Loading story…
OnTrac, a U.S. parcel delivery company, notified customers that attackers breached its corporate network and accessed certain files containing personal information. The company said the unauthorized access occurred between March 20 and March 22 and was detected on March 23, prompting an internal investigation and the engagement of a third-party incident response specialist.
The exposed information included customer names, though the full scope of compromised data was not publicly detailed because notification materials were redacted. OnTrac said it re-secured the affected data, verified it had not been distributed, and had not identified fraud or public leaks linked to the incident; the company is offering affected individuals 12 months of credit monitoring and identity protection through CyberScout.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
OnTrac disclosed to customers that a corporate network breach may have exposed their personal information. The company said it was offering 12 months of credit monitoring and identity protection through CyberScout to affected individuals.
OnTrac said an attacker gained unauthorized access to certain files on its corporate network between March 20 and March 22. The accessed files contained customers' personal information, though the exact data elements were not publicly disclosed.
As part of its response to the network intrusion, OnTrac said it notified law enforcement after detecting the incident and launching its investigation. The disclosure appeared in later reporting about the breach response.
OnTrac detected the incident on 2026-03-23 and launched an internal investigation. The company also engaged a third-party specialist and took steps to re-secure the affected data and verify it had not been distributed.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
teiss.co.uk
Open sourcescworld.com
Open sourcecyberveille.ch
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Tris Pharma experienced a data breach after detecting unauthorized activity on its network between September 24 and September 25, 2025. The breach, discovered on September 24, involved an unknown threat actor accessing specific systems, potentially exposing personal information such as names and other sensitive identifiers. The company has stated there is no current evidence of fraud or identity theft, but the investigation is ongoing, and law enforcement and regulators have been notified to mitigate further risks. The exposure of personal identifiers raises concerns about possible identity theft or targeted phishing attacks, as similar incidents in the pharmaceutical sector have led to such outcomes. Tris Pharma has not confirmed any misuse of the compromised data but is taking steps to address the incident and protect affected individuals. Customers and individuals associated with Tris Pharma are advised to remain vigilant for potential social engineering scams or financial fraud attempts resulting from this breach.
Jul 12, 2026
Carnival Corporation disclosed a data breach after a threat actor used social engineering to compromise an employee account and gain unauthorized access to a limited portion of the company’s internal IT systems. The company said it detected suspicious activity on April 14, contained the intrusion with help from third-party cybersecurity specialists, and confirmed by April 22 that customer personal information had been copied from affected systems. The exposed data included names, addresses and other contact details, dates of birth, government-issued identification numbers linked to passports and driver’s licenses, and in some cases Social Security numbers. Reports said about **6 million** people in the United States may be affected. Carnival began notifying impacted individuals on May 27, issued a public notice for people it could not contact directly, and is offering **24 months** of complimentary credit monitoring through **TransUnion MyTrueIdentity**. The company has not identified the threat actor or said whether ransomware or extortion was involved.
Jun 29, 2026
Medtronic disclosed that unauthorized actors accessed certain corporate IT systems between April 13 and April 19, exposing personal and health-related information tied to **3,834,294 individuals**. The company said the incident was detected after unusual activity on April 15 and attributed in public reporting to the **ShinyHunters** extortion group, which claimed to have stolen about **9 million records** and briefly listed Medtronic on its Tor-based leak site before the post disappeared. Exposed data may include names, contact details, dates of birth, Social Security numbers, and other health-related information. Medtronic said it found **no impact** on medical devices, patient safety, hospital customer networks, manufacturing and distribution operations, financial systems, or care delivery, and added that it has no evidence the stolen data was publicly released online. The company has engaged external cybersecurity experts, notified law enforcement and regulators, and is warning affected people to watch for phishing, social engineering, and unauthorized account activity while offering **24 months** of credit monitoring, dark web monitoring, and identity theft recovery services.
Jul 8, 2026