Loading story…
Adaptavist Group, a UK enterprise software consultancy, disclosed a security breach after an unauthorized actor used stolen credentials in late March to access some of its systems. The company said it launched an internal review and brought in external forensic specialists to investigate, adding that the affected environment held routine business information including contact details, contracts, and NDAs. Adaptavist said it has found no evidence that customer or partner personal data, client systems, or production systems were compromised, and disputed claims that sensitive customer data was accessed or exfiltrated.
A ransomware group calling itself The Gentlemen claimed responsibility on its leak site and alleged a far broader intrusion, including theft of customer records, source code, internal documents, credentials, and access to production systems, but those assertions remain unverified. Adaptavist also warned that unknown actors are sending misleading emails impersonating the company, suggesting follow-on phishing activity linked to the incident while the forensic investigation continues.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Adaptavist reported that unknown actors were sending misleading emails impersonating the company following the incident. The activity suggested follow-on phishing attempts connected to the breach.
By April 2026, the ransomware group calling itself The Gentlemen posted claims that it had fully compromised Adaptavist's infrastructure and stolen customer records, source code, internal documents, credentials, and other data. Adaptavist disputed the breadth of those claims and said they remained unverified.
After discovering the intrusion in late March, Adaptavist began an internal review and engaged external security specialists to investigate the incident. The company said it had found no evidence that customer or partner personal data, client systems, production systems, or sensitive customer data were accessed or exfiltrated.
In late March 2026, an unauthorized individual gained access to some Adaptavist Group systems using stolen credentials. The affected systems reportedly contained typical business information such as contact details, contracts, and NDAs.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
AdaptHealth disclosed a material cybersecurity incident after attackers used social engineering against a third-party contractor, compromised the contractor’s credentials, and accessed the company’s cloud-based business applications. The intrusion exposed internal patient management systems, document storage platforms, external electronic health record portals, and a stored password file tied to insurance billing, with patient personally identifiable information and protected health information believed to have been stolen. The company said the attacker contacted it on June 15 to disclose the theft, and it later determined the breach was material enough to report to the SEC. AdaptHealth said it disabled the contractor account, reset credentials, added access controls, engaged third-party cybersecurity experts, and notified law enforcement while the investigation continues. The company reported that operations and patient services were not disrupted, the total number of affected individuals is still unknown, and Social Security numbers, financial account information, and payment card data are not believed to have been stored in the compromised systems. Reporting also indicated the activity may be consistent with a data-theft-and-extortion attempt linked to **ShinyHunters**, which allegedly listed AdaptHealth on a leak site and threatened to publish the stolen data if no ransom is paid.
Jul 6, 2026
Accenture confirmed a cybersecurity breach after a threat actor using the name **"888"** advertised roughly **35 GB** of alleged company data for sale on a cybercrime forum. The seller claimed the cache included source code, configuration files, **RSA keys**, **SSH keys**, **Azure Personal Access Tokens**, and **Azure Storage access keys**, and reportedly shared a screenshot appearing to show an Azure DevOps repository tied to an Accenture domain being cloned. Independent verification of the full dataset and its authenticity was not available at the time of reporting. Accenture said it detected irregular activity, investigated the incident, contained the affected environment, remediated the source of the breach, and restored impacted systems. The company said operations and service delivery were not affected, but it has not disclosed how the intrusion occurred, how many systems or repositories were involved, whether the exposed credentials were valid, or whether any customer data or customer environments were impacted.
Jul 11, 2026
**Advantest Corporation** reported a cybersecurity incident in which an unauthorized party appears to have accessed parts of its network and **deployed ransomware**, impacting certain internal systems. The company said it detected unusual activity on **Feb. 15 (JST)**, activated incident response procedures, **isolated affected systems**, and engaged third-party cybersecurity specialists to support investigation and containment; the investigation remains ongoing and findings may change as more facts are confirmed. Public reporting echoed Advantest’s statement that the scope and responsible ransomware group are **not yet identified**, and noted the broader trend of increased ransomware targeting of industrial and manufacturing organizations, including the semiconductor sector. Advantest stated it will provide updates and, if the investigation determines **customer or employee data** was affected, it will notify impacted individuals directly with guidance on protective measures.
Jun 29, 2026