-
Meccha Chameleon development team
July 25, 2026
•
[ hack, malware, technology ]
A Meccha Chameleon system engineer's backup or test PC was infected with malware while the team investigated and patched the malicious-map vulnerability. The attacker used the compromised endpoint to bypass Discord two-factor authentication, change the official server's permissions, ban all staff members, and reduce the server to approximately two visible channels. The developers confirmed through logs that the affected PC could not access or edit the game's source files. The PC was wiped and reformatted, and the development team restored the Discord server and banned the intruders on July 26, 2026.
-
French Ministry of National Education (staff-training information system)
July 25, 2026
•
[ leak, government, education ]
On the night of July 25, 2026 an attacker used an impersonated or compromised professional account to enter the French Education Ministry staff-training information system. Security personnel were alerted July 26 and suspended external access to contain the intrusion. Information about ministry staff employed in regional academies since 2001 may have been acquired, and affected personnel were notified. ZeroBytes later claimed much wider education data theft and published alleged samples, but the ministry had not confirmed that claimed student population or data volume. This intrusion is distinct from the ministry COMPAS breach in March 2026.
-
Académie de Créteil
July 25, 2026
•
[ hack, leak, government ]
France's Acadmie de Crteil confirmed on Sept 22, 2026 that student and guardian data from its student databases and staff directory were exfiltrated in the July 2026 hack of Education Ministry systems. Hacker ZeroBytes claimed Crteil data in August; victim count undisclosed.
-
City of Plymouth Water and Sewer Utility
July 26, 2026
•
[ hack, espionage, energy ]
Beginning at approximately 7:30 p.m. on July 26, 2026, Plymouth lost SCADA communications with cellular-connected programmable logic controllers at two water towers and 14 sanitary-sewer lift stations. A second facility stopped communicating shortly after midnight, prompting a coordinated response. The city disconnected affected equipment, used manual site checks and procedures, hard-reset and secured systems location by location, and restored normal communications by the afternoon of July 28. Water levels, pressure, treatment, quality, and delivery remained unaffected. No data theft, ransom demand, or specific actor was disclosed. U.S. intelligence agencies preliminarily assessed that Iran was likely responsible for the coordinated Minnesota campaign, but attribution was not final.
-
Novum Energy Trading, Inc.
July 26, 2026
•
[ ransomware, energy ]
Global Secret Group listed Novum Energy on July 26, 2026 and threatened publication unless the company negotiated. DataBreach.com's verified searchable dataset confirms a data compromise. No public victim statement, regulator notice, or incident-specific report confirming encryption, unavailable systems, or interrupted trading or logistics operations was located as of August 12, 2026.
-
District of Columbia Public Schools
July 26, 2026
An unauthorized party accessed student data in a web-based application used for DCPS Summer Learning registration. DCPS removed the student information, involved the D.C. Office of the Chief Technology Officer and law enforcement, and reported no known misuse. ExfilSquad listed DCPS on July 26, 2026. Resecurity later linked the breach to the financially motivated extortion group and reported approximately 60,000 records; it found that the publicly released material contained sanitized artifacts for selected records rather than children's complete records.
-
Indonesian Army (TNI AD)
July 26, 2026
•
[ hack, government, technology ]
Dozens of Indonesian Army subdomains were defaced nearly simultaneously on July 26, 2026, with original pages replaced by a message reading hacked by azraelzer0d4y. Defacement archives associate the handle with the team m0z1ll4s. By July 29, some subdomains had returned to normal while others remained defaced or inaccessible. The Army acknowledged the reported cybersecurity disturbance and said it was investigating the cause and impact; no political message, data theft, or specific exploitation method was reported.
-
Love, Bonito
July 26, 2026
•
[ leak, retail, misconfiguration ]
Love, Bonito identified a vulnerability in its website on July 26, 2026 that allowed unauthorized access to some customer account information. The company contained and fixed the vulnerability the same day, notified affected customers on July 30, and reported the incident to law enforcement and data-protection authorities. No attacker, technical vulnerability, affected-customer count, record count, data volume, or confirmed exfiltration was disclosed. No credible threat-actor claim or publicly indexed dataset was located; references to more than 5,000 affected customers concern Love, Bonito's separate 2019 breach.
-
Chess.com
July 26, 2026
•
[ leak, technology ]
Records in the released dataset were collected in daily batches between July 26 and August 3, 2026. The dataset contained more than 7.3 million Chess.com user records, including non-public email information and internal advertising-audience fields. The forum account V0idix distributed the resulting dataset for free, but available evidence does not establish that V0idix performed the collection. No passwords or password hashes were observed, and the precise acquisition method was not conclusively established.
-
VIAVI Solutions Inc.
