-
Origin Energy Limited
July 2, 2026
•
[ leak, energy ]
Origin Energy confirmed unauthorized access to customer records disclosed in July 2026. An individual using the unverified alias Edison Walthour contacted the company on July 2 claiming to have obtained records, reportedly using a former employee's credentials to access a customer billing platform; Origin initially could not substantiate the claim. After receiving new evidence on July 22, Origin confirmed the breach July 23 and ultimately identified approximately 900,000 affected current and former customers. The claimant threatened public disclosure and later asserted a settlement, neither confirmed by Origin. By August 21 the company had provided individual notifications and said it had no evidence the stolen information had been published. The actual first-access and extraction dates and perpetrator identity remain unverified; no operational disruption was established.
-
elTOQUE (Mas Voces Foundation, Inc.)
July 2, 2026
•
[ ddos, government, technology ]
From July 2 through July 8, 2026, elTOQUE received approximately 1.09 billion malicious automated requests intended to overwhelm eltoque.com and prevent access to its reporting. The campaign focused principally on the homepage, which hosts the outlet's widely used informal Cuban exchange-rate tracker. Protective systems stopped approximately 96% of the traffic before it reached the origin server, and the website remained online, although emergency mitigation rules temporarily delayed or impeded access for some legitimate users, particularly in Cuba. About 2,400 accompanying attempts to exploit website vulnerabilities were unsuccessful. Traffic came through rented data-center and cloud infrastructure in several countries and does not establish attribution. Given the sustained Cuban government pressure against elTOQUE, the politically sensitive target, and the pattern of earlier attacks, the actor country is coded Cuba as a low-confidence contextual assessment; the perpetrator and actor type remain undetermined.
-
Cook Medical LLC
July 2, 2026
•
[ social, leak, healthcare ]
On July 2, 2026, a Cook Medical employee was deceived through social engineering and gave an outside party access to company systems. Cook identified and contained the access the same day. The company confirmed customer business-contact information, Salesforce communications, employee names and email addresses, and certain SharePoint business files were accessed, while stating that products, manufacturing, and patient/customer services were unaffected. ShinyHunters later claimed the incident and said it obtained more than 182 GB of data after failed extortion negotiations.
-
City of Jacksonville, Texas
July 3, 2026
•
[ hack, government ]
Jacksonville detected suspicious network activity on July 3, took affected systems offline, and disabled certain systems as a precaution. Some city services remained unavailable on July 6 while the city used workarounds and investigated with third-party cybersecurity specialists. No subsequent public update confirmed ransomware, data theft, a responsible actor, or the precise restoration date.
-
Rogers County Jail
July 3, 2026
•
[ hack, leak, government ]
Breach Boyz World Wide supplied reporters with accurate personal information for nearly 30 current Rogers County Jail inmates and later sent information about an inmate booked on July 10, demonstrating possession of current data. The group claimed that it compromised the jail in early March using Wi-Fi reconnaissance and captured credentials, but Rogers County said the Oklahoma State Bureau of Investigation, a network security company, and a third reviewer found no evidence that the county network was breached. The source system and access method remain undetermined, as does the groups claimed location in northern Iran.
-
Hellenic Food Authority (EFET)
July 3, 2026
•
[ hack, government ]
Attackers replaced the Hellenic Food Authority's homepage with a skull image and the message "HACKED BY TRENGGALEK CETAR," temporarily preventing normal access to the website. The displayed name has previously been associated with Indonesian website defacers, but the perpetrator's identity and origin were not verified. No data theft or compromise of other EFET systems was confirmed.
-
Ville de Drancy
July 3, 2026
•
[ ransomware, government, leak ]
The Ville de Drancy detected ransomware on July 3, 2026, after parts of its municipal IT environment became inaccessible. Officials disconnected all systems to contain the attack, filed a complaint, and rebuilt from clean offsite backups with ANSSI assistance. Municipal services were slowed or degraded, the telephone system was affected, and three online procedures reverted to paper. The city said personal-data leakage was probable but did not confirm its extent. Qilin later claimed responsibility and on August 2 listed 210 GB comprising 241,705 files as published, but the city did not confirm the attribution or data theft and the claim was not independently verified.
-
Olpha
July 3, 2026
•
[ hack, healthcare, technology ]
During investigation of the LVM incident, CERT.LV determined that the same attacker, later identified as Bytetobreach, independently compromised at least one server belonging to Latvian pharmaceutical manufacturer Olpha. Unauthorized access and deletion of evidentiary log files were confirmed; the server was contained, its data was not encrypted, and Olpha had identified no additional damage as of July 3, 2026.
-
Diater Laboratorio de Diagnóstico y Aplicaciones Terapéuticas, S.A.
July 3, 2026
Diater detected unauthorized access to its systems on July 3, 2026 as part of a ransomware attack. Unauthorized parties accessed information stored in affected systems and exfiltrated part of it. Diater isolated affected systems and contained the incident by July 5. The company later confirmed exposure of patient and employee information. DeadLock subsequently listed Diater on its leak site on July 28, 2026.
-
Abbott Laboratories, Inc. (Core Laboratory Diagnostics)
July 4, 2026
•
[ leak, healthcare, technology ]
On July 4, 2026, ShadowByt3$ claimed to have used compromised customer credentials and a weakness in Abbott's externally facing, third-party-hosted LabCentral portal to query API endpoints and download files. Abbott treated this as a separate incident, said the portal contained only public product-reference material, and reported no known exposure of proprietary, sensitive customer, or business information and no operational impact. The attacker's broader claims about regulatory and technical files remain unverified.
