Ceva Logistics: One Processor, Ten Controllers, and a Notification Chain That Took Five Days
A cyberattack on eight European warehouses run by Ceva Logistics has produced breach reports to the Dutch data protection authority from at least ten ...
data-breach
53 articles on data-breach — privacy laws, security frameworks, and regulatory compliance.
Amgen's Cloud Breach: Patient PHI, Third-Party Cloud Environments, and a Materiality Call Made Before the Scope Was Known
Amgen detected unauthorized activity in July 2026 and filed a Form 8-K on 29 July declaring the incident material. Attackers exfiltrated proprietary i...
Levi Strauss Filed an 8-K Over Three Laptops: Social Engineering as a Material Cyber Event
Levi Strauss & Co. filed a Form 8-K on 7 August 2026 disclosing that an unauthorized third party accessed company files through social engineering aga...
The Snowflake Guilty Plea: 165 Tenants, No Vulnerability, and the MFA Control Nobody Enforced
Connor Riley Moucka pleaded guilty on 5 August 2026 to computer fraud, conspiracy, and aggravated identity theft over the 2024 Snowflake extortion cam...
CareCloud's Four-Month Notification Gap: 345,000 Patients, 45,000 Providers, and the Business Associate Clock
CareCloud, a revenue cycle management vendor serving more than 45,000 U.S. healthcare providers, began notifying at least 345,000 individuals in late ...
Nine Months to Notice: MCBS, 1.26 Million Patients, and the HIPAA Clock That Runs on the Business Associate's Calendar
Attackers were inside Medical Computer Business Services of Augusta, Georgia between 22 and 26 September 2025. The investigation concluded on 28 May 2...
From 2.6 Million to 23 Million: The DentaQuest Breach Scope Expansion and What HIPAA Requires When the Number Moves
When we covered the DentaQuest breach in June, the working figure was 2.6 million people. Notification letters that began rolling out on 17 July 2026 ...
Nine Months to Identification: Pinnacle Financial, Mercadien CPAs, and the Fourth-Party Problem in Banking
An intruder was inside the network of Mercadien, P.C., CPAs between 17 September and 9 October 2025. Pinnacle Financial Partners did not determine tha...
EY's Support-Ticket Breach: Three Months From Detection to Notification, and the Data Was Client Tax Records
Ernst & Young LLP is notifying clients that an unauthorized third party accessed a third-party IT service management platform between 28 March and 12 ...
43 Attorneys General, $18 Million, and a Bankrupt Company: The 23andMe Settlement Redefines Genetic Data Enforcement
A bipartisan coalition of 43 state attorneys general secured an $18 million settlement from 23andMe over the 2023 credential-stuffing breach that expo...
Lidl's Third-Party Breach: When a Retailer's Own Platform Is Clean but the Processor Is Not
Lidl notified online shop customers in Germany, Belgium, and the Netherlands that attackers stole personal data from an external IT service provider —...
Nintendo, TinyPulse, and the $2M Ransom: How a Third-Party HR Survey Vendor Became a 2026 Extortion-as-a-Service Case Study
An extortion group calling itself Shadowbyt3$ stole roughly 859 MB of Nintendo of America employee data — including W-9 tax forms and bank statement P...
Kudankulam Nuclear Plant Contractor Breach 2026: When a Fourth-Party Data Centre Leaks Critical-Infrastructure Blueprints
The extortion group World Leaks published nearly 19,000 files (14.3 GB) tied to India's Kudankulam Nuclear Power Plant. The plant operator's systems w...
Conduent's 62 Million-Person Breach Becomes 2026's Cautionary Tale in HIPAA Business-Associate Liability
Conduent Business Solutions told federal regulators on June 4, 2026 that 62,224,658 people had data exposed in a SafePay ransomware intrusion — the th...
12 Million Exposed, Vendor Unnamed: The KDDI Breach and the Zero-Day That Has No CVE
Attackers exploited a zero-day in unnamed third-party software to sit inside the shared email platform behind six Japanese ISP brands for a month, exp...
Detected in One Day, Disclosed in 115: The AssuranceAmerica Breach and the Anatomy of a 6.9 Million-Person Notification Timeline
AssuranceAmerica detected intruders in its network on March 17, 2026 — roughly 24 hours after a credential attack on an employee. Notification letters...
35 GB of Keys to the Kingdom: The Accenture '888' Breach Claim and What It Means for Every Client Downstream
A threat actor called 888 is selling what they claim is 35 GB of Accenture source code, plus RSA keys, SSH keys, Azure personal access tokens, and sto...
