| 1 | 01/04/2018 | ? | Guardian Pharmacy of Jacksonville | Guardian Pharmacy of Jacksonville notifies 11,521 patients of email compromise of protected health information. | Account Hijacking | Q Human health and social work activities | CC | US |
| 2 | 01/04/2018 | JokerStash AKA Fin7 AKA Carbanak | Hudson's Bay Company | Retailer Hudson's Bay Company discloses that it was the victim of a security breach that compromised data on payment cards used at Saks and Lord & Taylor stores in North America. Millions of cards may have been compromised (5 millions are already offered for sale). | Unknown | G Wholesale and retail trade | CC | CA |
| 3 | 02/04/2018 | ? | Four U.S. pipeline companies (Oneok Inc, Energy Transfer Partners LP, Boardwalk Pipeline Partners LP, Eastern Shore Natural Gas) | At least four U.S. pipeline companies have seen their electronic systems for communicating with customers shut down, with three confirming it resulted from a cyberattack to Latitude Technology, a third-party provider. It is not clear is the outage is the result of a ransomware or DDoS attack. | Unknown | D Electricity gas steam and air conditioning supply | CC | US |
| 4 | 02/04/2018 | ? | 1,000 Magento Sites | Security researchers from FlashPoint say they've identified at last 1,000 Magento sites that have been hacked by cybercriminals and infected with malicious scripts that steal payment card details, perform cryptojacking, or redirect the visitors to malware distribution sites. | Brute-Force | Y Multiple Industries | CC | >1 |
| 5 | 02/04/2018 | ? | Android Users | Researchers from Trustlook reveal the details of a new strain of Android malware specifically aimed at stealing private conversations on IM applications like Facebook Messenger, Skype, Telegram, Twitter, Viber, and others. | Malware | X Individual | CC | >1 |
| 6 | 02/04/2018 | ? | Government of Sint Maarten | The entire government of Sint Maarten, an independent country within the Kingdom of the Netherlands, is taken down for a week by a cyber attack. | Unknown | O Public administration and defence, compulsory social security | CC | SX |
| 7 | 03/04/2018 | ? | Vadim Lavrusik Twitter and Flipboard accounts | Less than an hour after tweeting about being safe during the active shooting at YouTube's headquarters, the Twitter and Flipboard accounts of Vadim Lavrusik, a product manager at Youtube, are hit by hackers. | Account Hijacking | X Individual | CC | US |
| 8 | 03/04/2018 | Dark-Coder or Th3Falcon. | More than a dozen major Israeli websites | In name of OpIsrael, more than a dozen major Israeli websites, belonging to hospitals, local authorities, the Israeli Opera, Israel Teachers Union and the IDF Widows and Orphans Organization are defaced apparently in response to clashes between the IDF and Gazan protesters the previous weekend. | Defacement | Y Multiple Industries | H | IL |
| 9 | 03/04/2018 | Lazarus AKA Hidden Cobra | Online Casino in Central America | Researchers from ESET reveal that the infamous Lazarus Group, a malicious actor linked to North Korea, has used a new toolset, including the destructive KillDisk, to target the network of an online Casino in Central America. | Targeted Attack | R Arts entertainment and recreation | CE | N/A |
| 10 | 04/04/2018 | APT32 AKA OceanLotus | Multiple Targets | Researchers from Trend Micro reveal the details of a new backdoor affecting MacOS linked to the OceanLotus threat group. The backdoor is called OSX_OCEANLOTUS.D. | Targeted Attack | Y Multiple Industries | CE | >1 |
| 11 | 04/04/2018 | ? | Single Individuals | Researchers from Trend Micro discover a campaign aimed to inject the widely-used Coinhive code into an ad supplied by the AOL advertising network, in order to mine crypto currency. | Malicious Code Injection | X Individual | CC | >1 |
| 12 | 04/04/2018 | ? | Verge Cryptocurrency | An unknown attacker has exploited a bug in the Verge cryptocurrency network code to mine Verge coins at a very rapid pace | Unknown | V Fintech | CC | N/A |
| 13 | 04/04/2018 | ? | Facebook Users | Facebook reveals that "malicious actors" took advantage of search tools on its platform, making it possible for them to discover the identities and collect information on most of its 2 billion users worldwide. | Vulnerability in the Facebook search tool | X Individual | CC | US |
| 14 | 04/04/2018 | ? | Japan Ministry Employees | The Japanese government’s cybersecurity center reveals that the email addresses and passwords of thousands of ministry employees have been leaked and are being sold on the Internet. | Unknown | O Public administration and defence, compulsory social security | CC | JP |
