Recent Breaches
-
July 1, 2026 • From July 1 to July 4, 2026, attackers used an AI-agent framework to map 21 connected Taiwanese government systems, compromise 85 employee accounts, and extract at least 2,564 personnel-related records across the campaign. The operation also obtained SSO client secrets, database credentials, and internal network information and later scanned government IT vendors, a nuclear safety agency, a government email system, and energy companies. Simplified Chinese operator material and the targeting pattern support state-sponsored intelligence collection, but no named group or actor country has been publicly verified.
-
July 1, 2026 • A cyberattack forced an undisclosed approximately 15 MW gas-fired peaker plant in the United Kingdom offline for four days in July 2026. The incident did not affect the wider electricity grid. Multiple reports linked the attack to an Iran-linked state actor, but the UK government and NCSC have not publicly named a specific group. Public reporting does not disclose the precise technical mechanism used to take the generator offline.
-
July 1, 2026 • A Minnesota MyChart user reported to the Federal Trade Commission that a phishing email impersonating MyChart offered a free Medicare Kit in exchange for completing a survey and paying shipping. The victim, who identified Welia Health in Mora as the provider through which they used MyChart, completed the survey, entered credit-card and personal information, and submitted the form. Minutes later, the victim observed a card transaction categorized as an unrelated animal/pet service. Later reporting based on FTC complaints confirmed multiple successful victims of the same broader MyChart impersonation campaign. Epic and Welia Health were not themselves breached.
-
July 1, 2026 • An Illinois MyChart user reported to the Federal Trade Commission that a phishing email impersonating MyChart offered a free Medicare Kit and directed the victim through a survey to a shipping-payment step. The victim submitted Mastercard information before recognizing the message as fraudulent and reported that the scammers had obtained the card information. The complaint is one of several successful victims documented in the broader coordinated MyChart impersonation campaign. MyChart and Epic were not themselves breached.
-
July 1, 2026 • During the final week of July 2026 an unauthorized person gained access to part of Intermarch Drive customer systems and acquired information pertaining to 287,605 individuals. Parent company Groupement Les Mousquetaires confirmed the compromise on August 3 and notified affected customers and the French privacy regulator. Approximately two million was the total Drive customer base, not the number exposed. The attacker, precise intrusion day, and data-use intentions remain unverified.
-
July 1, 2026 • Argentina pipeline operator Oldelval disclosed on July 31, 2026 that a cyber incident affected certain administrative computer systems. It activated response and containment procedures and later reported that the affected platforms had been fully restored, without interruption to crude-oil transport. Ransomware/extortion group The Gentlemen listed the operator on its leak site on July 23 and claimed data theft; the company did not independently confirm exfiltration, encryption, or the attackers identity. The date of initial unauthorized access and full technical effects were not disclosed.
-
July 1, 2026 • Walnut Creek, California practice Golden State Orthopedics & Spine detected unusual network activity around July 2, 2026, saying patient data incl. SSNs may have been accessed. Brain Cipher claimed the attack on July 1, alleging 150 GB stolen; ~125,000 records were later indexed.
-
July 2, 2026 • On July 2, 2026, Anubis added Northeast Pediatrics & Adolescent Medicine to its extortion site and claimed that employee and patient data had been stolen. The precise intrusion date and initial-access method were not disclosed. After reported communications between the practice and Anubis ended, data was published, and the supplied breach database indexed 29,356 records containing names, dates of birth, phone numbers, and street addresses. No operational disruption or successful encryption was publicly confirmed.
-
July 2, 2026 • Origin Energy confirmed unauthorized access to customer records disclosed in July 2026. An individual using the unverified alias Edison Walthour contacted the company on July 2 claiming to have obtained records, reportedly using a former employee's credentials to access a customer billing platform; Origin initially could not substantiate the claim. After receiving new evidence on July 22, Origin confirmed the breach July 23 and ultimately identified approximately 900,000 affected current and former customers. The claimant threatened public disclosure and later asserted a settlement, neither confirmed by Origin. By August 21 the company had provided individual notifications and said it had no evidence the stolen information had been published. The actual first-access and extraction dates and perpetrator identity remain unverified; no operational disruption was established.
-
July 2, 2026 • From July 2 through July 8, 2026, elTOQUE received approximately 1.09 billion malicious automated requests intended to overwhelm eltoque.com and prevent access to its reporting. The campaign focused principally on the homepage, which hosts the outlet's widely used informal Cuban exchange-rate tracker. Protective systems stopped approximately 96% of the traffic before it reached the origin server, and the website remained online, although emergency mitigation rules temporarily delayed or impeded access for some legitimate users, particularly in Cuba. About 2,400 accompanying attempts to exploit website vulnerabilities were unsuccessful. Traffic came through rented data-center and cloud infrastructure in several countries and does not establish attribution. Given the sustained Cuban government pressure against elTOQUE, the politically sensitive target, and the pattern of earlier attacks, the actor country is coded Cuba as a low-confidence contextual assessment; the perpetrator and actor type remain undetermined.
