{
  "schemaVersion": 1,
  "site": "https://cveboard.org",
  "generatedAt": "2026-10-23T06:17:27.769Z",
  "lastRun": "2026-10-23T06:01:01.685Z",
  "liveDays": 14,
  "filters": {
    "kind": "breach",
    "exploited": false,
    "severity": null,
    "ecosystems": []
  },
  "attribution": [
    {
      "source": "CISA Known Exploited Vulnerabilities",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "licence": "US government work"
    },
    {
      "source": "GitHub Advisory Database",
      "url": "https://github.com/advisories",
      "licence": "CC BY 4.0"
    },
    {
      "source": "Have I Been Pwned",
      "url": "https://haveibeenpwned.com/",
      "licence": "CC BY 4.0"
    }
  ],
  "incidents": [
    {
      "id": "breach-assuranceretraite-bfc345a8cc6f8f48b808a8677bd4c034",
      "url": "https://cveboard.org/i/breach-assuranceretraite-bfc345a8cc6f8f48b808a8677bd4c034",
      "urlPt": "https://cveboard.org/pt/i/breach-assuranceretraite-bfc345a8cc6f8f48b808a8677bd4c034",
      "json": "https://cveboard.org/i/breach-assuranceretraite-bfc345a8cc6f8f48b808a8677bd4c034.json",
      "kind": "breach",
      "live": true,
      "knownExploited": false,
      "severity": null,
      "title": "Assurance Retraite data breach",
      "summary": "In September 2024, the French national pension fund Assurance Retraite suffered a data breach affecting approximately 370k assistance beneficiaries. The data included 70k unique email addresses along with names, dates of birth, physical addresses, phone numbers, income levels, marital statuses, French social security numbers (NIR) and contact details of relatives or other nominated contacts. In its disclosure notice, Assurance Retraite attributed the breach to a compromised partner account.",
      "titlePt": "Violação de dados da Assurance Retraite",
      "summaryPt": "Em setembro de 2024, o fundo de pensão nacional francês Assurance Retraite sofreu uma violação de dados afetando aproximadamente 370k beneficiários de assistência. Os dados incluíam 70k endereços de e-mail únicos, além de nomes, datas de nascimento, endereços físicos, números de telefone, níveis de renda, estados civis, números de seguro social francês (NIR) e detalhes de contato de parentes ou outros contatos nomeados. Em seu aviso de divulgação, a Assurance Retraite atribuiu a violação a uma conta de parceiro comprometida.",
      "cves": [],
      "ghsa": null,
      "cvss": null,
      "epss": null,
      "packages": [],
      "vendor": "Assurance Retraite",
      "product": null,
      "kev": null,
      "breach": {
        "domain": "lassuranceretraite.fr",
        "breachDate": "2024-09-01",
        "pwnCount": 70372,
        "dataClasses": [
          "Dates of birth",
          "Email addresses",
          "Family members' names",
          "Government issued IDs",
          "Income levels",
          "Marital statuses",
          "Names",
          "Phone numbers",
          "Physical addresses"
        ],
        "verified": true,
        "stealerLog": false,
        "malware": false
      },
      "retracted": false,
      "sources": [
        {
          "label": "Have I Been Pwned",
          "url": "https://haveibeenpwned.com/Breach/AssuranceRetraite"
        }
      ],
      "publishedAt": "2026-10-20T02:29:36.000Z",
      "updatedAt": "2026-10-20T02:29:36.000Z"
    },
    {
      "id": "breach-gitesdefrance-bf48c8f0feeaa3f86163cda74aa4d873",
      "url": "https://cveboard.org/i/breach-gitesdefrance-bf48c8f0feeaa3f86163cda74aa4d873",
      "urlPt": "https://cveboard.org/pt/i/breach-gitesdefrance-bf48c8f0feeaa3f86163cda74aa4d873",
      "json": "https://cveboard.org/i/breach-gitesdefrance-bf48c8f0feeaa3f86163cda74aa4d873.json",
      "kind": "breach",
      "live": true,
      "knownExploited": false,
      "severity": null,
      "title": "Gîtes de France data breach",
      "summary": "In May 2026, the French holiday rental network Gîtes de France suffered a data breach affecting some of its departmental branches. The incident exposed hundreds of thousands of customer records, including 118k unique email addresses alongside names, phone numbers, postal addresses and booking details.",
      "titlePt": "Violação de dados da Gîtes de France",
