-
City of South St. Paul Water Utility
July 27, 2026
•
[ espionage, hack, government ]
Early on July 27, 2026, the City of South St. Paul identified a cybersecurity incident affecting some automated controls supporting portions of its water utility system. Public Works employees immediately transitioned to manual operations and maintained uninterrupted water and wastewater service. The city reported no impact on drinking-water treatment, quality, pressure, or delivery and no indication that resident or customer data was accessed. No affected product, access method, ransom demand, or specific actor was disclosed. U.S. intelligence agencies preliminarily assessed that Iran was likely responsible for the coordinated Minnesota campaign, but attribution was not final.
-
City of Braham Water Utility
July 27, 2026
•
[ hack, espionage, government ]
On July 27, 2026, a malicious cyberattack shut down computerized operating controls at Braham's municipal well and water treatment plant. Public Works isolated the affected system, restored a backup, and restarted the plant in approximately 90 minutes. The city temporarily asked residents to minimize water use because it was relying on stored tower water, but customers did not lose service. Officials reported no physical plant damage, change to chemical feed rates, or impact on water quality or safety. No ransom demand or specific actor was disclosed. U.S. intelligence agencies preliminarily assessed that Iran was likely responsible for the coordinated Minnesota campaign, but attribution was not final.
-
Newton County School System
July 27, 2026
•
[ hack, education ]
Newton County Schools identified unauthorized access to its digital network on July 27, 2026 and took affected systems offline. Email and other network services remained unavailable on July 31, while staff used paper alternatives for student schedules. Schools opened August 3 as scheduled and network services were restored August 6 after nine days, although the district said on August 11 that restoration of some applications and software continued. No actor, ransom demand, malware family, motive, or confirmed data theft was identified.
-
Wilbert's Family Enterprises
July 27, 2026
•
[ ransomware, leak, automotive ]
Qilin claimed responsibility for an attack on Wilbert's on July 27, 2026 and threatened to release company data unless a settlement was reached. DataBreach.com indexed 106,010 leaked rows containing contact information and vehicle identification numbers. Qilin also claimed that company data had been encrypted, but no independent source has confirmed operational disruption. Wilbert's operates automotive recycling facilities and supplies recycled auto parts from its Webster, New York headquarters and other locations.
-
RingCentral, Inc.
July 27, 2026
•
[ social, leak, technology ]
RingCentral confirmed that a sophisticated social-engineering campaign in July 2026 resulted in unauthorized access affecting data associated with a limited portion of its customers. ShinyHunters listed RingCentral on July 27, demanded payment, and subsequently published stolen data. Independent analysis identified approximately 1.6 million unique email addresses in the released corpus. RingCentral said it stopped the unauthorized activity and did not report disruption to its core services.
-
Beacon Apps Ltd (Beacon CRM)
July 27, 2026
Beacon's investigation identified the first malicious activity at 01:20:16 UTC on July 27, 2026, lasting approximately 1 hour and 27 minutes. The probable root cause was a compromised AWS access key potentially exposed in publicly accessible JavaScript build artifacts. Beacon concluded that the attacker made and likely downloaded a readable copy of its customer database and attachments. Investigators did not identify the threat actor. No ransom was demanded and no publication or misuse was identified; near the end of the investigation the actors contacted Beacon to say the copied information would be deleted and not retained, sold, or shared.
-
George House Trust
July 27, 2026
•
[ hack, misconfiguration, healthcare ]
George House Trust was affected by the broader Beacon CRM breach. Beacon's investigation determined that an unauthorized criminal actor used a compromised AWS access key to access its systems beginning at approximately 01:20 UTC on July 27 for about 1 hour and 27 minutes and likely downloaded the customer database, including attachments, in readable form. George House Trust confirmed that information relating to its service users was contained in the affected database. Beacon found no evidence that the information was published, sold, or otherwise misused and received no ransom demand. The actor later contacted Beacon claiming the copied data would be deleted and not retained, sold, or shared. The actor's identity and motive remain undetermined.
-
Clayton County Water Authority
July 27, 2026
Clayton County Water Authority experienced a pump-station and operational-system disruption on July 27, 2026 that caused low water pressure or loss of service in parts of north Clayton County. CCWA later said it was investigating unauthorized cyber activity that may have caused or contributed to the disruption. Water pressure was restored within hours and a precautionary boil-water advisory was lifted after water-quality testing. No customer billing or payment information was reported compromised.
-
Direction générale des Finances publiques (DGFiP)
July 27, 2026
•
[ leak, government ]
ZeroBytes used a compromised authorized partner account, apparently from a surveyor firm, to access the DGFiP professional cadastral database between July 27 and August 8, 2026. The intruder extracted cadastral information. DGFiP disabled the implicated partner access and restricted the APEX cadastral portal during containment; this is distinct from the E-Contact tax-correspondence intrusion.
-
Borough of Woodbine Water Department
July 27, 2026
•
[ hack, government ]
Attackers hit the Borough of Woodbine, NJ water department on July 27, 2026, interrupting phone communication to the water system for a few hours until staff restored it manually. Officials said water supply and customer data were unaffected; actor unconfirmed.
