Recent Breaches
-
July 15, 2026 • In mid-July, attackers used compromised credentials to access a data-exchange platform shared with a Stadler supplier and stole technical information belonging to that supplier. Everest demanded CHF 10 million from Stadler, which refused to pay and filed a criminal complaint. Stadler confirmed that its internal IT systems, production sites, and in-service rail vehicles were unaffected and that no relevant personal data was stolen. The precise intrusion date was not disclosed; 15 July is used as the approximate midpoint of the reported period.
-
July 15, 2026 • WebHot ApS took all systems offline on July 15, 2026, after ransomware encrypted nearly every system within minutes. Investigators concluded that normal recovery was impossible, forcing the Danish hosting provider to rebuild its environment from scratch. Email service resumed on July 17 at 15:22, but all customer email predating restoration was permanently lost and users had to recreate their accounts. No data exfiltration or responsible group was reported.
-
July 15, 2026 • On July 15, 2026, ransomware activity affected two employee computers at the Oklahoma Manufacturing Alliance and disrupted access to part of its local network. Staff isolated the affected devices and restored access through a separate secure network later that morning. Booba Project subsequently listed the alliance as a victim on July 28 and claimed theft of 10 GB of data, but the organization reported finding no evidence of removed information or compromised client records. The attacker and encryption behavior have not been independently verified.
-
July 15, 2026 • Al Hayat, an Iraqi company that produces and distributes Pepsi products, was listed on Global Secret Group's leak site on July 26, 2026; the group claimed theft of 138 GB of internal files (attack est. mid-July). The company has not publicly confirmed the breach.
-
July 15, 2026 • Shillen Mackall & Seldon, a Woodstock, Vermont personal injury law firm, was listed by the DragonForce ransomware group on July 15, 2026, with a claimed dataset later indexed at about 1.25 million rows. The firm has not publicly confirmed a breach.
-
July 16, 2026 • Fairlife identified unauthorized third-party access to a portion of its systems, including production-related systems, in connection with a ransomware event. The incident temporarily suspended production at all four U.S. facilities. Coca-Cola confirmed that certain data was taken, while Anubis claimed it had locked servers and stolen 1 TB of confidential information. By July 27, most U.S. production had resumed. Canadian production, product quality and safety, and retail availability were largely unaffected.
-
July 16, 2026 Britsk listy reported that repeated DDoS attacks beginning July 16, 2026 made its website frequently inaccessible during the following 24 hours. No attacker, motive, traffic volume, or further impact was identified in the reporting.
-
July 16, 2026 • The Gentlemen listed the Czech municipality of elkovice on its leak site on 16 July 2026 and threatened publication of a full leak unless representatives entered negotiations. The supplied Novinky article independently reports that The Gentlemen attacked Czech municipal and city offices on 16 July and threatened release of sensitive data for nonpayment, but elkovice has not publicly confirmed the compromise and victim-specific encryption or outage is not established.
-
July 18, 2026 • Attackers replaced the homepage of Kenya's official presidential website with an anti-government message, a cryptocurrency wallet, and a demand for five bitcoins while threatening to publish unspecified information about President William Ruto. Authorities temporarily restricted access for containment and restored the site by July 20; the government found no evidence of sensitive-data access, exfiltration, or loss.
-
July 18, 2026 • The Indonesian Ministry of Home Affairs legal-documentation portal was defaced and made unavailable on July 18, 2026. The altered homepage displayed the self-claimed identity Dua Pemuda Pembawa Bencana and messages stating that Indonesia was experiencing a corruption emergency and calling for taxes to be stopped to combat corruption. No official evidence established access to stored data or broader ministry systems, and no recovery time was reported.
-
July 19, 2026 • On the evening of July 19, 2026, unidentified attackers used bots to flood Tidewater Telecom and affiliated Lincolnville Communications internet-service systems with malicious traffic. The providers worked with upstream carriers to block the traffic. Internet service for residential, business, and government customers across 23 towns became unreliable or unavailable, limiting municipal services and closing the Camden Town Office. Internet operations were near normal by the morning of July 21, although traditional voice service remained in major-outage status. A Tidewater representative said the attackers made demands, but the company did not disclose the demands, any requested amount, or whether payment occurred. The companies found no indication that customer data was compromised.
