Vendor security monitoring

Within the roughly Jan. 21–May 21, 2026 window, I found credible vulnerability signals but no confirmed public breach of Cursor customer data. Cursor published a Feb. 13, 2026 GitHub advisory for CVE-2026-26268 / GHSA-8pcm-8jpx-hv8r, a high-severity sandbox-escape/RCE path via Git hooks, fixed in Cursor 2.5. Separately, LayerX published an Apr. 28, 2026 report called CursorJacking alleging that malicious Cursor extensions could read locally stored API keys/session tokens and that the issue was not fixed as of publication; treat this as a credible third-party vulnerability report rather than a confirmed breach. Cursor’s own security page was updated Apr. 24, 2026 and says critical incidents are communicated to affected users, but I did not find a public Cursor breach notice in this window.

I did not find credible public signals in the Jan. 21–May 21, 2026 window of a Gat+ / GAT Labs breach, ransomware incident, widespread security compromise, or CISA KEV-relevant exploited product vulnerability. The official GAT Labs status page showed all systems operational and listed no incidents on recent checked dates, while the vendor’s Security Policy Statement describes SOC 2 Type II status, Google Workspace metadata handling, HTTPS transport, and encryption controls. The main GAT Labs product page and search results during the window were security-marketing/product content rather than incident disclosures. No reputable breach tracker/news source I found tied Gat+ to a current-window data leak or customer-data exposure.

I found a current-window JetBrains security advisory, but not a confirmed breach of JetBrains customer data. JetBrains disclosed a high-severity TeamCity On-Premises issue, CVE-2026-44413, affecting TeamCity On-Premises versions through 2025.11.4; JetBrains said the issue could let an authenticated user expose some parts of the TeamCity server API to unauthorized users, was reported privately on Apr. 30, 2026, and was fixed in TeamCity 2026.1 with a security patch plugin available for older versions. JetBrains stated TeamCity Cloud was not affected and that Cloud environments were verified as not impacted. I did not find a CISA KEV/public active-exploitation advisory or credible breach report tied to this 2026 issue during the review window; however, internet-facing TeamCity On-Prem customers should treat the vendor advisory as a relevant patch-priority signal.

I did not find a confirmed LinkedIn data breach or ransomware incident in the Jan. 20–May 20, 2026 window, but I did find a notable security/privacy controversy: on Apr. 3, 2026, BleepingComputer reported that it independently observed LinkedIn JavaScript checking for 6,236 Chromium extensions and collecting device/browser telemetry, while LinkedIn said the detection is used to protect the platform, users, privacy, data, and site stability and denied inferring sensitive information: BleepingComputer report. Because this is disputed and framed as extension detection/fingerprinting rather than unauthorized access to LinkedIn-hosted data, I would treat it as a privacy/security posture signal rather than a confirmed breach. LinkedIn’s own public status page showed “All Systems Operational” and no recent incidents in the visible May 2026 history: LinkedIn status. I also checked the CISA KEV catalog and did not find a LinkedIn product KEV signal in scope.

I did not find credible public reporting, vendor disclosures, breach-notification items, ransomware/leak-site coverage, or CISA KEV entries tying SimpliContract to a security incident in the Jan. 20–May 20, 2026 window. I checked the vendor’s public site and platform pages, which describe the product as an AI contract intelligence/CLM platform and advertise “Enterprise-Grade Security and Privacy” with ISO 27001 and SOC 2 Type 2 badges, but I did not find a recent incident notice or status/security advisory there: SimpliContract homepage and SimpliContract platform/security section. I also checked the CISA Known Exploited Vulnerabilities catalog and found no SimpliContract-specific KEV signal in scope.

I found a credible security/privacy signal in scope, but not a confirmed ransomware-style breach: on Apr. 2, 2026, The Verge reported that Granola notes were viewable to “anyone with the link” by default and that AI training was enabled by default for non-enterprise users, with Granola providing a statement that links are unlisted and full transcripts are not accessible unless explicitly shared: The Verge report. Granola’s own security page says notes are “private by default,” says users control who sees notes, and says enterprise users have model training off by default; those claims are worth validating against current tenant settings and contract terms: Granola security page. I did not treat Granola’s older 2025 AssemblyAI API-key exposure as current risk because the vendor’s post-mortem says it was fixed in 2025 and I did not find a new Jan. 20–May 20, 2026 development tying it to active exploitation: Granola AssemblyAI post-mortem. I also checked the CISA KEV catalog and found no Granola-specific KEV item.

