Skip to content
Breaches.

Supply chain breaches

123 breaches, most recently disclosed first. The list grows as new ones are disclosed.

OrganizationAffected
BigCommerceBigCommerce merchants' customer data stolen via compromised Ribon appsSep 214 days agoSupply chainUnverifiedUnknown
MathspaceMathspace Metabase breach exposes 1,079,819 students, parents and staffSep 33 weeks agoSupply chainUnverified1.1M
Framework ComputerFramework notifies all customers after Metabase zero-day breachAug 77 weeks agoSupply chainUnverifiedUnknown
PolymarketPolymarket users lose $3 million after vendor script injected into frontendJun 253 months agoSupply chainUnverifiedUnknown
8x88x8 says Klue integration abused to exfiltrate Salesforce customer dataJun 233 months agoSupply chainUnknown
LastPassLastPass support case data stolen via Klue OAuth tokensJun 233 months agoSupply chainUnknown
KlueKlue legacy credential breach leads to OAuth token theft and Salesforce raidsJun 193 months agoSupply chainUnknown
JetBrains15 malicious AI assistant plugins stole developers' AI API keysJun 163 months agoSupply chainUnverifiedUnknown
MicrosoftHijacked Microsoft GitHub repos pushed password stealers to AI coding tool usersJun 83 months agoSupply chainUnverifiedUnknown
GitHubGitHub says 3,800 internal repositories stolen via poisoned Nx Console extensionMay 204 months agoSupply chainUnknown
Grafana LabsGrafana Labs says stolen GitHub token let hackers take its source codeMay 164 months agoSupply chainUnverifiedUnknown
Mistral AITeamPCP offers Mistral AI code repos for sale after TanStack compromiseMay 144 months agoSupply chainUnknown
OpenAITanStack npm supply chain attack reached two OpenAI employee devices and internal reposMay 144 months agoSupply chainUnverifiedUnknown
SAPOfficial SAP npm packages trojanized to steal developer credentialsApr 294 months agoSupply chainUnverifiedUnknown
CheckmarxCheckmarx confirms LAPSUS$ leak of GitHub data after Trivy-linked compromiseApr 265 months agoSupply chainUnknown
BitwardenBitwarden CLI npm release trojanized to steal developer credentialsApr 235 months agoSupply chainUnverifiedUnknown
VercelBreach at AI app maker Context AI led to theft of Vercel customer credentialsApr 195 months agoSupply chainUnknown
AnodotAnodot token theft lets ShinyHunters raid customers' Snowflake and cloud dataApr 135 months agoSupply chainUnverifiedUnknown
AxiosAxios npm package hijacked to deliver cross-platform RATMar 315 months agoSupply chainUnverifiedUnknown
CiscoCisco source code reportedly stolen using Trivy supply-chain credentialsMar 315 months agoSupply chainUnverifiedUnknown
MercorAI training data contractor hit via compromised LiteLLM open source packageMar 315 months agoSupply chainUnverifiedUnknown
European CommissionEuropean Commission cloud breach via Trivy-stolen AWS key hits 30 EU bodiesMar 276 months agoSupply chainUnknown
LiteLLMMalware slipped into popular LiteLLM AI gateway package stole developer credentialsMar 246 months agoSupply chainUnverifiedUnknown
Aqua SecurityTrivy scanner releases and GitHub Actions hijacked to push credential stealerMar 216 months agoSupply chainUnverifiedUnknown
Telus DigitalTelus Digital confirms breach after ShinyHunters claims 1 PB data theftMar 116 months agoSupply chainUnverifiedUnknown
ClawHubOver 230 malicious OpenClaw skills pushed info-stealing malware to AI agent usersFeb 27 months agoSupply chainUnverifiedUnknown
Visual Studio Code MarketplaceMaliciousCorgi: AI coding extensions with 1.5M installs sent source files to ChinaJan 238 months agoSupply chainUnverifiedUnknown
GrubhubGrubhub confirms data theft using secrets stolen in Salesloft Drift attacksJan 158 months agoSupply chainUnverifiedUnknown
Malicious AI sidebar Chrome extensionsTwo Chrome AI sidebar extensions with 900,000 users stole ChatGPT and DeepSeek chatsDec 30, 20258 months agoSupply chainUnverifiedUnknown
Barts Health NHS TrustClop steals Barts Health invoices via Oracle EBS zero-dayDec 5, 20259 months agoSupply chainUnverifiedUnknown
University of PhoenixClop Oracle EBS hack exposes 3.5M University of Phoenix recordsDec 2, 20259 months agoSupply chain3.5M
Dartmouth CollegeClop Oracle EBS attack exposes SSNs of 1,494 Dartmouth individualsNov 24, 202510 months agoSupply chain99K
Cox EnterprisesOracle EBS zero-day breach exposes 9,479 Cox Enterprises peopleNov 20, 202510 months agoSupply chain9,479
GainsightGainsight app compromise exposes Salesforce data of 200+ companiesNov 19, 202510 months agoSupply chainUnverifiedUnknown
LogitechLogitech confirms data theft in Clop Oracle zero-day campaignNov 14, 202510 months agoSupply chainUnknown
GlobalLogicOracle EBS zero-day breach exposes 10,471 GlobalLogic employeesNov 7, 202510 months agoSupply chain10K
Washington PostOracle EBS hack exposes Washington Post staff bank and SSN dataNov 7, 202510 months agoSupply chain9,720
Envoy AirClop steals business data from American Airlines' Envoy via Oracle EBSOct 17, 202511 months agoSupply chainUnverifiedUnknown
OracleClop exploits Oracle E-Business Suite zero-day to steal data from dozensOct 2, 202511 months agoSupply chainUnknown
postmark-mcpFirst malicious MCP server on npm secretly BCC'd every email to attackerSep 25, 20251 year agoSupply chainUnverifiedUnknown
ToastToast Salesforce data stolen via Salesloft Drift OAuth tokensSep 18, 20251 year agoSupply chainUnknown
AvalaraAvalara Salesforce data stolen via Salesloft Drift OAuth tokensSep 12, 20251 year agoSupply chainUnknown
DynatraceDynatrace Salesforce data stolen via Salesloft Drift OAuth tokensSep 8, 20251 year agoSupply chainUnknown
FastlyFastly Salesforce data stolen via Salesloft Drift OAuth tokensSep 5, 20251 year agoSupply chainUnknown
PantheonPantheon Salesforce data stolen via Salesloft Drift OAuth tokensSep 5, 20251 year agoSupply chainUnknown
BeyondTrustBeyondTrust Salesforce data stolen via Salesloft Drift OAuth tokensSep 4, 20251 year agoSupply chainUnverifiedUnknown
Cato NetworksCato Networks Salesforce data stolen via Salesloft Drift OAuth tokensSep 4, 20251 year agoSupply chainUnverifiedUnknown
CyberArkCyberArk Salesforce data stolen via Salesloft Drift OAuth tokensSep 4, 20251 year agoSupply chainUnverifiedUnknown
ElasticElastic Salesforce data stolen via Salesloft Drift OAuth tokensSep 4, 20251 year agoSupply chainUnknown
JFrogJFrog Salesforce data stolen via Salesloft Drift OAuth tokensSep 4, 20251 year agoSupply chainUnverifiedUnknown

New breaches by email

Wednesdays, only in weeks with newly disclosed breaches, the largest first.

Double opt-in. Unsubscribe any time.