Loading story…
Hargreaves Lansdown suffered customer-facing IT problems, including account-balance glitches and service outages, between September 2025 and May 2026, prompting customer concern that the investment platform had been hacked. The company said the incidents were technical issues and maintained there was no evidence of a cyber incident or data breach.
In April 2026, the Bashe extortion group, also tracked as APT73 and Eraleign, added Hargreaves Lansdown to its Tor leak site and claimed it had stolen a database of 658,259 unique users; a sample later appeared on DarkForums. Subsequent analysis found the records were likely recycled or fabricated, with selectively chosen UK entries and overlaps with older breaches including Verifications.io and People Data Labs, indicating the group used the firm's recent outages to make a false breach claim appear credible and increase reputational pressure.
TTPs, infrastructure, and targeting history in one profile.
4 events from the most recent confirmed update back to the earliest known activity.
On 2026-04-27, ransomware.live reported Hudson Rock had detected infostealer-related exposure associated with Hargreaves Lansdown's hl.co.uk domain. The entry listed 1,141 compromised users, zero compromised employees, and four third-party employee credentials tied to the domain.
In May 2026, data presented as a sample of the alleged Hargreaves Lansdown breach appeared on DarkForums. Analysis described in the references found the records overlapped with older breaches including Verifications.io and People Data Labs, indicating the claimed breach was likely fabricated.
In April 2026, the Bashe extortion group, also known as APT73 or Eraleign, added Hargreaves Lansdown to its Tor leak site and claimed it had stolen a customer database containing 658,259 unique users.
Between September 2025 and March 2026, and reportedly into May 2026, Hargreaves Lansdown experienced account-balance glitches and service outages that prompted customer fears of hacking. The company said these were technical problems and stated there was no evidence of a cyber incident or data breach.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
5 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourceransomware.live
Open sourcebbc.co.uk
Open sourcearchive.is
Open sourceblog.bushidotoken.net
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Brinks Home disclosed that attackers gained unauthorized access to part of its IT environment and are threatening to leak allegedly stolen data, while extortion group **ShinyHunters** has claimed responsibility for the intrusion. The company said it detected the incident on July 20 and immediately began incident response, adding that its alarm monitoring operations, products, and core system functionality were not affected based on current findings. ShinyHunters alleges it accessed Brinks Home on July 13 through a Microsoft Entra voice-phishing attack and exfiltrated more than **4.9 million** Salesforce records, including some employee personally identifiable information, customer support chat logs, and other data from the company’s Salesforce environment. Brinks Home said it is still determining exactly what information was involved and which individuals may be affected, and warned customers that threat actors may use the incident to send fraudulent messages impersonating Brinks Home or its response partners.
Aug 10, 2026
Fintech platform **Betterment** reported a January 2026 social-engineering incident in which an employee was tricked into providing credentials that enabled unauthorized access to internal messaging systems via third-party tools. Betterment said it detected and contained the access the same day, launched an external forensic investigation, and later indicated the incident affected roughly **1.4 million customers**; exposed data included names, email addresses, and location data broadly, with a smaller subset including phone numbers, physical addresses, dates of birth, job titles, and device details. Betterment stated that **no financial accounts, logins, or passwords** were accessed, but warned that the stolen PII was used to send **crypto-scam messages** impersonating Betterment to pressure users into transferring funds. Separately, the extortion group **ShinyHunters** claimed it stole **1.7 million CarGurus corporate records** and threatened to leak the data if the company did not engage by a stated deadline; the criminals alleged the haul included PII and internal corporate data, and CarGurus had not publicly confirmed the claim at the time of reporting. The same reporting tied the CarGurus claim to a broader run of ShinyHunters-related leak-site postings and extortion threats against other organizations, with at least one victim (Canada Goose) indicating that data recently published online may have been **historical** rather than from a new intrusion.
Jun 29, 2026
Anonymous-affiliated attackers breached **HBGary Federal** after CEO **Aaron Barr** publicly claimed he had identified key members of the collective and was preparing to share findings with the FBI. The intrusion reportedly combined website exploitation, password reuse, and social engineering, leading to the defacement of HBGary systems, takeover of Barr’s Twitter account, theft of more than **50,000 emails**, and exposure of company financial and internal documents. Reporting on the operation described participants from AnonOps and highlighted disputed claims around a hacker using the alias **"Kayla"**, while leaked IRC logs later portrayed Anonymous as more coordinated than its public image suggested, with figures such as **Sabu** directing activity and discussing the HBGary attack. The leaked HBGary emails triggered wider fallout by exposing proposals tied to campaigns against **WikiLeaks** and critics, including plans reportedly prepared for clients connected to **Bank of America** and a law firm, and renewed scrutiny of the firm’s ties to federal agencies. Subsequent reporting said former Anonymous supporters provided chat logs and alleged identities to investigators, and later arrests brought the hacking saga closer to a conclusion. The episode became a defining early example of hacktivist retaliation escalating into a major corporate breach, reputational crisis, and law-enforcement investigation.
Jun 29, 2026