Live Nation reported: On May 20, 2024, Live Nation Entertainment, Inc. (the “Company” or “we”) identified unauthorized activity within a third-party cloud database environment containing Company data (primarily from its Ticketmaster L.L.C. subsidiary) and launched an investigation with industry-leading forensic investigators to understand what happened. On May 27, 2024, a criminal threat actor offered what it alleged to be Company user data for sale via the dark web. We are working to mitigate risk to our users and the Company, and have notified and are cooperating with law enforcement. As appropriate, we are also notifying regulatory authorities and users with respect to unauthorized access to personal information.
Hugging Face reported: Earlier this week, we detected and responded to an intrusion into part of our production infrastructure. This one was different from anything we had handled before in one important way: it was driven, end to end, by an autonomous AI agent system - and we detected and dissected it largely with AI of our own.
Vercel reported: We’ve identified a security incident that involved unauthorized access to certain internal Vercel systems. We are actively investigating, and we have engaged incident response experts to help investigate and remediate. We have notified law enforcement and will update this page as the investigation progresses.
Stryker reported: On March 11, 2026, we experienced a cybersecurity attack which resulted in a global disruption to Stryker’s Microsoft environment. Upon detecting this incident, we quickly activated our incident response plan and launched an investigation with the support of external advisors and cybersecurity experts.
Wiz Research reported: We identified a misconfigured Supabase database belonging to Moltbook, allowing full read and write access to all platform data. The exposure included 1.5 million API authentication tokens, 35,000 email addresses, and private messages between agents. We immediately disclosed the issue to the Moltbook team, who secured it within hours with our assistance, and all data accessed during the research and fix verification has been deleted.
Zapier reported: At around 5:50 AM UTC on November 24, 2025, Zapier became aware that a subset of our NPM packages were involved in a supply chain compromise that injected malicious code in their packages.
Ingram Micro reported: Ingram Micro recently identified ransomware on certain of its internal systems. Promptly after learning of the issue, the Company took steps to secure the relevant environment, including proactively taking certain systems offline and implementing other mitigation measures. The Company also launched an investigation with the assistance of leading cybersecurity experts and notified law enforcement.
United Natural Foods reported: We have identified unauthorized activity in our systems and have proactively taken some systems offline while we investigate. As soon as we discovered the activity, an investigation was initiated with the help of leading forensics experts and we have notified law enforcement. We are assessing the unauthorized activity and working to restore our systems to safely bring them back online. As we work through this issue, our customers, suppliers, and associates are our highest priority. We are working closely with them to minimize disruption as much as possible.
Coinbase reported: On May 11, 2025, Coinbase, Inc., a subsidiary of Coinbase Global, Inc. (“Coinbase” or the “Company”), received an email communication from an unknown threat actor claiming to have obtained information about certain Coinbase customer accounts, as well as internal Coinbase documentation, including materials relating to customer-service and account-management systems. The communication demanded money in exchange for not publicly disclosing the information. The threat actor appears to have obtained this information by paying multiple contractors or employees working in support roles outside the United States to collect information from internal Coinbase systems to which they had access in order to perform their job responsibilities. These instances of such personnel accessing data without business need were independently detected by the Company’s security monitoring in the previous months. Upon discovery, the Company had immediately terminated the personnel involved and also implemented heightened fraud-monitoring protections and warned customers whose information was potentially accessed in order to prevent misuse of any compromised information. Since receipt of the email, the Company has assessed the email to be credible, and has concluded that these prior instances of improper data access were part of a single campaign (the “Incident”) that succeeded in taking data from internal systems. The Company has not paid the threat actor’s demand and is cooperating with law enforcement in the investigation of this Incident.
Wiz Research reported: Upon further investigation, these ports led to a publicly exposed ClickHouse database , accessible without any authentication at all – immediately raising red flags.
Halliburton Company reported: On August 21, 2024, Halliburton Company (the “Company”) became aware that an unauthorized third party gained access to certain of its systems.
