⏳ Ongoing Attacks¶
Attacks this desk is following from first notice to outcome: the attacker's clock, then what actually happened — publication, sale, reported payment, quiet delisting — and the consequences that follow (notifications, lawsuits, disclosed cost). Deadlines and most outcomes are attacker claims (🟥) until a named source corroborates them; a delisting is not evidence of payment. See Methodology.
0 clock(s) running · 3 expired, outcome pending · 2 developing · as of Nov 03, 2026.
Deadline passed — outcome pending¶
The clock ran out and no publication, sale, payment or delisting has been observed yet. Re-checked on every run; closed as outcome-unknown after 14 quiet days.
Groupe Proxitelexpired 5d ago · outcome pending
- Sep 28Claimed by actor 🟥 Avignon-based B2B telecom/IT-services firm; ~35GB claimed exfiltrated. Emerging group (Vexy), treat with extra caution. Unverified claim, no company confirmation. Ransomware.live · FrenchBreaches
- Sep 28Clock set → expires Oct 29 🟥 ~31-day publication countdown per the listing. FrenchBreaches
Last checked Nov 03 — No publication or sale found since the Oct 29 deadline. Identity/attribution dispute unresolved -- sources still disagree whether Groupe Proxitel is a Timor-Leste telecom or a French B2B tech firm (proxi.tel). No statement from the victim. ransomware.live/RansomLook unreachable this check (DNS-blocked); DLS listing status not independently verified.
PwC (UK)expired 6d ago · outcome pending
- Oct 22Claimed by actor 🟥 Leak-site listing claiming ~590GB from a third-party vendor platform holding PwC training/learning records; PwC confirms a vendor-side cyber incident but says its own network/operations are unaffected and does not confirm the 590GB figure. Cybernews
- Oct 22Clock set → expires Oct 28 🟥 Sources disagree on the exact clock: one aggregator cites an Oct 28 publication deadline, Cybernews describes a 4-day negotiation window (~Oct 26), IDN Financials a 5-day countdown (~Oct 27) -- all from the same Oct 22 listing. No sample files published as of this run; deadline treated as expired-pending-outcome. Dexpose
- Nov 02Update 🟨 PwC's third-party-vendor framing (not PwC's own network) now corroborated across multiple late-Oct outlets (Cybernews, Analytics Insight, the420.in, Accountant.nl); one French-language source names the vendor as Cornerstone OnDemand, unconfirmed by PwC -- single-sourced, flagged not adopted. No sample data published, no deadline resolution; 590GB figure still unverified by PwC. Cybernews
Last checked Nov 03 — No publication, sale or payment found. Only Nov-dated reporting is still the single-sourced, unconfirmed French-language claim naming Cornerstone OnDemand as the vendor (108,426 files) -- unchanged from last check. No PwC/vendor statement, no lawsuit, no notification count.
Poole Groupexpired 9d ago · outcome pending
- Oct 12Claimed by actor 🟥 LockBit DLS listing, unverified, no company confirmation independently corroborated. Breachsense
- Oct 12Clock set → expires Oct 25 🟥 ~2-week publication clock per the DLS listing. Breachsense
- Oct 16Victim confirmed 🟨 Company confirms a cyber incident affecting part of its IT environment and says it notified OAIC, ACSC and the ATO; does not confirm LockBit's specific attribution or what data was taken, and has not yet determined if individuals were affected. Cyber Daily
Last checked Nov 03 — No publication, sale or payment found since the Oct 25 deadline. Poole Group still has not confirmed LockBit's attribution or data scope beyond its standing containment/investigation statement. One outlet (Cyber Daily, Oct 16) reports OAIC and ATO were notified of the incident -- a regulatory-notification detail, not an independently confirmed breach-notification count or determination, so not logged as a separate ED-17 consequence event.
Developing — no clock¶
Headline incidents still unfolding without an attacker deadline.
