Change Ledger
Official changes we have detected — recalls, end of support, exploited vulnerabilities, breaches. Every signal links to its source and to a public, tamper-evident evidence ledger.
Angel One data breach (2023-04-01) — 6,765,054 accounts
In July 2024, the Indian stock brokerage firm Angel One confirmed that data leaked online related to a breach that occurred in April 2023. The leaked data included 7.9M user records containing 6.8M u…
Carhartt data breach (2026-08-13) — 12,933,413 accounts
In August 2026, clothing retailer Carhartt was the target of a ShinyHunters "pay or leak" extortion campaign. The group subsequently published data allegedly obtained from the company including 12.9M…
Assurance Retraite data breach (2024-09-01) — 70,372 accounts
In September 2024, the French national pension fund Assurance Retraite suffered a data breach affecting approximately 370k assistance beneficiaries. The data included 70k unique email addresses along…
Houston City College data breach (2026-06-16) — 831,642 accounts
In June 2026, Houston City College was the target of a ShinyHunters "pay or leak" extortion campaign. Data allegedly obtained from the college was later published publicly and included 832k unique em…
Sharecare data breach (2026-08-12) — 318,185 accounts
In August 2026, the digital health company Sharecare was the target of a ShinyHunters "pay or leak" extortion campaign. The group subsequently published data it claimed was taken from Sharecare's sys…
Operation Endgame 4.0 data breach (2026-06-18) — 4,348,526 accounts
On 18 June 2026, the latest phase of Operation Endgame targeted the SocGholish malware operation, a prolific malware distribution network used to compromise systems and facilitate further cybercrime.…
Burger King Russia data breach (2024-08-25) — 3,155,792 accounts
In October 2024, news of a data breach exposing Burger King Russia customers broke following an August attack on the Mindbox marketing automation platform. The breach exposed 3.2M unique email addres…
Oz Hair and Beauty data breach (2026-08-15) — 1,988,331 accounts
In August 2026, Australian beauty retailer Oz Hair and Beauty was the target of an xpl0itrs extortion attack. The group subsequently published data allegedly obtained from the company, which included…
RingCentral data breach (2026-07-27) — 1,596,490 accounts
In July 2026, the cloud-based business communications platform RingCentral was the target of a ShinyHunters "pay or leak" extortion campaign. The group subsequently published data they claimed was ob…
Neogen data breach (2026-08-29) — 435,963 accounts
In August 2026, the food and animal safety organisation Neogen was the target of a ShinyHunters "pay or leak" extortion attempt. The group later published data it claimed had been obtained from Neoge…
Chess.com (2026) data breach (2026-08-03) — 4,653,212 accounts
In August 2026, millions of records allegedly sourced from Chess.com were posted online. The data contained 7.3M rows with 4.6M unique email addresses, along with usernames, names, countries and data…
Gîtes de France data breach (2026-05-16) — 117,574 accounts
In May 2026, the French holiday rental network Gîtes de France suffered a data breach affecting some of its departmental branches. The incident exposed hundreds of thousands of customer records, incl…
Chess.com (2023) data breach (2023-11-08) — 1,274,077 accounts
In November 2023, over 800k user records were scraped from the Chess.com website and posted to a popular hacking forum. The data included email address, name, username and the geographic location of…
Manchester Airports Group data breach (2026-08-27) — 8,849,657 accounts
In August 2026, Manchester Airports Group (MAG) disclosed a data breach impacting their services. The incident was later claimed by the FulcrumSec hacking group, who subsequently published email addr…
NIUS data breach (2025-07-13) — 6,090 accounts
In July 2025, the German news service NIUS suffered a data breach which was subsequently leaked publicly. The data included 6k unique email addresses along with names, physical addresses and payment…
Medela data breach (2026-09-07) — 423,947 accounts
In September 2026, Swiss medical device company Medela was the target of a ShinyHunters "pay or leak" extortion campaign. The data allegedly obtained in the breach was later published publicly and in…
Artvalue.com data breach (2019-06-19) — 157,692 accounts
In June 2019, the France-based art valuation website Artvalue.com (now defunct) left their 158k member subscriber base publicly exposed in a text file on their website. The exposed data included name…
Questel data breach (2026-08-01) — 1,226,209 accounts
In August 2026, the French intellectual property software and services company Questel was the target of a ShinyHunters "pay or leak" extortion campaign. The group subsequently published an extensive…
SplitVPN data breach (2026-07-21) — 865,336 accounts
In July 2026, the Russian VPN service SplitVPN (previously known as NotVPN) suffered a data breach. The incident exposed millions of customer records, including 865k unique email addresses. Other imp…
Alcon data breach (2026-08-01) — 218,395 accounts
In August 2026, the Alcon eye care company was named in a ShinyHunters "pay or leak" extortion campaign. The group subsequently published data allegedly sourced from Alcon containing 218k unique emai…
Brinks Home data breach (2026-07-13) — 732,162 accounts
In July 2026, Brinks Home was targeted in a ShinyHunters "pay or leak" extortion campaign. The group subsequently published data they alleged was taken from the company, including 732k unique email a…
LimeLeads data breach (2019-08-01) — 17,838,396 accounts
In 2019, the now-defunct B2B marketing leads database service LimeLeads suffered a data breach due to an exposed, unsecured Elasticsearch server. The incident exposed tens of millions of records of l…
Double Counter data breach (2026-10-04) — 274,922 accounts
In October 2026, the Discord server protection service Double Counter suffered a data breach attributed to a vulnerability in the Metabase analytics tool. In its disclosure notice, Double Counter adv…
CyrusOne data breach (2026-08-05) — 373,460 accounts
In August 2026, data centre operator CyrusOne was the target of a ShinyHunters "pay or leak" extortion attempt. The group subsequently published data allegedly obtained from the company, which includ…
Inter-Con Security data breach (2026-06-18) — 276,114 accounts
