Every public disclosure, dated and sourced.

Incidents worldwide, by country.

64 incidents from 11 countries in the last 90 days, each from a public source and reviewed before it is shown. Where the source says how the attackers got in, the row says so.

1. United States16 Oct 2026American Collection Medical AgencyThe source does not say how they got in.HIPAA Journal
2. United States16 Oct 2026Mid Florida Dermatology & Plastic SurgeryThe source does not say how they got in.HIPAA Journal
3. United States16 Oct 2026Anne Arundel CountyThe source does not say how they got in.The Record
4. United States15 Oct 2026BAE SystemsThe source does not say how they got in.The Record
5. United States15 Oct 2026DentaQuestThe source does not say how they got in.HIPAA Journal
6. United States15 Oct 2026CenterPoint EnergyThe source does not say how they got in.SecurityWeek
7. United States14 Oct 2026A Volexity customerHow they got in: a known flaw in software the victim ran.Security Affairs
8. United States14 Oct 2026Russian-speaking victims in BrooklynHow they got in: a domain made to look like the real one.The Record
9. United States14 Oct 2026Over 70 US companiesThe source does not say how they got in.The Hacker News
10. United States14 Oct 2026Organizations across 150 countriesHow they got in: email made to look like it came from a trusted sender.BleepingComputer
11. United States14 Oct 2026Ledger customersHow they got in: a supplier or vendor that was compromised first.BleepingComputer
12. United States14 Oct 2026Twin Cities Pain ClinicHow they got in: email made to look like it came from a trusted sender.HIPAA Journal