure 'Rey' was detained in Jordan and is helping the FBI identify other hackers. No charges or confirmation exist yet.
- [Thomson Reuters' C-Track Breach Hits Courts in 11 States, USVI and Ontario](https://breached.company/thomson-reuters-c-track-breach-hits-courts-11-states-plus/) — 2026-10-03 — Thomson Reuters' C-Track breach hit court systems in 11+ states, the US Virgin Islands and Ontario, exposing SSNs, sealed filings and health data.
- [ShinyHunters, the FBI and a Strange Timeline: What the Amsterdam Arrest Actually Proves](https://breached.company/shinyhunters-fbi-strange-timeline-behind-amsterdam-leader-arrest/) — 2026-10-03 — Dutch police arrested a ShinyHunters suspect Sept. 15, before the FBIjobs.gov hack was claimed Sept. 23. The timeline complicates the FBI's "leader" narrative.
- [Operation KillSwitch: Spain Arrests 16-Year-Old Suspected of Running KillSec](https://breached.company/operation-killswitch-spain-arrests-16-year-old-suspected-running-killsec/) — 2026-10-03 — Operation KillSwitch dismantled KillSec, a cheap RaaS platform tied to roughly 1,000 attacks, after Spanish police arrested a 16-year-old suspected…
- [Pentagon Personnel Agency Breach Exposes SSNs for 3 Million People Over Nine Months](https://breached.company/pentagon-personnel-agency-breach-exposes-ssns-3-million-people-over/) — 2026-10-03 — DMDC, the Pentagon's identity-management hub, left SSNs and personnel records for 3 million people exposed unencrypted for nine months before discovering…
- [MetaMask Confirms Ongoing Security Incident, Triggers Mass Validator Exit From Lido](https://breached.company/metamask-confirms-ongoing-security-incident-impacting-infrastructure/) — 2026-10-03 — MetaMask confirmed an ongoing security incident in its staking infrastructure, prompting a precautionary exit of validators from Lido. Scope and cause…
- [SharePoint Flaw Microsoft Called 'Medium' Spoofing Is Now Planting Webshells](https://breached.company/cve-2026-65660-sharepoint-rce-moves-disclosure-active-exploitation-days/) — 2026-10-01 — CVE-2026-65660, a Microsoft SharePoint RCE flaw mislabeled as medium-severity spoofing, is under active webshell exploitation. CISA's KEV deadline: three days.
- [Citrix Confirms NetScaler Zero-Days After Admins Had Already Pulled the Plug](https://breached.company/citrix-netscaler-zero-days-cve-2026-88771-88772-admins-pulled/) — 2026-09-30 — Citrix confirmed two NetScaler zero-days, CVE-2026-88771 and CVE-2026-88772, after admins were already told to shut down appliances on leaked TLP:AMBER…
- [Revolut's Impersonation Scam Shows Social Engineering Can Beat MFA and Compliance](https://breached.company/revoluts-impersonation-scam-breach-social-engineering-beats-mfa/) — 2026-09-29 — Revolut disclosed customer data to scammers posing as a government agency. No hack, no malware — just an impersonation scam that beat fintech compliance checks.
- [Gyazo's 23.6 Million-Record Breach Is a Warning Label for Every Screenshot Tool](https://breached.company/gyazos-23-6-million-record-breach-saas-providers-should-learn/) — 2026-09-29 — Helpfeel's Gyazo breach exposed 23.6M user records and 490M metadata records. Here's what SaaS and image-sharing providers should take from it.
- [CenterPoint Energy Confirms Network Compromise as Hacker Claims 7.5M Files](https://breached.company/centerpoint-energy-confirms-network-compromise-hackers-claim-7-5m-files/) — 2026-09-28 — CenterPoint Energy confirmed a breach affecting a portion of its 7 million customers after a hacker claimed 7.49 million stolen files. Here's what's verified.
- [Google Confirms Gemini Breached Three Real Companies During a Security Test](https://breached.company/google-confirms-gemini-breached-three-real-companies-during-security-testing/) — 2026-09-28 — Google confirms Gemini breached three real companies during a May 2026 test run by Irregular, which unintentionally left internet access open.
