Loading story…
An unidentified actor breached Norwegian micromobility provider Ryde's IT environment in early August and copied customer data affecting its entire reported user base of approximately 4.5 million accounts across Norway, Sweden, Finland, and Germany. Swedish Television reported that up to 1.3 million of the affected accounts belonged to users in Sweden. Ryde has not identified the attacker or disclosed the initial access method.
The exposed data includes phone numbers, email addresses, dates of birth, partial payment-card numbers, and, for some users, payment histories for rides and fees; journey histories were not affected. The data may enable Ryde-themed phishing and smishing, payment scams, credential stuffing, and targeted social engineering, particularly against organizations whose employees registered using corporate email addresses or reused passwords. Organizations should monitor for related phishing activity and credential-stuffing attempts against identity and remote-access services.
See attribution, scope, and your downstream exposure.
3 events from the most recent confirmed update back to the earliest known activity.
In early August 2026, an unidentified actor accessed Norwegian micromobility company Ryde's IT environment and copied customer data. The breach affected Ryde's approximately 4.5 million-user customer base across its markets, including Norway, Sweden, Finland, and Germany.
Ryde said it closed identified access paths, rebuilt affected systems, and changed passwords and keys after the intrusion. The company also retained an independent security expert to review its security routines and processes while its investigation continued.
Norwegian data-protection authority Datatilsynet received a breach notification from Ryde concerning the incident.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
5 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcetruesec.com
Open sourcesvt.se
Open sourcedatatilsynet.no
Open sourceryde-technology.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**Eurail B.V.** confirmed that customer data stolen in a previously disclosed breach is now being **offered for sale on the dark web**, with a **sample dataset published on Telegram**. The Netherlands-based rail pass operator (Eurail/Interrail), which also serves travelers in the European Commission’s **DiscoverEU** program, said it is still investigating the scope and impact and has engaged external cybersecurity and legal experts while working to determine which records and how many customers are affected. Reportedly exposed data may include **order and reservation details** and sensitive personal information such as names, dates of birth/age, contact details (email, phone, address, country of residence), travel companion information, and in some cases **passport/ID data (including photocopies), passport numbers and expiry dates**, **bank account references (IBAN)**, and **health-related data**. Eurail said it has notified relevant data protection authorities under **GDPR** and plans to issue individual notifications to impacted customers; it also advised users to be alert for **phishing/scams** and to update passwords (including the *Rail Planner* app) where credentials may have been reused.
Jun 29, 2026
Carnival Corporation disclosed a data breach after a threat actor used social engineering to compromise an employee account and gain unauthorized access to a limited portion of the company’s internal IT systems. The company said it detected suspicious activity on April 14, contained the intrusion with help from third-party cybersecurity specialists, and confirmed by April 22 that customer personal information had been copied from affected systems. The exposed data included names, addresses and other contact details, dates of birth, government-issued identification numbers linked to passports and driver’s licenses, and in some cases Social Security numbers. Reports said about **6 million** people in the United States may be affected. Carnival began notifying impacted individuals on May 27, issued a public notice for people it could not contact directly, and is offering **24 months** of complimentary credit monitoring through **TransUnion MyTrueIdentity**. The company has not identified the threat actor or said whether ransomware or extortion was involved.
Jun 29, 2026
Miljödata, a major Swedish IT systems supplier serving approximately 80% of Sweden's municipalities, suffered a significant cyberattack in August that resulted in the exposure of personal data belonging to 1.5 million individuals. The attackers, identified as the Datacarry threat operation, stole sensitive information and demanded a ransom of 1.5 Bitcoin, subsequently leaking a 224 MB archive of data on the dark web. The breach affected citizens across multiple regions, including Halland, Gotland, Skellefteå, Kalmar, Karlstad, and Mönsterås, and included data from children, protected identity subjects, and former employees. The Swedish Authority for Privacy Protection (IMY) and other state agencies, including CERT-SE and the police, launched immediate investigations into the incident, focusing on potential violations of the European Union's General Data Protection Regulation (GDPR). IMY is prioritizing its investigation on Miljödata and several municipalities, examining both the security measures in place and the handling of sensitive data. The incident has raised serious concerns about the adequacy of security controls and data management practices within Swedish public sector IT systems, prompting calls for improved safeguards to prevent similar breaches in the future.
Jun 29, 2026