All news with #data breach tag

🔒 Novocure, a global oncology company, reported a mid‑August incident in which unauthorized actors accessed certain information systems, exposing data for more than 1,400 U.S. cancer patients and an undisclosed number of employees. The company says most patient records contained ID numbers without names, while fewer than 50 patients in the western U.S. had identifying and provider contact details exposed. Novocure confirmed no medical devices were accessed and its operations remain functional, and it is evaluating regulatory notification obligations.

🔒 Hasbro has confirmed that attackers accessed personal and financial details of an undisclosed number of employees. The company filed notification letters with the Massachusetts Attorney General's Office but did not initially specify how many individuals were affected or when the intrusion was detected. Hasbro said it disabled the compromised account, terminated unauthorized access, and deployed additional safeguards while investigating the incident.

📈 Chubb’s 2026 Cyber Claims Report shows that average costs per cyber insurance claim rose markedly in 2025 even as claim volumes fell for large and middle-market companies. The insurer attributes the growing severity to higher data breach and privacy litigation costs and increased business interruption expenses. Regional differences were clear: the US saw much higher average costs than the UK and Europe, partly due to sizable third-party litigation expenses. SMEs experienced mixed trends, with claim frequency rising but costs moving in opposite directions across regions.

🔒 The Los Angeles County Museum of Art (LACMA) disclosed a data breach discovered in July 2025 after suspicious activity began four days earlier. The investigation, updated in February 2026 and finalized over a year later, determined that attackers may have accessed sensitive customer and employee records. Exposed elements include full names, dates of birth, Social Security numbers, government IDs, partial financial and card data, health insurance details, and medical treatment information. LACMA has notified law enforcement and affected individuals, offered one year of identity protection through Financial Shield, and set up a dedicated support line while recommending monitoring and credit protections.

🛡️ Nutex Health disclosed a cyberattack in an SEC filing after discovering that an unauthorized third party accessed and exfiltrated data from company servers. The company, which operates 28 facilities across 12 states, engaged external incident-response and forensic teams, activated its cybersecurity plan, and notified law enforcement. Nutex is still determining the types of data affected and whether patients, employees, or partners were impacted.

📰 The U.S. Department of Justice announced that ByteDance-owned TikTok agreed to pay $400 million to resolve a 2024 lawsuit alleging violations of child privacy laws. The settlement includes $300 million payable immediately and $100 million contingent on vacating a prior consent decree tied to Musical.ly. The complaint, filed with the FTC, accused TikTok of enabling under-13 accounts and improperly collecting data in "Kids Mode," claims the company has disputed as largely tied to past practices. The DoJ called the recovery among the largest under COPPA and noted TikTok has since strengthened age controls and parental oversight.

🔒 Japanese cloud provider Sakura Internet disclosed unauthorized access to its sales management system storing customer contract and membership data. The company said the incident was discovered during a separate investigation into a smaller breach at its Sakura Rental Server service and that up to 1,360,563 accounts may have been affected. Sakura reported no confirmed data exfiltration, noted stored passwords are hashed and no credit card data is kept in the compromised system, and is notifying affected customers and authorities.

🩺 CareCloud, a U.S. healthcare IT provider, disclosed a March breach that disrupted services and exposed patient data. The company said an unauthorized third party accessed an AWS environment between March 10 and March 16, 2026, and claimed to have exfiltrated database contents. Notifications began July 25, and impacted individuals are offered identity protection via IDX. No group has claimed responsibility and investigations continue.

🛡️ The U.S. Justice Department charged eight additional alleged members of the Mabna Institute, bringing the total to 17 Iranians accused of a years-long campaign that stole academic research, intellectual property, emails, and proprietary data from U.S. and international organizations. The DoJ says the operation began around 2013 and compromised roughly 8,000 accounts—targeting over 100,000 professors worldwide—and extracted about 31.5 TB of data valued at $3.4 billion. Rewards of up to $10 million are offered for information on five defendants, and the defendants face multiple charges including conspiracy and aggravated identity theft.

🔒 The University of Texas San Antonio took several IT systems offline after detecting attempted unauthorized activity at the network edge, prompting containment measures by University Technology Solutions and partners. Officials say there is no evidence of data access or exfiltration so far, though the outage disrupted online registration, tuition payments and phone systems ahead of term start. Students were granted extensions and instructed to reset passphrases as remediation steps continue.