MLD Mortgage (The Money Store)Developing
- Sep 22Claimed by actor 🟥 Storm leak-site claim, unverified; catch-up open triggered by the Oct9 legal consequence below. MPA
- Oct 09Legal / regulatory 🟩 Two proposed federal class actions filed in New Jersey (Turner v. MLD Mortgage via Milberg; Chavez v. MLD Mortgage via Kopelowitz Ostrow), alleging SSNs, financial-account, loan-application and credit-history data exposure. MPA
- Oct 21Legal / regulatory 🟨 Two previously-unrecorded class-action filings surface, both in the same New Jersey federal court as Turner/Chavez: Munoz v. MLD Mortgage Inc. (No. 2:26-cv-13231, filed Oct 9 alongside Turner/Chavez) and Jaiyeola v. MLD Mortgage Inc. (No. 2:26-cv-13706, filed Oct 21) -- bringing the public count to 5 proposed federal class actions (or 6 filings, since Turner was filed twice under separate docket numbers 2:26-cv-13238 and 2:26-cv-13218). All still at the complaint stage; no class certified, no company response in court, no new disclosed-cost figure. Independently corroborated via a second WebSearch pass of the same claims-aggregator tracker (no second, fully independent outlet found; direct WebFetch of the docket/aggregator sites failed in this sandbox) -- confidence kept at partial pending primary docket verification. OpenClassActions
- Oct 24Update 🟨 Data-scope detail firms up: breach notice confirms exposed types as names, SSNs, driver's license numbers, plus financial and medical information; Storm's claim is specified at 229GB. A third firm (Shamis & Gentile) is now also investigating/soliciting affected individuals alongside the two already-filed class actions (Turner, Chavez). Still no company confirmation or denial of the Storm attribution itself. MPA Magazine · ClaimDepot
Last checked Nov 01 — 9th check. No new filing beyond the 5 proposed class actions already on file; no settlement, MDL consolidation or regulatory action found. IDX identity-protection enrollment window confirmed open through Jan15 2027. ClaimDepot
ShellDeveloping
- Aug 13Claimed by actor 🟥 Clop lists Shell on DLS in the same PTC Windchill/FlexPLM campaign; ~89GB of engineering drawings, facility photos, test-report scans and project plans claimed. Shell confirms it is investigating. Catch-up open (F-24), same Oct8 trigger as Philips. NL Times
- Oct 09Victim confirmed 🟨 Shell confirms unauthorized access occurred to a cloud platform operated by an external party used for non-critical business activities -- no operational consequences, no sensitive personal data exposed. Distinct from a confirmed leak: BNR (per NL Times) could not access Shell's claimed 89GB dataset specifically, so publication itself remains unverified for Shell even though the underlying incident is now company-confirmed. Computable
Last checked Nov 01 — 11th check. No lawsuit, regulatory action or disclosed cost found; no coverage dated past the Aug2026 claim window. dexpose.io
When the clock runs out — follow-through by actor¶
Of 21 attacker clocks that have run out on this desk: 3 leaked · 18 outcome unknown. Small samples — read as case history, not a base rate.
| Actor | Clocks run out | Leaked | Sold | Paid | Delisted | Outcome unknown |
|---|---|---|---|---|---|---|
| N0n | 6 | 1 | — | — | — | 5 |
| ShinyHunters | 4 | 2 | — | — | — | 2 |
| The Gentlemen | 3 | — | — | — | — | 3 |
| Arcus Media | 1 | — | — | — | — | 1 |
| Everest | 1 | — | — | — | — | 1 |
| Helix | 1 | — | — | — | — | 1 |
| LockBit | 1 | — | — | — | — | 1 |
| Panzer | 1 | — | — | — | — | 1 |
| Securotrop | 1 | — | — | — | — | 1 |
| Unknown | 1 | — | — | — | — | 1 |
| Vexy | 1 | — | — | — | — | 1 |
Resolved & closed — last 90 days¶
Outcome recorded; consequences keep accruing on the timeline.