Stolen, Then Deleted: The Mount Royal University Attack and the Compliance Problem of Destructive Breaches
Mount Royal University confirmed that attackers who breached its network on June 17, 2026 stole data from its student and employee file storage, then ...
One Zero-Day, One Hundred Victims: The Oracle PeopleSoft Wave Breaks on Nissan, Kubota, Aflac, and the July 3 Disclosure Cluster
Between May 27 and June 10, 2026, attackers linked to ShinyHunters exploited CVE-2026-35273, a critical Oracle PeopleSoft zero-day, against more than ...
When the Regulator Gets Breached: ShinyHunters Dumps 3.1 TB from the NAIC and the U.S. Insurance Sector Inherits the Risk (2026)
The National Association of Insurance Commissioners — the body that wrote the insurance industry's data security model law — confirmed it was compromi...
Medtronic's 9 Million-Record Breach: ShinyHunters, an 80-Day Notification Gap, and the Questions HIPAA Will Ask (2026)
Medtronic has begun notifying individuals that attackers accessed its corporate IT systems between April 13 and 19, 2026, stealing names, dates of bir...
California's Supreme Court Just Made Data-Breach Lawsuits Easier to File: Inside J.M. v. Illuminate Education
In J.M. v. Illuminate Education, the California Supreme Court rejected a line of appellate decisions that had forced data-breach plaintiffs to prove a...
One Day, Three Continents of Obligation: The June 26, 2026 Breach Cluster and the Fragmented Map of Data-Breach Law
On June 26, 2026, breach disclosures surfaced for MagMutual Insurance, 911 Driving School, and Germany's Atlas Elektronik on the same day. The three i...
iRhythm's Zio Breach: When a Help-Desk Phone Call Exposes Cardiac Patient Data Under HIPAA (2026)
In June 2026, attackers used social engineering to break into third-party-hosted business applications at iRhythm Holdings, maker of the Zio cardiac p...
MSG Sports and the ShinyHunters Breach: How 26 Million Records and a Single Vishing Call Triggered a Compliance Crisis in 2026
In June 2026, the cybercrime group ShinyHunters breached Madison Square Garden Sports and affiliated MSG entities, claiming more than 26 million custo...
The Canvas Breach: When a Ransom Payment Meets FERPA, and the Login Screen Becomes the Extortion Note
ShinyHunters breached Instructure's Canvas learning platform, exposing data tied to hundreds of millions of users across roughly 8,800 institutions an...
Comcast's $117.5 Million Xfinity Settlement: The Cost of a Vulnerability Left Open
Comcast agreed to pay $117.5 million to resolve claims from the October 2023 Xfinity breach that exposed the data of more than 30 million customers. T...
LabCorp's $35 Million AMCA Settlement: When Your Vendor's Breach Becomes Your Liability
LabCorp agreed to a $35 million settlement over the American Medical Collection Agency breach that exposed data on more than 10 million of its patient...
23andMe Breach Claimants to Receive $46.75 Million: Genetic Data, Bankruptcy, and a Settlement Built on the Wreckage
The administrator of 23andMe's bankruptcy plan agreed to pay $46.75 million to victims of the 2023 breach that exposed genetic and personal data of ro...
Spectrum Class Action: 40 Million Records, One Vishing Call, and the CPNI Question Charter Now Faces
A wave of class-action lawsuits accuses Charter Communications of failing to safeguard the data of Spectrum customers after a vishing attack let hacke...
Novo Nordisk Clinical Trial Data Breach: Why 'Pseudonymized' Is Not 'Anonymous' Under GDPR
Novo Nordisk disclosed that patient data from some clinical trials was copied externally in a cyberattack. The data was pseudonymized, not anonymized ...
South Korea Fines Coupang a Record $409 Million: Inside the Largest Data Breach Penalty in PIPC History
South Korea's Personal Information Protection Commission hit e-commerce giant Coupang with a record fine of more than $409 million after a breach expo...
DentaQuest's 2.6 Million-Record Breach: ShinyHunters, Sun Life, and the HIPAA Questions Every Benefits Administrator Should Be Asking
The extortion group ShinyHunters leaked roughly 234 GB of data tied to DentaQuest, the Sun Life-owned dental benefits administrator, exposing names, d...
The Q2 2026 Ransomware Wave: Qilin, ShinyHunters, and the Compliance Failures Behind the Salesforce Extortion Campaign
May 2026 saw 95 publicly disclosed ransomware attacks across 17 countries, with Qilin and ShinyHunters leading a campaign that increasingly skips encr...
NYC Health + Hospitals Biometric Breach: HIPAA, BIPA, and the Irreversibility Problem
NYC Health + Hospitals confirmed a breach affecting 1.8 million individuals — including fingerprints and palm prints — originating through a third-par...