For Google Suite / Google Workspace, I found a credible security-adjacent authentication outage but not a confirmed Google breach of Workspace customer data in the window. Google’s official Workspace status dashboard JSON shows an April 10, 2026 Admin Console service disruption where Workspace users using Google IdP could not sign in with security keys and hardware-based passkeys; Google said the issue was resolved after suspected changes were rolled back: Google Workspace status JSON and the Workspace Status Dashboard. A separate April 2026 Vercel incident is relevant to Workspace tenant risk but is not a Google breach: TechCrunch reported that attackers used a Context AI OAuth connection to take over a Vercel employee’s Google-hosted corporate account and access Vercel internal systems, while Tom’s Hardware similarly described broad OAuth permissions in Vercel’s enterprise Google Workspace as part of the attack chain: TechCrunch and Tom’s Hardware. Google’s Workspace Updates blog in the same period emphasized audit-log and developer-security enhancements, which are hardening updates rather than incident disclosures: Google Workspace Updates.

I did not find a credible public signal from roughly Jan. 19–May 19, 2026 indicating HISAC itself suffered a breach, leak, ransomware event, platform compromise, or regulatory security action. The recent public material I found is Health-ISAC threat-intelligence and sector guidance, not an incident notice about HISAC: its Jan. 26, 2026 release says the organization published a health-sector threat landscape report covering ransomware, third-party compromise, phishing, and zero-days: Health-ISAC press release. The underlying report highlights healthcare-sector risks such as third-party breaches and ransomware trends, but it does not disclose a compromise of HISAC’s own systems: 2026 Health Sector Cyber Threat Landscape PDF. I also checked the Health-ISAC homepage, which showed current advisory/media content such as Stryker attack discussion and AI supply-chain transparency guidance, again not a HISAC breach notice: Health-ISAC homepage.

I did not find a credible current public signal from roughly Jan. 19–May 19, 2026 showing a new Hubspot data breach, leak, ransomware incident, or CISA KEV-relevant product exploitation. HubSpot’s official Feb. 25, 2026 incident report describes a permissions-configuration rollout that locked users out of certain workflow UI views for about 37 minutes; HubSpot says backend automations continued and no customer data was lost, so I would treat it as a reliability/access-control incident rather than a breach: HubSpot Feb. 25 incident report. HubSpot’s status page showed recent May 2026 availability incidents, including a May 12 database impairment and a May 7 AWS-related degradation, but they were not clearly security-related: HubSpot status. I also checked HubSpot’s March 2026 transparency report; it is about legal requests for customer data, not a security incident: HubSpot transparency report. Search results surfaced claims that resembled HubSpot’s March 2022 crypto-customer incident, but that event is outside the requested window and was omitted as stale absent a new 2026 development.

In the last ~4 months, I found security-relevant AWS signals, but not a confirmed breach of AWS’s own infrastructure. AWS published a May 2026 bulletin for CVE-2026-31431, a Linux kernel local-privilege-escalation issue affecting Amazon Linux, Bottlerocket, ECS/EKS-related images, EMR, Fargate, and some SageMaker/DLAMI contexts; CISA added that CVE to KEV on May 1, 2026, and NVD also marks it as in the CISA KEV catalog. AWS’s April security roundup listed multiple AWS product/software bulletins, including ECS Agent, WorkSpaces Skylight Agent, Firecracker, EFS CSI Driver, and AWS Encryption SDK issues, indicating patch-management attention rather than a known AWS platform breach (AWS April 2026 security roundup). At the edge of the review window, AWS also addressed the CodeBuild “CodeBreach” research in an AWS security bulletin, saying project-specific AWS-managed GitHub repository misconfigurations were remediated, no inappropriate code was introduced, and no AWS customer environments/services were impacted; Wiz’s write-up provides the researcher perspective (Wiz CodeBreach report). Separately, the European Commission disclosed a March 2026 cyberattack on cloud infrastructure for Europa.eu, and reporting tied it to a compromised AWS account/API key, but available reporting and AWS statements characterize it as a customer-environment/credential compromise rather than an AWS infrastructure breach (European Commission press release, TechCrunch follow-up).

In the last ~4 months, OpenAI disclosed two software-supply-chain security events but stated it found no evidence that ChatGPT/OpenAI user data, production systems, intellectual property, or shipped software were compromised. On May 13, 2026, OpenAI said the TanStack npm / “Mini Shai-Hulud” attack affected two employee devices, with limited credential material exfiltrated from internal source repositories; OpenAI is rotating signing certificates and requiring macOS app updates by June 12, 2026. On April 10, 2026, OpenAI separately disclosed an Axios developer-tool compromise involving a macOS app-signing workflow, again saying it saw no evidence of user-data access or software alteration and requiring macOS app updates by May 8, 2026. I did not find a credible public report in this window of a confirmed ChatGPT customer-data breach; OpenAI’s current security page and security news index show security posture updates and the above disclosures rather than a customer-data compromise.

