-
District of Columbia Public Schools
July 26, 2026
An unauthorized party accessed student data in a web-based application used for DCPS Summer Learning registration. DCPS removed the student information, involved the D.C. Office of the Chief Technology Officer and law enforcement, and reported no known misuse. ExfilSquad listed DCPS on July 26, 2026. Resecurity later linked the breach to the financially motivated extortion group and reported approximately 60,000 records; it found that the publicly released material contained sanitized artifacts for selected records rather than children's complete records.
-
Indonesian Army (TNI AD)
July 26, 2026
•
[ hack, government, technology ]
Dozens of Indonesian Army subdomains were defaced nearly simultaneously on July 26, 2026, with original pages replaced by a message reading hacked by azraelzer0d4y. Defacement archives associate the handle with the team m0z1ll4s. By July 29, some subdomains had returned to normal while others remained defaced or inaccessible. The Army acknowledged the reported cybersecurity disturbance and said it was investigating the cause and impact; no political message, data theft, or specific exploitation method was reported.
-
Love, Bonito
July 26, 2026
•
[ leak, retail, misconfiguration ]
Love, Bonito identified a vulnerability in its website on July 26, 2026 that allowed unauthorized access to some customer account information. The company contained and fixed the vulnerability the same day, notified affected customers on July 30, and reported the incident to law enforcement and data-protection authorities. No attacker, technical vulnerability, affected-customer count, record count, data volume, or confirmed exfiltration was disclosed. No credible threat-actor claim or publicly indexed dataset was located; references to more than 5,000 affected customers concern Love, Bonito's separate 2019 breach.
-
Chess.com
July 26, 2026
•
[ leak, technology ]
Records in the released dataset were collected in daily batches between July 26 and August 3, 2026. The dataset contained more than 7.3 million Chess.com user records, including non-public email information and internal advertising-audience fields. The forum account V0idix distributed the resulting dataset for free, but available evidence does not establish that V0idix performed the collection. No passwords or password hashes were observed, and the precise acquisition method was not conclusively established.
-
VIAVI Solutions Inc.
July 26, 2026
•
[ leak, technology ]
ExfilSquad listed VIAVI Solutions on July 26, 2026 and claimed approximately 430,000 records containing customer and partner contact information, personal information, and enterprise account identifiers. DataBreach.com subsequently indexed 351,833 rows associated with the company. VIAVI has not publicly confirmed the incident, and no operational disruption has been established.
-
City of Atlanta
July 26, 2026
•
[ leak, government ]
ExfilSquad listed the City of Atlanta on July 26, 2026 and claimed approximately 3 million records from city systems, including citizen service requests, addresses, municipal case histories, and internal case-management information. DataBreach.com subsequently indexed 701,869 rows associated with the city. The City of Atlanta has not publicly confirmed the incident, and no operational disruption has been established.
-
WESCO International, Inc.
July 26, 2026
•
[ leak, hack, technology ]
WESCO investigated unauthorized access involving its cloud-based customer relationship management environment after ExfilSquad claimed theft of approximately 2.6 million customer and employee records. DataBreach.com indexed 491,427 rows associated with the incident. WESCO reported no evidence of ransomware or malware on its internal systems and said business operations were unaffected.
-
Newcastle University
July 26, 2026
Newcastle University was alerted on July 27, 2026 and determined that a configuration issue affecting a connection to an admissions system enabled unauthorized access to limited contact information. ExfilSquad had publicly listed the university on July 26. The university found no evidence of ransomware, malware, broader infrastructure compromise, admissions information, or examination results being accessed. DataBreach.com indexed 425,677 rows.
-
Bonava AB
July 26, 2026
•
[ leak, retail ]
Bonava was notified by Swedish police on July 27, 2026 and subsequently confirmed unauthorized access to a limited portion of its customer-management and warranty-case systems. ExfilSquad had listed Bonava on July 26. Bonava's investigation confirmed access to customer and prospective-homebuyer personal information and found no evidence that other personal data or documents were accessed. DataBreach.com indexed 525,721 rows.
-
TaylorMade Golf Company / Sun Day Red
July 26, 2026
ExfilSquad listed TaylorMade and Sun Day Red on July 26, 2026 and claimed approximately 22 GB containing about 2 million records, with an August 5 extortion deadline. DataBreach.com subsequently indexed 439,517 rows containing personal and contact information. TaylorMade and Sun Day Red have not publicly confirmed the claimed intrusion or the attacker's broader claimed scope, and no operational disruption has been established.
-
OFS Brands Holdings, Inc.
July 26, 2026
•
[ ransomware, manufacturing ]
Global Secret Group publicly listed OFS on July 26, 2026 as part of a multi-victim data-theft extortion campaign. Independent ransomware monitoring captured the same claim, and DataBreach.com subsequently indexed 36,624 records associated with OFS. Federal and OSHA records identify OFS Brands Holdings as an office-furniture manufacturer headquartered in Huntingburg, Indiana. No independently verified operational disruption has been established.
