Recent Breaches
-
July 1, 2026 • SafePay claimed responsibility for compromising Bethany Lutheran Homes, Inc., which operates as Eagle Crest Communities, on 1 July and threatened to publish the full leak unless the organization contacted the group. A verified searchable dataset containing 16,556 name-and-telephone rows confirms that Eagle Crest data was compromised. The access method, encryption, and operational impact were not disclosed, and no service interruption was identified. Anubis separately claimed an Eagle Crest patient-and-employee data breach later in July, but available evidence does not establish whether that represented the same compromise or a separate event.
-
July 1, 2026 • ShinyHunters claimed responsibility for compromising Ingram Content Group on 1 July after attempted ransom negotiations reportedly failed. A verified searchable dataset containing 80,190 rows confirms that Ingram data was compromised. The access method, encryption, and operational impact were not disclosed, and no system outage or other operational disruption was identified.
-
July 1, 2026 • PwnForums actor 888 advertised an Accenture dataset on July 6 and claimed an early-July theft of more than 35 GB from a private Azure DevOps repository. Accenture acknowledged an isolated security matter and said it remediated the source with no impact to operations or service delivery, but did not confirm the claimed contents or volume.
-
July 1, 2026 • Indra detected ransomware within a non-critical environment belonging to an undisclosed subsidiary and activated its incident-response protocols. The company described the impact as minimal, reported no interruption to critical operations or services, and ruled out propagation to the rest of the group. The Gentlemen claimed the attack and initiated a leak countdown, but Indra did not confirm attribution or data exfiltration.
-
July 1, 2026 An unidentified criminal campaign impersonated Interpol investigators in emails sent to small businesses. A Proton Drive link delivered a password-protected archive containing a custom ransomware executable disguised as video evidence. When executed, the malware encrypted files on available drives and directed victims to negotiate through Tox. Bitdefender observed targets across Europe, Asia, the Middle East, and the United States in several industries but did not disclose the number or identities of successfully infected organizations.
-
July 1, 2026 • From July 1 to July 4, 2026, attackers used an AI-agent framework to map 21 connected Taiwanese government systems, compromise 85 employee accounts, and extract at least 2,564 personnel-related records across the campaign. The operation also obtained SSO client secrets, database credentials, and internal network information and later scanned government IT vendors, a nuclear safety agency, a government email system, and energy companies. Simplified Chinese operator material and the targeting pattern support state-sponsored intelligence collection, but no named group or actor country has been publicly verified.
-
July 1, 2026 • A cyberattack forced an undisclosed approximately 15 MW gas-fired peaker plant in the United Kingdom offline for four days in July 2026. The incident did not affect the wider electricity grid. Multiple reports linked the attack to an Iran-linked state actor, but the UK government and NCSC have not publicly named a specific group. Public reporting does not disclose the precise technical mechanism used to take the generator offline.
-
July 1, 2026 • A Minnesota MyChart user reported to the Federal Trade Commission that a phishing email impersonating MyChart offered a free Medicare Kit in exchange for completing a survey and paying shipping. The victim, who identified Welia Health in Mora as the provider through which they used MyChart, completed the survey, entered credit-card and personal information, and submitted the form. Minutes later, the victim observed a card transaction categorized as an unrelated animal/pet service. Later reporting based on FTC complaints confirmed multiple successful victims of the same broader MyChart impersonation campaign. Epic and Welia Health were not themselves breached.
-
July 1, 2026 • An Illinois MyChart user reported to the Federal Trade Commission that a phishing email impersonating MyChart offered a free Medicare Kit and directed the victim through a survey to a shipping-payment step. The victim submitted Mastercard information before recognizing the message as fraudulent and reported that the scammers had obtained the card information. The complaint is one of several successful victims documented in the broader coordinated MyChart impersonation campaign. MyChart and Epic were not themselves breached.
-
July 1, 2026 • During the final week of July 2026 an unauthorized person gained access to part of Intermarch Drive customer systems and acquired information pertaining to 287,605 individuals. Parent company Groupement Les Mousquetaires confirmed the compromise on August 3 and notified affected customers and the French privacy regulator. Approximately two million was the total Drive customer base, not the number exposed. The attacker, precise intrusion day, and data-use intentions remain unverified.
-
July 1, 2026 • Argentina pipeline operator Oldelval disclosed on July 31, 2026 that a cyber incident affected certain administrative computer systems. It activated response and containment procedures and later reported that the affected platforms had been fully restored, without interruption to crude-oil transport. Ransomware/extortion group The Gentlemen listed the operator on its leak site on July 23 and claimed data theft; the company did not independently confirm exfiltration, encryption, or the attackers identity. The date of initial unauthorized access and full technical effects were not disclosed.