I found no credible public signal in the Jan. 16–May 16, 2026 window of a Bamboo Health, Inc data breach, ransomware event, customer-data leak, regulatory action, or security-related outage. I checked Bamboo Health’s public privacy/security FAQ, which describes breach-management procedures, HIPAA compliance, annual third-party assessments/penetration tests, and security review materials, but it does not announce a recent breach (Bamboo Health Privacy and Security FAQs). I also checked the HHS OCR breach portal for healthcare breach reporting context and did not find a Bamboo Health item in the surfaced results (HHS OCR breach portal); searches instead surfaced unrelated 2026 healthcare/vendor incidents involving other companies. A recent UpGuard profile exists, but it is an external attack-surface/security-rating page rather than a confirmed breach report (UpGuard Bamboo Health profile). I did not find a Bamboo Health-specific entry in the CISA KEV catalog.

For the Jan. 15-May 15, 2026 window, I did not find credible public reporting that HITRUST Services Corp itself suffered a breach, ransomware incident, customer-data leak, security-related outage, or regulatory action. Recent HITRUST publications in the window are industry/security-assurance materials rather than incident disclosures, including the April 7, 2026 2026 HITRUST Trust Report announcement, the report page, and the April 30, 2026 Q1 2026 Cyber Threat Adaptive analysis announcement. I also checked the CISA KEV catalog and Privacy Rights Clearinghouse Data Breach Chronology and found no credible recent vendor-specific breach signal.

For the Jan. 15-May 15, 2026 window, I did not find a credible public report of a Loom-specific data breach, ransomware/extortion incident, customer-data leak, or security-related regulatory action. I checked Atlassian/Loom official sources: the Loom status page shows a May 8, 2026 multi-Atlassian-service incident attributed to a public-cloud infrastructure outage and resolved, not a security event; Atlassian’s security advisories page lists 2026 security bulletins primarily for Atlassian Data Center products, not a Loom breach; and Atlassian’s security practices page includes Loom among cloud services covered by Atlassian security controls. I also checked the CISA KEV catalog and Privacy Rights Clearinghouse Data Breach Chronology and found no on-topic recent Loom incident signal.

For the Jan. 15-May 15, 2026 window, I did not find credible public reports of a SpockOffice breach, leak, ransomware incident, platform compromise, or security-related regulatory action. I checked official SpockOffice materials including its features/security page, privacy policy, and data processing agreement, which identify data processed for the Slack leave-management service but do not disclose a recent incident. I also checked the CISA KEV catalog and the Privacy Rights Clearinghouse Data Breach Chronology and found no credible vendor-specific signal in the recent window.

In the Jan. 15-May 15, 2026 window, Anthropic had multiple credible public security signals, though not a confirmed customer-data breach. On March 31, reporting said a Claude Code npm release accidentally included a source map exposing internal Claude Code source; Anthropic's statement to VentureBeat said no sensitive customer data or credentials were exposed and called it a release-packaging error, not a breach (VentureBeat). On April 21-22, TechCrunch reported Anthropic was investigating alleged unauthorized access to Claude Mythos Preview through a third-party vendor environment, with Anthropic saying it had no evidence its own systems were impacted (TechCrunch). Separately, OX Security disclosed a systemic Model Context Protocol issue that it attributed to MCP's architecture and Anthropic-maintained SDK design, creating downstream RCE-style risk across MCP implementations (OX Security, Tom's Hardware).

JetBrains had credible TeamCity security signals in the window, but I did not find a confirmed JetBrains customer-data breach. On May 11, 2026, JetBrains disclosed CVE-2026-44413, a high-severity post-authentication TeamCity On-Premises vulnerability that could let authenticated users expose parts of the TeamCity server API to unauthorized users; JetBrains said TeamCity Cloud was not affected and urged on-prem users to update to 2026.1 (JetBrains TeamCity blog). In addition, the older TeamCity CVE-2024-27199 became newly relevant because CISA added it to KEV on April 20, 2026, with a May 4, 2026 remediation due date, indicating active exploitation within the review window (NVD/CISA KEV entry). This is a vendor-product exposure risk for self-hosted TeamCity environments rather than an incident affecting JetBrains' own cloud service based on the sources checked.

