Citizens Bank confirmed a third-party vendor breach in April 2026, with the Everest ransomware group claiming 3.4 million records stolen. Here is what happened and what every TPRM team must do now.
Trellix Data Breach May 2026: Source Code Repository Compromised by RansomHouse The Trellix data breach is a confirmed May 2026 security incident in which…
In April 2026, the hacking group ShinyHunters breached Amtrak through compromised Salesforce credentials, exposing over 2.1 million customer records including names, email addresses, and physical locations. Here is what risk professionals need to know.
In May 2026, education technology giant Instructure confirmed a major data breach affecting its Canvas platform. The ShinyHunters threat group claimed to have stolen data from 275 million students and staff across 9,000 institutions. Here's what happened and what it means for third-party risk managers.
In April 2026, ShinyHunters claimed to have breached Medtronic, exposing over 9 million patient records. Medtronic confirmed the incident after an SEC disclosure, making it one of the most significant medtech data breaches of the year. Here's what happened and what risk professionals need to know.
A supply chain attack compromised the elementary-data PyPI package, pushing an infostealer to over 1.1 million monthly users. Attackers exploited GitHub Actions CI/CD pipelines to steal cloud credentials, SSH keys, and cryptocurrency wallet data. Here is what risk professionals need to know.
Cybersecurity vendor Trellix disclosed in May 2026 that attackers gained unauthorised access to part of its internal source code repository. The breach raises serious supply chain risk concerns. Here is what risk professionals need to know and act on immediately.
ADT confirmed a data breach affecting 5.5 million customers in May 2026. The ShinyHunters group used voice phishing to compromise an employee Okta SSO account, then extracted data from Salesforce. ADT refused to pay the ransom and attackers dumped 11GB of records publicly.
Vimeo confirmed a data breach in May 2026 linked to a third-party vendor compromise at Anodot. Attackers used stolen tokens to access cloud environments, exposing user emails and video metadata. Here is what TPRM professionals must do now.
In April 2026, Universal Pure disclosed a breach that exposed names and Social Security numbers of affected individuals. The intrusion occurred in mid-2024 but took nearly two years to reach public notification. Here's what risk professionals need to know.
In April 2026, LPL Financial Holdings disclosed a breach affecting 1,581 customers. Phishing-delivered malware compromised affiliated financial advisor devices, enabling unauthorized securities transactions and fund transfers. Here is what risk managers need to know.
France's national ID agency ANTS suffered a major cyberattack in April 2026, exposing up to 19 million citizens' passport and identity records. An IDOR vulnerability in their public API allowed attackers to harvest records at scale with no sophisticated tools required.