-
District of Columbia Housing Authority
June 28, 2026
DCHA discovered an incident affecting technological systems on June 28, 2026 and shut down its network environment the same day as a precaution. A temporary website launched July 8, customers experienced delays, and normal operations resumed across departments July 20. DCHA confirmed that a limited subset of data including sensitive information was compromised and found no evidence of misuse. Interlock claimed responsibility and 1.6 TB stolen on its leak site, but DCHA did not verify the attribution or volume.
-
Undisclosed current and former U.S. officials, military leaders, allied personnel, journalists, and Ukrainian officials
June 29, 2026
•
[ espionage, phishing, government ]
Russian intelligence-linked actors tracked as UNC5792 and UNC4221 impersonated support accounts for Signal, WhatsApp, and other messaging applications to obtain verification codes, account PINs, and backup-recovery keys. The actors compromised accounts belonging to current and former U.S. officials, military leaders, allied personnel, journalists, and Ukrainian officials, accessed communications, and used compromised accounts to send messages and conduct additional phishing.
-
Washington State Department of Social and Health Services
June 29, 2026
•
[ insider, healthcare, government ]
In March 2026, the Washington State Department of Social and Health Services discovered that an employee had accessed client accounts in an internal database for reasons unrelated to authorized job duties. DSHS terminated the individual's system access, reviewed the employee's complete access history, and found that the affected records contained identity and program-enrollment information but no evidence of access to diagnoses, test results, treatments, claims, or clinical notes.
-
Samaa TV
June 29, 2026
On 2026-06-29, unidentified attackers defaced Samaa TV's Urdu-language news website and replaced its homepage with Hind Cyber Ghost branding, the message "No System Is Secure," and a "Play Music" feature. The attackers identified themselves as "Jordan X Alpha 02" and claimed control of the platform. The website later returned an Amazon CloudFront 502 error, but reporting could not confirm whether the outage resulted directly from the intrusion. Samaa TV had not issued a public statement, and no compromise of internal systems or user data was reported. The claimed Indian affiliation was not independently verified.
-
Salida School District R-32-J
June 29, 2026
•
[ ransomware, education ]
Salida School District R-32-J in Salida, Colorado, was hit by a cyberattack on June 29, 2026 that damaged files on device hard drives, some unrecoverably. All systems were taken offline and central office work was disrupted. It said no data appears to have been accessed.
-
Todd, Hamaker & Johnson, LLP
June 30, 2026
Akira listed the accounting firm and claimed theft of approximately 40 GB. Partner Kim Johnson later said attackers accessed two server drives, stole and encrypted approximately 55,000 files, wiped network systems, and kept the firm offline for several days; tax and audit software were not compromised.
-
PAI Pharma
June 30, 2026
•
[ ransomware, healthcare, manufacturing ]
PAI Pharma, a Greenville, South Carolina maker of generic liquid and unit-dose drugs, was listed on Brain Cipher's leak site on June 30, 2026; the group claimed theft of about 1.4 TB and threatened to publish it. PAI Pharma had issued no public notice as of September 2026.
-
Undisclosed Uruguayan commercial interiors company
June 30, 2026
•
[ ransomware, manufacturing ]
Gunra ransomware listed an undisclosed Uruguayan designer and maker of commercial interiors on its leak site on June 30, 2026, claiming theft of 30 GB of data. The company has not been named or commented.
-
Amgen Inc.
July 1, 2026
•
[ hack, healthcare, technology ]
In July 2026, Amgen identified unauthorized activity involving data stored in cloud environments hosted by third-party service providers. The company confirmed that proprietary data, patient protected health information, and other information were exfiltrated. Amgen implemented containment measures and engaged independent forensic experts. It reported no impact on its products, manufacturing operations, financial reporting systems, or ability to meet patient needs, and the investigation remained ongoing.
-
Nayax Ltd.
July 1, 2026
During a July 2026 incident, Nayax detected and contained unusual activity in a cloud account associated with one of its subsidiaries; the company did not disclose the exact detection or initial-access date. Nayax confirmed that a backup of scanned documents, business information, and mainly payment transaction records was exfiltrated. It said its production environment and core systems were unaffected, operations continued normally, and customer funds and accounts were not accessed. Nayax refused the criminal extortion demand. The Syndicate's claims of 100 TB of data and more than one billion card records remain unverified and are not reflected in the coded data fields.
-
Fluke Corporation
July 1, 2026
•
[ leak, technology, manufacturing ]
On July 1, 2026, ShinyHunters claimed it had stolen Fluke data from Salesforce and later published more than 100 gigabytes. No operational disruption was reported. This record is separate from Fluke's 2025 third-party business-application breach.