      "summaryPt": "Em maio de 2026, a rede francesa de aluguel de férias Gîtes de France sofreu uma violação de dados afetando alguns de seus ramos departamentais. O incidente expôs centenas de milhares de registros de clientes, incluindo 118k endereços de e-mail únicos juntamente com nomes, números de telefone, endereços postais e detalhes de reserva.",
      "cves": [],
      "ghsa": null,
      "cvss": null,
      "epss": null,
      "packages": [],
      "vendor": "Gîtes de France",
      "product": null,
      "kev": null,
      "breach": {
        "domain": "gites-de-france.com",
        "breachDate": "2026-05-16",
        "pwnCount": 117574,
        "dataClasses": [
          "Booking details",
          "Email addresses",
          "Names",
          "Phone numbers",
          "Physical addresses"
        ],
        "verified": true,
        "stealerLog": false,
        "malware": false
      },
      "retracted": false,
      "sources": [
        {
          "label": "Have I Been Pwned",
          "url": "https://haveibeenpwned.com/Breach/GitesDeFrance"
        }
      ],
      "publishedAt": "2026-10-18T04:50:13.000Z",
      "updatedAt": "2026-10-18T04:50:13.000Z"
    },
    {
      "id": "breach-crunchbase-e7865d6dd990d78d96d1d4fd04fb5645",
      "url": "https://cveboard.org/i/breach-crunchbase-e7865d6dd990d78d96d1d4fd04fb5645",
      "urlPt": "https://cveboard.org/pt/i/breach-crunchbase-e7865d6dd990d78d96d1d4fd04fb5645",
      "json": "https://cveboard.org/i/breach-crunchbase-e7865d6dd990d78d96d1d4fd04fb5645.json",
      "kind": "breach",
      "live": true,
      "knownExploited": false,
      "severity": null,
      "title": "Crunchbase data breach",
      "summary": "In January 2026, the private company intelligence platform Crunchbase was targeted in a ShinyHunters \"pay or leak\" extortion attempt. Data allegedly obtained from the company was subsequently published publicly and included 560k unique email addresses, largely belonging to leads and business contacts. Other data included names, physical addresses, phone numbers, job titles, employers and LinkedIn profiles. Crunchbase later confirmed that a threat actor had exfiltrated documents from its corporate network.",
      "titlePt": "Vazamento de dados da Crunchbase",
      "summaryPt": "Em janeiro de 2026, a plataforma de inteligência empresarial privada Crunchbase foi alvo de uma tentativa de extorsão \"pague ou vazamos\" dos ShinyHunters. Dados alegadamente obtidos da empresa foram posteriormente publicados publicamente e incluíram 560k endereços de e-mail únicos, pertencendo em grande parte a leads e contatos comerciais. Outros dados incluíram nomes, endereços físicos, números de telefone, cargos, empregadores e perfis do LinkedIn. A Crunchbase confirmou posteriormente que um agente de ameaça havia exfiltrado documentos de sua rede corporativa.",
      "cves": [],
      "ghsa": null,
      "cvss": null,
      "epss": null,
      "packages": [],
      "vendor": "Crunchbase",
      "product": null,
      "kev": null,
      "breach": {
        "domain": "crunchbase.com",
        "breachDate": "2026-01-22",
        "pwnCount": 559908,
        "dataClasses": [
          "Email addresses",
          "Employers",
          "Job titles",
          "Names",
          "Phone numbers",
          "Physical addresses",
          "Social media profiles"
        ],
        "verified": true,
        "stealerLog": false,
        "malware": false
      },
      "retracted": false,
      "sources": [
        {
          "label": "Have I Been Pwned",
          "url": "https://haveibeenpwned.com/Breach/Crunchbase"
        }
      ],
      "publishedAt": "2026-10-14T06:01:26.000Z",
      "updatedAt": "2026-10-14T06:01:26.000Z"
    },
    {
      "id": "breach-sharecare-d3a2e58b4b05c04fad62d0694e6db2e1",
      "url": "https://cveboard.org/i/breach-sharecare-d3a2e58b4b05c04fad62d0694e6db2e1",
      "urlPt": "https://cveboard.org/pt/i/breach-sharecare-d3a2e58b4b05c04fad62d0694e6db2e1",
      "json": "https://cveboard.org/i/breach-sharecare-d3a2e58b4b05c04fad62d0694e6db2e1.json",
      "kind": "breach",
      "live": true,
      "knownExploited": false,
      "severity": null,
      "title": "Sharecare data breach",
