The full corpus — beyond today's front page.
504 results · page 20 of 21
Medtronic has begun notifying people whose data was exposed in a cyberattack that occurred in April 2026, with the ShinyHunters threat group claiming responsibility for the breach. The medical device company's notification process follows reporting by The HIPAA Journal.
Who should care: Healthcare professionals · Privacy officers · Compliance
Aflac has disclosed a data breach affecting its Japan subsidiary, in which attackers accessed and stole personal information and bank account data. The incident involves one of the largest supplemental insurance providers in the United States, a Fortune 500 company serving millions of customers.
Who should care: Cybersecurity · Privacy officers · Administrators
Aflac has disclosed a data breach stemming from an attack on its Japan-based subsidiary, in which personal information and bank account details were stolen from affected individuals. The company has not publicly confirmed the full scope of the breach.
Who should care: Cybersecurity · Privacy officers · Administrators
Amicus Solutions, also known as Fedora Solutions, has disclosed a cybersecurity incident that affected Huntsville Hospital Health System. The hospital confirmed it was impacted by the breach, which was reported in connection with HIPAA compliance obligations.
Who should care: Healthcare professionals · Privacy officers · Compliance
Washington State's Department of Social and Health Services disclosed that an employee improperly accessed protected records belonging to approximately 8,600 individuals, constituting an insider data breach of sensitive personal information held by a state agency.
Who should care: Cybersecurity · Privacy officers · Administrators · Healthcare professionals · Compliance
Fox Rothschild, a top-100 U.S. law firm, has suffered a data breach carried out by Silent Ransom Group, a threat actor known to target law firms specifically. The breach resulted in a data leak, exposing the firm and potentially its clients to serious confidentiality risks.
Who should care: Cybersecurity · Privacy officers · Administrators
Nissan is warning that it suffered a data breach affecting current and former employees after threat actors exploited an Oracle PeopleSoft vulnerability in data theft attacks previously linked to the ShinyHunters extortion group. [...]
Who should care: Cybersecurity · Privacy officers · Administrators
The National Association of Insurance Commissioners (NAIC) says the ShinyHunters extortion group stole only publicly available data, outdated logs, and configuration files after breaching its systems by exploiting a zero-day vulnerability in an Oracle PeopleSoft server. [...]
Who should care: Cybersecurity · Privacy officers · Administrators
A federal court rejected a second attempt by Progress Software and co-defendants to dismiss negligence claims stemming from the large-scale MOVEit data breach, allowing lawsuits under the laws of California, Indiana, Michigan, and Ohio to move forward in multi-district litigation.
Who should care: Cybersecurity · Privacy officers · Administrators
South Florida Injury Centers reported a hacking incident, and the Chickasaw Nation Department of Health disclosed a separate data breach, according to reporting in the HIPAA Journal. Both incidents involve healthcare entities covered under federal patient privacy rules.
Who should care: Healthcare professionals · Privacy officers · Compliance
Healthcare organizations are increasingly being breached through remote desktop tools, which attackers are exploiting as a primary entry point, according to reporting in the HIPAA Journal. The trend persists even as overall cyberattack volume has shown some decline, per data from cybersecurity firm SonicWall.
Who should care: Healthcare professionals · Privacy officers · Compliance
Libya's Central Bank has confirmed it is investigating data that appeared on the dark web following a cyberattack earlier this month. The bank says its technical teams, alongside international experts, are working to determine what the data contains and whether it is directly tied to the breach.
Who should care: Cybersecurity · Privacy officers · Administrators
South Africa's data privacy law, POPIA, can require mandatory breach reporting even when personal information is exposed by something as routine as a misdirected email, according to attorneys citing an enforcement notice against a Johannesburg college. The case confirms that accidental internal disclosures are not exempt from the law's reporting obligations.
Who should care: Cybersecurity · Privacy officers · Administrators · Lawyers · Compliance · General readers · Policy
Japanese telecommunications company KDDI confirmed a data breach on June 17, 2026, in which attackers gained unauthorized access to a system shared by six ISP mail services. Up to 14.22 million email addresses and associated passwords may have been exposed as a result.
Who should care: Cybersecurity · Privacy officers · Administrators
Japanese telecommunications operator KDDI Corporation disclosed a data breach where threat actors gained access to one of its email systems used by five other internet service providers (ISPs) in the country. [...]
Who should care: Cybersecurity · Privacy officers · Administrators
AssuranceAmerica Managing General Agency has notified at least 1.1 million people across seven states after detecting suspicious activity on its systems. Breach notices have been sent to residents in California, Massachusetts, Nebraska, South Carolina, Texas, Vermont, and Washington.
Who should care: Cybersecurity · Privacy officers · Administrators
Melanie Conroy of Pierce Atwood LLP writes: The First Circuit recently affirmed dismissal of a putative data breach class action against Bayamón Medical Center (BMC), holding that the plaintiff failed to plausibly allege that her injuries were traceable to the healthcare provider’s 2019 ransomware attack. In Santos-Pagán v. Bayamón Medical Center, the court concluded that allegations... Source
Who should care: Cybersecurity · Privacy officers · Administrators
Polymarket, a prediction market platform, will reimburse roughly $3 million to customers after attackers compromised a third-party vendor and injected malicious code into the platform's frontend, draining user funds. The company says it will cover all losses from the incident.
Who should care: Cybersecurity · Privacy officers · Administrators
Ukraine's security service, the SBU, has detailed a sustained Russian intelligence operation in which operatives posed as technical support staff to trick targets into surrendering login credentials for their messaging accounts. The campaign gave attackers direct access to private communications.
Who should care: Cybersecurity · Privacy officers · Administrators
Okanogan Behavioral Healthcare, a behavioral health provider in Washington State, has agreed to settle a class action lawsuit stemming from a data breach. The settlement resolves claims brought by individuals whose information was exposed.
Who should care: Cybersecurity · Privacy officers · Administrators · Lawyers · Compliance · Healthcare professionals
Colorado Health Network and Kentucky Mountain Health Alliance have each disclosed separate data breaches, according to reporting in the HIPAA Journal. Details on the scope and nature of the compromised data remain limited in the available excerpt.
Who should care: Healthcare professionals · Privacy officers · Compliance
A database of nearly one million passport images, collected by an ID verification system used by cannabis dispensaries, was exposed online. The breach illustrates how sensitive government-issued credentials end up stored in peripheral, lower-security systems far removed from the original purpose of the document.
Who should care: Cybersecurity · Privacy officers · Administrators
Three separate organizations — Minnesota Epilepsy Group, Campbell University, and the City of Middletown, Ohio — have each disclosed data breaches. The incidents span healthcare, higher education, and local government, suggesting no single attack but a broad pattern of exposure across different sectors.
Who should care: Healthcare professionals · Privacy officers · Compliance
In August 2025, DataBreaches added the Colorado Health Network (CHN) to our non-public worksheets after threat actors called Cephalus added the provider to its’ dark web leak site with a claim that they had acquired 900 GB of data. Cephalus disappeared from public view days later, and never leaked the data on any server that... Source
Who should care: Cybersecurity · Privacy officers · Administrators