Data Breaches
Pay Tel, a US prison calling vendor, left a Microsoft Azure storage server holding 300,000-plus driver's license scans and inmate communications open to the web without a password, UpGuard told TechCrunch on May 28. It is Pay Tel's second known security failure in a year.
Data Breaches
Carnival Corporation began notifying 5,995,277 people on May 27, 2026 that their personal data was stolen in an April vishing breach — the corporate confirmation of an extortion claim ShinyHunters posted to its leak site 38 days earlier.
Data Breaches
A site branded as 'UK Visa Portal' exposed at least 100,000 applicants' passport scans and selfies, TechCrunch reported May 26. The site is not affiliated with the UK government, and the operator sent attorneys rather than fix the leak.
Data Breaches
Three breach disclosures landed in one cycle — Radiology Associates of Richmond (266,183 people), DocketWise (143,480), and a vendor breach at the Oncology Institute. None is a novel attack. Together they map 2026's two structural failures: repeat victimization and third-party risk.
Data Breaches
Trump Mobile confirmed customer names, email and mailing addresses, phone numbers, and order identifiers were exposed to the open internet via a third-party platform provider, and said it is still evaluating whether it must notify affected customers.
Cyber Attacks
GitHub confirmed TeamPCP (UNC6780) exfiltrated roughly 3,800 internal repositories after an employee installed a poisoned Visual Studio Code extension. The same actor behind the Mini Shai-Hulud worm listed the data for $50,000+ on BreachForums — framed as a sale, not a ransom.
Trending
ShinyHunters claims 9.4 million Amtrak records via Salesforce — 2.1 million accounts independently confirmed on Have I Been Pwned. The latest target in the group's coordinated 2026 campaign that has hit ADT, Udemy, Medtronic, Vimeo, and Cisco.
Data Breaches
Vimeo has confirmed a data breach affecting portions of its user database following a compromise at Anodot, a third-party analytics vendor. The breach has been attributed to ShinyHunters, which exploited trusted API connections between Anodot and its enterprise clients to access Vimeo's environment without directly targeting Vimeo'
Data Breaches
Major Dutch e-commerce platform bol.com is investigating unverified claims that a database containing approximately 400,000 customer records was offered for sale online, though the company currently reports no evidence of a security incident. UTRECHT, NETHERLANDS — Leading Dutch retailer bol.com addressed a series of unverified allegations between April
Data Breaches
Agoda has issued a formal denial following unverified claims on a dark web forum that a dataset containing 82 million customer records was stolen from its systems. SINGAPORE — Digital travel platform Agoda denied unverified claims on April 22, 2026, that a threat actor exfiltrated a database containing 82 million user
Data Breaches
Citizens Financial Group has confirmed it is managing a data security incident involving a third-party vendor, following claims by the Everest ransomware group that they exfiltrated sensitive corporate and customer data. Providence, RI — Citizens Financial Group (CFG) has become the latest major financial institution to grapple with the fallout of
Data Breaches
Canada Life has confirmed a significant data breach after hackers successfully exploited a single employee account to access a high-value Salesforce environment, exposing the sensitive personal information of thousands. Winnipeg, MB — Canada Life, one of the nation's largest insurance and financial services providers, has begun notifying approximately 70,