Skip to content

📡 Media & Telecom

Media, entertainment, gaming, publishing, telecommunications · a shareable slice of the daily brief for stakeholders who only care about this industry · RSS feed

Victims L30D5▼ −1
Prior 30D6
Active actor L90DUnknown · 6
Active actor L90DBYOD · 1
Active actor L90DPanzer · 1

Today — 03 Nov 2026

No industry-tagged items in today's briefing — see recent activity below.

Last 14 days

Sony Network Communications (So-net/plala) — company-confirmed breach of 2.58M Japanese ISP member records.HighMedia & TelecomSony's Japanese ISP subsidiary disclosed unauthorized access to its So-net and plala membership database; the intrusion occurred around Oct 19, Sony's investigation concluded Oct 24, and the company went public Oct 27. 2,141,986 So-net records and 443,495 plala records (2,585,481 total) were exposed — names, phone numbers, emails, user IDs, dates of birth and gender across the board, plus 54,401 records with email-account passwords and 16 with bank-account details (no PINs). PlayStation Network and NURO broadband are unaffected, and Sony says no credit-card data was involved. Sony has reported the incident to Japan's Personal Information Protection Commission; no threat-actor attribution has been made. This is a separate incident from this week's GMO Internet/Onamae.com breach — both Japanese, unrelated. Infosecurity Magazine · CyberInsider · Beebom
Capcom confirms 11.7M CAPCOM ID accounts exposed — a missed catch-up from last week, company-confirmed and well-corroborated, now on file.HighMedia & TelecomCapcom detected suspicious activity and confirmed unauthorized access to its CAPCOM ID account service on Oct 19, reported the incident to Japanese police and the Personal Information Protection Commission Oct 21, and disclosed publicly Oct 21–23. 11,774,247 records exposed — mostly email addresses plus account metadata (creation date, last login, login count, client IP); only 43 accounts also had DOB/gender/country/nickname exposed, and the attacker changed passwords on 196 accounts (since reset). No payment-card data affected; Capcom says it has no evidence user-set passwords were compromised. No threat actor has claimed the intrusion. BleepingComputer · Infosecurity Magazine
Ticketmaster began notifying Brazilian customers Oct 14 of a confirmed breach distinct from the 2024 ShinyHunters/Snowflake mass-claim.MediumMedia & TelecomThe company says a temporary vulnerability in a third-party data-analysis tool, not the systems used for ticket sales or account management, exposed 2025 ticket buyers: names, gender, date of birth, CPF/purchase-document numbers, phone, email, address and payment method with the last four card digits. Passwords and full card numbers were not exposed; Ticketmaster says an external investigation concluded in September. Company-confirmed. Canaltech
Nikkei discloses its third distinct data-incident in about a month: ~1.83M personal-information records compromised via a fraudulently-accessed cloud development service — a catch-up item.MediumMedia & TelecomReported access occurred around Oct 7; names, addresses and emails are affected, credit-card data is not, and Nikkei has not yet disclosed whether passwords leaked or named the affected service. Distinct from its earlier Slack-compromise (17,368 people) and employee-email-account incidents already in the news cycle. Nippon.com

Recent victim claims

Newest first, mapped to this industry from the victim database. Most are leak-site claims — verify before acting.