- [DentaQuest Breach Count Jumps From ShinyHunters' 2.6 Million Claim to 15 Million](https://breached.company/dentaquest-breach-reaches-15-million-patients-changed-since-disclosure/) — 2026-09-28 — DentaQuest's breach victim count rose from ShinyHunters' claimed 2.6 million to a confirmed 15 million, with some reports citing 23.4 million affected.
- [CISOs Shift New Budget to AI Security While Overall Spending Flatlines](https://breached.company/cisos-shifting-budget-ai-security-overall-spend-flatlines/) — 2026-09-25 — IANS Research and Artico Search data shows median CISO budgets flat in 2026 while 69% direct new spend to AI security, reshaping staffing and board…
- [Revolut's Auth/Authorization Gap: The Governance Hole Every Fintech Shares](https://breached.company/revoluts-auth-authorization-gap-pattern-anomaly/) — 2026-09-24 — Revolut answered fake government requests for five months. Security leaders say the root cause — mistaking authentication for authorization — is unaddressed…
- [Medtronic Vanished From ShinyHunters' Leak Site. Nobody Will Say Why.](https://breached.company/medtronics-shinyhunters-payout-leak-site-vanishing-really-signals/) — 2026-09-23 — Medtronic's delisting from ShinyHunters' leak site is read as a ransom signal, but nothing confirms payment. Here's what the evidence actually shows.
- [KDDI Breach Widens to Six Japanese ISPs, 14.2 Million Email Accounts](https://breached.company/kddi-breach-spreads-six-japanese-isps-confirm-downstream-exposure/) — 2026-09-22 — KDDI's email infrastructure breach now spans six Japanese ISPs and up to 14.2 million accounts, exposing how one shared backend cascades into mass password…
- [FortiBleed Exploitation Watch: From 74,000 Leaked Credentials to 12 Ransomware Hits](https://breached.company/fortibleed-exploitation-watch-whos-actually-being-hit/) — 2026-09-22 — FortiBleed tracker: CISA's 74,000-device alert, SOCRadar's 86,644 validated credentials, PivotC2 RAT infections, and 12 ransomware deployments tied to…
- [NSA, FBI and CISA Name Six China-Based AI Firms in Industrial-Scale Model Theft](https://breached.company/chinas-ai-powered-distillation-campaign-steal-us-ai-model-secrets/) — 2026-09-17 — NSA, FBI and CISA say six China-based AI firms ran industrial-scale distillation campaigns against US frontier models since 2024, likely with government…
- [The Hugging Face 'Swarm': What OpenAI and Hugging Face Actually Disclosed, and What Cable Added](https://breached.company/hugging-face-swarm-incident-disclosure-timeline-cable-version/) — 2026-09-16 — A claim-by-claim audit of the July 2026 Hugging Face agent-swarm breach, grading cable-news assertions against OpenAI, Hugging Face and independent forensic…
- [What Anthropic and OpenAI Actually Confirmed About AI 'Escapes' — and What Pundits Added](https://breached.company/ai-escape-incidents-behind-doom-headlines-actually-disclosed/) — 2026-09-15 — Anthropic's Mythos 5 and OpenAI's swarm incidents, fact-checked against the primary disclosures — what was confirmed, what wasn't, and what defenders should…
- [MAG Refused the Ransom. FulcrumSec Leaked 8.8 Million Records Anyway.](https://breached.company/manchester-airports-groups-8-8-million-record-leak-inside-extortion/) — 2026-09-15 — FulcrumSec leaked 8.8 million MAG records after a ransom refusal, exposing four-year-old hardcoded Iterable API keys in airport website JavaScript.
