Recent cyber attacks and data breaches

Interstate Management Company, LLC notified the California Attorney General of a data breach on May 26, 2026, with the breach dated November 19, 2025. The notice covers more than 500 California residents; California does not publish the exact number.

Nickey Kehoe notified the California Attorney General of a data breach on May 26, 2026, with the breach dated March 29, 2026. The notice covers more than 500 California residents; California does not publish the exact number.

Spokane Digestive Disease Center, P.S. notified the Washington State Attorney General on May 26, 2026 of a data breach that occurred on January 22, 2026, affecting 2,093 Washington residents. Information involved: Name, Social Security Number, Driver's License or Washington ID Card Number, Financial & Banking Information, Full Date of Birth, Medical Information.

University of St. Thomas-Houston notified the Washington State Attorney General on May 26, 2026 of a data breach that occurred on July 25, 2025, affecting 516 Washington residents. Information involved: Name, Social Security Number, Driver's License or Washington ID Card Number, Financial & Banking Information, Full Date of Birth, Student ID Number, Passport Number, Medical Information, Username and Password/Security Question Answers.

In April 2026, 7-Eleven was the victim of a "pay or leak" extortion campaign by ShinyHunters , with the data later published that month. The incident exposed 185k unique email addresses, along with names, physical addresses, dates of birth and phone numbers. A small number of records also contained additional exposed data fields. The company later advised the breach was limited to "certain 7-Eleven systems used to store franchisee documents", a statement consistent with the exposed data.

Sacramento County notified the California Attorney General of a data breach on May 22, 2026, with the breach dated October 29, 2025. The notice covers more than 500 California residents; California does not publish the exact number.

Gastro Health notified the Washington State Attorney General on May 22, 2026 of a data breach that occurred on February 24, 2026, affecting 1,813 Washington residents. Information involved: Name, Social Security Number, Driver's License or Washington ID Card Number, Full Date of Birth, Health Insurance Policy or ID Number, Medical Information, Protected Health Information owned or licensed by a HIPAA covered entity.

In December 2025, the European Dragonica private server Dragonica Lunaris suffered a data breach. The incident exposed 126k email addresses, usernames, dates of birth and bcrypt password hashes. The service operator confirmed the breach and advised it has since been fixed.

In January 2021, the parody site Windows93 suffered a data breach of the Myspace93 sub-site after a beta application was exploited to download server files. The compromised data was later leaked in June and included 46k Myspace93 accounts containing email and IP addresses, usernames and passwords stored in plain text.