Recent cyber attacks and data breaches

In August 2026, Manchester Airports Group (MAG) disclosed a data breach impacting their services . The incident was later claimed by the FulcrumSec hacking group , who subsequently published email addresses and phone numbers relating to 8.8M customers of Manchester, Stansted and East Midlands airports. The data contained personal information relating to airport services, including vehicle registrations and parking history, Fast Track purchases and lounge bookings. In their disclosure notice , MAG advised that "at no point has passenger safety or aviation security been compromised".

Fishbrain AB notified the California Attorney General of a data breach on September 2, 2026, with the breach dated July 30, 2026. The notice covers more than 500 California residents; California does not publish the exact number.

Knowledge Research Center notified the California Attorney General of a data breach on September 2, 2026, with the breach dated July 8, 2026. The notice covers more than 500 California residents; California does not publish the exact number.

YouLend US LLC notified the California Attorney General of a data breach on September 2, 2026, with the breach dated June 5, 2026. The notice covers more than 500 California residents; California does not publish the exact number.

HumanEdge, Inc. notified the California Attorney General of a data breach on September 2, 2026, with the breach dated March 17, 2026. The notice covers more than 500 California residents; California does not publish the exact number.

Fiesta Insurance Franchise Corporation notified the California Attorney General of a data breach on September 2, 2026, with the breach dated May 25, 2026. The notice covers more than 500 California residents; California does not publish the exact number.

See’s Candies, Inc. notified the California Attorney General of a data breach on September 2, 2026, with the breach dated April 11, 2026. The notice covers more than 500 California residents; California does not publish the exact number.

In August 2026, the French intellectual property software and services company Questel was the target of a ShinyHunters "pay or leak" extortion campaign . The group subsequently published an extensive corpus of data they alleged was obtained from the company, largely comprising corporate contact information associated with sales leads, support cases and marketing activities, with 1.2M unique email addresses. The data also included names, employers and job titles, along with physical addresses and phone numbers.

Kaniksu Community Health notified the California Attorney General of a data breach on September 1, 2026, with the breach dated December 18, 2025. The notice covers more than 500 California residents; California does not publish the exact number.

DeMera DeMera Cameron, LLP notified the California Attorney General of a data breach on September 1, 2026, with the breach dated March 27, 2026. The notice covers more than 500 California residents; California does not publish the exact number.