AT&T Inc. reported: On April 19, 2024, AT&T Inc. (“AT&T”) learned that a threat actor claimed to have unlawfully accessed and copied AT&T call logs. AT&T immediately activated its incident response process to investigate and retained external cybersecurity experts to assist. Based on its investigation, AT&T believes that threat actors unlawfully accessed an AT&T workspace on a third-party cloud platform and, between April 14 and April 25, 2024, exfiltrated files containing AT&T records of customer call and text interactions that occurred between approximately May 1 and October 31, 2022, as well as on January 2, 2023, as described below.
A cyber incident at CDK Global caused widespread disruption to U.S. auto dealerships that rely on CDK’s dealer management systems. Dealership groups disclosed operational disruption and potential financial impacts in statements and securities filings, and reporting described large portions of the dealership ecosystem switching to manual processes while systems were restored. The incident highlights concentrated third-party operational risk in industry-critical SaaS and managed platforms.
In 2024, multiple companies reported data theft and extortion attempts linked to unauthorized access to their Snowflake environments. Reporting and industry analysis described attackers using stolen credentials (often associated with infostealer infections) and, in many cases, lack of MFA on Snowflake accounts as a contributing risk factor. Snowflake stated it did not identify evidence that the activity was due to a vulnerability or breach of Snowflake’s platform itself.
Banco Santander, S.A. reported: Madrid, 14 May 2024 - We recently became aware of an unauthorized access to a Santander database hosted by a third-party provider. We immediately implemented measures to contain the incident, including blocking the compromised access to the database and establishing additional fraud prevention controls to protect affected customers.
A cyberattack affecting Change Healthcare caused widespread disruption to healthcare payment and pharmacy claims processing in the United States. UnitedHealth Group (Change Healthcare’s parent company) disclosed the incident and its impacts through SEC filings, describing significant operational disruption and material financial effects across the business. Subsequent filings and earnings-related documents discussed ongoing remediation costs and impacts, reflecting the scale of financial risk from a high-availability healthcare transaction intermediary being taken offline.
Ivanti and CISA warned of active exploitation of vulnerabilities affecting Ivanti Connect Secure (ICS) and Ivanti Policy Secure (IPS), urging organizations to apply mitigations and updates. CISA issued emergency directives and alerts for federal agencies and provided guidance for broader organizations, reflecting the severity and active exploitation status. The incident illustrates the rapid operational and financial risk created when widely deployed VPN/access gateways are exploited at scale.
high confidencevuln exploitation • CVE-2023-46805 • IvantiT1190
Okta disclosed that its support case management system was breached and that files uploaded by customers for support, including HAR (HTTP Archive) files, were accessed. Okta warned that some HAR files can contain sensitive tokens or session data if captured incorrectly, creating downstream risk for affected customers. The incident underscores the financial and operational impact of third-party support system compromises, including emergency credential rotation and incident response work for customers.
Caesars Entertainment disclosed a cyber incident in an SEC filing, reporting unauthorized access to its network and exfiltration of data from its loyalty program database. Public reporting described the incident as involving an extortion demand and discussed alleged ransom payment amounts. The event shows how consumer-facing loyalty programs can create concentrated data exposure and how extortion pressure can drive direct financial costs in addition to remediation and notification expenses.
MGM Resorts disclosed a cybersecurity issue in September 2023 that disrupted certain company systems and operations, prompting incident response actions and public communications through SEC filings. In later SEC disclosures, MGM estimated the incident would reduce third-quarter adjusted property EBITDAR by approximately $100 million. The event is a clear example of a cyber incident driving both immediate operational disruption in hospitality and a quantified negative impact on financial results reported to investors.
The Clorox Company reported: The Clorox Company (the “Company” or “Clorox”) has identified unauthorized activity on some of its Information Technology (IT) systems. After becoming aware of the activity, the Company began taking steps to stop and remediate the activity, including taking certain systems offline. The Company is working diligently to respond to and address this issue, and is also coordinating with law enforcement. To the extent possible, and in line with its business continuity plans, Clorox has implemented workarounds for certain offline operations in order to continue servicing its customers. However, the incident has caused, and is expected to continue to cause, disruption to parts of the Company’s business operations.