MoneyGramOutcome unknown
- Oct 12Claimed by actor 🟥 Leak-site listing; no data sample released, MoneyGram has not confirmed. Computing
- Oct 12Clock set → expires Oct 19 🟥 Roughly one-week negotiation clock per the claim. Cybernews
- Nov 03Case closed 🟩 No publication, sale or payment observed in 19 checks since the 2026-10-19 deadline (checks spanning 15+ days). Closed as outcome-unknown per the follow-up sweep closure rule. MoneyGram has issued no statement at all -- confirm or deny -- about this claim as of today. No data sample has ever been published by the group. Takes new events if a leak, sale, payment or company statement surfaces later. Cybernews
QuikreteOutcome unknown
- Oct 18Claimed by actor 🟥 Leak-site listing, no encryption claim, no proof samples posted. RedPacket Security
- Oct 18Clock set → expires Oct 18 🟥 Actor threatened to post file-sharing links/passwords within six hours of the Oct 18 listing; clock already expired by this run with no observed outcome. RedPacket Security
- Nov 01Case closed 🟩 No publication, sale or payment observed in 14 checks since the Oct18 deadline; the claim stayed single-sourced to one leak-site aggregator the entire time, with no second outlet or Quikrete statement ever surfacing. Closed outcome-unknown per the 14-day quiet-check bar. dexpose.io
FBIOutcome unknown
- Sep 22Claimed by actor 🟥 Claim first briefed Sep 23; opening for case tracking (F-24 catch-up). 2-3TB of employee/applicant data claimed via a claimed Oracle PeopleSoft zero-day; retaliation motive (wants a May 2026 FBI bulletin retracted), not ransom. BleepingComputer
- Sep 22Clock set → expires Sep 30 🟥 7-day clock: retract the May 2026 PSA or the group leaks the claimed data. FBI says only that it is investigating; no breach confirmed. The Hacker News
- Sep 28Victim confirmed 🟩 FBI declared an internal 'cyber security incident,' confirming the substance of ShinyHunters' PeopleSoft claim: agent/employee names, addresses, job titles and Social Security numbers exposed via the FBIJobs.gov HR system, with some reporting adding medical/psychiatric evaluation data. Compromised volume reported at ~2-3TB. TechCrunch · CNN
- Sep 28Update 🟩 Dutch police confirmed the arrest of alleged ShinyHunters member Pepijn van der Stap ('Umbreon'), 24, Amsterdam -- first named suspect in custody in the ShinyHunters investigation (also accused separately of soliciting two murders); court appearance Rotterdam District Court Sep 29. FBI Cyber Division AD Brett Leatherman published a video statement to remaining members: 'You know how to find us, and we know how to find you.' Separately ShinyHunters gave NBC News a sample document a former agent confirmed as authentic, corroborating the underlying breach further without a bulk-data publication. ShinyHunters denies the suspect is a member. NBC News · TechCrunch
- Sep 29Update 🟨 ShinyHunters told Cybernews it has decided not to publish the FBI data, calling the episode a 'marketing campaign' and denying it was ever a real extortion/ransom threat; FBI has not independently confirmed any breach. Cybernews · 404 Media
- Oct 01Update 🟨 ShinyHunters tells Cybernews it never intended to publish the FBI data and calls the saga a 'marketing stunt,' but explicitly says it cannot guarantee the ~5K sample files already shared with reporters won't eventually leak elsewhere, since those copies are 'out of our control.' An actor self-statement, not independent confirmation of non-publication. Cybernews
- Oct 03Update 🟨 Second suspect detained: alleged ShinyHunters member 'Rey' (Saif al-Din Khader) held in Jordan since ~Sep29, reportedly cooperating with/helping the FBI identify other members -- follows the Sep29-30 Dutch arrest of an alleged leader, 'Umbreon' (24, Amsterdam). No bulk publication of the claimed ~2-3TB FBIJobs.gov dataset observed; ShinyHunters' Sep29 'marketing stunt, never intended to publish' statement still stands. Outcome for the data itself remains unknown -- this is a law-enforcement development, not a data-publication event. BleepingComputer via search snippet · SecurityAffairs · GV Wire