      "summary": "In August 2026, the digital health company Sharecare was the target of a ShinyHunters \"pay or leak\" extortion campaign. The group subsequently published data it claimed was taken from Sharecare's systems, containing 318k unique email addresses. Most of the data consisted of B2B sales and marketing records with names, physical addresses, phone numbers, job titles and employers. The data also included a small number of Brazilian health insurance plan members, including dates of birth, genders, marital statuses and CPF numbers (Brazilian taxpayer identification numbers).",
      "titlePt": "Vazamento de dados da Sharecare",
      "summaryPt": "Em agosto de 2026, a empresa de saúde digital Sharecare foi alvo de uma campanha de extorsão \"pague ou vazamos\" do grupo ShinyHunters. O grupo publicou em seguida dados que alegou ter sido retirado dos sistemas da Sharecare, contendo 318k endereços de e-mail únicos. A maioria dos dados consistia em registros de vendas e marketing B2B com nomes, endereços físicos, números de telefone, títulos de emprego e empregadores. Os dados também incluíam um pequeno número de membros de planos de seguro saúde brasileiros, incluindo datas de nascimento, gêneros, estados civis e números de CPF (números de identificação fiscal brasileiros).",
      "cves": [],
      "ghsa": null,
      "cvss": null,
      "epss": null,
      "packages": [],
      "vendor": "Sharecare",
      "product": null,
      "kev": null,
      "breach": {
        "domain": "sharecare.com",
        "breachDate": "2026-08-12",
        "pwnCount": 318185,
        "dataClasses": [
          "Dates of birth",
          "Email addresses",
          "Employers",
          "Genders",
          "Government issued IDs",
          "Job titles",
          "Marital statuses",
          "Names",
          "Phone numbers",
          "Physical addresses"
        ],
        "verified": true,
        "stealerLog": false,
        "malware": false
      },
      "retracted": false,
      "sources": [
        {
          "label": "Have I Been Pwned",
          "url": "https://haveibeenpwned.com/Breach/Sharecare"
        }
      ],
      "publishedAt": "2026-10-12T23:28:32.000Z",
      "updatedAt": "2026-10-12T23:28:32.000Z"
    },
    {
      "id": "breach-neogen-c8f5fbec903c64bf6e81095ec6001fa1",
      "url": "https://cveboard.org/i/breach-neogen-c8f5fbec903c64bf6e81095ec6001fa1",
      "urlPt": "https://cveboard.org/pt/i/breach-neogen-c8f5fbec903c64bf6e81095ec6001fa1",
      "json": "https://cveboard.org/i/breach-neogen-c8f5fbec903c64bf6e81095ec6001fa1.json",
      "kind": "breach",
      "live": true,
      "knownExploited": false,
      "severity": null,
      "title": "Neogen data breach",
      "summary": "In August 2026, the food and animal safety organisation Neogen was the target of a ShinyHunters \"pay or leak\" extortion attempt. The group later published data it claimed had been obtained from Neogen. The data consisted largely of corporate contact records and included 436k unique email addresses from mailing lists, employee records and other contacts.",
      "titlePt": "Vazamento de dados da Neogen",
      "summaryPt": "Em agosto de 2026, a organização de segurança alimentar e animal Neogen foi alvo de uma tentativa de extorsão \"pague ou vazamos\" do grupo ShinyHunters. O grupo publicou posteriormente dados que alegou ter obtido da Neogen. Os dados consistiam principalmente em registros de contatos corporativos e incluíam 436k endereços de e-mail únicos de listas de e-mail, registros de funcionários e outros contatos.",
      "cves": [],
      "ghsa": null,
      "cvss": null,
      "epss": null,
      "packages": [],
      "vendor": "Neogen",
      "product": null,
      "kev": null,
      "breach": {
        "domain": "neogen.com",
        "breachDate": "2026-08-29",
        "pwnCount": 435963,
        "dataClasses": [
          "Email addresses",
          "Employers",
          "Job titles",
          "Names",
          "Phone numbers",
          "Physical addresses",
          "Salutations"
        ],
        "verified": true,
        "stealerLog": false,
        "malware": false
      },
      "retracted": false,
      "sources": [
        {
          "label": "Have I Been Pwned",
          "url": "https://haveibeenpwned.com/Breach/Neogen"
        }
      ],
      "publishedAt": "2026-10-09T07:06:25.000Z",
      "updatedAt": "2026-10-09T07:06:25.000Z"
    }
  ]
}