Charter Communications (Spectrum) Breach: ShinyHunters, 13 Million Records, and What ISPs Owe Regulators
Charter Communications confirmed on May 25, 2026 that a ShinyHunters vishing attack on a Microsoft Entra credential gave the threat actor access to Ch...
West Pharmaceutical Services Ransomware Attack: SEC Disclosure, Healthcare Supply Chain Risk, and What Vendors Must Do Now
West Pharmaceutical Services detected a ransomware attack on May 4, 2026, disclosing via SEC 8-K that attackers exfiltrated data and encrypted systems...
Trellix Source Code Breach: When a Cybersecurity Vendor Becomes the Target
On May 2, 2026, Trellix — the cybersecurity company formed from the merger of McAfee Enterprise and FireEye, serving more than 50,000 enterprise and g...
Cushman & Wakefield's Vishing-Triggered Breach: ShinyHunters, 500K Salesforce Records, and Third-Party Risk
In late April and early May 2026, Cushman & Wakefield confirmed a cyberattack originating from a voice phishing operation that gave ShinyHunters acces...
Instructure Canvas Breach: ShinyHunters Stole 275 Million Student Records — Twice
ShinyHunters breached Instructure's Canvas learning management system twice in May 2026, stealing an estimated 275 million records — names, email addr...
CNIL's €42 Million Fine Against Free Mobile: Three GDPR Violations Every Security Team Must Study
In January 2026, France's data protection authority fined Free Mobile €27 million and its parent Free €15 million — a combined €42 million — for three...
ShinyHunters, Salesforce, and the FERPA Blind Spot: The McGraw-Hill and Rockstar Games Supply Chain Breach
In April 2026, ShinyHunters executed two related but technically distinct supply chain attacks: a Salesforce Experience Cloud misconfiguration at McGr...
Citizens Bank and Frost Bank: Everest Ransomware's Third-Party Breach and the GLBA Vendor Accountability Gap
On April 20, 2026, the Everest ransomware gang listed both Citizens Financial Group and Frost Bank on its dark web leak site, claiming to hold 3.4 mil...
Rituals Cosmetics Confirms Membership Database Breach: GDPR Notification, Dutch AP, and the Loyalty Program Risk Pattern
On April 22, 2026, Netherlands-based luxury cosmetics chain Rituals confirmed that attackers had accessed its customer membership database, exposing n...
Lloyds Bank App Glitch Exposed 450,000 Customers' Transactions: What the FCA and ICO Are Asking
A software defect introduced during an overnight IT update on March 12, 2026 caused Lloyds, Halifax, and Bank of Scotland app users to see other custo...
Booking.com's Second GDPR Breach in Five Years: When Repeat Offenders Meet Repeat Violations
Booking.com confirmed hackers accessed customer reservation data in April 2026, raising immediate GDPR 72-hour notification questions — and echoing a ...
The Adobe BPO Breach: When Your Vendor's Vendor Becomes Your Biggest Compliance Risk
A threat actor known as 'Mr. Raccoon' claims to have stolen 13 million Adobe customer support tickets and 15,000 employee records — not by hacking Ado...
Basic-Fit Breach: One Million Gym Members Across Six Countries Have Their Bank Details Exposed
Europe's largest fitness chain confirmed on April 13, 2026 that a cyberattack exposed the personal and bank account details of approximately one milli...
Five Lawsuits and Counting: A Compliance Breakdown of the Mercor Data Breach Litigation
In the span of a single week, five separate class action lawsuits landed in federal courts against Mercor.io Corporation. The complaints vary in scope...
Fake Compliance, Stolen Credentials, and 4 Terabytes of AI Secrets: Inside the Class Action That Connects Mercor, LiteLLM, and Delve
A supply chain attack, a compliance fraud scandal, and invasive contractor surveillance converge in a single federal lawsuit — exposing the fragile tr...
Healthcare Under Siege: Ransomware Attacks Surge 49% as Patient Lives Hang in the Balance
In 2025, ransomware groups launched 1,174 publicly disclosed attacks—a 49% year-over-year increase—and healthcare bore the heaviest burden with 22% of...
When Redactions Un-Redact Themselves: The Cornwall Council GDPR Breach Explained
Cornwall Council exposed the personal data of 10 complainants — including home addresses, emails, and phone numbers — after redacted PDFs automaticall...
Mercer Advisors Faces Second Class-Action After ShinyHunters Breach: A Wake-Up Call for RIA Cybersecurity
Two class-action lawsuits now target Mercer Advisors after ShinyHunters exposed 5.7 million records and hit Beacon Pointe and Pathstone. Analysis of F...