July 26, 2026
•
[ leak, technology ]
ExfilSquad listed VIAVI Solutions on July 26, 2026 and claimed approximately 430,000 records containing customer and partner contact information, personal information, and enterprise account identifiers. DataBreach.com subsequently indexed 351,833 rows associated with the company. VIAVI has not publicly confirmed the incident, and no operational disruption has been established.
-
City of Atlanta
July 26, 2026
•
[ leak, government ]
ExfilSquad listed the City of Atlanta on July 26, 2026 and claimed approximately 3 million records from city systems, including citizen service requests, addresses, municipal case histories, and internal case-management information. DataBreach.com subsequently indexed 701,869 rows associated with the city. The City of Atlanta has not publicly confirmed the incident, and no operational disruption has been established.
-
WESCO International, Inc.
July 26, 2026
•
[ leak, hack, technology ]
WESCO investigated unauthorized access involving its cloud-based customer relationship management environment after ExfilSquad claimed theft of approximately 2.6 million customer and employee records. DataBreach.com indexed 491,427 rows associated with the incident. WESCO reported no evidence of ransomware or malware on its internal systems and said business operations were unaffected.
-
Newcastle University
July 26, 2026
Newcastle University was alerted on July 27, 2026 and determined that a configuration issue affecting a connection to an admissions system enabled unauthorized access to limited contact information. ExfilSquad had publicly listed the university on July 26. The university found no evidence of ransomware, malware, broader infrastructure compromise, admissions information, or examination results being accessed. DataBreach.com indexed 425,677 rows.
-
Bonava AB
July 26, 2026
•
[ leak, retail ]
Bonava was notified by Swedish police on July 27, 2026 and subsequently confirmed unauthorized access to a limited portion of its customer-management and warranty-case systems. ExfilSquad had listed Bonava on July 26. Bonava's investigation confirmed access to customer and prospective-homebuyer personal information and found no evidence that other personal data or documents were accessed. DataBreach.com indexed 525,721 rows.
-
TaylorMade Golf Company / Sun Day Red
July 26, 2026
ExfilSquad listed TaylorMade and Sun Day Red on July 26, 2026 and claimed approximately 22 GB containing about 2 million records, with an August 5 extortion deadline. DataBreach.com subsequently indexed 439,517 rows containing personal and contact information. TaylorMade and Sun Day Red have not publicly confirmed the claimed intrusion or the attacker's broader claimed scope, and no operational disruption has been established.
-
OFS Brands Holdings, Inc.
July 26, 2026
•
[ ransomware, manufacturing ]
Global Secret Group publicly listed OFS on July 26, 2026 as part of a multi-victim data-theft extortion campaign. Independent ransomware monitoring captured the same claim, and DataBreach.com subsequently indexed 36,624 records associated with OFS. Federal and OSHA records identify OFS Brands Holdings as an office-furniture manufacturer headquartered in Huntingburg, Indiana. No independently verified operational disruption has been established.
-
Cold Front Distribution, LLC
July 26, 2026
•
[ ransomware, leak, retail ]
Global Secret Group listed Cold Front Distribution on July 26, 2026, and DataBreach.com subsequently indexed 33,573 leaked records containing personal and contact information. Interlock had previously listed Cold Front Distribution on June 2, 2026 and claimed to have released internal company files. Available evidence does not establish whether the July disclosure resulted from a separate compromise or involved data obtained through the earlier incident.
-
AnMed
July 26, 2026
•
[ ransomware, malware, healthcare ]
On July 26, 2026 AnMed detected malware that locked access to computer-network files and disrupted telephone, internet, medical-office and clinical IT services, causing multiple temporary facility closures. Files stored on certain local systems were also copied without authorization in July; AnMed later confirmed the theft but said its cloud-based electronic health records were not affected. On August 11 attackers claiming to be The Gentlemen posted ransom demands through AnMed social-media accounts and claimed theft of 6 TB; AnMed did not verify the volume. Care and communications services were progressively restored and an investigation to identify affected individuals continued.
-
Police National Legal Database (PNLD)
July 26, 2026
•
[ ransomware, leak, government ]
Data from the Police National Legal Database was compromised and published on the dark web, including professional contact information for police and criminal justice personnel and data from some Ask the Police users. ExfilSquad claimed the breach and demanded payment; independent review validated samples associated with the wider ExfilSquad campaign, although PNLD did not itself attribute the intrusion to the group.
-
City of Maple Plain Water Utility
July 27, 2026
•
[ espionage, hack, government ]
On July 27, 2026, the City of Maple Plain identified a cybersecurity incident affecting certain automated control functions supporting portions of its water utility system. Employees immediately used contingency procedures and maintained water and wastewater services without interruption. The city declared a local emergency on July 27 and terminated it on July 29 after conditions stabilized. No affected product, access method, data theft, ransom demand, or specific actor was disclosed. U.S. intelligence agencies preliminarily assessed that Iran was likely responsible for the coordinated Minnesota campaign, but attribution was not final.
