Every public disclosure, dated and sourced.

Incidents worldwide, by country.

71 incidents from 11 countries in the last 90 days, each from a public source and reviewed before it is shown. Where the source says how the attackers got in, the row says so.

1. United States23 Oct 2026Tarter Krinsky & DroginThe source does not say how they got in.HIPAA Journal
2. United States23 Oct 2026Quest DiagnosticsThe source does not say how they got in.SecurityWeek
3. United States22 Oct 2026Summit School DistrictThe source does not say how they got in.Vermont Attorney General
4. United States22 Oct 2026Nordace Limited d/b/a NordaceThe source does not say how they got in.Vermont Attorney General
5. United States22 Oct 2026Deposition Solutions, LLC (d/b/a Lexitas)The source does not say how they got in.California Attorney General
6. United States22 Oct 2026Opportune LLPThe source does not say how they got in.California Attorney General
7. United States22 Oct 2026Transformative Healthcare, LLCThe source does not say how they got in.HIPAA Journal
8. United States22 Oct 2026American Renal Management LLCThe source does not say how they got in.HIPAA Journal
9. United States22 Oct 2026Ridgeway Pharmacy LtdHow they got in: a supplier or vendor that was compromised first.HIPAA Journal
10. United States22 Oct 2026City of Columbia, South CarolinaThe source does not say how they got in.The Record
11. United States22 Oct 2026RailwayThe source does not say how they got in.TechCrunch
12. United States21 Oct 2026Critical infrastructure organizations worldwideHow they got in: stolen or reused passwords.BleepingComputer