-
July 2, 2026 • On July 2, 2026, a Cook Medical employee was deceived through social engineering and gave an outside party access to company systems. Cook identified and contained the access the same day. The company confirmed customer business-contact information, Salesforce communications, employee names and email addresses, and certain SharePoint business files were accessed, while stating that products, manufacturing, and patient/customer services were unaffected. ShinyHunters later claimed the incident and said it obtained more than 182 GB of data after failed extortion negotiations.
-
July 3, 2026 • Jacksonville detected suspicious network activity on July 3, took affected systems offline, and disabled certain systems as a precaution. Some city services remained unavailable on July 6 while the city used workarounds and investigated with third-party cybersecurity specialists. No subsequent public update confirmed ransomware, data theft, a responsible actor, or the precise restoration date.
-
July 3, 2026 • Breach Boyz World Wide supplied reporters with accurate personal information for nearly 30 current Rogers County Jail inmates and later sent information about an inmate booked on July 10, demonstrating possession of current data. The group claimed that it compromised the jail in early March using Wi-Fi reconnaissance and captured credentials, but Rogers County said the Oklahoma State Bureau of Investigation, a network security company, and a third reviewer found no evidence that the county network was breached. The source system and access method remain undetermined, as does the groups claimed location in northern Iran.
-
July 3, 2026 • Attackers replaced the Hellenic Food Authority's homepage with a skull image and the message "HACKED BY TRENGGALEK CETAR," temporarily preventing normal access to the website. The displayed name has previously been associated with Indonesian website defacers, but the perpetrator's identity and origin were not verified. No data theft or compromise of other EFET systems was confirmed.
-
July 3, 2026 • The Ville de Drancy detected ransomware on July 3, 2026, after parts of its municipal IT environment became inaccessible. Officials disconnected all systems to contain the attack, filed a complaint, and rebuilt from clean offsite backups with ANSSI assistance. Municipal services were slowed or degraded, the telephone system was affected, and three online procedures reverted to paper. The city said personal-data leakage was probable but did not confirm its extent. Qilin later claimed responsibility and on August 2 listed 210 GB comprising 241,705 files as published, but the city did not confirm the attribution or data theft and the claim was not independently verified.
-
July 3, 2026 • During investigation of the LVM incident, CERT.LV determined that the same attacker, later identified as Bytetobreach, independently compromised at least one server belonging to Latvian pharmaceutical manufacturer Olpha. Unauthorized access and deletion of evidentiary log files were confirmed; the server was contained, its data was not encrypted, and Olpha had identified no additional damage as of July 3, 2026.
-
July 3, 2026 Diater detected unauthorized access to its systems on July 3, 2026 as part of a ransomware attack. Unauthorized parties accessed information stored in affected systems and exfiltrated part of it. Diater isolated affected systems and contained the incident by July 5. The company later confirmed exposure of patient and employee information. DeadLock subsequently listed Diater on its leak site on July 28, 2026.
-
July 4, 2026 • On July 4, 2026, ShadowByt3$ claimed to have used compromised customer credentials and a weakness in Abbott's externally facing, third-party-hosted LabCentral portal to query API endpoints and download files. Abbott treated this as a separate incident, said the portal contained only public product-reference material, and reported no known exposure of proprietary, sensitive customer, or business information and no operational impact. The attacker's broader claims about regulatory and technical files remain unverified.
-
July 4, 2026 • Clover Health detected anomalous login activity on July 4, 2026 and determined that an unidentified actor used social engineering to trick three non-managerial health-plan employees into disclosing credentials, enabling access to their employee email accounts used for member visit scheduling and broker-facing sales. The accounts could access member personal and protected health information but not corporate financial or claims systems. Clover contained and terminated the access, and no operational disruption was reported. No group, country, extortion demand, or stated motive was identified; Criminal and Financial are bounded inferences from deliberate credential theft targeting accounts containing identity and health data. Clover is remote-first and states that it maintains no headquarters, so state and county remain undetermined.
-
July 5, 2026 • Pennington County identified a cyber incident affecting portions of its network on July 5. Most public-facing offices closed July 6, then reopened with reduced or manual services. In August, real-estate and some county programs remained offline and some motor-vehicle transactions were handled manually; the county website still reported limited services on August 12. No data compromise, ransomware, ransom demand, attack method, or responsible actor had been confirmed.