sec disclosure9 articles
Gentlemen Ransomware Gang Takes Credit for Nutex Health Breach
Nutex Health has confirmed a data breach in which hackers stole patient, employee, financial, and business information, with the company notifying the SEC and facing a class-action lawsuit in Texas. The Gentlemen ransomware group (also known as Storm-2697) has claimed responsibility, threatening to leak the stolen data within nine days if their demands are not met. The group, which operates as a ransomware-as-a-service and has claimed over 580 victims across 75 countries since emerging in mid-2025, employs double extortion tactics by both encrypting and exfiltrating victim data.
Boston Scientific Hit by Cyberattack, Global Operations in Chaos
Boston Scientific, a major US medical technology company, suffered a cyberattack on August 25 that disrupted global operations, including the ability to process and ship customer orders. The company has disclosed the incident in an SEC filing but cannot yet determine the full scope of operational and financial impacts. It remains unclear whether a data breach occurred or which threat actor is responsible.
Levi Strauss Hit by Social Engineering Attack, Corporate Data Walked Out the Door
Levi Strauss & Co disclosed a cyberattack in an SEC filing, revealing that social engineering was used to compromise three employees' company-issued computers, resulting in corporate data being accessed and exfiltrated. The company says it has contained the incident and evicted the attackers, with no customer data or business operations appearing to have been affected. The investigation is ongoing, and unconfirmed reports suggest the hacking group UNC6671, known for voice phishing campaigns, may have been responsible.
River Bank Paid Ransomware Crew to Delete Stolen Data. Trust Them on That.
River Bank & Trust suffered a ransomware attack on June 16, in which hackers accessed portions of its network and exfiltrated data, prompting the company to take affected systems offline and disable compromised accounts. The bank engaged with the threat actors and obtained representations that the stolen data had been deleted, likely following a ransom payment. The investigation is ongoing, and River has yet to determine whether personal information was stolen or whether the incident will materially impact its business.
Upbound Group's Data Breach Cost It $13 Million in Fake Lease Agreements
Texas-based consumer finance company Upbound Group disclosed in an SEC filing that a recent data breach, in which hackers obtained non-sensitive customer information, was used to facilitate fraudulent lease-to-own agreements. The incident resulted in approximately $13 million in fraudulent contract losses within its Acima segment during the second quarter of 2026. The company has notified law enforcement, engaged external cybersecurity experts, and considers the breach non-material, though its investigation remains ongoing.
Clover Health Investments Hit by Social Engineering Attack, Patient Data Exposed
Clover Health Investments disclosed a data breach discovered on July 4, resulting from a social engineering attack that compromised three non-managerial employee accounts with access to personal and protected health information. The company activated its response plan, engaged third-party cybersecurity experts, and believes the attackers have been evicted, though the full scope of the breach remains undetermined. No threat actor or ransomware group has claimed responsibility for the incident.
This Cybersecurity Index Tracks Real Breaches and Refuses to Invent a Grand Total
Richard Bird, a cybersecurity executive and author, has launched the Hacker in a Hoodie (HIH) Index — a website that tracks disclosed material cyber breaches by drawing on SEC EDGAR filings and news sources, grading each entry by the reliability of its sourcing. Unlike industry estimates that aggregate losses into headline figures, Bird deliberately avoids summing the data, arguing that combining inconsistently evidenced entries produces misleading numbers that resemble the marketing-driven projections already plaguing the field. The project's broader argument is that cybersecurity has long been measured by activity rather than outcomes, and that treating it as a business cost rather than a performance-tracked function is the root cause of the industry's persistent failure to reduce breaches.
Ransomware Knocks Out Fairlife Milk Production Across the US
Coca-Cola has suspended US production at its dairy subsidiary Fairlife following a ransomware attack that compromised portions of the company's systems, including production-related infrastructure. The company has activated incident response protocols, notified law enforcement, and is working with cybersecurity experts to assess the full impact, though it states that product quality and safety have not been affected. Key details such as the attackers' identity, how the breach occurred, and whether any ransom demands have been made remain undisclosed.
AdaptHealth Blames Social Engineering After Patient Data Walks Out the Door
Medical equipment provider AdaptHealth suffered a cyberattack in which criminals used social engineering to compromise a third-party contractor and gain access to the company's cloud systems. Attackers stole sensitive patient data, including personally identifiable information, protected health information, and a password file linked to insurance billing, though Social Security numbers and payment details are believed to be unaffected. AdaptHealth disclosed the breach to the SEC on June 27, deeming it material due to the potential volume of data at risk, while investigations into the full scope of the incident are ongoing.