-
Clover Health Investments, Corp.
July 4, 2026
•
[ social, healthcare, financial ]
Clover Health detected anomalous login activity on July 4, 2026 and determined that an unidentified actor used social engineering to trick three non-managerial health-plan employees into disclosing credentials, enabling access to their employee email accounts used for member visit scheduling and broker-facing sales. The accounts could access member personal and protected health information but not corporate financial or claims systems. Clover contained and terminated the access, and no operational disruption was reported. No group, country, extortion demand, or stated motive was identified; Criminal and Financial are bounded inferences from deliberate credential theft targeting accounts containing identity and health data. Clover is remote-first and states that it maintains no headquarters, so state and county remain undetermined.
-
Pennington County, South Dakota
July 5, 2026
•
[ government, technology, hack ]
Pennington County identified a cyber incident affecting portions of its network on July 5. Most public-facing offices closed July 6, then reopened with reduced or manual services. In August, real-estate and some county programs remained offline and some motor-vehicle transactions were handled manually; the county website still reported limited services on August 12. No data compromise, ransomware, ransom demand, attack method, or responsible actor had been confirmed.
-
Metro Mondego, S.A.
July 6, 2026
•
[ ransomware, leak, technology ]
Metro Mondego detected ransomware on July 6, 2026 affecting part of its internal systems, but the Metrobus service continued operating and isolated bank-card payment terminals were unaffected. The Gentlemen listed Metro Mondego on its leak site on July 16 and claimed possession of company information. Metro Mondego subsequently said available evidence made data copying probable and warned personalized-pass holders, email correspondents, employees, suppliers, and contractual counterparties while noting that the exact copied data remained unconfirmed.
-
U.S. Army
July 6, 2026
•
[ hack, government, technology ]
An actor signing the defacements as Kurdish sr altered the 404 error pages of the U.S. Army Open Innovation Lab and Artificial Intelligence Integration Center websites with pro-Kurdistan and anti-Trump messages. The Army removed both sites after notification and said the legacy third-party hosting platform was isolated from its enterprise network. The Army found no access to enterprise, classified, or contractor networks and no evidence that data was accessed or exfiltrated. The initial access method was not determined.
-
Apollo Management Holdings, L.P. (Apollo Global Management)
July 6, 2026
•
[ social, finance, technology ]
An unidentified actor used social engineering to compromise employee authentication and gain unauthorized access to Apollo cloud platforms between July 6 and July 10, 2026. Personal information including names, birth dates, addresses and Social Security numbers was accessed and stolen. The company reported the breach to regulators, notified affected people and offered monitoring services. The exact victim count, particular cloud application and responsible group were not disclosed.
-
Grand Isle Shipyard
July 6, 2026
•
[ ransomware, energy ]
Grand Isle Shipyard, an offshore oil and gas services firm in Galliano, Louisiana, was claimed by the Chaos ransomware group on July 6, 2026, alleging theft of 1.1 TB (341,712 files) from its network servers and setting a negotiation deadline. No company statement.
-
Undisclosed Israeli IT service provider(s)
July 7, 2026
Since early 2026, Check Point Research tracked the MOIS-linked Cavern Manticore cluster compromising Israeli IT service providers. In multiple intrusions, the operators abused remote monitoring and management software already deployed in victim environments; in several cases, they moved from an initially compromised provider to a second-hop provider before reaching an intended target. The Cavern framework provided capabilities for file and database access, credential-related activity, reconnaissance, tunneling, and lateral movement. Check Point observed data exfiltration through remote-printing features in some campaign intrusions but did not identify which victim sectors were involved or disclose the stolen information, victim names, counts, or exact intrusion dates.
-
Undisclosed Israeli government organization(s)
July 7, 2026
•
[ espionage, government, technology ]
Check Point Research reported that the MOIS-linked Cavern Manticore cluster gained access to undisclosed Israeli government organizations during Operation Epic Fury. The operators used compromised IT service providers, trusted remote-management relationships, and browser-based remote-desktop technology to move into and through victim environments. The Cavern framework provided capabilities for file and database access, credential-related activity, reconnaissance, tunneling, and lateral movement. Check Point observed data exfiltration through remote-printing features in some campaign intrusions but did not state whether those cases involved government victims or disclose the stolen information, victim names, counts, or exact intrusion dates.
-
Undisclosed Israeli defense organization(s)
July 7, 2026
Check Point Research reported that the MOIS-linked Cavern Manticore cluster gained access to undisclosed Israeli defense organizations during Operation Epic Fury. The operators used compromised IT service providers, trusted remote-management relationships, and browser-based remote-desktop technology to move into and through victim environments. The Cavern framework provided capabilities for file and database access, credential-related activity, reconnaissance, tunneling, and lateral movement. Check Point observed data exfiltration through remote-printing features in some campaign intrusions but did not state whether those cases involved defense victims or disclose the stolen information, victim names, counts, or exact intrusion dates. The source did not clarify whether the defense victims were government bodies or private companies.
-
Undisclosed Chinese research institution
July 7, 2026
•
[ espionage, insider, government ]
According to China's Ministry of State Security, an outsourced database maintenance worker recruited by an unidentified foreign intelligence agency used remote maintenance privileges to download core research data from an undisclosed institution's experimental database and transfer it abroad. The worker was reportedly arrested, but the institution, contractor, foreign service, incident date, and transfer channel were not disclosed. No operational disruption was reported; because the incident date is unknown, event_date defaults to the supplied source's publication date.