-
Cold Front Distribution, LLC
July 26, 2026
•
[ ransomware, leak, retail ]
Global Secret Group listed Cold Front Distribution on July 26, 2026, and DataBreach.com subsequently indexed 33,573 leaked records containing personal and contact information. Interlock had previously listed Cold Front Distribution on June 2, 2026 and claimed to have released internal company files. Available evidence does not establish whether the July disclosure resulted from a separate compromise or involved data obtained through the earlier incident.
-
AnMed
July 26, 2026
•
[ ransomware, malware, healthcare ]
On July 26, 2026 AnMed detected malware that locked access to computer-network files and disrupted telephone, internet, medical-office and clinical IT services, causing multiple temporary facility closures. Files stored on certain local systems were also copied without authorization in July; AnMed later confirmed the theft but said its cloud-based electronic health records were not affected. On August 11 attackers claiming to be The Gentlemen posted ransom demands through AnMed social-media accounts and claimed theft of 6 TB; AnMed did not verify the volume. Care and communications services were progressively restored and an investigation to identify affected individuals continued.
-
Police National Legal Database (PNLD)
July 26, 2026
•
[ ransomware, leak, government ]
Data from the Police National Legal Database was compromised and published on the dark web, including professional contact information for police and criminal justice personnel and data from some Ask the Police users. ExfilSquad claimed the breach and demanded payment; independent review validated samples associated with the wider ExfilSquad campaign, although PNLD did not itself attribute the intrusion to the group.
-
City of Maple Plain Water Utility
July 27, 2026
•
[ espionage, hack, government ]
On July 27, 2026, the City of Maple Plain identified a cybersecurity incident affecting certain automated control functions supporting portions of its water utility system. Employees immediately used contingency procedures and maintained water and wastewater services without interruption. The city declared a local emergency on July 27 and terminated it on July 29 after conditions stabilized. No affected product, access method, data theft, ransom demand, or specific actor was disclosed. U.S. intelligence agencies preliminarily assessed that Iran was likely responsible for the coordinated Minnesota campaign, but attribution was not final.
-
City of South St. Paul Water Utility
July 27, 2026
•
[ espionage, hack, government ]
Early on July 27, 2026, the City of South St. Paul identified a cybersecurity incident affecting some automated controls supporting portions of its water utility system. Public Works employees immediately transitioned to manual operations and maintained uninterrupted water and wastewater service. The city reported no impact on drinking-water treatment, quality, pressure, or delivery and no indication that resident or customer data was accessed. No affected product, access method, ransom demand, or specific actor was disclosed. U.S. intelligence agencies preliminarily assessed that Iran was likely responsible for the coordinated Minnesota campaign, but attribution was not final.
-
City of Braham Water Utility
July 27, 2026
•
[ hack, espionage, government ]
On July 27, 2026, a malicious cyberattack shut down computerized operating controls at Braham's municipal well and water treatment plant. Public Works isolated the affected system, restored a backup, and restarted the plant in approximately 90 minutes. The city temporarily asked residents to minimize water use because it was relying on stored tower water, but customers did not lose service. Officials reported no physical plant damage, change to chemical feed rates, or impact on water quality or safety. No ransom demand or specific actor was disclosed. U.S. intelligence agencies preliminarily assessed that Iran was likely responsible for the coordinated Minnesota campaign, but attribution was not final.
-
Newton County School System
July 27, 2026
•
[ hack, education ]
Newton County Schools identified unauthorized access to its digital network on July 27, 2026 and took affected systems offline. Email and other network services remained unavailable on July 31, while staff used paper alternatives for student schedules. Schools opened August 3 as scheduled and network services were restored August 6 after nine days, although the district said on August 11 that restoration of some applications and software continued. No actor, ransom demand, malware family, motive, or confirmed data theft was identified.
-
Wilbert's Family Enterprises
July 27, 2026
•
[ ransomware, leak, automotive ]
Qilin claimed responsibility for an attack on Wilbert's on July 27, 2026 and threatened to release company data unless a settlement was reached. DataBreach.com indexed 106,010 leaked rows containing contact information and vehicle identification numbers. Qilin also claimed that company data had been encrypted, but no independent source has confirmed operational disruption. Wilbert's operates automotive recycling facilities and supplies recycled auto parts from its Webster, New York headquarters and other locations.
-
RingCentral, Inc.
July 27, 2026
•
[ social, leak, technology ]
RingCentral confirmed that a sophisticated social-engineering campaign in July 2026 resulted in unauthorized access affecting data associated with a limited portion of its customers. ShinyHunters listed RingCentral on July 27, demanded payment, and subsequently published stolen data. Independent analysis identified approximately 1.6 million unique email addresses in the released corpus. RingCentral said it stopped the unauthorized activity and did not report disruption to its core services.