- Oct 04Update 🟨 FBI Director Kash Patel posts publicly that "more arrests are on the table" as the bureau works new leads. ShinyHunters' dark-web leak site (where it had posted its FBI threats) went offline in early October; a group-linked email address attributed this to sabotage by rival actors plus a separate, unrelated disruption -- not a law-enforcement seizure, and unconfirmed independently either way. No bulk publication of the claimed ~2-3TB FBIJobs.gov dataset observed; outcome on the data itself remains unknown. Cybernews · HackRead
- Oct 09Update 🟨 FBI Director Kash Patel announced a third arrest of a suspected co-conspirator (did not name the suspect). Multiple outlets separately identify him as Edward Dubrovsky, a Canadian cybersecurity/ransomware-negotiation executive, arrested in the Philadelphia, PA area and expected to face sealed charges in Texas (conspiracy to threaten confidentiality of information to extort money, interference with commerce). Some outlets report officials have not publicly confirmed the ShinyHunters link to Dubrovsky specifically; Boston Globe cites two sources calling him a primary co-conspirator. Third publicly disclosed arrest in the case (after Amsterdam and Jordan). No bulk publication, sale or payment of the claimed ~2-3TB FBIJobs.gov dataset observed. Boston Globe · Fox13
- Oct 11Update 🟥 Ambient reporting (dates uncertain relative to this check, flagged for next-run verification): a second suspect, 'Rey'/Saif al-Din Khader, reportedly detained in Jordan and cooperating with FBI; a new ShinyHunters-linked leak site reportedly came back online after the original went offline. No source reports the claimed FBIJobs dataset (~2-3TB) published, sold, or any ransom paid. BleepingComputer
- Oct 12Update 🟥 ShinyHunters issued a 'final statement' saying it 'never intended or planned to' publish the claimed FBI dataset and will not share further updates; separately denied its leak-site outage relates to the FBI probe. Actor's own disavowal, not a confirmed outcome -- case stays open, outcome still unknown. Cybernews · SAN
- Oct 14Update 🟨 The ShinyHunters leak site that went offline around Oct 10 (claimed sabotage, unconfirmed) has reappeared under a new site, indicating the outage was not a full takedown and other members continue operating. Still no confirmed publication of the FBI data itself. Malwarebytes
- Oct 19Case closed 🟩 Closed as outcome-unknown: 9th quiet check, 19 days since the 2026-09-30 deadline, exceeding the >=3-checks/>=14-days threshold. No publication, sale or payment observed. The group itself now disclaims intent to publish (quoted by 404 Media and Cybernews calling the episode a 'marketing campaign'), but that is the actor's own claim, not proof of outcome. Two arrests of suspected co-conspirators (Jordan, Netherlands) and a third arrest announced by the FBI Director have followed; the group's leak site went dark around the deadline for reasons it attributes to an unrelated DDoS. Case takes new events later if a leak, sale or further law-enforcement outcome surfaces. 404 Media · BleepingComputer
RevolutOutcome unknown
- Sep 12Victim confirmed 🟩 Revolut confirms KYC documents, statements and Bitcoin histories were released to an impostor using a legitimate government-agency email domain. TechCrunch
- Sep 17Clock set → expires Sep 18 🟥 Actor 'iamnotavillain' cuts the demand to $3M in Monero with a 24-hour clock before selling 680 high-net-worth crypto-account files. CryptoTimes
- Sep 24Update 🟥 Original $3M/24h corporate deadline (Sep18) lapsed with no confirmed bulk publication or payment. Actor pivoted to individual extortion: opened a Tor site demanding payment directly from ~680 affected accountholders to avoid individual exposure. A separate Telegram channel ('Revolut Smilik') claims the breach with a partial sample; iamnotavillain disputes it as a former associate re-selling a small piece. Sourcing here is extortion-adjacent trackers, not tier-1 press -- treat as 🟥 low-confidence stage update, not a confirmed sale. iamnotavillain leak-site tracker · cross-checked against original claim coverage in Irish Times and Cryptonews
