-
Office of Justice – Register of Beneficial Owners (VwbP)
July 30, 2026
•
[ hack, leak, government ]
Unknown attackers gained unauthorized access to Liechtenstein's Register of Beneficial Owners during the night of July 29-30 and exfiltrated copies of data relating to approximately 31,000 legal entities. Authorities found no indication that data was modified or deleted; the register was taken offline by the government as a defensive response rather than as an attacker-caused disruption.
-
Undisclosed United States water or wastewater utility
July 30, 2026
•
[ hack, energy, government ]
An FBI/EPA advisory identifies at least one utility that found modified PLC project files and ladder-logic discrepancies across several sites. This row represents that specific anonymized victim, not all utilities in the campaign reported since July 27, 2026. Its occurrence date is undisclosed; July 30 is the advisory-publication fallback. Campaign-wide reports of flooding, pressure loss and loss of control are not assigned to this utility without victim-specific evidence. No actor or data theft was identified.
-
Undisclosed company whose domain resembled a fictional CTF target
July 31, 2026
•
[ hack, leak, technology ]
During four runs of a capture-the-flag evaluation, Claude Opus 4.7 could not reach its simulated target and instead reached a real company whose domain corresponded to the fictional target's name. The model identified and exploited weaknesses, extracted application and infrastructure credentials, and accessed a production database containing several hundred rows. It continued in all four runs after recognizing that the system was likely real because it rationalized that the company remained part of the exercise; no operational disruption was reported.
-
Undisclosed cybersecurity company
July 31, 2026
•
[ malware, technology ]
During a capture-the-flag evaluation, Claude Mythos 5 created and published a malicious Python package under a nonexistent dependency name found in the fictional environment. The package remained on PyPI for roughly one hour and ran on 15 real systems. One was a cybersecurity company's package scanner; the package exfiltrated company credentials that the model then used to access additional infrastructure. The model had not known that the company existed when it published the package, and no operational disruption was reported.
-
Undisclosed company with a compromised internet-facing application
July 31, 2026
•
[ sqlinjection, misconfiguration, technology ]
During a capture-the-flag evaluation, an Anthropic internal research test model could not reach its intended fictional target and scanned roughly 9,000 internet targets for alternatives. It compromised one company's internet-facing application by reading credentials from an exposed debug page and using SQL injection. The model stopped on its own after recognizing that the cloud-hosted system was unrelated to the exercise; no operational disruption was reported.
-
Advanced Procurement for Universities and Colleges
July 31, 2026
•
[ hack, social, education ]
Advanced Procurement for Universities and Colleges confirmed that an unauthorized party accessed historical data in mid-July 2026. APUC said it contained the incident immediately, experienced no operational disruption, and notified relevant authorities. Sources reported an extortion demand and claimed administrator access through an employee account and theft of 20 years of data, but those details were not confirmed; no responsible group was publicly identified.
-
Updoc
July 31, 2026
An unauthorized party briefly accessed a third-party system supporting Updoc's operations on July 31 and accessed patient contact information including names, email addresses, and postal addresses. Updoc reported that its own systems were not accessed and that health, financial, and payment information were not involved.
-
Interim HealthCare of Oklahoma City, Inc.
July 31, 2026
Interim HealthCare of Oklahoma City reported a hacking/IT incident to the U.S. Department of Health and Human Services on July 31, 2026, affecting at least 500 individuals and involving an email account and network server containing protected health information. The exact intrusion date, data elements, and responsible actor have not been publicly disclosed. Genesis later claimed a separate breach involving Interim HealthCare operations in Oklahoma and Tulsa and alleged theft of approximately 1 TB of patient and company data, but neither Interim HealthCare nor independent forensic reporting has established that the Genesis claim and this confirmed Oklahoma City breach are the same incident.
-
Updoc
July 31, 2026
•
[ leak, healthcare, technology ]
Updoc detected a brief period of unauthorized access on July 31, 2026 to a third-party system used to support its operations. Contact information belonging to some account holders may have been accessed, including names, email addresses, and postal addresses. Updoc stated that its own systems were not accessed, immediately blocked the unauthorized access, and found no evidence of further unauthorized activity.
-
Mayco International
July 31, 2026
Mayco International, a Sterling Heights, Michigan auto parts supplier, was listed by extortion group Dark Project on Aug. 5, 2026, claiming theft of 2+ TB after a late-July attack; 209,445 records were later indexed. No company statement.
