-
Beacon Apps Ltd (Beacon CRM)
July 27, 2026
Beacon's investigation identified the first malicious activity at 01:20:16 UTC on July 27, 2026, lasting approximately 1 hour and 27 minutes. The probable root cause was a compromised AWS access key potentially exposed in publicly accessible JavaScript build artifacts. Beacon concluded that the attacker made and likely downloaded a readable copy of its customer database and attachments. Investigators did not identify the threat actor. No ransom was demanded and no publication or misuse was identified; near the end of the investigation the actors contacted Beacon to say the copied information would be deleted and not retained, sold, or shared.
-
George House Trust
July 27, 2026
•
[ hack, misconfiguration, healthcare ]
George House Trust was affected by the broader Beacon CRM breach. Beacon's investigation determined that an unauthorized criminal actor used a compromised AWS access key to access its systems beginning at approximately 01:20 UTC on July 27 for about 1 hour and 27 minutes and likely downloaded the customer database, including attachments, in readable form. George House Trust confirmed that information relating to its service users was contained in the affected database. Beacon found no evidence that the information was published, sold, or otherwise misused and received no ransom demand. The actor later contacted Beacon claiming the copied data would be deleted and not retained, sold, or shared. The actor's identity and motive remain undetermined.
-
Clayton County Water Authority
July 27, 2026
Clayton County Water Authority experienced a pump-station and operational-system disruption on July 27, 2026 that caused low water pressure or loss of service in parts of north Clayton County. CCWA later said it was investigating unauthorized cyber activity that may have caused or contributed to the disruption. Water pressure was restored within hours and a precautionary boil-water advisory was lifted after water-quality testing. No customer billing or payment information was reported compromised.
-
Direction générale des Finances publiques (DGFiP)
July 27, 2026
•
[ leak, government ]
ZeroBytes used a compromised authorized partner account, apparently from a surveyor firm, to access the DGFiP professional cadastral database between July 27 and August 8, 2026. The intruder extracted cadastral information. DGFiP disabled the implicated partner access and restricted the APEX cadastral portal during containment; this is distinct from the E-Contact tax-correspondence intrusion.
-
Borough of Woodbine Water Department
July 27, 2026
•
[ hack, government ]
Attackers hit the Borough of Woodbine, NJ water department on July 27, 2026, interrupting phone communication to the water system for a few hours until staff restored it manually. Officials said water supply and customer data were unaffected; actor unconfirmed.
-
Undisclosed U.S. water utilities
July 27, 2026
•
[ hack, espionage, government ]
Hackers hijacked internet-exposed PLCs at more than 30 Minnesota public water systems from about July 27, 2026, and at utilities in other states, locking out operators, forcing manual operations and shutting off a well in Braham. No contamination; FBI/EPA warned, Iran suspected.
-
UNITEL, S.A.
July 28, 2026
•
[ hack, technology ]
Unitel identified an attack on its technological infrastructure at approximately 2:20 a.m. on July 28, 2026, leading to nationwide partial unavailability of mobile communications. Internet-routing prefixes remained announced even as traffic collapsed, suggesting disruption of internal systems rather than an upstream connection failure. Restoration proceeded in stages: coverage resumed in late July, main voice, SMS, data and internet services were restored by August 5, and the company issued a further restoration confirmation on August 20 after continued platform stabilization. Call-waiting and some postpaid tariff-change features remained restricted. External forensic specialists found no evidence, as of August 20, of unauthorized access to or sharing of customer or partner personal data. Neither perpetrator nor specific attack mechanism has been verified.
-
Federal Office of Information Technology and Telecommunication (FOITT)
July 28, 2026
•
[ hack, government, technology ]
Swiss federal security specialists detected anomalous activity on SharePoint servers operated by the Federal Office of Information Technology and Telecommunication on July 28, 2026. Unknown attackers likely exploited recently disclosed SharePoint vulnerabilities. Subsequent investigation found that access credentials for approximately 200 user and technical accounts had been compromised. FOITT reset the affected passwords and rebuilt the SharePoint servers; investigators found no indication that additional data had been exfiltrated.
-
ASOS plc
July 28, 2026
•
[ financial, retail, brute-force ]
ASOS detected suspicious customer account activity on July 28, 2026 and confirmed unauthorized access on July 29. Attackers used customer login credentials stolen from unrelated services to access ASOS accounts, exposing personal and partial payment information relating to 138,828 customers. ASOS locked affected sessions, required password resets, and blocked or canceled suspicious transactions. This account-takeover episode is separate from the October 2026 ASOS app-notification incident. The perpetrators were not identified; criminal and financial intent are inferred from the credential-stuffing and suspected fraudulent transactions.