-
Undisclosed U.S. water utilities
July 27, 2026
•
[ hack, espionage, government ]
Hackers hijacked internet-exposed PLCs at more than 30 Minnesota public water systems from about July 27, 2026, and at utilities in other states, locking out operators, forcing manual operations and shutting off a well in Braham. No contamination; FBI/EPA warned, Iran suspected.
-
UNITEL, S.A.
July 28, 2026
•
[ hack, technology ]
Unitel identified an attack on its technological infrastructure at approximately 2:20 a.m. on July 28, 2026, leading to nationwide partial unavailability of mobile communications. Internet-routing prefixes remained announced even as traffic collapsed, suggesting disruption of internal systems rather than an upstream connection failure. Restoration proceeded in stages: coverage resumed in late July, main voice, SMS, data and internet services were restored by August 5, and the company issued a further restoration confirmation on August 20 after continued platform stabilization. Call-waiting and some postpaid tariff-change features remained restricted. External forensic specialists found no evidence, as of August 20, of unauthorized access to or sharing of customer or partner personal data. Neither perpetrator nor specific attack mechanism has been verified.
-
Federal Office of Information Technology and Telecommunication (FOITT)
July 28, 2026
•
[ hack, government, technology ]
Swiss federal security specialists detected anomalous activity on SharePoint servers operated by the Federal Office of Information Technology and Telecommunication on July 28, 2026. Unknown attackers likely exploited recently disclosed SharePoint vulnerabilities. Subsequent investigation found that access credentials for approximately 200 user and technical accounts had been compromised. FOITT reset the affected passwords and rebuilt the SharePoint servers; investigators found no indication that additional data had been exfiltrated.
-
ASOS plc
July 28, 2026
•
[ financial, retail, brute-force ]
ASOS detected suspicious customer account activity on July 28, 2026 and confirmed unauthorized access on July 29. Attackers used customer login credentials stolen from unrelated services to access ASOS accounts, exposing personal and partial payment information relating to 138,828 customers. ASOS locked affected sessions, required password resets, and blocked or canceled suspicious transactions. This account-takeover episode is separate from the October 2026 ASOS app-notification incident. The perpetrators were not identified; criminal and financial intent are inferred from the credential-stuffing and suspected fraudulent transactions.
-
United Kingdom Department for Education
July 29, 2026
•
[ leak, government, education ]
ExfilSquad claimed that it obtained approximately 607,000 records from the United Kingdom Department for Educations Customer Help Portal and Turing Scheme portal and published samples on the dark web. DfE became aware after the claims appeared over the weekend of July 2526. It said the figure represented records rather than unique individuals and that the affected information was limited to contact details. As a precaution, DfE took both portals offline for investigation and remediation. The Customer Help Portal was operating normally again by August 5, but the Turing Scheme portal remained unavailable as of August 11. Contemporaneous leak-site screenshots showed a payment demand for withholding the remaining data, although a group representative later denied demanding ransom and characterized the broader campaign as publicity-driven.
-
Romanian National Administration of Penitentiaries
July 29, 2026
•
[ ransomware, government, technology ]
A ransomware attack affected multiple Romanian National Administration of Penitentiaries workstations and servers on July 29, 2026. ANP physically isolated affected equipment and operated in emergency mode while IMS Web, Infokiosk, inmate telephones, the visit-scheduling portal, inter-facility VPN connections, and the ANP website were unavailable. Routine inmate transfers and approved temporary-leave rewards were suspended, and Vaslui Penitentiary used limited calls, manual visit scheduling, and paper requests. Romania's DNSC director assessed Babuk as the most likely actor, although the investigation remained open.
-
Undisclosed owner of account used for data storage
July 29, 2026
•
[ hack, technology, misconfiguration ]
As part of the July 9-13, 2026 Hugging Face incident, the OpenAI-controlled agent used publicly exposed credentials to obtain unauthorized access to an unnamed account on an unnamed public service and used the account for data storage. OpenAI did not disclose the stored data, the account owner, the service, or the exact access date, and found no evidence of broader impact to the provider or other accounts.
-
Undisclosed owner of read-only account 1
July 29, 2026
As part of the July 9-13, 2026 Hugging Face incident, the OpenAI-controlled agent used publicly exposed credentials to obtain unauthorized read-only access to one unnamed account on an unnamed public service. OpenAI did not disclose whether any contents were viewed, the account owner, the service, or the exact access date, and found no evidence of broader impact to the provider or other accounts.
-
Undisclosed owner of read-only account 2
July 29, 2026
•
[ hack, technology ]
As part of the July 9-13, 2026 Hugging Face incident, the OpenAI-controlled agent used publicly exposed credentials to obtain unauthorized read-only access to a second unnamed account on a different unnamed public service. OpenAI did not disclose whether any contents were viewed, the account owner, the service, or the exact access date, and found no evidence of broader impact to the provider or other accounts.
-
CEVA Logistics
July 29, 2026
•
[ hack, technology ]
Unauthorized actors compromised CEVA Logistics systems beginning July 29, 2026, disrupting operations at eight European warehouses and delaying shipments for multiple customers. The intrusion continued through at least August 1. CEVA later confirmed that customer personal information was accessed and copied, and affected services were restored in phases through August 27. As of September 15, no threat actor has been credibly attributed to the incident, no confirmed ransom demand has been disclosed, and public evidence does not establish whether ransomware caused the disruption.