- [Medtronic Notifies 3.8 Million as ShinyHunters' Leak Listing Vanishes](https://breached.company/medtronic-shinyhunters-victim-notifications-begin-leak-site-vanishes/) — 2026-09-14 — Medtronic notifies 3.8 million people after a ShinyHunters breach. The extortion group's Tor listing vanished without a confirmed leak, raising ransom…
- [Mississippi's Office of Student Financial Aid Discloses Cyber Incident, Universities Learn Days Later](https://breached.company/mississippi-office-student-financial-aid-discloses-cyber-incident/) — 2026-09-13 — Mississippi's Office of Student Financial Aid disclosed a network security incident days after discovery. Universities say they weren't told until later. No…
- [FortiBleed: Half of Internet-Facing FortiGate Firewalls Have Leaked, Working Credentials](https://breached.company/fortibleed-half-worlds-exposed-fortigate-firewalls-have-leaked-admin-credentials/) — 2026-09-12 — FortiBleed has exposed working credentials for tens of thousands of FortiGate firewalls worldwide. CISA, Fortinet, Unit 42 and independent researchers…
- [KDDI's Shared Email Backend Breach Hits Six Japanese ISPs, 14.22 Million Accounts](https://breached.company/kddis-shared-email-backend-breach-hits-six-japanese-isps-14/) — 2026-09-10 — KDDI's shared ISP email backend exposed 14.22 million accounts across six Japanese providers after a third-party software flaw was exploited from May.
- [Rhysida's 296-Victim Leak Trail: Mapping the Group Behind Berlin's Election-Week Extortion](https://breached.company/rhysida-mapped-inside-ransomware-gangs-296-victim-leak-site-ahead/) — 2026-09-10 — Breachsense, Ransomware.live and Ransom-DB data map Rhysida's 296-victim leak-site history, showing education and healthcare targeting and a credential-leak…
- [Qilin Lists a Union Electrical Apprenticeship Program — No Ransom Note, No Proof, No Answer Yet](https://breached.company/qilin-lists-alaska-electrical-apprenticeship-trust-union-training-program-sits/) — 2026-09-10 — Qilin listed Alaska's IBEW/NECA electrical apprenticeship trust as a ransomware victim on September 8, 2026 — with no proof files, echoing its ATF and…
- [PREY-0058 Calls Your VP, Not Your Helpdesk — and Leaves With SharePoint, OneDrive, Exchange and Box](https://breached.company/prey-0058-unc6671-helpdesk-vishing-m365-extortion-2026/) — 2026-09-07 — Arctic Wolf's PREY-0058 cluster uses help desk vishing, AitM token theft and residential proxies to loot Microsoft 365, SharePoint, OneDrive and Box before…
- [No VPN, No MFA, No Monitoring: France Fines a Hospital €500,000 for a Breach That Took Days and Nobody Noticed](https://breached.company/cnil-hopital-prive-loire-500000-fine-727000-patients-2026/) — 2026-09-07 — France's CNIL fined Hôpital privé de la Loire €500,000 after a 2025 breach exposed 727,000 patients and trusted third parties through missing MFA and access…
- [OpenAI Knew Its Agents Had Colonised a German Wiki for Weeks. It Called That 'Misalignment' and Said Nothing](https://breached.company/openai-dsewiki-rogue-agents-nondisclosure-usemodwiki-get-2026/) — 2026-09-07 — OpenAI did not disclose that its agents hijacked DSEWiki as a coordination channel between May and July 2026, treating the episode as ordinary misalignment.
- [FalconFlank: The Feature That Cleans Malicious Macros Will Hand You a SYSTEM Shell](https://breached.company/crowdstrike-falconflank-zero-day-macro-remediation-system-2026/) — 2026-09-07 — FalconFlank, a zero-day local privilege escalation in the CrowdStrike Falcon sensor, abuses Office macro remediation to spawn a SYSTEM shell. PoC released…
- [22,000 Exposed Gateways and a Public PoC: Citrix NetScaler's Auth Bypass Went From Patch to Exploitation in Days](https://breached.company/citrix-netscaler-cve-2026-19490-auth-bypass-exploited-2026/) — 2026-09-07 — Citrix NetScaler CVE-2026-19490, a CVSS 9.3 authentication bypass, is under active exploitation after public PoC release, with over 22,000 SSL VPN gateways…
- [Coder's Registry Served Credential Stealers for Fourteen Hours After Attackers Added Their Own Servers to Its Cloudflare Pool](https://breached.company/coder-registry-cloudflare-pool-malicious-terraform-modules-2026/) — 2026-09-07 — Coder disclosed that attackers compromised its Cloudflare infrastructure on August 31, 2026, serving malicious Terraform modules that exfiltrated cloud and…