DataBreach News

Usernames, email addresses, and passwords are the most frequently leaked data type simply because https://remedyalliance.com/privacy-policy?noamp=mobile they’re the most widely collected, nearly every online account requires them. Once numbers like these are circulating, they’re commonly bundled with names and addresses to enable synthetic identity fraud, fraudulent tax filings, and new-account fraud that can surface years after the original leak. Notably, the number of individuals affected by data compromises in 2025 actually fell to its lowest annual total since 2014, even as the incident count hit an all-time high.

In February 2025, North Korea’s Lazarus Group pulled off the largest cryptocurrency theft in history, stealing approximately $1.5 billion in Ethereum from Dubai-based exchange Bybit by compromising a third-party tool used to move funds between wallets, a theft the FBI later formally attributed to North Korean state actors. On the state-actor side, a hacker or small group operating under the alias FlamingChina claimed in February to have spent six months quietly extracting more than 10 petabytes of data from China’s National Supercomputing Center in Tianjin, including alleged defense documents, missile schematics, and aerospace research tied to major state entities. Industry trackers such as the Identity Theft Resource Center group all three under a single reporting category, data compromises, precisely because the resulting risk to affected individuals is the same regardless of which mechanism caused it. Substack notifies users of data breach affecting nearly 700,000 accounts

Ledger customers were caught up in a separate incident in early January 2026, when a misconfigured API key at e-commerce partner Global-e exposed customer names, addresses, and order details, though no payment data or wallet recovery phrases were affected. Crunchyroll (March 12–24, 2026) Malware on a Telus International (outsourcing partner, India) support agent’s device captured Okta SSO credentials, giving a hacker access to Crunchyroll’s Slack, Zendesk, and Google Workspace for ~24 hours. A Nightwing contractor’s public repo, “Private-CISA,” sat exposed for ~183 days, leaking 844 MB, including AWS GovCloud admin keys, plaintext credentials, and CI/CD secrets for CISA’s own DevSecOps environment. ASOS confirms data breach after hackers spam customers with “ASOS HACKED” push alerts

Latest breaches

This matters most for organizations, since a single compromised employee credential or leaked vendor database can expose an entire company’s attack surface long before a formal breach notification ever gets filed. Rather than waiting for a company to publicly disclose a breach, which, as this page has shown, can happen weeks or months after the actual incident, DeXpose’s dark web monitoring scans dark web markets, malware logs, and leaked databases on an ongoing basis to flag exposure as it surfaces. Because so many people reuse passwords across services, a single leaked credential set can unlock accounts far beyond the site it was originally stolen from, a technique called credential stuffing that remains one of the most common ways leaked data turns into an actual account takeover. Not every major data leak happened in the last two years, some of the incidents that shaped how companies and governments handle personal data today go back nearly a decade.

• A threat actor claims 3,615 Trump Mobile customer records were compromised through a Liberty Mobile employee, raising fresh questions about third-party security.
• By running your scan you agree to the Terms and Conditions and the Privacy Policy, and to GalaxyWarden emailing you the results of this scan.
• Yoido Full Gospel Church says a data breach may have exposed information belonging to 850,000 members, including some highly sensitive identification data.
• Most people whose SSN is exposed instead rely on credit monitoring, fraud alerts, and credit freezes to limit the damage.
• Ethical-hacking firm CodeWall pointed an autonomous offensive AI agent at McKinsey’s internal AI assistant “Lilli” and had full read-write access within two hours via SQL injection through 22 unauthenticated API endpoints — exposing 46.5M chat messages, 728K files, 57K user accounts, and the system prompts governing Lilli’s behavior for 40,000+ consultants.

FBI and Secret Service Warn of FortiBleed Lockout Threat

• Industry trackers such as the Identity Theft Resource Center group all three under a single reporting category, data compromises, precisely because the resulting risk to affected individuals is the same regardless of which mechanism caused it.
• Third-party risk management isn’t new, but what counts as a third party when an AI agent or a community of agents becomes part of the ecosystem?
• The Command of the National Police of Ecuador (Comandancia General de la Policía Nacional) is the country’s top-level police administrative and command center.
• Great Britain may legislate to protect critical infrastructure from artificial intelligence-powered cyberthreats, the government said Monday, also warning AI companies not to release risky models – while announcing greater use of AI to boost the country’s cybersecurity.
• Stockholm architecture and interior-design firm, with work including commercial properties, workplaces, hotels, property development, and product design.
• Once identified, U.S. companies are generally required to notify affected individuals and relevant state attorneys general, though the timeline varies significantly by state and industry.

The Dutch Institute for Vulnerability Disclosure reveals agentic AI-powered attack using Zammad zero-days This information is aggregated from public sources for awareness only and is not legal, https://synapsewaves.com/articles/phd-cryptography-programs-guide/ security, or investment advice. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. 67 breaches surfaced in the last 24 hours, against a baseline of about 55.5/day. Breach listings — particularly those originating from ransomware or leak sites — are third-party claims that may be unverified, incomplete, or inaccurate.

• Between the two, the year produced 425.7 million breached accounts worldwide, working out to roughly 810 breaches every minute.
• Flaws CISA has confirmed are being actively exploited in the wild — if you run the affected software, patch these first.
• Notably, the number of individuals affected by data compromises in 2025 actually fell to its lowest annual total since 2014, even as the incident count hit an all-time high.
• Some incidents make headlines for their scale, like the 2025 discovery of over 16 billion exposed login credentials, described by researchers as the largest credential exposure in recorded history.

Lawson Confirms Data Breach Exposing 2.15 Million Customer Records

Iranian hackers just used Stryker’s own security tools to delete itself The FBI says a contractor failed to install a security patch before ShinyHunters breached its recruitment infrastructure and stole sensitive… Kazu claims more than 1 million Clínica Vesalio records were exposed, adding another healthcare target to the group’s recent breach activity. The FBI says a contractor failed to install a security patch before ShinyHunters breached its recruitment infrastructure and stole sensitive personnel information. Federal prosecutors accuse MonsterCloud’s owner of secretly paying ransomware attackers for decryptors while charging victims more than $19 million for recovery services. A threat actor claims 3,615 Trump Mobile customer records were compromised through a Liberty Mobile employee, raising fresh questions about third-party security.

EternalBlue’s aftermath is a reminder that not every “leak” exposes personal data directly, some expose the very tools that make every subsequent breach on this page possible, which is part of why the exploit is still detected in active attacks years after Microsoft patched the underlying vulnerability. In April 2017, a group calling itself the Shadow Brokers released a trove of classified NSA cyber tools, including the EternalBlue exploit, which within a month powered the global WannaCry ransomware attack that crippled hospitals, banks, and businesses across more than 150 countries. But the single most consequential event of https://cafelam.com/coingpt-revolutionizing-ai-powered-cryptocurrency-solutions/ this era wasn’t a corporate breach at all, it was a leak of government cyberweapons. Companies including Qantas, Vietnam Airlines, and Google were confirmed among those affected.