2026 continues the year-over-year growth trend in confirmed disclosures. The list below updates as new breaches are reported by Verizon DBIR partners and major security news outlets.
Black Hat 2026 is shaping up to be another AI-heavy conference, but this year’s announcements suggest the industry is moving beyond simply adding copilots to existing products. Vendors are increasingly packaging AI in
IBM Langflow Code Injection Vulnerability — Langflow contains a code injection vulnerability that allows unauthenticated attackers to achieve full remote code execution on default Langflow deployments.
Apache Tomcat Missing Encryption of Sensitive Data Vulnerability — Apache Tomcat contains a missing encryption of sensitive data vulnerability that allows the bypass of the EncryptInterceptor.
Bill Curtis reports: The full names and contact details for more than 100,000 police officers and staff have been leaked on the dark web after a hack, The Times can reveal. As part of a major security breach, hackers com
The Herald Business reports: Seoul Facilities Corp. has drawn criticism over its plan to offer 5,000 won [$3.50 USD] per affected user in response to a personal data breach involving about 4.62 million people, with quest
N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability — N-able N-central contains an authentication bypass using an alternate path or channel allows for authentication bypass and account
The INC Ransomware operation has emerged as the "dominant threat actor" exploiting the recently disclosed security flaws in SonicWall Secure Mobile Access (SMA) 1000 series VPN appliances. In a report published over the
An unknown Chinese-speaking threat actor has been observed running a campaign targeting Apple iOS devices by leveraging a publicly leaked version of the DarkSword exploit kit. Attack surface management platform Censys s
Fake Xeno Executor installers are infecting unsuspecting Roblox players with malware that provides remote access and steals sensitive information. [...]
DPA reports: The tiny principality of Liechtenstein has fallen victim to a major cyberattack in which the data of 31,000 people were stolen, the government said on Sunday. The country, which lies between Switzerland and
A hacker has drained nearly $89m from Coldcard Bitcoin wallets after exploiting a legacy bug
This week kept coming back to permission. A model crossed a boundary. A wallet trusted bad randomness. Webmail kept an intruder around. Public systems, package feeds, hotel networks, and login flows all gave away more th
The Police National Legal Database (PNLD) has confirmed that police, government and customer contact information was compromised and published on the dark web. The data included names, organisations and work email addre
A cyberattack on the U.K.'s Police National Legal Database (PNLD) has compromised contact data of more than 100,000 police officers and other criminal justice professionals. [...]
2024 breach affecting more than 3 million Americans' healthcare data
Credit card data and private information of 75 million customers allegedly for sale by attackers
Data breach exposing 740,000 records; failure to properly secure personally identifiable information
Third-party help-desk platform breach exposed client SSNs, tax records, and financial account codes
Cyberattack exposes hospital records on approximately 13,000 patients
Data breach compromises personal health information of hospital system patients
Healthcare billing firm network breach exposed sensitive data affecting 1.26 million people
Active intrusion into federal information sharing network