Loading story…
Threat actors have claimed responsibility for a significant data breach targeting HSBC USA, alleging the theft and subsequent leak of a large trove of personally identifiable information (PII) and sensitive financial records belonging to the bank's customers. The compromised data reportedly includes full names, addresses, Social Security numbers, dates of birth, phone numbers, bank account numbers, account balances, and transaction histories. Multiple sources indicate that the data was posted on prominent data leak forums, with early analysis by independent researchers suggesting the leaked samples appear legitimate, though the full scope and authenticity remain under investigation. Security experts warn that the exposure of such comprehensive PII and financial details could enable a range of fraudulent activities, including identity theft, unauthorized account access, SIM swapping, and spearphishing attacks.
HSBC USA has publicly denied that a breach occurred, stating that internal investigations have found no evidence of compromised systems or service providers. Despite the bank's denial, cybersecurity researchers and industry analysts emphasize the severe risks posed by the alleged leak, urging financial institutions to strengthen authentication mechanisms, enhance account recovery processes, and promptly notify potentially affected customers. The incident has raised concerns about the adequacy of data protection measures in the banking sector and highlights the urgent need for robust security controls to prevent large-scale identity and financial fraud.
See the actors and campaigns active against you right now.
2 events from the most recent confirmed update back to the earliest known activity.
Hackers subsequently leaked the purported HSBC USA customer data online, escalating the incident from a breach claim to public exposure of the allegedly stolen records.
Threat actors publicly claimed to have breached HSBC USA and to possess customer data, including personally identifiable information and financial or transaction records. Multiple reports describe the same alleged incident and data exposure claim.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
4 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcecyberpress.org
Open sourcescworld.com
Open sourcecybernews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
National Public Data disclosed a security incident affecting a large repository of consumer background-check and people-search information, with exposed data reported to include highly sensitive personal identifiers such as **Social Security numbers**, names, mailing addresses, and other profile details. The company published a breach notice on its website, while an individual notification letter filed with the California Attorney General indicates affected residents were formally notified that their information may have been involved. The incident drew attention because the compromised records appear to involve data commonly used for identity verification and fraud, increasing the risk of **identity theft**, account takeover, and social-engineering abuse. The notification materials show the breach response included direct notice to impacted individuals and guidance on protective steps such as monitoring accounts and credit activity, underscoring the seriousness of the exposure for consumers whose records were held by the data broker.
Jul 12, 2026
Bank of Baroda has confirmed a cybersecurity incident after threat actors claimed to have stolen and published sensitive bank data online. The bank said a compromised employee email account enabled unauthorized access to certain data, but added that its core banking systems were not accessed and that the incident was detected and contained quickly. Public reporting said leaked samples and directory listings appeared to include internal documents, customer onboarding records, audit materials, internal emails, loan documents, and corporate banking files, although the authenticity and full scope of the exposed data have not been independently verified. Researchers tracking darknet activity said the stolen material was advertised for sale on underground forums and a Telegram channel by an actor identified in separate reports as **"leak-king-F"** and publicly linked elsewhere to **Triple X**. One report described the cache as roughly **1 TB** of data spanning retail, corporate, and digital banking operations, while also noting an unverified claim that the breach stemmed from a weak password. Bank of Baroda had not confirmed customer-data exfiltration, and the incident raised concerns over fraud, phishing, and follow-on attacks if internal security and audit documents were exposed.
Jul 30, 2026
Healthcare Interactive, a company specializing in AI-driven medical insurance benefit enrollment and billing solutions, confirmed a significant data breach that resulted in the exfiltration of sensitive customer data by hackers. The compromised information included names, dates of birth, Social Security numbers, contact details, health insurance enrollment data, patient diagnoses, provider names, lab results, medical images, and treatment plans. The breach also involved medical claims data, such as account numbers and billing codes. The incident occurred between July 8 and July 12, 2025, but was only detected around July 22, prompting the company to notify regulators and launch an internal investigation. The method of intrusion was not disclosed, leaving uncertainty about whether social engineering or phishing was involved. In a separate but related trend, Allianz Life, a major American insurance provider, reported a data breach in July 2025 that affected nearly 1.5 million individuals, including customers, financial professionals, and employees. The breach was traced to unauthorized access of a third-party cloud-based CRM system, with the ShinyHunters extortion group suspected to be behind the attack. Exposed data included names, addresses, dates of birth, and Social Security numbers, though earlier reports suggested additional information such as email addresses and phone numbers may have been compromised. Allianz Life has since notified affected individuals and authorities, and provided instructions for protective measures. Another incident involved ClaimPix, an Illinois-based auto insurance claims platform, where a misconfigured and unencrypted database exposed over 5.1 million files, totaling 10.7 terabytes of data. The exposed records included personal identifiable information, insurance documents, vehicle registrations, repair invoices, and images of damaged vehicles, as well as sensitive Power of Attorney documents that could facilitate fraud or impersonation. Archer Health, a U.S. provider of palliative and in-home care services, also suffered a data exposure due to a misconfigured database, leaking nearly 145,000 health records containing names, Social Security numbers, diagnostic details, and treatment plans. The company responded by securing the database and initiating an investigation, though it remains unclear if the data was accessed by malicious actors. These incidents collectively highlight a pattern of significant data breaches affecting the insurance and healthcare sectors, often involving misconfigured cloud storage or third-party service vulnerabilities. The breaches have exposed millions of individuals' sensitive personal and health information, raising concerns about the adequacy of cybersecurity measures in these industries. Regulatory notifications and investigations have been initiated in each case, but the full impact on affected individuals and organizations is still being assessed. The incidents underscore the critical need for robust data protection, regular security audits, and stringent oversight of third-party service providers. The exposure of highly sensitive data, including medical diagnoses and legal documents, increases the risk of identity theft, fraud, and other malicious activities. Organizations are urged to review their cloud security configurations and incident response protocols to prevent similar breaches. The healthcare and insurance sectors remain prime targets for cybercriminals due to the value of the data they hold. These breaches serve as a stark reminder of the evolving threat landscape and the importance of proactive cybersecurity strategies.
Jun 29, 2026