The full corpus — beyond today's front page.
256 results · page 10 of 11
A federal court rejected a second attempt by Progress Software and co-defendants to dismiss negligence claims stemming from the large-scale MOVEit data breach, allowing lawsuits under the laws of California, Indiana, Michigan, and Ohio to move forward in multi-district litigation.
Who should care: Cybersecurity · Privacy officers · Administrators
South Florida Injury Centers reported a hacking incident, and the Chickasaw Nation Department of Health disclosed a separate data breach, according to reporting in the HIPAA Journal. Both incidents involve healthcare entities covered under federal patient privacy rules.
Who should care: Healthcare professionals · Privacy officers · Compliance
Healthcare organizations are increasingly being breached through remote desktop tools, which attackers are exploiting as a primary entry point, according to reporting in the HIPAA Journal. The trend persists even as overall cyberattack volume has shown some decline, per data from cybersecurity firm SonicWall.
Who should care: Healthcare professionals · Privacy officers · Compliance
Libya's Central Bank has confirmed it is investigating data that appeared on the dark web following a cyberattack earlier this month. The bank says its technical teams, alongside international experts, are working to determine what the data contains and whether it is directly tied to the breach.
Who should care: Cybersecurity · Privacy officers · Administrators
South Africa's data privacy law, POPIA, can require mandatory breach reporting even when personal information is exposed by something as routine as a misdirected email, according to attorneys citing an enforcement notice against a Johannesburg college. The case confirms that accidental internal disclosures are not exempt from the law's reporting obligations.
Who should care: Cybersecurity · Privacy officers · Administrators · Lawyers · Compliance · General readers · Policy
Japanese telecommunications company KDDI confirmed a data breach on June 17, 2026, in which attackers gained unauthorized access to a system shared by six ISP mail services. Up to 14.22 million email addresses and associated passwords may have been exposed as a result.
Who should care: Cybersecurity · Privacy officers · Administrators
Japanese telecommunications operator KDDI Corporation disclosed a data breach where threat actors gained access to one of its email systems used by five other internet service providers (ISPs) in the country. [...]
Who should care: Cybersecurity · Privacy officers · Administrators
AssuranceAmerica Managing General Agency has notified at least 1.1 million people across seven states after detecting suspicious activity on its systems. Breach notices have been sent to residents in California, Massachusetts, Nebraska, South Carolina, Texas, Vermont, and Washington.
Who should care: Cybersecurity · Privacy officers · Administrators
Melanie Conroy of Pierce Atwood LLP writes: The First Circuit recently affirmed dismissal of a putative data breach class action against Bayamón Medical Center (BMC), holding that the plaintiff failed to plausibly allege that her injuries were traceable to the healthcare provider’s 2019 ransomware attack. In Santos-Pagán v. Bayamón Medical Center, the court concluded that allegations... Source
Who should care: Cybersecurity · Privacy officers · Administrators
Polymarket, a prediction market platform, will reimburse roughly $3 million to customers after attackers compromised a third-party vendor and injected malicious code into the platform's frontend, draining user funds. The company says it will cover all losses from the incident.
Who should care: Cybersecurity · Privacy officers · Administrators
Ukraine's security service, the SBU, has detailed a sustained Russian intelligence operation in which operatives posed as technical support staff to trick targets into surrendering login credentials for their messaging accounts. The campaign gave attackers direct access to private communications.
Who should care: Cybersecurity · Privacy officers · Administrators
Okanogan Behavioral Healthcare, a behavioral health provider in Washington State, has agreed to settle a class action lawsuit stemming from a data breach. The settlement resolves claims brought by individuals whose information was exposed.
Who should care: Cybersecurity · Privacy officers · Administrators · Lawyers · Compliance · Healthcare professionals
Colorado Health Network and Kentucky Mountain Health Alliance have each disclosed separate data breaches, according to reporting in the HIPAA Journal. Details on the scope and nature of the compromised data remain limited in the available excerpt.
Who should care: Healthcare professionals · Privacy officers · Compliance
A database of nearly one million passport images, collected by an ID verification system used by cannabis dispensaries, was exposed online. The breach illustrates how sensitive government-issued credentials end up stored in peripheral, lower-security systems far removed from the original purpose of the document.
Who should care: Cybersecurity · Privacy officers · Administrators
Three separate organizations — Minnesota Epilepsy Group, Campbell University, and the City of Middletown, Ohio — have each disclosed data breaches. The incidents span healthcare, higher education, and local government, suggesting no single attack but a broad pattern of exposure across different sectors.
Who should care: Healthcare professionals · Privacy officers · Compliance
In August 2025, DataBreaches added the Colorado Health Network (CHN) to our non-public worksheets after threat actors called Cephalus added the provider to its’ dark web leak site with a claim that they had acquired 900 GB of data. Cephalus disappeared from public view days later, and never leaked the data on any server that... Source
Who should care: Cybersecurity · Privacy officers · Administrators
A data breach in New Zealand is prompting discussion about potential reforms to the country's privacy legislation, according to reporting from the IAPP. The incident may accelerate legislative changes to how personal data is protected under New Zealand law.
Who should care: Cybersecurity · Privacy officers · Administrators · General readers · Policy
A data exposure at Dialog, described as an exclusive, invite-only organization, left membership information accessible without any breach in the conventional sense. The organization reportedly framed the incident as a hack, though the data appears to have been leaking rather than stolen through an intrusion.
Who should care: Cybersecurity · Privacy officers · Administrators
Bradford Health Services and Bradford Health Partners have agreed to settle a lawsuit stemming from a December 2023 cybersecurity incident that exposed patient data. The breach prompted legal action under privacy and healthcare data protection laws.
Who should care: Cybersecurity · Privacy officers · Administrators · Lawyers · Compliance · Healthcare professionals
Hillcrest Convalescent Center, a skilled nursing and rehabilitation facility in Durham, North Carolina, has reached a settlement in a class action lawsuit stemming from a data breach affecting patient information.
Who should care: Cybersecurity · Privacy officers · Administrators · Healthcare professionals · Compliance
A British member of the Scattered Spider hacking group has pleaded guilty to cyberattacks on Transport for London, SSM Health Care, and Sutter Health, with a second British hacker also pleading guilty in connection with the TfL breach. The cases mark a rare instance of criminal accountability for a group linked to a string of high-profile intrusions.
Who should care: Healthcare professionals · Privacy officers · Compliance
Tata Electronics, a major supplier to companies including Apple and Tesla, has reportedly suffered a cyberattack in which threat actors claim to have obtained sensitive trade secrets tied to those client relationships. The full scope of the breach and the validity of the claims have not been independently confirmed.
Who should care: Cybersecurity · Privacy officers · Administrators
A lawsuit stemming from a data breach at MSG Entertainment is drawing attention to the company's use of facial recognition technology and how it handles the personal data of people who attend its venues.
Who should care: Cybersecurity · Privacy officers · Administrators · Lawyers · Compliance · General readers · Policy
A blogpost by EDPS head Wojciech Wiewiórowski addresses the risks posed by unauthorized AI tools used inside organizations, noting that such tools can expose personal data, create regulatory blind spots, and introduce security vulnerabilities that official IT governance never sees.
Who should care: Cybersecurity · Privacy officers · Administrators · Lawyers · Compliance · General readers · AI governance · Policy