October 2026

Oct 27 Sony Network Communications (So-net/plala) Unknown Ransomware · telecommunications · Japan Unauthorized access to the So-net and plala member database -- intrusion ~Oct 19, investigation completed Oct 24, publicly confirmed Oct 27. ~2.58M records exposed (2,141,986 So-net + 443,495 plala), including names, phone numbers, emails, user IDs, DOB and gender; 54,401 records include email account passwords (no leak of login-account passwords per Sony) and 16 include bank account details, no PINs. PlayStation Network and NURO unaffected; no credit-card data involved. No threat-actor attribution confirmed. · Sources: Infosecurity Magazine · CyberInsider · Beebom
Oct 22 Capcom Unknown Ransomware · gaming · Japan Unauthorized access to the CAPCOM ID account service, detected and confirmed Oct 19; exposed records for 11,774,247 accounts worldwide (mostly email addresses plus account metadata -- creation date, last login, login count, client IP). A further 43 accounts also had DOB/gender/country/nickname exposed, and the attacker changed passwords on 196 accounts (since reset by Capcom). No payment-card data affected; company says no evidence user-set passwords were compromised. Reported to Japanese police and the PPC Oct 21. No threat actor has claimed the intrusion. · Sources: BleepingComputer · Infosecurity Magazine · Help Net Security
Oct 14 Ticketmaster (Brazil) Unknown Ransomware · Media & Telecom · BRA Ticketmaster began notifying Brazilian accountholders Oct 14 of a confirmed incident distinct from the 2024 ShinyHunters/Snowflake mass-breach claim. The company says a temporary vulnerability in a third-party data-analysis tool -- not the systems used for ticket sales or account management -- exposed buyers from 2025: names, gender, date of birth, CPF/purchase-document numbers, phone, email, address, and payment method with the last four card digits. Passwords and full card numbers were not exposed; Ticketmaster says an external cybersecurity investigation concluded in September. · Sources: Canaltech
Oct 08 Daiichikosho (Big Echo) Unattributed Breach · Entertainment · Japan Karaoke chain operator discloses ~8.72M customer and ~93K employee records potentially leaked via malware found on a contractor (Japan Columbia Group/NCG) employee PC; disclosed Oct 8. Company-confirmed potential exposure, no misuse confirmed. · Sources: Nippon.com
Oct 05 Trump Mobile BYOD Ransomware · telecommunications · USA Extortion group BYOD posted 3,615 customer records (name, email, phone, address, order details) on its leak site, claiming initial access via a partner lacking MFA; some listed individuals confirmed their details, others denied being customers. Trump Mobile has not responded or acknowledged the incident. Unverified claim. · Sources: Cybernews · San.com

September 2026

Sep 27 Ressources Si Panzer Ransomware · Entertainment · France Movie theater/cinema operator listed on Panzer's leak site. Unverified claim, no company confirmation. · Sources: Ransomware.live
Sep 25 Simba Telecom Unattributed Breach · Telecom · Singapore Breach discovered Sep 24, disclosed Sep 25, affecting approximately 23,549 customers. Exposed: names, IC numbers, dates of birth, mobile numbers, emails. No card/bank data; no confirmed misuse; customer notification in progress. Distinct from the earlier state-linked UNC3886 telecom-espionage campaign -- no attacker named for this incident. · Sources: DataBreaches.net
Sep 23 Trump Mobile ENDZONE Ransomware · telecommunications / MVNO · USA ENDZONE listed Trump Mobile, the Trump-Organization-licensed mobile virtual network operator launched by Donald Trump Jr. and Eric Trump, on its leak site Sep 23 claiming eSIM QR codes and customer PII across the carrier's roughly 10,000 unique subscribers; no company confirmation. · Sources: RedPacket Security · The Daily Beast
Sep 20 Inter N0n Ransomware · telecom · Venezuela N0n listed Inter, Venezuela's largest ISP, on its leak site, claiming 15.3M subscriber connection records and network maps, with a Sep 20 deadline. No company confirmation. DLS claim only. · Sources: Brinztech
Sep 13 i2i-systems Barracuda Ransomware · Telecommunications · Turkey A ransomware/extortion group operating under the name Barracuda (unrelated to the Barracuda Networks vendor) lists Turkish telecommunications firm i2i-systems, claiming roughly 693GB exfiltrated including source code for key projects after about a week of network access; attackers cite weak security configurations. No company confirmation yet; verify before treating as a breach. · Sources: Ransomware.live · RedPacketSecurity
Sep 07 Conde Nast Unknown Ransomware · publishing services · US A dataset of 32,815,767 user records (names, emails, postal addresses, gender, DOB, phone numbers -- no passwords or payment data) listed for sale for $15,000 on a Russian-language cybercrime forum Sep 7, pitched as the full set behind the Dec 2025 WIRED subscriber leak (which itself totaled a fraction of this volume). Ransomnews sampled 5,000 records and found them consistent with genuine Conde Nast account data collected Sep-Oct 2025. Conde Nast has not confirmed the breach or the new sale listing. · Sources: SecurityAffairs · Cybernews

