Recent Breaches
-
July 20, 2026 • On July 20, 2026, Sumner County Schools discovered unauthorized access to its network. The incident disrupted network communications and back-to-school preparations, causing the district to postpone registration from July 22 to August 4-5 and move the first day of classes from August 4 to August 10. The district restored core network communications before announcing recovery on July 31. It reported that Skyward, school nutrition, payroll, student iPads and Chromebooks, and scheduled sports were unaffected. The FBI, Tennessee Bureau of Investigation, Department of Homeland Security, Tennessee Department of Education, and outside forensic specialists assisted. The district had not identified an actor, attack method, ransom demand, encryption, or compromised student or employee data.
-
July 20, 2026 • Craneware disclosed on July 20, 2026 that an unauthorized party had accessed a subset of its internal data environment and removed employee, customer, and partner records. Chaos claimed responsibility on July 28 and alleged theft of approximately 960 gigabytes, but Craneware has not confirmed the attribution or the actor's claim. Craneware explicitly said neither its operations nor customer services were disrupted.
-
July 21, 2026 • Upbound Group disclosed multiple recent cybersecurity incidents in which unauthorized parties obtained customer information and company documents. The stolen information was used to create fraudulent lease-to-own agreements through the Acima platform; Acima paid retailers, while the fraudsters obtained merchandise and did not make the required payments. Upbound attributed approximately $13 million in elevated fraudulent contract losses during the second quarter of 2026 to the incidents. The company enhanced authentication and fraud controls and notified federal law enforcement. No actor, intrusion vector, or operational disruption was disclosed.
-
July 21, 2026 A threat actor distributed a 17 GB SQL database on the Altenen cybercrime forum on July 21, 2026 that was claimed to have been stolen from SplitVPN, formerly NotVPN. SplitVPN acknowledged that subscription/account metadata in the leak was authentic, rotated credentials and encryption keys, changed server IP addresses, closed the vulnerability, and engaged external security specialists. The company disputes that the 58 million alleged connection logs originated from its infrastructure.
-
July 21, 2026 • Attackers took over a certified (PEC) email account of Italy's Reggio Calabria Prefecture, reportedly via infostealer, and posed as authorities to get data on ~680 Revolut customers (July 21, 2026). Group iamnotavillain demanded ransom; prosecutors are investigating.
-
July 21, 2026 • North Dakota HHS said a phishing email on 21 Jul 2026 let an unauthorized third party into the email accounts of three Developmental Disabilities staff, exposing health data of about 1,700 clients. State IT secured the accounts; notices went out 24 Aug.
-
July 22, 2026 • An unnamed Western government organization lost more than 18,000 records from its backend database on July 22, 2026 after an attacker exploited its WordPress site, per GreyNoise, which links the suspected Chinese-speaking actor to the Red Heron group and a ZyXEL switch campaign.
-
July 23, 2026 • At least two Meccha Chameleon Steam Workshop maps, Laser Tag Neon and Chroma Grid Arena, abused a custom-map vulnerability to execute malware on players' Windows computers. The analyzed Laser Tag Neon map wrote a batch file and launched hidden PowerShell to retrieve a second stage. Players reported command windows appearing, and a recovered copy installed an unidentified remote-access trojan, although the originally examined computer received an HTTP 404 and did not execute the second stage. Laser Tag Neon had 756 subscribers when checked, but the number who loaded a malicious map and became infected is undetermined. The maps were removed and version 3.1.0 patched the execution path.
-
July 23, 2026 • Kairos listed Melbourne property-management company LR Reed on its leak site and claimed theft of 335 gigabytes of data. Published samples appeared to contain identifiable employee and internal company records, supporting that unauthorized data access occurred, although the full volume claim was not independently verified. LR Reed said customer data was segregated and unaffected, its core systems remained operational, and it notified the Australian Signals Directorate and Australian Federal Police.
-
July 23, 2026 • An attacker exploited the Verus Protocol's Ethereum cross-chain bridge on July 23, 2026 by inserting duplicate malicious state-root entries into otherwise legitimate notarizations, then submitting a fabricated import proof that authorized inflated Ethereum withdrawals after a 0.01 VRSC export. Approximately US$7.44 million was drained, swapped into about 2,779 ETH, and deposited into Tornado Cash. Researchers said a different attacker and wallet were involved than in the May bridge exploit; no operational disruption was reported.