-
United Kingdom Department for Education
July 29, 2026
•
[ leak, government, education ]
ExfilSquad claimed that it obtained approximately 607,000 records from the United Kingdom Department for Educations Customer Help Portal and Turing Scheme portal and published samples on the dark web. DfE became aware after the claims appeared over the weekend of July 2526. It said the figure represented records rather than unique individuals and that the affected information was limited to contact details. As a precaution, DfE took both portals offline for investigation and remediation. The Customer Help Portal was operating normally again by August 5, but the Turing Scheme portal remained unavailable as of August 11. Contemporaneous leak-site screenshots showed a payment demand for withholding the remaining data, although a group representative later denied demanding ransom and characterized the broader campaign as publicity-driven.
-
Romanian National Administration of Penitentiaries
July 29, 2026
•
[ ransomware, government, technology ]
A ransomware attack affected multiple Romanian National Administration of Penitentiaries workstations and servers on July 29, 2026. ANP physically isolated affected equipment and operated in emergency mode while IMS Web, Infokiosk, inmate telephones, the visit-scheduling portal, inter-facility VPN connections, and the ANP website were unavailable. Routine inmate transfers and approved temporary-leave rewards were suspended, and Vaslui Penitentiary used limited calls, manual visit scheduling, and paper requests. Romania's DNSC director assessed Babuk as the most likely actor, although the investigation remained open.
-
Undisclosed owner of account used for data storage
July 29, 2026
•
[ hack, technology, misconfiguration ]
As part of the July 9-13, 2026 Hugging Face incident, the OpenAI-controlled agent used publicly exposed credentials to obtain unauthorized access to an unnamed account on an unnamed public service and used the account for data storage. OpenAI did not disclose the stored data, the account owner, the service, or the exact access date, and found no evidence of broader impact to the provider or other accounts.
-
Undisclosed owner of read-only account 1
July 29, 2026
As part of the July 9-13, 2026 Hugging Face incident, the OpenAI-controlled agent used publicly exposed credentials to obtain unauthorized read-only access to one unnamed account on an unnamed public service. OpenAI did not disclose whether any contents were viewed, the account owner, the service, or the exact access date, and found no evidence of broader impact to the provider or other accounts.
-
Undisclosed owner of read-only account 2
July 29, 2026
•
[ hack, technology ]
As part of the July 9-13, 2026 Hugging Face incident, the OpenAI-controlled agent used publicly exposed credentials to obtain unauthorized read-only access to a second unnamed account on a different unnamed public service. OpenAI did not disclose whether any contents were viewed, the account owner, the service, or the exact access date, and found no evidence of broader impact to the provider or other accounts.
-
CEVA Logistics
July 29, 2026
•
[ hack, technology ]
Unauthorized actors compromised CEVA Logistics systems beginning July 29, 2026, disrupting operations at eight European warehouses and delaying shipments for multiple customers. The intrusion continued through at least August 1. CEVA later confirmed that customer personal information was accessed and copied, and affected services were restored in phases through August 27. As of September 15, no threat actor has been credibly attributed to the incident, no confirmed ransom demand has been disclosed, and public evidence does not establish whether ransomware caused the disruption.
-
Office of Justice - Register of Beneficial Owners (VwbP)
July 29, 2026
•
[ leak, misconfiguration, government ]
Unknown perpetrators gained unauthorized access to Liechtenstein's Register of Beneficial Owners during the night of July 29-30, 2026 and exfiltrated copies of data concerning approximately 31,000 legal entities. Government analysis later determined that faulty authorization-checking logic allowed repeated requests to exploit the register's API. Authorities took the compromised register offline and defensively disconnected additional sensitive government systems for security reviews. No data alteration or deletion was identified, no perpetrator has been attributed, and no motive has been established.
-
LATAM Airlines Brasil
July 29, 2026
•
[ leak, misconfiguration, technology ]
LATAM Airlines Brasil said unauthorized automated queries exploiting a system flaw exposed personal and partial card data of a limited share of LATAM Pass members; detected July 29, 2026 and disclosed Aug 19. It blocked suspicious IPs, fixed the code and notified Brazil's ANPD.
-
Undisclosed South Korean news website owner or operator
July 30, 2026
An unnamed state-sponsored group compromised at least one South Korean news website, installing a webshell and malicious JavaScript so the site could serve as a watering hole against selected visitors. Fifteen legitimate South Korean websites across several sectors were used as watering holes, but the exact number in the news sector and individual compromise dates were not disclosed. No operational disruption or data theft from the website owner was reported.
-
Undisclosed South Korean healthcare website owner or operator
July 30, 2026
•
[ espionage, healthcare, government ]
An unnamed state-sponsored group compromised at least one South Korean healthcare website and used it as a watering hole against selected visitors. Fifteen legitimate South Korean websites across several sectors were used as watering holes, but the exact number in the healthcare sector, individual compromise dates, and specific server-access method were not disclosed. No operational disruption or data theft from the website owner was reported.
-
Undisclosed South Korean educational website owner or operator
July 30, 2026
•
[ espionage, hack, education ]
An unnamed state-sponsored group compromised at least one South Korean educational website and used it as a watering hole against selected visitors. Fifteen legitimate South Korean websites across several sectors were used as watering holes, but the exact number in the education sector, individual compromise dates, and specific server-access method were not disclosed. No operational disruption or data theft from the website owner was reported.