August 2026

Aug 22 Thialf The Gentlemen Ransomware · Sports / Entertainment · Netherlands TheGentlemen ransomware DLS claim August 22 2026; Thialf is an international speed skating venue in Heerenveen, Netherlands; data scope unconfirmed · Sources: https://www.ransomware.live/
Aug 11 Stade Français Paris Qilin Ransomware · Sports · FR Qilin DLS August 11, 2026; Aug 15 deadline; player passport/ID data published as proof-of-breach; club filed complaint with French authorities; no payment confirmed. · Sources: https://www.redpacketsecurity.com/qilin-ransomware-victim-stade-francais/
Aug 08 Daily Trust Unknown Ransomware · Media · NGA DLS claim posted August 8 on ransomware.live; Nigerian national newspaper/news organization; group attribution not confirmed in available sources · Sources: https://www.ransomware.live/
Aug 07 Stade Français Unknown Ransomware · Sports/Entertainment · France Paris-based Top 14 rugby club; systems restored after cyberattack; data leak under investigation · Sources: https://therecord.media
Aug 03 Service Electric Qilin Ransomware · Telecommunications · US Qilin DLS claim approximately August 3 2026; US regional telecom; no statement from Service Electric; data scope and impact unconfirmed · Sources: https://www.ransomware.live/

July 2026

Jul 23 Czech Philharmonic The Gentlemen Ransomware · arts/culture · Czech Republic TheGentlemen DLS claim July 23; data volume not yet disclosed; cultural heritage institution based in Prague. Unverified DLS claim. · Sources: https://www.ransomware.live/
Jul 19 Eana Qilin Ransomware · telecommunications (satellite/connectivity) · Argentina Qilin DLS posting July 19; data claimed exfiltrated; unverified — no public statement from Eana · Sources: https://www.ransomware.live
Jul 15 ATCOM Technology DragonForce Ransomware · Telecommunications/Manufacturing · Unknown Telecommunications manufacturer claimed on DragonForce DLS July 15. Country unconfirmed. No public statement. · Sources: https://www.ransomware.live/group/dragonforce
Jul 02 Ingram Content Group ShinyHunters Extortion · publishing services · book distribution/US major US book distribution, print-on-demand, and publishing-services company serving thousands of publishers worldwide; ShinyHunters DLS claim July 2, 2026; group alleged failed negotiations with victim; Salesforce data exfiltration claimed; data scope unconfirmed; no public statement from Ingram; 🟥 unverified · https://breachnews.com/breaches/shinyhunters-adds-ingram-content-group-and-fluke-corporation-to-leak-site/ · https://www.hendryadrian.com/ransom-ingram-content-group-inc-jul-2026/ · Sources: [BreachNews] · [hendryadrian.com]