-
Bethany Lutheran Homes, Inc. d/b/a Eagle Crest Communities
July 1, 2026
•
[ ransomware, leak, healthcare ]
SafePay claimed responsibility for compromising Bethany Lutheran Homes, Inc., which operates as Eagle Crest Communities, on 1 July and threatened to publish the full leak unless the organization contacted the group. A verified searchable dataset containing 16,556 name-and-telephone rows confirms that Eagle Crest data was compromised. The access method, encryption, and operational impact were not disclosed, and no service interruption was identified. Anubis separately claimed an Eagle Crest patient-and-employee data breach later in July, but available evidence does not establish whether that represented the same compromise or a separate event.
-
Ingram Content Group, Inc.
July 1, 2026
•
[ ransomware, technology ]
ShinyHunters claimed responsibility for compromising Ingram Content Group on 1 July after attempted ransom negotiations reportedly failed. A verified searchable dataset containing 80,190 rows confirms that Ingram data was compromised. The access method, encryption, and operational impact were not disclosed, and no system outage or other operational disruption was identified.
-
Accenture plc
July 1, 2026
•
[ leak, technology ]
PwnForums actor 888 advertised an Accenture dataset on July 6 and claimed an early-July theft of more than 35 GB from a private Azure DevOps repository. Accenture acknowledged an isolated security matter and said it remediated the source with no impact to operations or service delivery, but did not confirm the claimed contents or volume.
-
Indra Group (undisclosed subsidiary)
July 1, 2026
•
[ ransomware, technology ]
Indra detected ransomware within a non-critical environment belonging to an undisclosed subsidiary and activated its incident-response protocols. The company described the impact as minimal, reported no interruption to critical operations or services, and ruled out propagation to the rest of the group. The Gentlemen claimed the attack and initiated a leak countdown, but Indra did not confirm attribution or data exfiltration.
-
At least one undisclosed small business
July 1, 2026
An unidentified criminal campaign impersonated Interpol investigators in emails sent to small businesses. A Proton Drive link delivered a password-protected archive containing a custom ransomware executable disguised as video evidence. When executed, the malware encrypted files on available drives and directed victims to negotiate through Tox. Bitdefender observed targets across Europe, Asia, the Middle East, and the United States in several industries but did not disclose the number or identities of successfully infected organizations.
-
At least one undisclosed Taiwan government agency
July 1, 2026
•
[ espionage, government, energy ]
From July 1 to July 4, 2026, attackers used an AI-agent framework to map 21 connected Taiwanese government systems, compromise 85 employee accounts, and extract at least 2,564 personnel-related records across the campaign. The operation also obtained SSO client secrets, database credentials, and internal network information and later scanned government IT vendors, a nuclear safety agency, a government email system, and energy companies. Simplified Chinese operator material and the targeting pattern support state-sponsored intelligence collection, but no named group or actor country has been publicly verified.
-
Undisclosed United Kingdom gas-fired peaker plant
July 1, 2026
•
[ espionage, hack, energy ]
A cyberattack forced an undisclosed approximately 15 MW gas-fired peaker plant in the United Kingdom offline for four days in July 2026. The incident did not affect the wider electricity grid. Multiple reports linked the attack to an Iran-linked state actor, but the UK government and NCSC have not publicly named a specific group. Public reporting does not disclose the precise technical mechanism used to take the generator offline.
-
Undisclosed Minnesota MyChart user
July 1, 2026
•
[ phishing, healthcare, financial ]
A Minnesota MyChart user reported to the Federal Trade Commission that a phishing email impersonating MyChart offered a free Medicare Kit in exchange for completing a survey and paying shipping. The victim, who identified Welia Health in Mora as the provider through which they used MyChart, completed the survey, entered credit-card and personal information, and submitted the form. Minutes later, the victim observed a card transaction categorized as an unrelated animal/pet service. Later reporting based on FTC complaints confirmed multiple successful victims of the same broader MyChart impersonation campaign. Epic and Welia Health were not themselves breached.
-
Undisclosed Illinois MyChart user
July 1, 2026
•
[ phishing, healthcare, financial ]
An Illinois MyChart user reported to the Federal Trade Commission that a phishing email impersonating MyChart offered a free Medicare Kit and directed the victim through a survey to a shipping-payment step. The victim submitted Mastercard information before recognizing the message as fraudulent and reported that the scammers had obtained the card information. The complaint is one of several successful victims documented in the broader coordinated MyChart impersonation campaign. MyChart and Epic were not themselves breached.