In June 2026, Inter-Con Security was targeted in a ShinyHunters “pay or leak” extortion campaign. The group subsequently published data it alleged was taken from the company, including 276k unique em…
Crunchbase data breach (2026-01-22) — 559,908 accounts
In January 2026, the private company intelligence platform Crunchbase was targeted in a ShinyHunters "pay or leak" extortion attempt. Data allegedly obtained from the company was subsequently publish…
McKesson data breach (2026-08-21) — 6,404,340 accounts
In August 2026, healthcare and pharmaceutical company McKesson was targeted in a ShinyHunters "pay or leak" extortion campaign. The group subsequently published a substantial corpus of data they alle…
Exact Sciences data breach (2026-07-15) — 10,869,543 accounts
In July 2026, Exact Sciences (now owned by Abbott Laboratories) was the target of a ShinyHunters "pay or leak" extortion campaign. The group claimed to have obtained data from the company's cancer di…
Fanlore data breach (2026-08-06) — 144,520 accounts
In August 2026, the Organization for Transformative Works (OTW) identified unauthorised access to the Fanlore wiki it operates. The breach resulted in the exposure of 145k unique email addresses alon…
Golf Canada data breach (2026-05-14) — 568,972 accounts
In mid-2026, hundreds of thousands of user records allegedly sourced from Golf Canada began circulating via Telegram. The data included 569k unique email addresses along with names, usernames, dates…
CVE-2026-102489: Zammad GmbH Zammad Session Fixation Vulnerability
Zammad GmbH Zammad contains a session fixation vulnerability that can lead to remote code execution as the zammad user. This vulnerability can be chained with CVE-2026-102490.
CVE-2026-0322: Palo Alto Networks PAN-OS Code Injection Vulnerability
Palo Alto Networks PAN-OS contains a code injection vulnerability that could allow an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall.
CVE-2016-3081: Apache Struts Command Injection Vulnerability
Apache Struts contains a command injection vulnerability that could allow remote attackers to execute arbitrary code via method:prefix when Dynamic Method Invocation is enabled.
CVE-2026-21589: Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability
Multiple Atlassian products (Bitbucket Data Center ,Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye…
CVE-2021-3199: ONLYOFFICE Docs Server Path Traversal Vulnerability
ONLYOFFICE Docs contains a path traversal vulnerability that can occur when JWT is used, via a /.. sequence in an image upload parameter and could allow for remote code execution.
CVE-2026-88771: Citrix NetScaler Improper Input Validation Vulnerability
Citrix NetScaler ADC and NetScaler Gateway contain an improper input validation vulnerability that could allow an unauthenticated attacker to execute arbitrary commands.
CVE-2025-61624: Fortinet Multiple Products Path Traversal Vulnerability
FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager contain a path traversal vulnerability that may allow an authenticated attacker with admin profile and at least read-write permissions to write o…
CVE-2026-76504: Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability
Cisco Catalyst SD-WAN Manager contains a hex encoding vulnerability that could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user due to improper…
CVE-2026-102490: Zammad GmbH Zammad Improper Privilege Management Vulnerability
Zammad GmbH Zammad contains an improper privilege management vulnerability that can allow the local zammad user to escalate privileges to root. This vulnerability can be chained with CVE-2026-102489.
CVE-2026-88772: Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability
Citrix NetScaler ADC and NetScaler Gateway contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow for remote code execution or denial of ser…
CVE-2026-104935: Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability
Ivanti Connect Secure contains an authentication bypass by spoofing vulnerability that allows a remote unauthenticated attacker to execute arbitrary commands.
CVE-2026-93952: Arista VeloCloud Orchestrator Improper Input Validation Vulnerability
Arista VeloCloud Orchestrator (VCO) on-prem contains an improper input validation vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. S…
CVE-2026-93616: Check Point Multiple Products Path Traversal Vulnerability
Check Point Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEvent contain a path traversal vulnerability that allows an unauthentica…
CVE-2026-102764: BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability
BeyondTrust Remote Support contains an authentication bypass by spoofing vulnerability that could allow a remote attacker to perform file operations on the appliance.
CVE-2026-105134: Ahsay AhsayCBS Command Injection Vulnerability
Ahsay AhsayCBS contains a command injection vulnerability that could allow a remote attacker to execute operating system commands via manipulation of the random parameter in the Replication Receiver…
CVE-2026-71362: Adobe Commerce and Magento Incorrect Authorization Vulnerability
Adobe Commerce and Magento contains an incorrect authorization vulnerability that could allow an attacker to leverage this vulnerability to gain elevated access to sensitive resources without any use…
CVE-2026-5430: WSO2 Multiple Products Path Traversal Vulnerability
WSO2 API Control Plane, API Manager, Traffic Manager & Universal Gateway contain a path traversal vulnerability that could allow for unrestricted file upload and lead to remote code execution.
CVE-2026-94127: F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability
F5 BIG-IP APM contains a heap-based buffer overflow vulnerability when access policy and an OAuth profile are configured on a virtual server. This vulnerability could allow an unauthenticated attacke…
CVE-2026-105133: Ahsay AhsayCBS Improper Authentication Vulnerability
Ahsay AhsayCBS contains an improper authentication vulnerability that could allow a remote attacker to bypass authentication via manipulation of the random parameter in the API component’s checkSysPw…
CVE-2026-85102: Check Point Multiple Products Improper Certificate Validation Vulnerability
Check Point Security Gateway and Check Point Spark Firewall using Site to Site VPN or Remote Access VPN contain an improper certificate validation vulnerability which could allow an unauthenticated r…
Only see what affects you
Add what you own or use. Reality Radar matches new official changes to your items and explains why.