The week in breach news Sep 2, 2026

The Berlin city government is being blackmailed by a ransomware group after hackers compromised the city’s systems and exfiltrated 5.79 TB of data.

The breach was discovered early in August after attackers gained access to city systems and exfiltrated a significant volume of information. Officials have not been able to confirm the content or scope of the affected data, as the investigation is still ongoing.

The Rhysida ransomware group has since claimed responsibility on its website, stating it took 5.79 TB of data from the city government administration. The group says the stolen data includes 46,500 contracts, emails, phone numbers, passwords and other classified information and is demanding 30 bitcoin, equivalent to approximately $2.5 million.

The U.S. Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) confirmed a data breach after a hacking group publicly claimed the attack last week.

The breach affected a stand-alone system separate from the bureau's main network, which contained information such as the targets of ATF investigations. The system was shut down quickly after the breach was discovered, and an investigation is currently underway. The incident has been formally classified as a "major incident," a legally defined designation that requires official notification to members of Congress.

The Qilin ransomware gang claimed responsibility on its leak site, though it has not provided any evidence to support the claim, such as a sample of the stolen data.

Manchester Airports Group (MAG), the largest airport group in the UK, disclosed a data breach on August 27 that could expose data belonging to 8.7 million customers.

MAG operates Manchester, London Stansted and East Midlands airports. The group confirmed that data was stolen from a third-party-hosted database, with the breach affecting car park, lounge and Fast Track bookings, as well as in-airport Wi-Fi sign-ups across all three airports. Compromised data includes email addresses, phone numbers, vehicle registrations and postcodes. MAG confirmed that no payment information was accessed and that passenger safety and aviation security were not affected.

MAG said it received a ransom demand from the attackers but has not shared further details on the threat actor or the specific demands. Meanwhile, the FulcrumSec extortion group reportedly claimed responsibility for the incident, stating it stole approximately 86 GB of data from MAG.

American medical technology giant Boston Scientific is still working to restore operations following a highly disruptive cyberattack it experienced on August 25.

Boston Scientific develops and manufactures devices and therapies used in cardiology, neurology and oncology. The cyberattack caused a network outage that disrupted the company’s global operations, including product manufacturing, customer order processing and shipping. Boston Scientific confirmed that its cloud-based systems and applications were not affected, with the breach appearing limited to some on-premises systems.

The company has not been able to provide a full restoration timeline. Meanwhile, the identity of the threat actor remains unclear, as no known cybercrime group has claimed responsibility for the attack.

Canadian telecommunications provider Eastlink is warning approximately 75,000 customers that their data may have been compromised following a breach discovered last week.

Eastlink learned of the incident on August 26, with user accounts potentially compromised between August 26 and 27. The company shut down affected platforms on its website and mobile app after discovering the breach. The incident affects around 75,000 accounts covering internet, television and landline services, with exposed information potentially including customer names, contact details, account numbers and PINs. Eastlink has said it does not believe any credit card or banking information was accessed.