Recent cyber attacks and data breaches

In April 2026, 7-Eleven was the victim of a "pay or leak" extortion campaign by ShinyHunters , with the data later published that month. The incident exposed 185k unique email addresses, along with names, physical addresses, dates of birth and phone numbers. A small number of records also contained additional exposed data fields. The company later advised the breach was limited to "certain 7-Eleven systems used to store franchisee documents", a statement consistent with the exposed data.

Sacramento County notified the California Attorney General of a data breach on May 22, 2026, with the breach dated October 29, 2025. The notice covers more than 500 California residents; California does not publish the exact number.

Gastro Health notified the Washington State Attorney General on May 22, 2026 of a data breach that occurred on February 24, 2026, affecting 1,813 Washington residents. Information involved: Name, Social Security Number, Driver's License or Washington ID Card Number, Full Date of Birth, Health Insurance Policy or ID Number, Medical Information, Protected Health Information owned or licensed by a HIPAA covered entity.

In December 2025, the European Dragonica private server Dragonica Lunaris suffered a data breach. The incident exposed 126k email addresses, usernames, dates of birth and bcrypt password hashes. The service operator confirmed the breach and advised it has since been fixed.

In January 2021, the parody site Windows93 suffered a data breach of the Myspace93 sub-site after a beta application was exploited to download server files. The compromised data was later leaked in June and included 46k Myspace93 accounts containing email and IP addresses, usernames and passwords stored in plain text.

Barnhart Crane & Rigging Company, Inc. notified the Washington State Attorney General on May 21, 2026 of a data breach that occurred on April 23, 2025, affecting 1,068 Washington residents. Information involved: Name, Social Security Number, Driver's License or Washington ID Card Number, Financial & Banking Information, Full Date of Birth, Passport Number, Health Insurance Policy or ID Number, Medical Information.

Frost Bank notified the California Attorney General of a data breach on May 20, 2026, with the breach dated December 6, 2025. The notice covers more than 500 California residents; California does not publish the exact number.

Cardinal Services, Inc, Cardinal Employer Organization, and Preferred Employer Solutions, collectively (“Cardinal”) notified the California Attorney General of a data breach on May 20, 2026, with the breach dated June 25, 2025. The notice covers more than 500 California residents; California does not publish the exact number.

VacPartsWarehouse.com notified the California Attorney General of a data breach on May 20, 2026, with the breach dated October 31, 2025. The notice covers more than 500 California residents; California does not publish the exact number.