- Sep 28Update 🟨 Revolut states it received no direct contact/demand from the actor and that systems and customer funds were unaffected. The 24-hour sale deadline (Sep 18) has passed with no independent confirmation the ~680k-record dataset was sold. Irish Times · Newsbreak/FT
- Sep 29Update 🟥 Actor published preview files (~85,000, branded 'Italy Files') on a Tor site claiming a broader dataset of Italian Interior/Justice Ministry documents, distinct from and larger than the original 680-account Revolut claim; Italy's Interior Ministry and Postal Police dispute the claimed scope and say initial investigation found no evidence of an Interior Ministry systems breach. The original 680-account Revolut dataset sale remains unconfirmed. La Sicilia · Il Sole 24 Ore
- Oct 02Update 🟨 'Italy Files' leak has escalated beyond the Sep 29 preview: actor now claims ~150GB/85,000+ files affecting 130,000+ Italian public officials (personal data, mailboxes, passports, health cards, arms licenses, immigration/diplomatic docs). Italy's Interior Minister Piantedosi has publicly addressed the leak's origin (a 'ghost PEC' mailbox in Reggio Calabria) -- government-official-level confirmation data circulated, though this concerns the Italian-government side, not a new Revolut statement. No evidence yet of a full/complete dump beyond expanded previews. TechNadu · Cybernews
- Oct 07Update 🟩 Revolut's Western Europe CEO stated the company will cover costs for customers affected by the breach, and reiterated that government agencies -- not Revolut's own systems -- were the 'weak link.' Company statement, not a data-outcome event. No confirmed bulk publication beyond the already-logged Oct2 'Italy Files' expanded-preview claim (~150GB/85,000+ files, actor-claimed). The Star/Reuters
- Oct 16Case closed 🟩 No publication, sale or payment of the original 680-account dataset observed in 15 checks since the Sep 18 deadline. The actor pivoted to an 'Italy Files' claim against Italian government systems (logged separately Sep29-Oct7) which remains unconfirmed by Revolut or Italian authorities as a Revolut-sourced breach. Closing as outcome-unknown on the core Revolut extortion thread; later consequence events can still be added. Ransomware.live
Pantaneiro CapasOutcome unknown
- Sep 27Claimed by actor 🟥 Manufacturer listed on Arcus Media's leak site; unverified claim, no company confirmation. Ransomware.live
- Sep 27Clock set → expires Oct 04 🟥 Publication deadline set by the actor. GalaxyWarden
- Oct 15Case closed 🟩 No publication, sale or payment observed across 12 checks since the Oct 4 deadline (opened Sep 27) -- closed as outcome-unknown per the ≥3-checks/≥14-days rule. Takes new events later if consequences surface. Ransomware.live
Precision Facades LtdOutcome unknown
- Sep 28Claimed by actor 🟥 UK facade-engineering firm; claim covers full file server (finance/accounts, audits, bank mandates, board papers, tender/project data). Unverified claim, no company confirmation. Ransomware.live · DeXpose
- Sep 28Clock set → expires Oct 02 🟥 Publication deadline per the listing. DeXpose
- Oct 15Case closed 🟩 No publication, sale or payment observed across 11 checks since the Oct 2 deadline (opened Sep 28) -- closed as outcome-unknown per the ≥3-checks/≥14-days rule. Takes new events later if consequences surface. Ransomware.live
Agencia Estatal de Meteorología (AEMET)Outcome unknown
- Sep 11Claimed by actor 🟥 Panzer lists Spain's national meteorological agency, ~5GB claimed; no agency confirmation. EscudoDigital · Ransomware.live
- Sep 11Clock set → expires Oct 01 🟥 20–21 day publication clock per the listing; expiry is approximate (Oct 1–2). EscudoDigital
- Oct 14Case closed 🟩 Closed outcome-unknown: no publication, sale or payment observed in 14 checks since the ~Oct1-2 deadline passed. EscudoDigital
Prefix CorpOutcome unknown
- Sep 18Claimed by actor 🟥 1,135GB of exfiltrated data claimed. RedPacket Security
- Sep 18Clock set → expires Sep 30 🟥 Publication threatened if no contact by Sep 30. RedPacket Security