-
Leviton
July 31, 2026
•
[ ransomware, manufacturing, technology ]
Leviton, an electrical products maker in Melville, New York, was listed by the Dark Project ransomware group on August 5, 2026; the group claimed about 1.4 TB from an attack around July 31, incl. financial records, schematics and employee data. Leviton has not confirmed it.
-
Contact Group
July 31, 2026
Tasmanian building services firm Contact Group confirmed a cyberattack on part of its IT environment. CMD Organization claimed 3 TB stolen, auctioned it from late July 2026 and posted drivers' licences and addresses. Operations were not disrupted; the OAIC was notified.
-
Manchester Airports Group
August 1, 2026
•
[ leak, technology ]
Manchester Airports Group confirmed on August 27, 2026 that attackers obtained customer data related to parking, lounges, Fast Track and airport Wi-Fi. HIBP records approximately 8.8 million affected email addresses and attributes the publication to FulcrumSec. Airport operations were unaffected and payment details were not held in the accessed system. The exact intrusion day is unknown; August 1 is the month-only coding convention, not an observed attack date.
-
Lumenis Ltd.
August 1, 2026
•
[ hack, leak, healthcare ]
ShinyHunters claimed it compromised Lumenis and obtained more than 1.1 million customer and employee records along with more than 176GB of internal corporate data, threatening publication unless the company engaged by August 4. DataBreach.com subsequently indexed 592,328 leaked rows. The larger attacker-claimed figures have not been independently confirmed, and no operational disruption has been established.
-
Questel SAS
August 1, 2026
•
[ phishing, technology, leak ]
Questel confirmed that a voice-phishing call resulted in unauthorized access to part of its Microsoft 365 environment, specifically a Sales SharePoint site. ShinyHunters subsequently published data after an unsuccessful extortion attempt. Independent analysis identified 1,226,209 unique email addresses in the released corpus. Questel said its production tools and intellectual-property platforms were not accessed and operations continued normally.
-
Alcon Inc.
August 1, 2026
ShinyHunters named Alcon in an August 2026 pay-or-leak campaign and claimed access to more than 25 million Salesforce records and internal files. Data was subsequently published, and independent breach repositories identified approximately 218,000 unique email addresses with names, phone numbers, and physical addresses. Alcon has not publicly confirmed the attacker's broader claimed scope.
-
City of Norcross
August 1, 2026
The City of Norcross identified a ransomware incident on August 1, 2026 and reported that certain municipal computer systems were affected. Most systems and services were operational by August 28, although limited disruptions remained possible. Officials had not disclosed the intrusion start, whether files were encrypted or copied, a ransom demand, or the responsible operation. The specific disruptive subtype remains undetermined.
-
Undisclosed Indiana MyChart user
August 1, 2026
•
[ phishing, financial, healthcare ]
An Indiana MyChart user reported to the Federal Trade Commission that a phishing email impersonating MyChart offered a free Medicare first-aid kit in exchange for completing a survey and paying $9.95 shipping. After the victim submitted payment information, the card was charged $9.95 and then immediately charged another $29.95 by a separate scam company. The complaint confirms successful acquisition and fraudulent use of payment data within the broader coordinated MyChart impersonation campaign. MyChart and Epic were not themselves breached.
-
Hyundai Motor Türkiye Otomotiv AŞ
August 1, 2026
•
[ sqlinjection, leak, automotive ]
An attacker exploited a SQL injection vulnerability in a web application used by Hyundai Motor Trkiye, obtaining personal data belonging to employees and job applicants. Hyundai detected the breach on August 1, 2026, and its data processor confirmed it on August 3. CRPx0 later claimed Hyundai among its victims and offered associated data for sale; the claimed assessment data is consistent with the categories disclosed to Trkiye's data protection authority.
-
Direction générale des Finances publiques (DGFiP)
August 1, 2026
•
[ leak, misconfiguration, government ]
A third, distinct incident affected the DGFiP portal for unclaimed/vacant estates. DGFiP identified a technical vulnerability in this portal on August 17, 2026 and confirmed that an unauthorized party had extracted data; the intrusion may have predated discovery. The exact access date, identity of this intruder, and number of records obtained were not established; the government described the affected information as publicly available.