🔒 SafePal disclosed an authorization flaw in an order-tracking plug-in that exposed names, emails, shipping addresses, phone numbers, and purchase details for about 39,798 customers. The company said no wallet credentials or payment card data were included and that affected customers were notified on August 16. SafePal fixed the flaw, reduced retention, purged affected records from active servers, and engaged an independent firm to validate fixes and review systems.

🛡️ A threat actor using the alias “TheHatman” is advertising employee databases allegedly exfiltrated from Microsoft Azure tenants of multiple large companies, claiming a total of 3.64 million records. The posted dumps, beginning July 31, target organizations such as McDonald’s, Tata Consultancy Services, Gap Inc., Vodafone, HCL, IHG, and Kyndryl and include names, emails, titles, phone numbers, addresses, and tenant account details. Several affected firms say investigations show no evidence of current breaches and that much of the data appears dated and non-sensitive, while cyber intelligence firm Hudson Rock assessed the samples as authentic and noted presence of service and admin accounts that could enable targeted attacks.

📣 Pokémon Center has notified UK and German customers that a third-party logistics provider, CEVA Logistics, suffered a cyberattack that exposed customer personal and order information. The breach affected CEVA systems between July 29 and August 1 and disrupted several European warehouses, causing shipping delays and cancellations. Pokémon Center says exposed data may include names, mailing addresses, phone numbers, email addresses, and order details, but not payment card information.

🔒 SafePal reports a data breach affecting about 39,798 customers after an authorization flaw in an order-tracking plug-in was exploited to steal order information. The exposed data includes names, emails, shipping addresses, phone numbers, and purchase details for orders placed between March 2, 2025, and April 11, 2026. SafePal says sensitive wallet credentials, payment card numbers, and government IDs were not exposed and that it has fixed the vulnerability, notified affected customers, and launched a verification tool. A threat actor is now claiming to sell the stolen data on a cybercrime forum, and the company warns of targeted phishing and social engineering attempts.

🔍 New analysis links the ExfilSquad extortion group to leaked data from 13 victims across government, education, finance and manufacturing. Fortra Intelligence and Research Experts (FIRE) validated that public samples contained sensitive information, with published torrents totaling 382.64 GB and 27 million records. Researchers say misconfigured Microsoft Power Pages and unauthorized read access to Microsoft D365/Dataverse exports appear to be the primary cause, not a D365 vulnerability. FIRE identified numerous exposed Power Pages instances and highlighted the risk of the Anonymous Users web role.

🔎 Shell is investigating a potential security incident after the Clop ransomware gang claimed to have stolen 89GB of data, including engineering drawings and project plans. A Shell spokesperson confirmed awareness and said security teams and external experts are examining the matter. Clop listed Shell among 43 victims allegedly targeted via a PTC Windchill and FlexPLM vulnerability tracked as CVE-2026-12569. PTC, CISA, and other authorities have warned of active exploitation and urged urgent patching and mitigations.

🔒 In July 2026, the ShinyHunters extortion group claimed to have stolen personal data from RingCentral accounts after a reported social engineering intrusion. RingCentral acknowledged a security incident and said remediation steps were taken, noting services continued to operate and only a portion of customers were affected. Have I Been Pwned confirmed leaked data tied to 1.6 million accounts, including names, emails, phone numbers, and addresses.

🛡️ A former Brightly Software contractor was sentenced to two years in prison after pleading guilty to orchestrating a $2.5 million extortion scheme. He stole payroll and corporate data, emailed employees threatening to leak PII, and demanded ransom in cryptocurrency after his contract ended. Brightly paid a small Bitcoin ransom before involving law enforcement; the FBI recovered devices linking the suspect to the crimes.

🔒 Beacon attributes a cyber-attack to a compromised AWS access key likely exposed in public Javascript build artifacts, allowing an attacker to download CRM data belonging to about 1,500 UK charities. The incident, identified in activity starting on July 27, saw data decrypted during download despite being encrypted at rest. Beacon has reset credentials, found no evidence of persistence, and instructed customers to report the breach to the ICO. Affected charities have been notified, and there is no confirmation that stolen data has been published or misused.

📢 Trezor disclosed a data breach after its shipping partner ShipMonk was hacked, exposing nearly 14,000 customers' order details. The exposed data includes full names, shipping addresses, email addresses, and phone numbers for customers who received orders between May 10 and August 8, 2026. Trezor confirmed its systems and devices were not compromised but warned affected customers to expect heightened phishing attempts. ShipMonk attributed the intrusion to a Metabase zero-day vulnerability that allowed attackers to access stored customer data.