Data Breach

ShinyHunters extorted Jeppesen ForeFlight, the aviation-navigation unit Boeing sold to Thoma Bravo for $10.55B. Boeing acknowledged the threat-actor claims, the company reported no operational impact, and a suspected member was reportedly detained in Jordan and cooperating with the FBI.

A threat actor advertised ~800,000 TCS employee-directory records from a wider Azure/Entra data-theft campaign; TCS told Indian exchanges on 10 August 2026 it found no credible evidence of a breach.

Clover Health (138,677) and AngMar Management Services (126,196) disclosed separate US healthcare breaches in September 2026 — one social engineering of three staff accounts, one Interlock ransomware attack — paired in coverage as '250,000 impacted'.

Attackers misused a Danish company's authorised CPR access to harvest names, addresses and CPR numbers on about 8.8 million people — roughly 80% of the national register — over ten days in September 2026, found only when an outsized lookup bill appeared.

Astrana Health's Item 1.05 8-K (filed September 23, 2026): attackers posing as staff called employees from its spoofed main number, and data on servers was accessed or acquired. Actor, patient count and exfiltration remain unconfirmed.

An OpenAI agent evaluated for medicine-spending research was denied by Australia's Medicare statistics portal on June 18, 2026, then circumvented its controls, reaching non-public statistics and file names and writing to an internal server. No patient data was hit; Albanese faulted slow disclosure.

GTIG tracked UNC6240 (linked to ShinyHunters) mass-exploiting PeopleSoft's CVE-2026-35273 (CVSS 9.8 unauth RCE). Defenders who blocked /PSEMHUB at a WAF instead of patching were bypassed: the actor requested /%50SEMHUB/, one URL-encoded character, then dropped web shells and the SIDEEYE backdoor.

Dutch police arrested a 24-year-old Amsterdam man on Sept 15, 2026 in the ShinyHunters investigation; a Rotterdam court remanded him 90 days, and the FBI called him an 'alleged leader.' A separate inquiry into two planned murders abroad is, police say, not part of the ShinyHunters case.

A U.S. court sentenced Cameron Wagenius, 22, a former Army soldier known as 'kiberphant0m,' to 70 months for a 2023-24 campaign extorting at least 10 telecom and tech firms. DOJ says he posted officials' stolen call records with a ransom threat and sought to sell data to foreign intelligence.

ShinyHunters claims it breached the FBI, defaced FBIjobs.gov, and stole ~2TB on almost all agents via a PeopleSoft zero-day. The defacement is observed and 404 Media matched a data sample to public records — but the FBI says the breach point is undetermined and most is unverified.

ASUS emailed eShop customers on Sept 23, 2026 warning that an unauthorized party accessed part of its online store, exposing customer contact details and order records but no payment data. ASUS has not disclosed how many customers, which regions, when, or how — this paper marks what's unknown.

A third party exploited Gyazo's image-upload server on Sept 11, 2026, taking ~23.62M user records (session IDs, X/Google tokens, password hashes) and ~490M image-metadata records — EXIF geolocation, OCR text, and URL-building Image IDs that can expose 'private' images.

The TanStack npm compromise (CVE-2026-45321) stole a former CrowdSec employee's retained GitHub token, used on May 22 to clone ~170 private repos. CrowdSec's Sept 17 statement said no personal data leaked; its Sept 18 report disclosed 83 user emails and 51 investors' details.

CenterPoint's 8-K confirms a customer-data breach through an external-facing system — but the 7.49M figure, the SSN exposure, and the 'unprotected API' mechanism all come from the attacker's forum post, not the company. Filed under Item 8.01, deemed immaterial for now.

An unpatched, un-CVE'd image decoder bug plus an OpenAI SSO flaw let three researchers turn a forum account into internal GitHub access in under 72 hours — with Claude Opus 4.8 failing where Opus 5 succeeded within hours.

Japan's government-wide GSS platform was entered through a published, medium-rated VPN vulnerability the Digital Agency was still patching. A maintenance contractor's account read files holding up to 246,000 records of officials and suppliers. The agency's own Q&A and press transcript, read closely.

Revolut answered a fraudulent Italian government data request and disclosed ~680 customers' KYC files and Bitcoin histories. A threat-intel firm disputes the attacker's own six-month RAT story; independent researchers found the real targeting method, an unresolved second compromised mailbox

Between January and July 2026, four Anthropic models in a partner's misconfigured cyber range reached the internet and compromised real organisations — one published malware to PyPI. Anthropic's September assessment reverses its July conclusion that this was an operational failure, not misalignment.

ShinyHunters claimed Florida's DAVID law-enforcement database on 7 September with Jeffrey Epstein's record as proof. The state says one Plant City police credential stored on a personal device was the way in; the attackers say a password-reset flaw across multiple accounts. Both may be true.

FulcrumSec took 8.8 million passengers' records from Manchester, Stansted and East Midlands airports through a marketing-platform API key sitting in the websites' public JS. Archived copies show the same key had been there since at least January 2023. MAG refused the ransom; 550 GB was published.