-
July 19, 2026 • DDoS attacks against KazTAG began July 19 and continued July 20, causing access problems and temporarily preventing the newsroom from publishing. Its hosting provider observed an anomalous surge in inbound traffic and blocked foreign traffic until the attacks ended while leaving access from Kazakhstan unrestricted; no attacker or motive was identified.
-
July 20, 2026 • On July 20, 2026, Sumner County Schools discovered unauthorized access to its network. The incident disrupted network communications and back-to-school preparations, causing the district to postpone registration from July 22 to August 4-5 and move the first day of classes from August 4 to August 10. The district restored core network communications before announcing recovery on July 31. It reported that Skyward, school nutrition, payroll, student iPads and Chromebooks, and scheduled sports were unaffected. The FBI, Tennessee Bureau of Investigation, Department of Homeland Security, Tennessee Department of Education, and outside forensic specialists assisted. The district had not identified an actor, attack method, ransom demand, encryption, or compromised student or employee data.
-
July 20, 2026 • Craneware disclosed on July 20, 2026 that an unauthorized party had accessed a subset of its internal data environment and removed employee, customer, and partner records. Chaos claimed responsibility on July 28 and alleged theft of approximately 960 gigabytes, but Craneware has not confirmed the attribution or the actor's claim. Craneware explicitly said neither its operations nor customer services were disrupted.
-
July 21, 2026 • Upbound Group disclosed multiple recent cybersecurity incidents in which unauthorized parties obtained customer information and company documents. The stolen information was used to create fraudulent lease-to-own agreements through the Acima platform; Acima paid retailers, while the fraudsters obtained merchandise and did not make the required payments. Upbound attributed approximately $13 million in elevated fraudulent contract losses during the second quarter of 2026 to the incidents. The company enhanced authentication and fraud controls and notified federal law enforcement. No actor, intrusion vector, or operational disruption was disclosed.
-
July 21, 2026 A threat actor distributed a 17 GB SQL database on the Altenen cybercrime forum on July 21, 2026 that was claimed to have been stolen from SplitVPN, formerly NotVPN. SplitVPN acknowledged that subscription/account metadata in the leak was authentic, rotated credentials and encryption keys, changed server IP addresses, closed the vulnerability, and engaged external security specialists. The company disputes that the 58 million alleged connection logs originated from its infrastructure.
-
July 21, 2026 • Attackers took over a certified (PEC) email account of Italy's Reggio Calabria Prefecture, reportedly via infostealer, and posed as authorities to get data on ~680 Revolut customers (July 21, 2026). Group iamnotavillain demanded ransom; prosecutors are investigating.
-
July 21, 2026 • North Dakota HHS said a phishing email on 21 Jul 2026 let an unauthorized third party into the email accounts of three Developmental Disabilities staff, exposing health data of about 1,700 clients. State IT secured the accounts; notices went out 24 Aug.
-
July 22, 2026 • An unnamed Western government organization lost more than 18,000 records from its backend database on July 22, 2026 after an attacker exploited its WordPress site, per GreyNoise, which links the suspected Chinese-speaking actor to the Red Heron group and a ZyXEL switch campaign.
-
July 23, 2026 • At least two Meccha Chameleon Steam Workshop maps, Laser Tag Neon and Chroma Grid Arena, abused a custom-map vulnerability to execute malware on players' Windows computers. The analyzed Laser Tag Neon map wrote a batch file and launched hidden PowerShell to retrieve a second stage. Players reported command windows appearing, and a recovered copy installed an unidentified remote-access trojan, although the originally examined computer received an HTTP 404 and did not execute the second stage. Laser Tag Neon had 756 subscribers when checked, but the number who loaded a malicious map and became infected is undetermined. The maps were removed and version 3.1.0 patched the execution path.