- Oct 14Case closed 🟩 Closed outcome-unknown: no publication, sale or payment observed in 12 checks since the Sep30 deadline passed. RedPacket Security
ChibitekLeaked
- Oct 07Claimed by actor 🟥 SOCRadar discovery; claimed client financial records, network credentials and internal docs; no independent corroboration, no stealer-log evidence found SOCRadar
- Oct 07Clock set → expires Oct 11 🟥 Roughly four-day publication deadline per the listing SOCRadar
- Oct 11Data published 🟥 Aggregator mirrors N0n's own leak-site status as 'NOT PAID -- EXPOSED' as of Oct 11 04:43 UTC; this is the actor's own status flag relayed by a secondary aggregator, not an independent review of the published data's contents or volume -- treat as claim-level confirmation only Hendry Adrian DLS mirror
FanaticsOutcome unknown
- Sep 20Claimed by actor 🟥 46,902 order files (~108GB) of customer PII, AP invoices, bank transaction records and tax-exemption certificates claimed; no company confirmation. RedPacket Security
- Sep 20Clock set → expires Sep 23 🟥 Publication deadline per the listing. RedPacket Security
- Oct 08Case closed 🟩 No publication, sale or payment observed in 9 checks since the 2026-09-23 deadline (15+ days quiet). Closed as outcome-unknown per the follow-up sweep closure rule. SOCRadar
PhilipsLeaked
- Aug 13Claimed by actor 🟥 Clop lists Philips on DLS in mass PTC Windchill/FlexPLM campaign (CVE-2026-12569); ~13.5GB of PDF drawings/diagrams/blueprints claimed. Philips confirms an investigation underway. Catch-up open (F-24): case opened retroactively once the Oct8 leak development made outcome tracking material. NL Times
- Oct 08Data published 🟨 Dutch radio show BNR directly reviewed Philips data published on Clop's dark-web leak site -- technical drawings of MRI scanners/medical equipment and Philips IT-infrastructure details -- and sent files to Philips for verification. Philips declines to discuss substance but says no personal or patient data is involved. Independent media review of actually-published files, not just the original claim. NL Times · Computable
AstraZeneca TurkiyeOutcome unknown
- Sep 18Claimed by actor 🟥 940MB of network-security configuration across three sites plus 1.35M connection records claimed. RedPacket Security
- Sep 18Clock set → expires Sep 21 🟥 RedPacket Security
- Oct 06Case closed 🟩 No publication, sale or payment observed in 10 checks since the 2026-09-21 deadline (checks spanning 15+ days). Closed as outcome-unknown per the follow-up sweep closure rule. SOCRadar
STOKR (digital securities platform)Outcome unknown
- Sep 18Claimed by actor 🟥 KYC investor register and wallet-to-identity mapping claimed; threat to forward data to investors' home tax authorities. Ransomware.live · RedPacket Security
- Sep 18Clock set → expires Sep 20 🟥 Clock expires Sep 20 22:40 UTC per the listing. Ransomware.live
- Oct 04Case closed 🟥 No publication, sale or payment observed in 8 checks since the 2026-09-20 deadline (checks spanning 14+ days). Closed as outcome-unknown per the follow-up sweep closure rule. DeXpose · RedPacketSecurity
InterOutcome unknown
- Sep 20Claimed by actor 🟥 15.3M subscriber connection records and network maps claimed; no company confirmation. Brinztech
- Sep 20Clock set → expires Sep 20 🟥 Same-day publication deadline per the listing. Brinztech
- Oct 04Case closed 🟥 No Inter-specific publication, sale or payment observed in 7 checks since the 2026-09-20 deadline (checks spanning 14+ days). Generic group-wide activity noted on aggregators is not victim-specific evidence. Closed as outcome-unknown per the follow-up sweep closure rule. GalaxyWarden
Kimberly-ClarkOutcome unknown
- Sep 13Claimed by actor 🟥 Final-warning listing; no data volume, vector or company confirmation. Ransomware.live · DeXpose
- Sep 13Clock set → expires Sep 16 🟥 Open negotiations by Sep 16 or face data release and unspecified 'disruptive' action. Ransomware.live