Microsoft reported that the China-based threat actor it tracks as Storm-0558 used a stolen Microsoft account (MSA) signing key to forge authentication tokens and gain access to Outlook Web Access and Exchange Online mailboxes of targeted organizations, including government entities. Microsoft described mitigations taken to block the actor’s access and remediate the signing key issue. The U.S. Cyber Safety Review Board (CSRB) later issued a report on the incident, including recommendations related to cloud identity, logging, and key management.
A critical vulnerability in Progress Software’s MOVEit Transfer product (CVE-2023-34362) was exploited at scale in 2023 to steal data from affected organizations and enable extortion. Progress published advisories and mitigation guidance, and CISA issued a joint advisory describing the exploitation and attributing the campaign to the Cl0p ransomware group. The event led to widespread breach notifications and material response costs for many victims across industries.
high confidencevuln exploitation • CVE-2023-34362 • MOVEitT1190
Uber disclosed a security incident in September 2022 in which an attacker gained access to internal systems after obtaining credentials and leveraging social engineering techniques. The incident drew attention to MFA fatigue/social engineering risks and internal tooling exposure. The U.S. Cyber Safety Review Board (CSRB) later analyzed related intrusions in the period (including Lapsus$ activity), emphasizing systemic identity and access control weaknesses exploited through social engineering.
LastPass disclosed a security incident in August 2022 involving unauthorized access to portions of its development environment and source code. In subsequent updates, LastPass reported additional details about a related incident involving a third-party cloud storage service and the theft of customer vault data and backups. The disclosures highlight how incidents at security vendors can create downstream risk and drive significant customer remediation and trust impacts.
In 2022, multiple Costa Rican government agencies were hit by ransomware attacks that disrupted public services and contributed to the government declaring a national emergency. U.S. State Department reward announcements referenced the Conti ransomware group in connection with attacks affecting Costa Rica. News reporting described significant disruption to government functions and highlighted broader economic and operational impacts.
In July 2021, attackers exploited Kaseya VSA and leveraged its remote management capabilities to distribute ransomware to downstream customers, particularly through managed service providers (MSPs). CISA issued alerts and guidance during the incident response period, and public vulnerability records tracked the relevant Kaseya VSA weakness used in the campaign. The event illustrates how compromise of a widely deployed management platform can multiply financial and operational impact across many organizations.
med confidencesupply chain • CVE-2021-30116 • KaseyaT1195.002T1486
JBS reported a ransomware attack that affected IT systems supporting North American and Australian operations and temporarily disrupted meat processing. The company issued public statements on restoration progress, and media reporting described ransom payment discussions and operational impacts. The incident illustrates ransomware’s capacity to disrupt industrial and food supply operations and create significant financial and operational risk.
Ireland’s Health Service Executive (HSE) suffered a ransomware attack in May 2021 that led to major disruption across health services and IT systems. The HSE published ongoing public updates, and Ireland’s National Cyber Security Centre issued alerts about the situation. U.S. health-sector coordination reporting and other analyses highlighted the operational consequences and the need for resilient healthcare cybersecurity practices.
Colonial Pipeline experienced a ransomware incident that led the company to shut down pipeline operations temporarily, creating significant fuel supply disruption and economic impact. The U.S. Department of Justice later announced the seizure of approximately $2.3 million in cryptocurrency paid to the DarkSide ransomware extortionists. The incident became a prominent example of ransomware’s ability to drive operational shutdown decisions and significant downstream financial effects.