| 15 | 04/04/2018 | ? | Oakton High School | A police investigation reveals that hackers attempted to change grades at Oakton High School, using an attack carried on via a malicious email. | Account Hijacking | P Education | CC | US |
| 16 | 05/04/2018 | ? | [24]7.ai | [24]7.ai, a firm providing online customer support services based on artificial intelligence and machine learning, is breached. As consequence other companies using its services suffer a theft of customer payment information. The breach occurred between September 26, 2017 and October 12, 2017. The list of the victims include Sears, Kmart, and Delta Airlines. Even Best Buy is involved. | Unknown | J Information and communication | CC | US |
| 17 | 05/04/2018 | ? | Several Financial Firms | Researchers from Recorded Future reveal the details of the IoTroop botnet, a botnet made up of hijacked internet-connected televisions and web cameras used to target financial firms with DDoS attacks. | DDoS | K Financial and insurance activities | CC | >1 |
| 18 | 05/04/2018 | ? | Multiple Financial Targets | Researchers from Netskope discover a new ATM jackpotting malware dubbed ATMJackpot. The malware seems to have originated from Hong Kong and to be still in development. | Malware | K Financial and insurance activities | CC | >1 |
| 19 | 05/04/2018 | ? | Multiple Targets | Researchers from Fortinet discover a new variant of the Agent Tesla spyware, spreading via weaponized Microsoft Word Documents. | Malware | Y Multiple Industries | CC | >1 |
| 20 | 06/04/2018 | Suspected Chinese Hackers | India's Ministry of Defence | The website of India's Ministry of Defence is defaced by suspected Chinese attackers. | Defacement | O Public administration and defence, compulsory social security | CC | IN |
| 21 | 08/04/2018 | ? | Drake Bell | Drake Bell appears to be the most recent victim of hackers as part of another episode of the Fappening saga. | Account Hijacking | X Individual | CC | US |
| 22 | 08/04/2018 | ? | Natalie Cassidy | EastEnders star Natalie Cassidy is the latest celebrity to have her intimate pictures leaked online in yet another evolution of the Fappening 2018 scandal. | Account Hijacking | X Individual | CC | UK |
| 23 | 09/04/2018 | JHT | Cisco switches around the world | The Iranian IT Ministry reveals that Hackers have attacked networks in a number of countries including data centers in Iran where they left the image of a U.S. flag on screens along with a warning: “Don’t mess with our elections”. The attack, exploiting CVE-2018-0171, affected 200,000 router switches across the world in a widespread attack, including 3,500 switches in Iran. | IOS Vulnerability | Y Multiple Industries | H | >1 |
| 24 | 09/04/2018 | ? | Armed Forces Recreation Center Edelweiss Lodge and Resort | The Armed Forces Recreation Center Edelweiss Lodge and Resort investigates a data breach that left some guests open to identity theft. At least 18 guests — primarily soldiers and retirees — who stayed at the resort between November 2017 and February 2018 reported that their credit cards were misused after their stays. | PoS Malware | I Accommodation and food service activities | CC | DE |
| 25 | 09/04/2018 | ? | Sodexo Filmology | Sodexo food services and facilities management company notifies a number of customers that it was the victim of a targeted attack on its cinema vouchers platform Sodexo Filmology. | Targeted Attack | R Arts entertainment and recreation | CC | UK |
| 26 | 09/04/2018 | ? | Telco companies in Brazil, Columbia and other Latin American countries | Researchers from Flashpoint observe a spike of activity in Telegram messaging channels being used to exchange HTTP injectors. HTTP injectors can be used to obtain free mobile internet access. | HTTP Injectors | J Information and communication | CC | >1 |
| 27 | 10/04/2018 | ? | Vulnerable CMS Systems. | Security researchers at Malwarebytes report to have uncovered evidence of a sophisticated campaign of thousands of compromised websites running vulnerable CMS' and abused to distribute malware to visiting users via fake updates. The campaign is called FakeUpdates and is used to distribute the ZeusVM variant Chtonic banking malware or a NetSupport Remote Access Tool | Malicious Code Injection into vulnerable CMS' | X Individual | CC | >1 |
| 28 | 10/04/2018 | Kuroi’SH and Prosox | Vevo Youtube Account | Two hackers manage to deface several popular YouTube music videos, changing titles and thumbnail images. The list of the victims include the most-viewed YouTube video of all time, “Despacito”. The two claim to have done it for Palestine. | Defacement | R Arts entertainment and recreation | H | US |
