ASOS, a UK-based online fashion retailer, suffered a data breach caused by a social engineering attack where hackers stole an employee's login credentials. The attackers accessed certain third-party platforms used by ASOS, exposing some customers' basic personal information and contact details. Payment card information and account passwords were not accessed. ASOS confirmed the breach, locked down affected platforms, and is investigating with external experts and law enforcement. Customers were notified that no action is required on their accounts but were advised to be cautious of unsolicited messages. The company has implemented additional security measures to prevent similar incidents.
Nearly 20 million individuals had their personal and medical information compromised in a cyberattack on Oracle Health's legacy Cerner systems in early 2025. The breach involved unauthorized access via stolen customer credentials to a legacy server not yet migrated to Oracle Cloud. The compromised data includes names, Social Security numbers, medical records, diagnoses, medications, test results, and treatment information. The attacker demanded cryptocurrency ransom to prevent data leakage. This incident is among the largest healthcare data breaches in the US, with significant numbers of affected individuals reported across multiple states.
Southern Company has disclosed a data breach affecting approximately 400,000 customer accounts across its electric utilities Georgia Power, Alabama Power, and Mississippi Power. An unauthorized third party accessed limited customer account information via the company's online customer portal. The compromised data includes names, mailing addresses, phone numbers, emails, last four digits of Social Security numbers, and other basic account details. Sensitive financial information such as bank account numbers, payment card numbers, and driver’s license numbers were not accessed. The company has notified affected customers and is offering one year of free credit monitoring. The breach was detected and stopped promptly, with law enforcement engaged. Details about the intrusion timeline and attack vector have not been disclosed.
Advantest, a Japanese chip testing company, disclosed a data breach months after a ransomware attack in February 2026. Hackers stole personally identifiable information (PII) including names, dates of birth, contact details, Social Security numbers, passport and driver’s license numbers, and medical and financial information. The company has not indicated public misuse of the data but warned of increased risk of identity theft or fraud. Notifications indicate that over 500 California residents and smaller numbers in Massachusetts and Vermont were affected. No ransomware group has claimed responsibility for the attack.
Advantest Corporation experienced a ransomware attack earlier this year that resulted in the exposure of personally identifiable information of affected individuals. The company has notified those impacted by this data breach.
British online retailer ASOS confirmed a cyberattack involving the compromise of a third-party communication platform used to send notifications to users. Hackers sent rogue notifications to ASOS users' mobile apps, claiming full compromise of ASOS's Snowflake data platform instance and threatening data leaks. ASOS stated that basic user information such as names and contact details may have been accessed, but payment card information and passwords were not impacted. The company’s website and app operations remain unaffected. The incident was claimed by a hacking group named Xuanye Group, possibly a Chinese-speaking threat actor or a false flag. ASOS has restricted access to the compromised notification platform and is working with specialists and authorities. The exact initial access vector and details about the third-party platform remain undisclosed.
A cyberattack on the Arizona Supreme Court system resulted in the theft of personal information for approximately 1.3 million people, including data related to unpaid court fees, fines, and restitution payments dating back 30 years. Additionally, records of nearly 30,000 orders of protection and 150,000 foster care reports from 2010 onward were stolen. The breach began when a court employee clicked a malicious email link. The attack was detected and stopped within two hours, with no evidence of data misuse or sharing. No court cases were affected or delayed, and no records were altered or deleted. Information about jurors, witnesses, or court employees was not compromised.
UK fashion retailer ASOS confirmed a data breach after unauthorized push notifications were sent through its mobile app. The attackers claimed to have stolen customer data from ASOS's Snowflake environment. Details about the breach's scope, exploited vulnerabilities, or remediation status have not been disclosed.
The FBI experienced a data breach exposing personal information of thousands of its employees due to a missed security patch on an Oracle PeopleSoft platform managed by an Accenture contractor. The breach was attributed to the ShinyHunters cybercrime group, which exploited the unpatched system to access sensitive data. The FBI removed the contractor responsible and took measures to mitigate further risk. The incident followed ShinyHunters' claim of hacking the FBI's job site to pressure the agency over a report about the group. Law enforcement has arrested alleged leaders of ShinyHunters in connection with the breach.
