The cyber risks we track, in real time

Anubis encrypted Nutanix production servers and stole 1 TB including HR records, engineering docs, and production data, suspending all US dairy production and triggering an SEC 8-K on July 16. Confirmed wiper-mode capability threatens permanent data loss.

4.38 million policyholder records stolen, including names, addresses, and policy details, with 230,000 customers losing bank-account data. The customer portal was compromised for 10 days before detection; a US SEC 8-K followed.

The BigLaw firm, which handles active M&A matters, notified clients July 10 of a breach discovered in early May. Names and SSNs of thousands were exposed; Silent Ransom Group TTPs are suspected and a class action is proposed.

D1R ransomware claimed the global industrial manufacturer, stealing sensitive engineering data that represents decades of R&D and competitive IP. Scope and volume remain under investigation.

AI-assisted zero-day chaining breached the world’s largest open-source AI model repository, and INC ransomware piled on. Model weights and developer credentials are at risk, creating downstream exposure for every enterprise using hosted models.

Ransomware forced the closure of US healthcare facilities amid July’s record 35% healthcare attack share. Patient-care disruption, clinical-data exposure, and a HIPAA investigation followed.

Ransomware wiped the entire national property database, paralyzing Romania’s real estate market. A wipe rather than encryption means no decryption key, and the recovery timeline is unknown.

NightSpire ransomware claimed the college on July 16 amid a 44% month-over-month surge in education attacks. Student and staff PII and research data are at risk.

630.4 GB exfiltrated including Apple and Tesla technical drawings, manufacturing specs, and employee passports. 204,341 files published publicly.

1.8 million individuals affected. SSNs, biometric fingerprints, palm prints, medical records, precise geolocation, and financial credentials exfiltrated via a third-party vendor. Senate HELP Committee inquiry.

Ransomware attack on Bajaj Auto and subsidiary Bajaj Auto Technology Ltd. Regulatory filing to NSE and CERT-In. Detected June 23 at 8:00 AM IST. No confirmed data exfiltration.

Unauthenticated API endpoint flaw exploited June 2–5 across all hosted customer instances. Internal tickets, employee records, and operational documentation exposed. Patch deployed June 5.

Up to 14.22 million email addresses and passwords exposed across 6 Japanese ISPs via a third-party software vulnerability. Detected June 17, disclosed June 23.

859 MB stolen: employee PII, internal surveys, sentiment analytics, progress plans, and reports spanning 2016–2026. Corporate intelligence value.

ShinyHunters claimed a ransomware attack; scope under investigation. Follows the group’s prolific April and May 2026 campaign against high-visibility brands.

Anubis ransomware claimed the real estate appraisal and consulting firm June 22. Property valuations, client financials, and HNW individual PII at risk.

SEC 8-K filed May 7 as a material event. Data exfiltrated and global systems encrypted; manufacturing and shipping disrupted worldwide. Unit 42 engaged. Only the third S&P 500 company to file a cyber 8-K in 2026.

275 million records stolen across 8,800+ institutions (Duke, Harvard, Penn, Wisconsin). 3.65 TB exfiltrated via an XSS flaw in the free-tier support flow. Ransom paid. FBI PSA issued.

Both listed within 24 hours. Fiserv serves 10,000+ financial institutions with core banking and Clover POS. A coordinated strike against US payment infrastructure with systemic downstream risk.

$13M ransom demand. 10 clients notified. M&A deal files, litigation memos, and client financials exposed via targeted phishing at a law firm actively handling live transactions.

9M+ PII records and terabytes of corporate data claimed. Medtronic confirmed unauthorized access; the listing was removed, suggesting a quiet settlement. HIPAA exposure at scale.

21 GB exfiltrated: HNW client files, NDAs, passports, payroll, government IDs, and contracts. A classic high-value, low-security-posture wealthcare target.

111,000 individuals notified. SSNs and names exposed via Fortinet edge-gear exploitation. Class action filed. Real estate investment firm.

Source code, employee database, API keys, MongoDB and MySQL credentials stolen. Every Checkmarx customer’s DevOps pipeline placed at downstream risk. Software supply-chain multiplier.

200,000+ devices wiped across 79 countries with 50 TB of data theft claimed and simultaneous factory resets. Nation-state retaliation; BYOVD technique used to neutralize EDR.

Multinational bank from a central-bank consortium listed April 22. Cross-border banking data, inter-bank records, and regulatory exposure. LockBit 5 resurgent after takedown.

Source code, employee database, API keys, and database credentials stolen. DevSecOps platform compromise creates a supply-chain multiplier for all downstream customers.

Qilin claimed unauthorized access with internal data allegedly exfiltrated. Chemical manufacturing with an OT/IT boundary vulnerability. Unconfirmed ransom demand.

German political entity. Ransomware plus data theft; IT systems partially shut down. Russian-aligned framing via spear-phishing and remote desktop exploitation.

All non-emergency public services suspended; personal data potentially compromised. Opportunistic targeting of under-resourced municipal IT with a weeks-long recovery.

German logistics provider and supply-chain bottleneck target with high disruption leverage. Listed April 24. Client data and logistics records exposed.

1.52 TB exfiltrated including names, IDs, and banking data. Leading Brazilian government-linked institution. LGPD regulatory exposure.