| 29 | 10/04/2018 | ? | Single Individuals | Researchers from Barracuda reveal the details of a recent spate of attacks using phishing, social engineering, exploits, and obfuscation to spread a Quant Loader trojan capable of distributing ransomware and password stealers. The attack uses a “.url” file extension claiming to be billing documents but actually lead to remote script files using a variation of CVE-2016-3353 | Malware | X Individual | CC | >1 |
| 30 | 10/04/2018 | ? | Victoria Independent School District | Victoria independent School District notifies employees that some email accounts were inappropriately accessed between July and October 2017. Some of the emails in those accounts contained employees’ personal information. | Account Hijacking | P Education | CC | US |
| 31 | 11/04/2018 | ? | Great Western Railway | Great Western Railway reset more than a million customer accounts after discovering hackers had successfully breached a small percentage of them. According to the operator, about 1,000 of its passengers' details have been exposed. | Credential Stuffing | X Individual | CC | UK |
| 32 | 12/04/2018 | UK | Islamic State | The director of the intelligence agency GCHQ, Jeremy Fleming reveals that the UK has conducted a "major offensive cyber-campaign" against the Islamic State group. | DDoS | S Other service activities | CW | N/A |
| 33 | 12/04/2018 | ? | Governments and high-level officials in the Middle East and North Africa (MENA) | Kaspersky Labs details a large-scale nation-state backed malware campaign called Operation Parliament that is targeting governments and high-level officials in the Middle East and North Africa (MENA) regions and more specifically Palestine. | Targeted Attack | O Public administration and defence, compulsory social security | CE | PS |
| 34 | 12/04/2018 | ? | Single Individuals | Researchers from Menlo Security reveal the details of a new multi-stage campaign using malicious attachments to infect the endpoint with content hosted on a remote host (and exploiting CVE-2017-8570 to drop the executable in the endpoint), The campaign is used to deliver the Formbook malware. | Malware | X Individual | CC | >1 |
| 35 | 12/04/2018 | ? | Sucuri | The California based website security provider Sucuri suffers a series of massive DDoS attacks causing service outage in West Europe, South America and parts of Eastern United States. | DDoS | M Professional scientific and technical activities | CC | US |
| 36 | 13/04/2018 | ? | Diagnostic Radiology & Imaging | Diagnostic Radiology & Imaging notifies 800 patients of phishing incident occurred in November 2017. | Account Hijacking | Q Human health and social work activities | CC | US |
| 37 | 13/04/2018 | ? | Vulnerable Drupal CMS Systems | After the publication of PoC code, attackers start to exploit the Drupalgeddon2 vulnerability (CVE-2018-7600). | Vulnerability (CVE-2018-7600) | Y Multiple Industries | CC | >1 |
| 38 | 13/04/2018 | ? | Vulnerable routers | Security researchers at Akamai discover a proxy botnet composed of more than 65,000 routers exposed to the Internet via the Universal Plug and Play (UPnP) protocol. | UPnP Vulnerability | Y Multiple Industries | CC | >1 |
| 39 | 13/04/2018 | ? | Inogen | Inogen, a California-based medical device manufacturer, reports that 30,000 former and current customers may have had their personal information exposed when a company employee's email account was compromised sometime between Jan. 2, 2018, and Mar. 14, 2018. | Account Hijacking | C Manufacturing | CC | US |
| 40 | 13/04/2018 | ? | Mise En Place Restaurant Services | Mise En Place Restaurant Services announces that it was subject to a ransomware attack, which may have potentially exposed some information of clients and individuals. | Malware | I Accommodation and food service activities | CC | US |
| 41 | 14/04/2018 | ? | Texas Health Resources | Texas Health Resources reveals that an unauthorized party may have gained access to patient information back in October 2017 by compromising some of the organization's email accounts. The breach was discovered in January 4,000 and might impact 4,000 users. | Account Hijacking | Q Human health and social work activities | CC | US |
| 42 | 15/04/2018 | ? | UnityPoint Health | UnityPoint Health notifies patients of a phishing attack occurred between November 1, 2017 and February 7, 2018 | Account Hijacking | Q Human health and social work activities | CC | US |