Denmark's Central Person Register (CPR) suffered a data breach impacting approximately 8.8 million individuals. Hackers exploited a Danish company's lawful access to the CPR system to steal personal information including names, addresses, and CPR numbers. The breach was discovered after abnormal system behavior was detected in September. The breach does not affect individuals who opted for name and address protection. CPR revoked the company's access, notified authorities, and is investigating the incident while planning to enhance security measures.
Japanese media giant Nikkei disclosed breaches of two employee email accounts—one Google Workspace account accessed in July and one Microsoft 365 account accessed in September. The Google account breach exposed personal information of 1,646 employees and business partners but did not include reader or interviewee data. The Microsoft 365 breach was used to send 9,000 phishing emails targeting internal staff and interviewees. Nikkei changed passwords after discovering the breaches and has contacted affected individuals. No unauthorized logins have been detected since remediation. The company has not attributed the attacks to any specific threat actor or linked the two incidents.
Denmark's Central Population Register (CPR) experienced a data breach exposing personal information of approximately 8.8 million individuals. The breach involves sensitive registry data but specific technical details and exploited vulnerabilities are not provided. No patch or remediation details are available from the input data. The incident affects a large portion of the Danish population, but no information on targeted countries beyond Denmark is given.
South Korea's Financial Services Commission is investigating multiple cyberattacks targeting major financial institutions, including Shinhan Bank and Kookmin Bank. These breaches resulted in the exposure of sensitive customer data, including personal details and credit card information. Authorities suspect the involvement of AI-powered attack automation tools, specifically referencing ARTEX AI, an open-source penetration-testing system, though no official confirmation links this tool to the attacks. The government has mandated financial companies to inspect IT systems, reduce information exposure, and share threat intelligence promptly. Investigations and regulatory reviews are ongoing to enhance consumer protection and prevent future incidents.
In July 2026, two healthcare organizations, Clover Health Investments and AngMar Management Services, suffered data breaches resulting in the theft of personally identifiable information (PII) and protected health information (PHI) of over 250,000 individuals. Clover Health's breach involved social engineering attacks compromising employee accounts, exposing names, birth dates, insurance identifiers, and account numbers. AngMar Management Services experienced a ransomware-related breach with over 700 GB of data stolen, including sensitive patient details such as Social Security numbers, medical history, and prescription information. Both companies reported the incidents to the US Department of Health and Human Services and were added to its breach portal.
The Technical University of Denmark (DTU) says information belonging to up to 200,000 users may have been exposed after hackers accessed its identity and access management system and downloaded a large amount of data. [...]
Frontline Education is notifying school districts of a data breach after attackers exploited a vulnerability in third-party software to gain unauthorized access to its systems and steal employee information, including Social Security numbers. [...]
On Thursday, unknown attackers hijacked the official Microsoft account on X, which has over 13 million followers, in what appeared to be a pump-and-dump scheme promoting a crypto token. [...]
Polish dental software vendor FELG Dent suffered a data breach involving patient records and received a ransom demand. An attacker exploited insecure API endpoints to access sensitive patient and staff data, including personal identifiers and medical information. FELG estimates about 2 million patient records were affected. The attacker claims to hold about 10% of the database and threatens to sell it on a dark web forum after failed ransom negotiations. FELG has notified Polish authorities and is assisting affected dental practices with breach notifications under GDPR.
In October 2025, hackers breached the Pentagon's Defense Manpower Data Center (DMDC) human resources management system, stealing sensitive personnel records of over 3 million individuals. The breach exposed personally identifiable information (PII) including Social Security numbers, names, dates of birth, contact details, sex, race, and military personnel data. The unauthorized access persisted until July 2026. The DMDC responded by initiating incident response actions and is offering affected individuals 12 months of free credit monitoring. This breach impacts both living and deceased military personnel records.
The Dutch Institute for Vulnerability Disclosure (DIVD) suffered a network breach through exploitation of two zero-day vulnerabilities in the open-source Zammad ticketing system. The attack was driven by an autonomous AI agent that chained the vulnerabilities to hijack sessions, execute remote code, and escalate privileges to root within seconds. Due to network segmentation and incident response, the attacker did not penetrate deeper into DIVD's network. DIVD recommends upgrading to Zammad version 7 or taking vulnerable instances offline. The investigation is ongoing.