- Sep 30Case closed 🟩 No publication, sale or payment observed in 9 checks since the 2026-09-16 deadline. One aggregator search snippet (SOCRadar) suggested a 'Data Leaked' status but could not be independently verified this run (direct page blocked; no press pickup, no sample data, no company statement, no SEC 8-K) -- closed outcome-unknown per the >=3-checks/>=14-days rule rather than logged as a confirmed leak on an unverifiable snippet. SOCRadar tracker (unverified this run)
LA MetroOutcome unknown
- Sep 07Claimed by actor 🟥 Leak-site listing. LA Metro has confirmed only that it restricted employee network access after 'unauthorized activity', not the ransomware claim. Cybernews
- Sep 07Clock set → expires Sep 16 🟥 Nine-day clock to open negotiations before threatened release. Cybernews
- Sep 28Case closed 🟩 No publication, sale or payment observed across 8 checks since the Sep 16 deadline (opened Sep 7) -- closed as outcome-unknown per the ≥3-checks/≥14-days rule. Takes new events later if consequences surface. Cybernews · GalaxyWarden
VeradigmOutcome unknown
- Sep 05Claimed by actor 🟥 Posted to The Gentlemen's leak site; 3.5M-record scope is the group's own figure. BleepingComputer
- Sep 05Clock set → expires Sep 11 🟥 Publication deadline absent a ransom negotiation. BleepingComputer
- Sep 08Victim confirmed 🟩 Veradigm confirms patient data incl. SSNs downloaded through one API using compromised third-party vendor credentials; no clinical data or network compromise. BleepingComputer · The Record
- Sep 20Notifications filed 🟩 Veradigm has begun notifying affected individuals and offering credit monitoring, and has notified law enforcement, per HIPAA Journal/Healthcare IT News. No publication or sale of the claimed 3.5M patient records observed; this is a consequence event, not a change in outcome status. HIPAA Journal
- Sep 25Case closed 🟩 No publication, sale or payment observed in 4 checks since the 2026-09-11 deadline (checks spanning 14+ days). Closed as outcome-unknown per the follow-up sweep closure rule. Company already confirmed the breach and began notifying affected individuals Sep 20 -- that consequence stays on the timeline; the case takes new events if a leak, sale or payment surfaces later. HIPAA Journal
Florida DAVID (Highway Safety and Motor Vehicles)Leaked
- Sep 04Attack noticed 🟩 FLHSMV says it learned of the intrusion Sep 4; entry via a Plant City PD account whose DAVID credentials sat on an officer's personal device. The Record
- Sep 07Claimed by actor 🟥 Leak-site listing with extortion demand; ~200,000 driver records claimed, Epstein DMV record screenshot offered as proof. BleepingComputer
- Sep 07Clock set → expires Sep 11 🟥 Leak-site publication deadline. BleepingComputer
- Sep 12Victim confirmed 🟩 FLHSMV confirms the intrusion, calls it quickly mitigated; the 200,000-record scope stays the attacker's figure. The Record
- Sep 16Refused to pay 🟨 Ransom went unpaid. TechCrunch
- Sep 16Data published 🟨 Files published: 200,000+ driver records including Social Security numbers, per reporting. TechCrunch · BleepingComputer
McKesson CorporationLeaked
- Aug 25Claimed by actor 🟥 ShinyHunters claims ~1TB / 284M Snowflake rows exfiltrated Aug 21–25 via vished Okta SSO accounts; $55M demand. The record count is the attacker's own figure. BleepingComputer
- Aug 28Victim confirmed 🟩 SEC 8-K confirms unauthorized access and exfiltration affecting the Oncology and Medical-Surgical businesses; declared non-material. BleepingComputer · HIPAA Journal
- Aug 29Clock set → expires Sep 01 🟥 72-hour contact deadline for the $55.2M ransom; lapsed Sep 1 with no public engagement. SecurityWeek
- Sep 03Clock set → expires Sep 09 🟥 Second threshold: data-publication deadline. SecurityWeek · CyberScoop
- Sep 10Data published 🟨 Data published: 6.4M unique email addresses plus other personal/corporate data loaded into Have I Been Pwned (marked sensitive). The original 284M-row/1TB claim was never independently confirmed -- only the 6.4M-record scope is verified. DataBreaches.net · Have I Been Pwned
Store: data/cases.jsonl — one case per actor+victim, written via python data_writer.py case; status, countdowns and the scoreboard are derived at build time.