In early 2021, multiple vulnerabilities in Microsoft Exchange Server were exploited at scale, with Microsoft attributing early activity to the actor it tracked as HAFNIUM and subsequent widespread opportunistic exploitation. CISA issued a joint advisory describing the exploitation chain, victim impact, and remediation actions, including patching and web shell detection. The episode drove urgent patching across on-premises Exchange deployments and illustrates the financial and operational risk created by rapidly exploited internet-exposed enterprise services.
high confidencevuln exploitation • CVE-2021-26855 • Microsoft ExchangeT1190T1505.003
Attackers exploited vulnerabilities in Accellion’s legacy File Transfer Appliance (FTA) product to access and steal data from multiple organizations, frequently followed by extortion. CISA published a joint advisory describing the exploitation, IOCs, and mitigation steps, and affected organizations issued breach notifications and updates. The incident illustrates both the risk of end-of-life file transfer appliances and the financial and regulatory consequences of third-party data exposure.
med confidencevuln exploitation • CVE-2021-27101 • AccellionT1190
A supply chain compromise of SolarWinds Orion involved the distribution of maliciously modified software updates, enabling unauthorized access to affected customer environments. CISA issued an emergency directive for federal civilian agencies and published guidance on detection and response, while SolarWinds disclosed details and risks in SEC filings. The incident triggered broad remediation efforts across government and industry and remains a major reference case for software supply chain risk management.
Garmin experienced a multi-day outage affecting customer-facing services and internal operations in July 2020 and issued a public statement during restoration efforts. Security reporting and analyses characterized the event as a ransomware incident impacting Garmin’s systems and availability. The disruption highlights how ransomware can produce material downtime and business interruption even when customer data theft is not the primary public focus.
In July 2020, attackers gained access to Twitter’s internal tools through social engineering and used that access to take over high-profile verified accounts to promote a cryptocurrency scam. Twitter published updates describing the incident and remediation steps, and the New York Department of Financial Services (NYDFS) later issued a detailed report on control failures and recommendations. The incident demonstrated how compromise of internal administration tools can create outsized fraud and reputational damage even without large-scale data theft.
Capital One announced a data security incident involving unauthorized access to personal information and certain credit card application data. The company provided details on timing and affected populations and engaged law enforcement. The U.S. Office of the Comptroller of the Currency (OCC) later assessed an $80 million civil money penalty related to the incident, reflecting significant regulatory financial impact.
In May 2019, the City of Baltimore suffered a ransomware attack that disrupted municipal services such as property transactions and city systems. Public-sector testimony and reporting described substantial recovery expenses and prolonged disruption, illustrating the financial and operational impact ransomware can have on local government. The incident is commonly associated in public reporting with the “RobbinHood” ransomware family.
Norsk Hydro reported a ransomware attack in March 2019 that disrupted operations across its global aluminum and energy business, forcing parts of the organization into manual processes. Public reporting and case studies described significant operational disruption and material recovery costs reported by the company in subsequent communications. The incident has been used as a widely referenced case study in ransomware response and business continuity planning.
Marriott disclosed unauthorized access to the Starwood guest reservation database, reporting that information related to hundreds of millions of guests may have been exposed. Regulatory enforcement followed, including a penalty decision by the UK Information Commissioner’s Office (ICO) resulting in a monetary penalty. The incident drove significant remediation, legal, and compliance costs for the company and impacted global hospitality customers.
British Airways disclosed a breach affecting customer data, including payment card details for some bookings made through its website and mobile app. The UK Information Commissioner’s Office (ICO) later issued a monetary penalty notice, reflecting regulatory enforcement and financial consequences tied to the incident. The event underscores the financial and reputational impact of e-commerce data theft in large consumer-facing brands.
In March 2018, the City of Atlanta suffered a ransomware attack that disrupted multiple municipal services and required extensive recovery work. Government and public-sector reporting cited the incident as an example of how ransomware can impose prolonged operational disruption and significant recovery costs on local governments. Public analyses describe the event as involving ransomware activity consistent with encrypting systems and disrupting service delivery.
Equifax disclosed a breach that exposed sensitive personal information of a large portion of the U.S. population. Congressional investigations concluded the incident involved exploitation of an unpatched Apache Struts vulnerability (CVE-2017-5638). Regulators announced major financial settlements and remediation obligations, including a settlement involving the FTC, CFPB, and states.
high confidencebreach • CVE-2017-5638 • EquifaxT1190
NotPetya spread rapidly in June 2017, initially impacting organizations in Ukraine and then causing disruption in multiple countries. Although presented as ransomware, government and security reporting described it as destructive, with victims unable to recover data even after payment. U.S. and UK government statements publicly attributed the attack to Russia’s military, and security advisories documented widespread operational impact and significant financial losses across affected organizations.
