-
Salida School District R-32-J
June 29, 2026
•
[ ransomware, education ]
Salida School District R-32-J in Salida, Colorado, was hit by a cyberattack on June 29, 2026 that damaged files on device hard drives, some unrecoverably. All systems were taken offline and central office work was disrupted. It said no data appears to have been accessed.
-
Todd, Hamaker & Johnson, LLP
June 30, 2026
Akira listed the accounting firm and claimed theft of approximately 40 GB. Partner Kim Johnson later said attackers accessed two server drives, stole and encrypted approximately 55,000 files, wiped network systems, and kept the firm offline for several days; tax and audit software were not compromised.
-
PAI Pharma
June 30, 2026
•
[ ransomware, healthcare, manufacturing ]
PAI Pharma, a Greenville, South Carolina maker of generic liquid and unit-dose drugs, was listed on Brain Cipher's leak site on June 30, 2026; the group claimed theft of about 1.4 TB and threatened to publish it. PAI Pharma had issued no public notice as of September 2026.
-
Undisclosed Uruguayan commercial interiors company
June 30, 2026
•
[ ransomware, manufacturing ]
Gunra ransomware listed an undisclosed Uruguayan designer and maker of commercial interiors on its leak site on June 30, 2026, claiming theft of 30 GB of data. The company has not been named or commented.
-
Amgen Inc.
July 1, 2026
•
[ hack, healthcare, technology ]
In July 2026, Amgen identified unauthorized activity involving data stored in cloud environments hosted by third-party service providers. The company confirmed that proprietary data, patient protected health information, and other information were exfiltrated. Amgen implemented containment measures and engaged independent forensic experts. It reported no impact on its products, manufacturing operations, financial reporting systems, or ability to meet patient needs, and the investigation remained ongoing.
-
Nayax Ltd.
July 1, 2026
During a July 2026 incident, Nayax detected and contained unusual activity in a cloud account associated with one of its subsidiaries; the company did not disclose the exact detection or initial-access date. Nayax confirmed that a backup of scanned documents, business information, and mainly payment transaction records was exfiltrated. It said its production environment and core systems were unaffected, operations continued normally, and customer funds and accounts were not accessed. Nayax refused the criminal extortion demand. The Syndicate's claims of 100 TB of data and more than one billion card records remain unverified and are not reflected in the coded data fields.
-
Fluke Corporation
July 1, 2026
•
[ leak, technology, manufacturing ]
On July 1, 2026, ShinyHunters claimed it had stolen Fluke data from Salesforce and later published more than 100 gigabytes. No operational disruption was reported. This record is separate from Fluke's 2025 third-party business-application breach.
-
Bethany Lutheran Homes, Inc. d/b/a Eagle Crest Communities
July 1, 2026
•
[ ransomware, leak, healthcare ]
SafePay claimed responsibility for compromising Bethany Lutheran Homes, Inc., which operates as Eagle Crest Communities, on 1 July and threatened to publish the full leak unless the organization contacted the group. A verified searchable dataset containing 16,556 name-and-telephone rows confirms that Eagle Crest data was compromised. The access method, encryption, and operational impact were not disclosed, and no service interruption was identified. Anubis separately claimed an Eagle Crest patient-and-employee data breach later in July, but available evidence does not establish whether that represented the same compromise or a separate event.
-
Ingram Content Group, Inc.
July 1, 2026
•
[ ransomware, technology ]
ShinyHunters claimed responsibility for compromising Ingram Content Group on 1 July after attempted ransom negotiations reportedly failed. A verified searchable dataset containing 80,190 rows confirms that Ingram data was compromised. The access method, encryption, and operational impact were not disclosed, and no system outage or other operational disruption was identified.
-
Accenture plc
July 1, 2026
•
[ leak, technology ]
PwnForums actor 888 advertised an Accenture dataset on July 6 and claimed an early-July theft of more than 35 GB from a private Azure DevOps repository. Accenture acknowledged an isolated security matter and said it remediated the source with no impact to operations or service delivery, but did not confirm the claimed contents or volume.
-
Indra Group (undisclosed subsidiary)
July 1, 2026
•
[ ransomware, technology ]
Indra detected ransomware within a non-critical environment belonging to an undisclosed subsidiary and activated its incident-response protocols. The company described the impact as minimal, reported no interruption to critical operations or services, and ruled out propagation to the rest of the group. The Gentlemen claimed the attack and initiated a leak countdown, but Indra did not confirm attribution or data exfiltration.