-
July 23, 2026 • Play listed Restaurant Depot on July 23, 2026 and claimed exfiltration of internal files. DataBreach.com later indexed 3,697,383 rows containing personal and contact information associated with the company. Restaurant Depot is a wholesale cash-and-carry foodservice supplier headquartered in College Point, New York. No operational disruption has been independently established.
-
July 24, 2026 • Threat intelligence attributed the leak-site claim to Triple X, while the material was also advertised under the handle leak-king-F. The bank later confirmed that a compromised employee email account enabled unauthorized access to certain data, but it did not confirm the actor attribution or full leak claim. The incident was contained and the bank said its core banking and transaction systems were not accessed or affected.
-
July 24, 2026 • RTL Nieuws identified The Gentlemen as responsible for a ransomware attack against Thialf and reported that the criminals demanded payment to make inaccessible computers available again and to prevent publication of purportedly stolen data. The group claimed to possess internal documents, employee information, financial contracts, and other sensitive data. Thialf confirmed the attack but said its forensic investigation found that data and operational processes were not affected or endangered and that planned events could continue; the claimed data theft therefore remains unverified.
-
July 24, 2026 Suspicious outflows from Triple-A treasury wallets began on July 24, 2026 and continued for about 31 hours across Ethereum, TRON, Polygon, Arbitrum, Solana, TON, and Bitcoin, with estimated losses reaching US$11.8 million. Triple-A identified unauthorized access July 25 and said the affected wallets belonged to its Singapore entity. Some services entered maintenance mode for approximately three hours as a containment precaution; all services were restored and client funds were unaffected.
-
July 24, 2026 • District communications confirmed a network disruption and unavailable services while forensic specialists investigated and restored systems. Internal sources said containment had been underway since July 24, 2026; that date is an onset/response proxy, not a verified intrusion date. The superintendent identified email, internet, Google Drive and ClassLink-related outages. Staff suspicions of database extraction were not confirmed. The attacker, motive, encryption status and recovery completion remain undisclosed.
-
July 25, 2026 • A Meccha Chameleon system engineer's backup or test PC was infected with malware while the team investigated and patched the malicious-map vulnerability. The attacker used the compromised endpoint to bypass Discord two-factor authentication, change the official server's permissions, ban all staff members, and reduce the server to approximately two visible channels. The developers confirmed through logs that the affected PC could not access or edit the game's source files. The PC was wiped and reformatted, and the development team restored the Discord server and banned the intruders on July 26, 2026.
-
July 25, 2026 • On the night of July 25, 2026 an attacker used an impersonated or compromised professional account to enter the French Education Ministry staff-training information system. Security personnel were alerted July 26 and suspended external access to contain the intrusion. Information about ministry staff employed in regional academies since 2001 may have been acquired, and affected personnel were notified. ZeroBytes later claimed much wider education data theft and published alleged samples, but the ministry had not confirmed that claimed student population or data volume. This intrusion is distinct from the ministry COMPAS breach in March 2026.
-
July 25, 2026 • France's Acadmie de Crteil confirmed on Sept 22, 2026 that student and guardian data from its student databases and staff directory were exfiltrated in the July 2026 hack of Education Ministry systems. Hacker ZeroBytes claimed Crteil data in August; victim count undisclosed.
-
July 26, 2026 • Beginning at approximately 7:30 p.m. on July 26, 2026, Plymouth lost SCADA communications with cellular-connected programmable logic controllers at two water towers and 14 sanitary-sewer lift stations. A second facility stopped communicating shortly after midnight, prompting a coordinated response. The city disconnected affected equipment, used manual site checks and procedures, hard-reset and secured systems location by location, and restored normal communications by the afternoon of July 28. Water levels, pressure, treatment, quality, and delivery remained unaffected. No data theft, ransom demand, or specific actor was disclosed. U.S. intelligence agencies preliminarily assessed that Iran was likely responsible for the coordinated Minnesota campaign, but attribution was not final.
-
July 26, 2026 • Global Secret Group listed Novum Energy on July 26, 2026 and threatened publication unless the company negotiated. DataBreach.com's verified searchable dataset confirms a data compromise. No public victim statement, regulator notice, or incident-specific report confirming encryption, unavailable systems, or interrupted trading or logistics operations was located as of August 12, 2026.