June 2026

Jun 28 KDDI Corporation Unattributed Breach · telecommunications · Japan Japan's second-largest mobile carrier; 14.22 million email subscriber accounts compromised across six ISPs managed by KDDI (Chuokai, Johoku Communications, KCN Kyoto, Okayama Information Highway, Sanin Godo Bank Net, Tokai Broadband); root cause: vulnerability in third-party email management software; email subscriber account records (addresses, associated metadata) affected; KDDI confirmed breach and began customer notifications June 24-28, 2026; actor unattributed · https://therecord.media/ · https://www.securityweek.com/ · Sources: [The Record] · [SecurityWeek]
Jun 24 Alexandria Nova Ransomware · telecommunications · unknown region teleinfrastructure platform; DLS claim June 24, 2026; data scope unconfirmed · https://www.ransomware.live/ · Sources: [ransomware.live]
Jun 24 Stadttheater Giessen The Gentlemen Ransomware · arts · culture/Germany municipal theatre serving the city of Giessen in the Mittelhessen region; publicly funded civic cultural venue; The Gentlemen DLS claim June 24, 2026; data scope and impact unconfirmed; 🟥 unverified · https://www.redpacketsecurity.com/thegentlemen-ransomware-victim-stadttheater-giessen/ · https://www.ransomware.live/group/thegentlemen · Sources: [RedPacket Security] · [ransomware.live]
Jun 23 Canada Wide Media The Gentlemen Ransomware · media · Canada https://www.breachsense.com/breaches/ · https://www.ransomware.live/ · Sources: [Breachsense] · [ransomware.live]
Jun 20 Newspaper Media Group INC Ransom Ransomware · media · publishing/US US-based local news organization operating community newspapers and magazines across Central and South Jersey; DLS claim June 20, 2026; data scope and impact unconfirmed; no public statement from victim · https://www.redpacketsecurity.com/incransom-ransomware-victim-newspaper-media-group/ · Sources: [RedPacket Security]
Jun 19 ATCOM Unattributed Breach · telecom · IT services/Chile Sources: breachsense/ransomware.live DLS
Jun 15 Kodak ShinyHunters Extortion · media technology · US 2.2M records (customer PII and internal corporate data); ShinyHunters listed June 15 with a June 18 ransom deadline; Kodak confirmed "unauthorized third party illegally gained temporary access to a limited amount of company data" June 17 and engaged cybersecurity experts and law enforcement; no proof sample published; no data dump confirmed; claimed vector: Oracle PeopleSoft CVE-2026-35273 · https://cybernews.com/security/shinyhunters-claims-kodak-hack-2-million-records/ · https://www.bleepingcomputer.com/news/security/kodak-confirms-data-breach-claimed-by-shinyhunters-extortion-gang/ · https://www.techtimes.com/articles/318565/20260617/kodak-confirms-data-breach-shinyhunters-threatens-leak-22m-records.htm · Sources: [Cybernews] · [BleepingComputer] · [TechTimes]
Jun 14 INK DragonForce Ransomware · creative production · UK UK-based production studio; 102.85 GB exfiltrated; DLS claim June 14, 2026; 7–8 day data-publication ultimatum issued after ransom deadline · https://www.dexpose.io/dragonforce-ransomware-attack-on-ink/ · https://www.redpacketsecurity.com/dragonforce-ransomware-victim-ink/ · Sources: [DeXpose] · [RedPacket Security]
Jun 12 American Tower Corporation ShinyHunters Extortion · telecommunications infrastructure · US 5.2M records claimed including customer and landowner PII, records linking T-Mobile/Verizon/US DHS as clients, tower asset GPS coordinates, and plaintext physical access/gate codes for cell tower compounds across the US; claimed June 12, ransom deadline June 15 (passed with no confirmed data dump); company has not issued a public statement; 🟥 unverified — treat as claimed only · https://www.dexpose.io/shinyhunters-breach-american-tower-corporation/ · https://www.redpacketsecurity.com/shinyhunters-ransomware-victim-american-tower-corporation/ · https://www.breachsense.com/breaches/american-tower-data-breach/ · Sources: [DeXpose] · [RedPacket Security] · [Breachsense]
Jun 12 Zayo Group + Allstream ShinyHunters Extortion · telecommunications · US+Canada ShinyHunters claimed June 12, 2026 with a June 16 payment-or-leak deadline; data scope unconfirmed; no victim statement · https://www.dexpose.io/shinyhunters-target-zayo-group-and-allstream-in-ransomware-attack/ · https://www.redpacketsecurity.com/shinyhunters-ransomware-victim-zayo-com-allstream-com/ · https://www.ransomware.live/id/WmF5by5jb20gJiBBbGxzdHJlYW0uY29tQHNoaW55aHVudGVycw · Sources: [DeXpose] · [RedPacket Security] · [ransomware.live]
Jun 12 Nintendo of America ShadowByt3$ Ransomware · entertainment · gaming/US ShadowByt3$ claimed June 12, 2026 via compromise of TinyPulse (HR and employee-engagement SaaS platform used by Nintendo); group demanded $2M ransom with 48-hour deadline; Nintendo declined; ShadowByt3$ shifted demand to TinyPulse directly on June 14 with June 16 secondary deadline; data leaked June 16 after deadline passed; Nintendo confirmed breach "limited to internal survey content comprising a small subset of our employees" — Nintendo's own network was not compromised; attack was against TinyPulse's cloud environment; ShadowByt3$ claims 859MB including full employee names, email addresses, bank statements, W-9 tax forms, employee IDs, HR progress plans, analytics, and survey data spanning 2016–2026; 🟨 breach confirmed by Nintendo (survey content); broader scope claims unverified · Sources: [HackRead] · [Nintendo Life] · [TechNadu] · [DeXpose]
Jun 09 AireSpring Chaos Ransomware · managed telecom services · US Sources: ransomware.live DLS
Jun 08 Opéra Comique Qilin Ransomware · arts-culture · France Sources: ransomware.live DLS
Jun 05 Madison Square Garden Sports Corp. ShinyHunters Extortion · entertainment · sports/US 45 GB published June 16 (26M customer and corporate records); content includes facial recognition surveillance records, internal threat assessments, and personal customer data; breach June 5, ransom deadline June 15, deadline missed, data published June 16; MSG's second major breach within 6 months (prior: Cl0p/Oracle eBusiness Suite February 2026, 131,070 employees/contractors); claimed vector: Oracle PeopleSoft CVE-2026-35273 · https://thenextweb.com/news/shinyhunters-madison-square-garden-45gb-data-leak-facial-recognition · https://www.dexpose.io/shinyhunters-breach-madison-square-garden-sports-corp/ · Sources: [The Next Web] · [DeXpose]
Jun 01 The Adviser Brain Cipher Ransomware · media · AU 350GB claimed; ransom deadline 2026-06-02 · Sources: Brain Cipher DLS
Jun 01 Dresden State Art Collections Unattributed Breach · arts-culture · Germany digital systems disrupted · actor not yet attributed · Sources: The Record

