Loading page…
Crunchbase confirmed a data breach in January 2026 in which a threat actor exfiltrated data on approximately 560,000 individuals, including names, email addresses, phone numbers, and job-related information.
Sharecare, a digital health company, had data on approximately 318,000 accounts published by the ShinyHunters group following an extortion campaign in August 2026.
Neogen, a food and animal safety organization, had data on approximately 436,000 individuals published by the ShinyHunters group following an extortion attempt in August 2026.
Data centre operator CyrusOne had data on approximately 373,000 accounts published by the ShinyHunters group following an extortion attempt in August 2026.
Double Counter, a Discord server protection service, suffered a data breach in October 2026 affecting approximately 275,000 accounts, exposing email addresses, Discord usernames, and limited subscriber details.
Angel One, an Indian stock brokerage firm, confirmed in July 2024 that a breach from April 2023 exposed personal and financial data for approximately 6.8 million unique users.
Russian VPN service SplitVPN suffered a data breach in July 2026, exposing 865,336 unique email addresses along with IP addresses, location data, and partial payment card details.
RingCentral, a cloud-based business communications platform, had data on approximately 1.6 million accounts exposed after a ShinyHunters extortion campaign in July 2026.
Questel, a French intellectual property software and services company, had data on approximately 1.2 million accounts published by the ShinyHunters group following an extortion campaign in August 2026.
Australian beauty retailer Oz Hair and Beauty had data on approximately 2 million customers exposed after an extortion attack by the group xpl0itrs in August 2026.
Manchester Airports Group disclosed a breach in August 2026 in which the FulcrumSec hacking group stole and published data on approximately 8.8 million customers of Manchester, Stansted, and East Midlands airports.
LimeLeads, a now-defunct B2B marketing leads service, exposed approximately 17.8 million unique email addresses and related corporate contact data in 2019 due to an unsecured Elasticsearch server.
Inter-Con Security had data on approximately 276,000 individuals published by the ShinyHunters group following an extortion campaign in June 2026.
Golf Canada had approximately 569,000 user records allegedly exposed in mid-2026, with the data later circulating on Telegram.
In August 2026, unauthorized access to the Fanlore wiki exposed approximately 145,000 accounts including email addresses, usernames, names, and hashed passwords.
In August 2026, approximately 4.6 million unique Chess.com user records including names, usernames, email addresses, and geographic locations were posted online, with analysis suggesting the data was obtained through scraping.
Clothing retailer Carhartt had data on approximately 12.9 million customers exposed after the ShinyHunters group conducted an extortion campaign and published stolen records in August 2026.
Burger King Russia suffered a data breach in August 2024 affecting approximately 3.2 million customers, exposing personal details including names, email addresses, phone numbers, and dates of birth.
Brinks Home suffered a data breach in July 2026 in which the ShinyHunters group published data on approximately 732,000 customers, leads, and staff, including names, contact details, and partial credit card information.
Alcon, an eye care company, had data on approximately 218,000 individuals published by the ShinyHunters group in August 2026 following an extortion campaign.
McKesson disclosed an August 2026 cybersecurity incident involving unauthorized access to third-party applications and data exfiltration; the affected data and population have not been disclosed.
Houston City College suffered a data breach in June 2026 when ShinyHunters extorted the college and later published data on approximately 832,000 current students and alumni.
Hackers obtained and publicly released data from gig economy platform Paidwork in March 2026, exposing over 23 million accounts including banking information, passwords, and broad personal profile data.
A November 2025 Suno security incident was followed by reports of a dataset containing more than 55 million unique email addresses and a smaller set of purchase records.
Fluke Corporation had data on over 821,000 accounts exposed after the ShinyHunters group published more than 100GB of allegedly stolen data in July 2026.
Goose Creek Candle Company suffered a data breach in June 2026 that exposed the personal and purchase information of approximately 6.6 million customers.
Glendale Community College suffered a data breach in June 2026 affecting nearly 794,000 individuals, exposing names, email addresses, Social Security numbers, and student enrollment records.
Moody Bible Institute suffered a data breach in June 2026 in which over 2.3 million accounts had personal information including names, addresses, phone numbers, and dates of birth publicly exposed following a ShinyHunters extortion campaign.
Sysco, a food distribution company, had data on approximately 2.7 million staff and customers exposed after a ShinyHunters extortion campaign resulted in the publication of corporate contact information.
American Tower had data on over 216,000 employees, contractors, customers, and leads exposed after a ShinyHunters extortion campaign in June 2026.