-
At least one undisclosed small business
July 1, 2026
An unidentified criminal campaign impersonated Interpol investigators in emails sent to small businesses. A Proton Drive link delivered a password-protected archive containing a custom ransomware executable disguised as video evidence. When executed, the malware encrypted files on available drives and directed victims to negotiate through Tox. Bitdefender observed targets across Europe, Asia, the Middle East, and the United States in several industries but did not disclose the number or identities of successfully infected organizations.
-
At least one undisclosed Taiwan government agency
July 1, 2026
•
[ espionage, government, energy ]
From July 1 to July 4, 2026, attackers used an AI-agent framework to map 21 connected Taiwanese government systems, compromise 85 employee accounts, and extract at least 2,564 personnel-related records across the campaign. The operation also obtained SSO client secrets, database credentials, and internal network information and later scanned government IT vendors, a nuclear safety agency, a government email system, and energy companies. Simplified Chinese operator material and the targeting pattern support state-sponsored intelligence collection, but no named group or actor country has been publicly verified.
-
Undisclosed United Kingdom gas-fired peaker plant
July 1, 2026
•
[ espionage, hack, energy ]
A cyberattack forced an undisclosed approximately 15 MW gas-fired peaker plant in the United Kingdom offline for four days in July 2026. The incident did not affect the wider electricity grid. Multiple reports linked the attack to an Iran-linked state actor, but the UK government and NCSC have not publicly named a specific group. Public reporting does not disclose the precise technical mechanism used to take the generator offline.
-
Undisclosed Minnesota MyChart user
July 1, 2026
•
[ phishing, healthcare, financial ]
A Minnesota MyChart user reported to the Federal Trade Commission that a phishing email impersonating MyChart offered a free Medicare Kit in exchange for completing a survey and paying shipping. The victim, who identified Welia Health in Mora as the provider through which they used MyChart, completed the survey, entered credit-card and personal information, and submitted the form. Minutes later, the victim observed a card transaction categorized as an unrelated animal/pet service. Later reporting based on FTC complaints confirmed multiple successful victims of the same broader MyChart impersonation campaign. Epic and Welia Health were not themselves breached.
-
Undisclosed Illinois MyChart user
July 1, 2026
•
[ phishing, healthcare, financial ]
An Illinois MyChart user reported to the Federal Trade Commission that a phishing email impersonating MyChart offered a free Medicare Kit and directed the victim through a survey to a shipping-payment step. The victim submitted Mastercard information before recognizing the message as fraudulent and reported that the scammers had obtained the card information. The complaint is one of several successful victims documented in the broader coordinated MyChart impersonation campaign. MyChart and Epic were not themselves breached.
-
Intermarché Drive (Groupement Les Mousquetaires)
July 1, 2026
•
[ leak, retail, technology ]
During the final week of July 2026 an unauthorized person gained access to part of Intermarch Drive customer systems and acquired information pertaining to 287,605 individuals. Parent company Groupement Les Mousquetaires confirmed the compromise on August 3 and notified affected customers and the French privacy regulator. Approximately two million was the total Drive customer base, not the number exposed. The attacker, precise intrusion day, and data-use intentions remain unverified.
-
Oleoductos del Valle S.A. (Oldelval)
July 1, 2026
•
[ ransomware, energy, leak ]
Argentina pipeline operator Oldelval disclosed on July 31, 2026 that a cyber incident affected certain administrative computer systems. It activated response and containment procedures and later reported that the affected platforms had been fully restored, without interruption to crude-oil transport. Ransomware/extortion group The Gentlemen listed the operator on its leak site on July 23 and claimed data theft; the company did not independently confirm exfiltration, encryption, or the attackers identity. The date of initial unauthorized access and full technical effects were not disclosed.
-
Golden State Orthopedics & Spine
July 1, 2026
•
[ ransomware, healthcare ]
Walnut Creek, California practice Golden State Orthopedics & Spine detected unusual network activity around July 2, 2026, saying patient data incl. SSNs may have been accessed. Brain Cipher claimed the attack on July 1, alleging 150 GB stolen; ~125,000 records were later indexed.
-
Northeast Pediatrics & Adolescent Medicine
July 2, 2026
•
[ ransomware, healthcare, leak ]
On July 2, 2026, Anubis added Northeast Pediatrics & Adolescent Medicine to its extortion site and claimed that employee and patient data had been stolen. The precise intrusion date and initial-access method were not disclosed. After reported communications between the practice and Anubis ended, data was published, and the supplied breach database indexed 29,356 records containing names, dates of birth, phone numbers, and street addresses. No operational disruption or successful encryption was publicly confirmed.
