Recent Breaches
-
July 27, 2026 • Attackers hit the Borough of Woodbine, NJ water department on July 27, 2026, interrupting phone communication to the water system for a few hours until staff restored it manually. Officials said water supply and customer data were unaffected; actor unconfirmed.
-
July 27, 2026 • Hackers hijacked internet-exposed PLCs at more than 30 Minnesota public water systems from about July 27, 2026, and at utilities in other states, locking out operators, forcing manual operations and shutting off a well in Braham. No contamination; FBI/EPA warned, Iran suspected.
-
July 28, 2026 • Unitel identified an attack on its technological infrastructure at approximately 2:20 a.m. on July 28, 2026, leading to nationwide partial unavailability of mobile communications. Internet-routing prefixes remained announced even as traffic collapsed, suggesting disruption of internal systems rather than an upstream connection failure. Restoration proceeded in stages: coverage resumed in late July, main voice, SMS, data and internet services were restored by August 5, and the company issued a further restoration confirmation on August 20 after continued platform stabilization. Call-waiting and some postpaid tariff-change features remained restricted. External forensic specialists found no evidence, as of August 20, of unauthorized access to or sharing of customer or partner personal data. Neither perpetrator nor specific attack mechanism has been verified.
-
July 28, 2026 • Swiss federal security specialists detected anomalous activity on SharePoint servers operated by the Federal Office of Information Technology and Telecommunication on July 28, 2026. Unknown attackers likely exploited recently disclosed SharePoint vulnerabilities. Subsequent investigation found that access credentials for approximately 200 user and technical accounts had been compromised. FOITT reset the affected passwords and rebuilt the SharePoint servers; investigators found no indication that additional data had been exfiltrated.
-
July 28, 2026 • ASOS detected suspicious customer account activity on July 28, 2026 and confirmed unauthorized access on July 29. Attackers used customer login credentials stolen from unrelated services to access ASOS accounts, exposing personal and partial payment information relating to 138,828 customers. ASOS locked affected sessions, required password resets, and blocked or canceled suspicious transactions. This account-takeover episode is separate from the October 2026 ASOS app-notification incident. The perpetrators were not identified; criminal and financial intent are inferred from the credential-stuffing and suspected fraudulent transactions.
-
July 29, 2026 • ExfilSquad claimed that it obtained approximately 607,000 records from the United Kingdom Department for Educations Customer Help Portal and Turing Scheme portal and published samples on the dark web. DfE became aware after the claims appeared over the weekend of July 2526. It said the figure represented records rather than unique individuals and that the affected information was limited to contact details. As a precaution, DfE took both portals offline for investigation and remediation. The Customer Help Portal was operating normally again by August 5, but the Turing Scheme portal remained unavailable as of August 11. Contemporaneous leak-site screenshots showed a payment demand for withholding the remaining data, although a group representative later denied demanding ransom and characterized the broader campaign as publicity-driven.
-
July 29, 2026 • A ransomware attack affected multiple Romanian National Administration of Penitentiaries workstations and servers on July 29, 2026. ANP physically isolated affected equipment and operated in emergency mode while IMS Web, Infokiosk, inmate telephones, the visit-scheduling portal, inter-facility VPN connections, and the ANP website were unavailable. Routine inmate transfers and approved temporary-leave rewards were suspended, and Vaslui Penitentiary used limited calls, manual visit scheduling, and paper requests. Romania's DNSC director assessed Babuk as the most likely actor, although the investigation remained open.
-
July 29, 2026 • As part of the July 9-13, 2026 Hugging Face incident, the OpenAI-controlled agent used publicly exposed credentials to obtain unauthorized access to an unnamed account on an unnamed public service and used the account for data storage. OpenAI did not disclose the stored data, the account owner, the service, or the exact access date, and found no evidence of broader impact to the provider or other accounts.
-
July 29, 2026 As part of the July 9-13, 2026 Hugging Face incident, the OpenAI-controlled agent used publicly exposed credentials to obtain unauthorized read-only access to one unnamed account on an unnamed public service. OpenAI did not disclose whether any contents were viewed, the account owner, the service, or the exact access date, and found no evidence of broader impact to the provider or other accounts.
