-
The Hospital for Sick Children (SickKids)
July 9, 2026
•
[ hack, healthcare ]
SickKids identified a cybersecurity incident on July 9, 2026 involving a vulnerability in a third-party software application supporting its external Careers website and certain human-resources functions. The incident resulted in unauthorized access to employee and job-applicant personal information and temporarily affected the Careers website. Clinical systems, patient information and patient care were unaffected.
-
Chumz (Moneto Ventures Limited)
July 11, 2026
•
[ leak, finance, technology ]
DataBreach.com indexed 89,577 structured records associated with Chumz, a mobile savings and investment service operated by Kenya-incorporated Moneto Ventures Limited, on July 11, 2026. The records contained names, email addresses, and phone numbers. The source marked the dataset unverified, and no victim notice, regulator statement, or reliable actor attribution was located. No evidence established financial-account exposure, the initial access vector, or operational disruption.
-
Nihon Kotsu Co., Ltd.
July 11, 2026
•
[ ransomware, malware, technology ]
Nihon Kotsu detected unauthorized access and malware early on July 11 and isolated its internal network, leaving several dispatch, reservation, registration, and internal services unavailable. AiLock later claimed responsibility. On July 22, Nihon Kotsu said information believed to have leaked in the attack had appeared online, but the company was still determining its contents and scope and did not confirm AiLock's attribution.
-
Lidl via undisclosed IT service provider
July 13, 2026
Unknown attackers briefly accessed a separately stored Lidl customer file maintained by an unidentified external IT service provider. The provider was directly compromised; Lidl's online-shop systems and customer accounts were not compromised. Passwords, billing and delivery addresses, bank details, and payment information were not affected. The precise intrusion date, number of affected customers, actor, access method, and motive were not disclosed, and no operational disruption was reported.
-
Nichirei Corporation
July 13, 2026
•
[ ransomware, manufacturing, technology ]
Nichirei detected unauthorized access on July 13 and disconnected group systems, disrupting cold-storage and frozen-food distribution. RansomHouse later claimed the attack. On August 10, S&J observed at least 200,000 published files; Nichirei acknowledged additional information had been published but did not validate the reported contents or quantity. All sites returned to normal operation on July 24.
-
Brinks Home
July 13, 2026
•
[ phishing, ransomware, technology ]
ShinyHunters said it gained access to Brinks Home on July 13, 2026 through Microsoft Entra voice phishing and used the resulting account access to obtain Salesforce and Cresta data. Brinks identified and contained unauthorized access on July 20. After Brinks did not pay, ShinyHunters released more than 41 gigabytes of data; a subsequent dataset analysis identified 732,162 unique email addresses. Brinks has not confirmed the access method or the actor's larger record counts. Alarm monitoring, products, and system functionality continued without interruption.
-
Spectrum Chemical Mfg. Corp.
July 14, 2026
•
[ ransomware, technology, manufacturing ]
Chaos claimed responsibility for compromising Spectrum Chemical Mfg. Corp. on July 14, 2026, issued what it described as a final ultimatum, and threatened publication of stolen data. DataBreach.com indexed 372,396 structured contact records, supporting classification of the affected asset as a database-backed application server, although the initial access vector was not disclosed. Spectrum manufactures and distributes fine chemicals and laboratory products and is headquartered in New Brunswick, New Jersey. The company has not publicly confirmed the attribution, encryption, or operational disruption.
-
V-Silicon
July 14, 2026
•
[ ransomware, technology, manufacturing ]
Cybernews researchers found an exposed INC staging server containing tools and data customized for an intrusion into V-Silicon. Most reconnaissance and attack preparation occurred around July 14, 2026. Active Directory exports were dated June 16, but researchers could not determine whether access began then or whether the exports were copied later. INC listed V-Silicon on July 18. Although ransomware binaries supported architectures used in industrial systems, no evidence showed that operational technology was reached or encrypted, and no outage was reported. References to NXP and UnitedDS infrastructure did not establish successful separate compromises.
-
National Agency for Cadastre and Land Registration (ANCPI)
July 14, 2026
Attackers used previously leaked credentials and known unpatched vulnerabilities to compromise ANCPI infrastructure, encrypt or delete systems, and disable e-Terra, email, and related applications nationwide. ByteToBreach claimed responsibility. Authorities confirmed limited credential and source-code exfiltration but found no evidence that personal data or land certificates were stolen. E-Terra began a phased restart in Romania's Government Cloud on August 11.
-
Undisclosed Netherlands IP-camera owners or operators
July 14, 2026
•
[ espionage, hack, government ]
AIVD and MIVD disclosed that a small number of internet-accessible IP cameras along military logistics routes in the Netherlands had been compromised and that the operators used image-recognition software to identify military vehicles and cargo. The Dutch advisory did not name the Russian service; GRU Unit 26165 is coded from a separate official multinational advisory, cited by the Dutch agencies, that linked the unit to closely matching IP-camera operations.