-
July 1, 2026 • Walnut Creek, California practice Golden State Orthopedics & Spine detected unusual network activity around July 2, 2026, saying patient data incl. SSNs may have been accessed. Brain Cipher claimed the attack on July 1, alleging 150 GB stolen; ~125,000 records were later indexed.
-
July 2, 2026 • On July 2, 2026, Anubis added Northeast Pediatrics & Adolescent Medicine to its extortion site and claimed that employee and patient data had been stolen. The precise intrusion date and initial-access method were not disclosed. After reported communications between the practice and Anubis ended, data was published, and the supplied breach database indexed 29,356 records containing names, dates of birth, phone numbers, and street addresses. No operational disruption or successful encryption was publicly confirmed.
-
July 2, 2026 • Origin Energy confirmed unauthorized access to customer records disclosed in July 2026. An individual using the unverified alias Edison Walthour contacted the company on July 2 claiming to have obtained records, reportedly using a former employee's credentials to access a customer billing platform; Origin initially could not substantiate the claim. After receiving new evidence on July 22, Origin confirmed the breach July 23 and ultimately identified approximately 900,000 affected current and former customers. The claimant threatened public disclosure and later asserted a settlement, neither confirmed by Origin. By August 21 the company had provided individual notifications and said it had no evidence the stolen information had been published. The actual first-access and extraction dates and perpetrator identity remain unverified; no operational disruption was established.
-
July 2, 2026 • From July 2 through July 8, 2026, elTOQUE received approximately 1.09 billion malicious automated requests intended to overwhelm eltoque.com and prevent access to its reporting. The campaign focused principally on the homepage, which hosts the outlet's widely used informal Cuban exchange-rate tracker. Protective systems stopped approximately 96% of the traffic before it reached the origin server, and the website remained online, although emergency mitigation rules temporarily delayed or impeded access for some legitimate users, particularly in Cuba. About 2,400 accompanying attempts to exploit website vulnerabilities were unsuccessful. Traffic came through rented data-center and cloud infrastructure in several countries and does not establish attribution. Given the sustained Cuban government pressure against elTOQUE, the politically sensitive target, and the pattern of earlier attacks, the actor country is coded Cuba as a low-confidence contextual assessment; the perpetrator and actor type remain undetermined.
-
July 2, 2026 • On July 2, 2026, a Cook Medical employee was deceived through social engineering and gave an outside party access to company systems. Cook identified and contained the access the same day. The company confirmed customer business-contact information, Salesforce communications, employee names and email addresses, and certain SharePoint business files were accessed, while stating that products, manufacturing, and patient/customer services were unaffected. ShinyHunters later claimed the incident and said it obtained more than 182 GB of data after failed extortion negotiations.
-
July 3, 2026 • Jacksonville detected suspicious network activity on July 3, took affected systems offline, and disabled certain systems as a precaution. Some city services remained unavailable on July 6 while the city used workarounds and investigated with third-party cybersecurity specialists. No subsequent public update confirmed ransomware, data theft, a responsible actor, or the precise restoration date.
-
July 3, 2026 • Breach Boyz World Wide supplied reporters with accurate personal information for nearly 30 current Rogers County Jail inmates and later sent information about an inmate booked on July 10, demonstrating possession of current data. The group claimed that it compromised the jail in early March using Wi-Fi reconnaissance and captured credentials, but Rogers County said the Oklahoma State Bureau of Investigation, a network security company, and a third reviewer found no evidence that the county network was breached. The source system and access method remain undetermined, as does the groups claimed location in northern Iran.
-
July 3, 2026 • Attackers replaced the Hellenic Food Authority's homepage with a skull image and the message "HACKED BY TRENGGALEK CETAR," temporarily preventing normal access to the website. The displayed name has previously been associated with Indonesian website defacers, but the perpetrator's identity and origin were not verified. No data theft or compromise of other EFET systems was confirmed.
-
July 3, 2026 • The Ville de Drancy detected ransomware on July 3, 2026, after parts of its municipal IT environment became inaccessible. Officials disconnected all systems to contain the attack, filed a complaint, and rebuilt from clean offsite backups with ANSSI assistance. Municipal services were slowed or degraded, the telephone system was affected, and three online procedures reverted to paper. The city said personal-data leakage was probable but did not confirm its extent. Qilin later claimed responsibility and on August 2 listed 210 GB comprising 241,705 files as published, but the city did not confirm the attribution or data theft and the claim was not independently verified.