Looker had a credible vulnerability signal in the window: Tenable disclosed LeakyLooker on March 10, 2026, a set of nine cross-tenant Google Looker Studio vulnerabilities that could have allowed attackers to exfiltrate, insert, or delete data in victims' connected Google Cloud services (Tenable). Google's Cloud security bulletin says Looker Studio fixed vulnerabilities reported via the Google/Alphabet VRP and found no evidence of exploitation, with no customer action required; the same bulletin page also notes separate Looker fixes for Looker-hosted and self-hosted customers (Google Cloud security bulletins). This appears to be a serious product vulnerability disclosure/remediation event, not a confirmed breach of Looker-hosted customer data. I did not find a CISA KEV entry for these Looker/Looker Studio issues in the sources checked.

I found no credible public report in the Jan. 14–May 14, 2026 window of a KnowBe4 customer-data breach, ransomware incident, widespread compromise, or CISA KEV-listed exploited vulnerability affecting KnowBe4 products. KnowBe4’s official status page did show service-access and functionality incidents in May 2026, including KnowBe4 Academy access issues and Secure Workspace upload issues, but these were availability/functionality items and not described as security compromises or data exposures (KnowBe4 status). KnowBe4’s public security statement describes SOC 2 coverage and security/compliance artifacts, but it does not disclose a current breach in the period reviewed (KnowBe4 security statement). Searches of major security/news sources and the CISA KEV catalog did not surface an on-topic KnowBe4 incident in the roughly four-month window.

Within the Jan. 14–May 14, 2026 window, I found credible Zendesk-related security-abuse signals, though not a confirmed Zendesk platform breach. Zendesk’s own notice says bad actors were sending relay spam through Zendesk by creating fake tickets in customer instances that allowed unverified users; Zendesk said personal information was not accessed or exposed through Zendesk and advised customers to change settings to reduce abuse (Zendesk spam notice). BleepingComputer reported the same January 2026 global spam wave and said Zendesk introduced new safety features to detect and stop this type of spam (BleepingComputer). Separately, ManoMano confirmed a January 2026 third-party customer-service provider incident affecting customer data, and reporting said unconfirmed information pointed to a compromised Zendesk environment/account at a subcontractor; this is relevant third-party SaaS risk, but the public reporting does not establish a Zendesk core-platform breach (BleepingComputer ManoMano report). Zendesk also posted a January 28, 2026 outage affecting Analytics, Chat, Admin Center, and related functions due to an internal access-service update mistake; it was an availability/access incident, not reported as a data compromise (Zendesk incident report).

I found no confirmed, credible public report in the Jan. 14–May 14, 2026 window of a CoderPad platform breach, ransomware incident, customer-data leak, or CISA KEV item affecting CoderPad-shipped software. CoderPad’s official status page was operational when checked and showed recent daily entries with no reported incidents in the visible May 2026 history (CoderPad status). CoderPad’s official security page describes SOC 2 Type 2, annual penetration testing, vulnerability scanning, bug bounty, encryption, SSO, and internal MFA controls, but does not disclose a current incident (CoderPad security); its vulnerability disclosure policy was updated in March 2026, which appears to be program documentation rather than an incident notice (Vulnerability disclosure policy). One automated vendor-risk page dated April 2026 reported infostealer malware associated with the organization, but it did not establish a confirmed CoderPad breach or customer-data compromise, so I would treat it as a low-confidence monitoring lead rather than an incident finding (UpGuard CoderPad profile).

No credible reports of an Amplitude (the product analytics vendor) breach, ransomware event, or actively exploited platform vulnerability surfaced in roughly the previous four months. UpGuard's continuously updated vendor profile, refreshed in April 2026, does not list any new disclosed breach for Amplitude (UpGuard – Amplitude security report). Amplitude's own Trust, Security and Privacy hub and security FAQ describe ongoing SOC 2 Type 2 / ISO 27001 / ISO 27018 attestations but do not announce a new advisory in this window. Older, still-active items remain non-security in nature (the 2024–2025 privacy class-action over embedded SDK data collection in apps like DoorDash, now headed to arbitration), and we did not find a fresh 2026 development on that thread that would constitute a security incident. Net: no actionable third-party security signal against Amplitude in the last ~4 months.

No live web searches could be performed (all web-access tools were permission-blocked), and the requested window (Dec 2025–Apr 2026) falls after the training-data cutoff (May 2025). As of mid-2025, no publicly reported data breaches, CVEs, or security incidents involving Calamari.io (the Polish HR/leave-management and time-tracking SaaS platform) were found in available training data. Calamari is a niche, smaller vendor with limited security-news footprint, so the absence of reported incidents is not strong evidence of no incidents — it more likely reflects limited coverage. The company advertises GDPR compliance and hosts on AWS. Verify current status at Calamari.io's security page and check general breach trackers such as Have I Been Pwned. Because live searches could not be completed, incidents between December 2025 and April 2026 may have been missed entirely.