-
Undisclosed Ukrainian IP-camera owners or operators
July 14, 2026
AIVD and MIVD disclosed that Russian operators compromised internet-accessible IP cameras in Ukraine, used image-recognition software to identify military vehicles and cargo, and in some cases used camera-derived intelligence in attempts to neutralize Ukrainian personnel and materiel. The Dutch advisory did not name the Russian service; GRU Unit 26165 is coded from a separate official multinational advisory, cited by the Dutch agencies, that linked the unit to closely matching IP-camera operations.
-
Undisclosed IP-camera owners or operators in other EU or NATO member states
July 14, 2026
•
[ espionage, hack, government ]
AIVD and MIVD disclosed that Russian operators compromised internet-accessible IP cameras in multiple EU and NATO member states beyond the Netherlands and used image-recognition software to collect military-logistics and other militarily relevant intelligence. The Dutch advisory did not name the Russian service; GRU Unit 26165 is coded from a separate official multinational advisory, cited by the Dutch agencies, that linked the unit to closely matching IP-camera operations.
-
Town of Milford
July 15, 2026
•
[ hack, government, technology ]
Beginning early July 15, 2026, unauthorized activity affecting Milford municipal computer systems disrupted phone and internet service across town buildings. The water utilities billing office closed, online payments became unavailable, the town clerk lost access to New Hampshire state systems, Zoom participation in public meetings was suspended, and some services continued through backup procedures with delays. Emergency calls to 911 remained available. On July 22, several systems were still offline for forensic analysis. Milford did not disclose the actor, attack method, malware or ransomware involvement, a ransom demand, encryption, or data theft. Earlier warnings about an internet-accessible town storage system were not publicly linked to this incident.
-
Stadler Rail AG
July 15, 2026
•
[ ransomware, technology, manufacturing ]
In mid-July, attackers used compromised credentials to access a data-exchange platform shared with a Stadler supplier and stole technical information belonging to that supplier. Everest demanded CHF 10 million from Stadler, which refused to pay and filed a criminal complaint. Stadler confirmed that its internal IT systems, production sites, and in-service rail vehicles were unaffected and that no relevant personal data was stolen. The precise intrusion date was not disclosed; 15 July is used as the approximate midpoint of the reported period.
-
WebHot ApS
July 15, 2026
•
[ ransomware, technology ]
WebHot ApS took all systems offline on July 15, 2026, after ransomware encrypted nearly every system within minutes. Investigators concluded that normal recovery was impossible, forcing the Danish hosting provider to rebuild its environment from scratch. Email service resumed on July 17 at 15:22, but all customer email predating restoration was permanently lost and users had to recreate their accounts. No data exfiltration or responsible group was reported.
-
Oklahoma Manufacturing Alliance
July 15, 2026
•
[ ransomware, manufacturing, technology ]
On July 15, 2026, ransomware activity affected two employee computers at the Oklahoma Manufacturing Alliance and disrupted access to part of its local network. Staff isolated the affected devices and restored access through a separate secure network later that morning. Booba Project subsequently listed the alliance as a victim on July 28 and claimed theft of 10 GB of data, but the organization reported finding no evidence of removed information or compromised client records. The attacker and encryption behavior have not been independently verified.
-
Al Hayat
July 15, 2026
•
[ leak, manufacturing, retail ]
Al Hayat, an Iraqi company that produces and distributes Pepsi products, was listed on Global Secret Group's leak site on July 26, 2026; the group claimed theft of 138 GB of internal files (attack est. mid-July). The company has not publicly confirmed the breach.
-
Shillen Mackall & Seldon
July 15, 2026
•
[ ransomware, leak ]
Shillen Mackall & Seldon, a Woodstock, Vermont personal injury law firm, was listed by the DragonForce ransomware group on July 15, 2026, with a claimed dataset later indexed at about 1.25 million rows. The firm has not publicly confirmed a breach.
-
Fairlife, LLC (Coca-Cola subsidiary)
July 16, 2026
•
[ ransomware, manufacturing, technology ]
Fairlife identified unauthorized third-party access to a portion of its systems, including production-related systems, in connection with a ransomware event. The incident temporarily suspended production at all four U.S. facilities. Coca-Cola confirmed that certain data was taken, while Anubis claimed it had locked servers and stolen 1 TB of confidential information. By July 27, most U.S. production had resumed. Canadian production, product quality and safety, and retail availability were largely unaffected.
-
Britské listy
July 16, 2026
Britsk listy reported that repeated DDoS attacks beginning July 16, 2026 made its website frequently inaccessible during the following 24 hours. No attacker, motive, traffic volume, or further impact was identified in the reporting.