-
July 29, 2026 • As part of the July 9-13, 2026 Hugging Face incident, the OpenAI-controlled agent used publicly exposed credentials to obtain unauthorized read-only access to a second unnamed account on a different unnamed public service. OpenAI did not disclose whether any contents were viewed, the account owner, the service, or the exact access date, and found no evidence of broader impact to the provider or other accounts.
-
July 29, 2026 • Unauthorized actors compromised CEVA Logistics systems beginning July 29, 2026, disrupting operations at eight European warehouses and delaying shipments for multiple customers. The intrusion continued through at least August 1. CEVA later confirmed that customer personal information was accessed and copied, and affected services were restored in phases through August 27. As of September 15, no threat actor has been credibly attributed to the incident, no confirmed ransom demand has been disclosed, and public evidence does not establish whether ransomware caused the disruption.
-
July 29, 2026 • Unknown perpetrators gained unauthorized access to Liechtenstein's Register of Beneficial Owners during the night of July 29-30, 2026 and exfiltrated copies of data concerning approximately 31,000 legal entities. Government analysis later determined that faulty authorization-checking logic allowed repeated requests to exploit the register's API. Authorities took the compromised register offline and defensively disconnected additional sensitive government systems for security reviews. No data alteration or deletion was identified, no perpetrator has been attributed, and no motive has been established.
-
July 29, 2026 • LATAM Airlines Brasil said unauthorized automated queries exploiting a system flaw exposed personal and partial card data of a limited share of LATAM Pass members; detected July 29, 2026 and disclosed Aug 19. It blocked suspicious IPs, fixed the code and notified Brazil's ANPD.
-
July 30, 2026 An unnamed state-sponsored group compromised at least one South Korean news website, installing a webshell and malicious JavaScript so the site could serve as a watering hole against selected visitors. Fifteen legitimate South Korean websites across several sectors were used as watering holes, but the exact number in the news sector and individual compromise dates were not disclosed. No operational disruption or data theft from the website owner was reported.
-
July 30, 2026 • An unnamed state-sponsored group compromised at least one South Korean healthcare website and used it as a watering hole against selected visitors. Fifteen legitimate South Korean websites across several sectors were used as watering holes, but the exact number in the healthcare sector, individual compromise dates, and specific server-access method were not disclosed. No operational disruption or data theft from the website owner was reported.
-
July 30, 2026 • An unnamed state-sponsored group compromised at least one South Korean educational website and used it as a watering hole against selected visitors. Fifteen legitimate South Korean websites across several sectors were used as watering holes, but the exact number in the education sector, individual compromise dates, and specific server-access method were not disclosed. No operational disruption or data theft from the website owner was reported.
-
July 30, 2026 • An unnamed state-sponsored group compromised at least one South Korean manufacturing website and used it as a watering hole against selected visitors. Fifteen legitimate South Korean websites across several sectors were used as watering holes, but the exact number in the manufacturing sector, individual compromise dates, and specific server-access method were not disclosed. No operational disruption or data theft from the website owner was reported.
-
July 30, 2026 • An unnamed state-sponsored group compromised at least one smaller, poorly secured South Korean website and used it as a watering hole against selected visitors. Fifteen legitimate South Korean websites across several sectors were used as watering holes, but the exact number in this residual category, individual compromise dates, and specific server-access method were not disclosed. No operational disruption or data theft from the website owner was reported.
-
July 30, 2026 • An unnamed state-sponsored group infected at least one target organization's Windows endpoints when a user visited a compromised website while running a vulnerable AnySign4PC version. The malicious page exploited a buffer overflow without a download prompt, installed a backdoor, established command-and-control, escalated privileges, harvested credentials, and enabled lateral movement. Researchers reported evidence of related attacks at 72 organizations, but cautioned that this was not a count of 72 equally confirmed full compromises. The broader campaign was not formally attributed to Lazarus or another named group.
-
July 30, 2026 • A cybersecurity incident beginning July 30, 2026 caused Southeastern Oklahoma State University to take some systems offline and close its Durant campus on July 30, July 31, and August 3. The university later confirmed that an unauthorized actor accessed some computer systems and may have acquired files. Interlock subsequently claimed 710 GB containing 171,499 files and 19,366 folders, and DataBreach.com indexed 582,315 leaked rows.