WannaCry was a fast-spreading ransomware outbreak that disrupted organizations worldwide, including major impacts to the UK National Health Service (NHS). Microsoft and government advisories linked the outbreak to exploitation of SMB-related vulnerabilities addressed by Microsoft’s MS17-010 updates, and Microsoft referenced CVE-2017-0144 in its customer guidance. Government reporting described operational disruption and response costs for affected organizations.
high confidenceransomware • CVE-2017-0144 • WannaCryT1486T1210
Dyn reported large-scale distributed denial-of-service (DDoS) attacks against its managed DNS infrastructure on October 21, 2016, causing widespread service disruption for many internet platforms that depended on Dyn DNS resolution. U.S. prosecutors later announced guilty pleas related to the creation and operation of the Mirai botnet, which was used in major DDoS attacks during the period, including attacks affecting Dyn. The incident highlighted systemic availability risk from botnet-driven DDoS on core internet services.
Attackers compromised systems at the central bank of Bangladesh and used the SWIFT financial messaging system to send fraudulent transfer requests from the bank’s account at the Federal Reserve Bank of New York. The operation resulted in approximately $81 million being transferred and laundered, with additional transfers blocked. U.S. authorities later charged a North Korean regime-linked programmer for a campaign that included the Bangladesh Bank heist, tying the theft to broader state-backed illicit cyber activity.
The U.S. Office of Personnel Management (OPM) experienced major data breaches that exposed sensitive information about federal employees, contractors, and individuals involved in background investigations. Congressional oversight reporting described the scope of affected systems and weaknesses in security practices. The incident drove significant government response and remediation efforts, though precise total financial costs are not consolidated in the cited sources.
Anthem disclosed a cyberattack that exposed personal information of approximately 78.8 million current and former members. U.S. authorities later brought charges in connection with the breach, and regulators announced major financial settlements, including a record HIPAA settlement with HHS OCR and a multistate attorneys general settlement. These outcomes highlight substantial regulatory and legal financial consequences for large-scale healthcare data breaches.
Sony Pictures Entertainment suffered a destructive cyberattack that disrupted business operations and resulted in the theft and public release of internal data. The FBI publicly stated it concluded North Korea was responsible for the attack. Later U.S. Department of Justice statements about related cyber conspiracies also referenced the Sony Pictures incident.
Home Depot announced findings from its investigation into a data security incident involving malware on its U.S. and Canadian self-checkout point-of-sale systems. The company’s disclosures and subsequent filings described response actions, investigation, and costs associated with the incident. The event resulted in significant remediation and legal expenses, partially offset in some periods by insurance recoveries as disclosed in filings.
Target disclosed unauthorized access to payment card data for guests who shopped at U.S. Target stores during the 2013 holiday season. The company reported the incident publicly and in securities filings, describing ongoing investigation and remediation. Public reporting and subsequent investigations connected the incident to substantial response costs, litigation, and payments to affected parties, though precise totals vary by accounting period and source.
Saudi Aramco disclosed that a destructive malware attack affected its corporate computer systems and required restoration work, while stating oil production was unaffected. Public reporting described tens of thousands of workstations impacted and significant operational disruption to business IT. Vendor analyses characterize Shamoon as destructive malware designed to wipe systems.
Sony disclosed that an external intrusion affected the PlayStation Network and Qriocity services, leading to a multi-week service outage and exposure of user account data. Sony announced it was investigating the compromise and took systems offline while rebuilding security controls. Public reporting cited Sony’s estimate of roughly 14 billion yen (about $171 million at the time) in costs tied to response and customer remediation.
Stuxnet was a highly specialized malware campaign designed to target industrial control environments, including systems using Siemens Step7 software. Public technical advisories and analyses described how it could interfere with industrial processes while spreading in Windows environments. Public reporting and government analysis linked Stuxnet to Iran’s nuclear program, but a definitive public attribution was not formally confirmed in the cited sources.