May 2026

May 22 TVN Media APT73 Ransomware · multimedia · broadcasting/Panama leading multimedia company and broadcaster based in Panama; APT73/Bashe DLS claim May 22, 2026; data scope and impact unconfirmed; APT73 noted for fabricating some high-profile claims — 🟥 unverified pending independent confirmation · https://www.dexpose.io/apt73-bashe-strikes-panamas-tvn-media/ · https://www.ransomware.live/group/apt73 · Sources: [DeXpose] · [ransomware.live]

April 2026

Apr 28 Mediaworks Kft WorldLeaks Ransomware · media · broadcasting/Hungary Hungary's largest pro-government media company (Orbán-aligned conglomerate operating national TV, radio, and print outlets); WorldLeaks DLS claim April 28-29, 2026; 15 million files (~8.5 TB) published including payroll records, contracts, financial statements, and internal communications; Hungary's National Authority for Data Protection and Freedom of Information (NAIH) confirmed unlawful exfiltration and scale; Mediaworks confirmed breach and warned journalists against circulating leaked material; 🟨 confirmed breach, scope verified by Hungarian data authority · https://therecord.media/ransomware-group-claims-breach-of-pro-orban-media-firm · https://www.redpacketsecurity.com/worldleaks-ransomware-victim-mediaworks-kft/ · https://www.dexpose.io/worldleaks-targets-hungarian-mediaworks-kft/ · Sources: [The Record] · [RedPacket Security] · [DeXpose]
Apr 11 Rockstar Games ShinyHunters Extortion · gaming · technology/US 78.6M records claimed (GTA Online/Red Dead Online analytics, internal business metrics); breach April 11 via Anodot (third-party SaaS analytics) → Snowflake; ransom deadline April 14 missed, partial data published; Rockstar confirmed "limited, non-material" information; Snowflake confirmed breach was Anodot credential compromise, not Snowflake infrastructure; SaaS supply chain vector (not PeopleSoft CVE-2026-35273) · https://www.benzinga.com/markets/tech/26/04/51795873/rockstar-games-data-breach-80-million-records-anodot-snowflake · https://www.bitdefender.com/en-us/blog/hotforsecurity/rockstar-games-data-breach · https://www.deepwatch.com/labs/ca-a-26-006-shinyhunters-breaches-rockstar-games-via-third-party-cloud-integration/ · Sources: [Benzinga] · [Bitdefender] · [DeepWatch]
Apr 01 Charter Communications ShinyHunters Extortion · telecommunications · US 40-42M records claimed (13M+ individually confirmed); names, email/physical addresses, phone numbers, subscription plan details, support tickets, CPNI; vishing attack April 1 2026 targeting Microsoft Entra credentials; attacker pivoted to Salesforce CRM; Charter disclosed publicly May 26 one day before ShinyHunters' May 27 ransom deadline; 50GB data published after ransom refusal; Charter disputes CPNI exfiltration, ShinyHunters disputes claim with screenshots; access via Salesforce/Entra (not PeopleSoft CVE-2026-35273); among the largest US telecom breaches on record · https://www.bleepingcomputer.com/news/security/charter-confirms-data-breach-after-shinyhunters-extortion-threat/ · https://www.techradar.com/pro/security/charter-communications-confirms-data-breach-shinyhunters-blamed-after-threat-to-leak-user-info-online/ · https://www.scworld.com/brief/shinyhunters-extorts-charter-communications-after-data-breach · Sources: [BleepingComputer] · [TechRadar] · [SC Media]

← All industries · Victim database →