Recent cyber attacks and data breaches

In March 2026, the financial consulting and advisory firm CFGI was the target of a ShinyHunters "pay-or-leak" extortion campaign . The group subsequently publicised data allegedly obtained from CFGI comprising corporate contact information, including 243k unique email addresses, names, phone numbers and physical addresses.

Richard D. Jones, A Professional Law Corporation notified the California Attorney General of a data breach on June 18, 2026, with the breach dated August 22, 2024. The notice covers more than 500 California residents; California does not publish the exact number.

Alcott HR notified the California Attorney General of a data breach on June 17, 2026, with the breach dated February 12, 2025. The notice covers more than 500 California residents; California does not publish the exact number.

AssuranceAmerica Managing General Agency, LLC notified the Washington State Attorney General on June 17, 2026 of a data breach that occurred on March 16, 2026, affecting 8,950 Washington residents. Information involved: Name, Driver's License or Washington ID Card Number, Other.

In June 2026, a collection of accumulated stealer logs from various sources was added to HIBP. The corpus comprised 56M unique email addresses across hundreds of millions of stealer log records. The data also contained 124M unique passwords, which have been added to Pwned Passwords and are now searchable. Individuals can view any records captured against their email address in the stealer logs section of their dashboard . Organisations can see logs affecting their domain via the stealer logs API .

In March 2026, the commercial real estate finance company Berkadia was the target of a ShinyHunters "pay or leak" extortion campaign . The group subsequently published data they alleged was taken from Berkadia's Salesforce instance, including over 300k unique email addresses as well as names, physical addresses and phone numbers, among other data.

In March 2026, the student information system Infinite Campus was targeted in a ShinyHunters "pay or leak" extortion campaign . The group subsequently published data they alleged was taken from Infinite Campus, containing 137k unique email addresses along with names, phone numbers, physical addresses and support tickets. Infinite Campus subsequently sent notifications , advising that the exposed data largely consisted of "names and contact information for school staff" and that "the majority is directory information commonly found on school websites".

Networking Technology, Inc. notified the California Attorney General of a data breach on June 15, 2026, with the breach dated March 1, 2026. The notice covers more than 500 California residents; California does not publish the exact number.

Nelson University notified the Washington State Attorney General on June 15, 2026 of a data breach that occurred on March 21, 2025, affecting 508 Washington residents. Information involved: Name, Social Security Number, Driver's License or Washington ID Card Number, Full Date of Birth, Student ID Number, Health Insurance Policy or ID Number, Medical Information, Username and Password/Security Question Answers.

Grandview School District notified the Washington State Attorney General on June 15, 2026 of a data breach that occurred on September 28, 2024, affecting 9,414 Washington residents. Information involved: Name, Social Security Number, Driver's License or Washington ID Card Number, Financial & Banking Information, Full Date of Birth, Passport Number, Medical Information, Username and Password/Security Question Answers.