Full List

Search

Recent Breaches

• Undisclosed Australian critical infrastructure operator June 26, 2026 • [ espionage, hack, government ] Australia's Security Intelligence Organisation disclosed that state-sponsored actors had compromised the network of an undisclosed Australian critical infrastructure operator and obtained login details and passwords belonging to active users, including information-technology personnel. ASIO assessed that the actors were preparing to sabotage the network, but no disruptive effect was reported and the sponsoring state was not publicly identified.
• Wikoff Color Corporation June 26, 2026 Between June 26 and July 6, 2026, an unauthorized third party accessed Wikoff Color Corporation's internal systems and acquired files. Wikoff later confirmed the incident through a regulatory notice and offered affected individuals 24 months of credit monitoring. Chaos listed Wikoff on its extortion site on July 20 and claimed to possess 650 GB of internal data, including board financial reports and proprietary research formulas. The supplied breach database subsequently indexed 64,930 leaked records containing contact information. No encryption or operational disruption was publicly confirmed.
• Meerut Development Authority June 27, 2026 • [ hack, government ] Unidentified hackers defaced the Meerut Development Authority's official website on June 27, 2026, replacing its homepage with a black screen containing anti-India and pro-Pakistan messages and slogans. Authorities took the website offline for maintenance and restoration, and police opened an investigation. Public reporting did not establish how long the defacement or subsequent outage lasted.
• FCCI Insurance Group June 27, 2026 • [ phishing, finance, technology ] Threat-intelligence reporting attributes the FCCI compromise to Redact and dates its detection to 27 June 2026. The attackers reportedly used voice phishing and adversary-in-the-middle session hijacking to compromise cloud identities, register rogue MFA devices, and exfiltrate data through Microsoft Graph, OneDrive, and SharePoint APIs. Redact is described as an extortion-only operation, and no encryption or operational disruption was reported.
• District of Columbia Housing Authority June 28, 2026 DCHA discovered an incident affecting technological systems on June 28, 2026 and shut down its network environment the same day as a precaution. A temporary website launched July 8, customers experienced delays, and normal operations resumed across departments July 20. DCHA confirmed that a limited subset of data including sensitive information was compromised and found no evidence of misuse. Interlock claimed responsibility and 1.6 TB stolen on its leak site, but DCHA did not verify the attribution or volume.
• Undisclosed current and former U.S. officials, military leaders, allied personnel, journalists, and Ukrainian officials June 29, 2026 • [ espionage, phishing, government ] Russian intelligence-linked actors tracked as UNC5792 and UNC4221 impersonated support accounts for Signal, WhatsApp, and other messaging applications to obtain verification codes, account PINs, and backup-recovery keys. The actors compromised accounts belonging to current and former U.S. officials, military leaders, allied personnel, journalists, and Ukrainian officials, accessed communications, and used compromised accounts to send messages and conduct additional phishing.
• Washington State Department of Social and Health Services June 29, 2026 • [ insider, healthcare, government ] In March 2026, the Washington State Department of Social and Health Services discovered that an employee had accessed client accounts in an internal database for reasons unrelated to authorized job duties. DSHS terminated the individual's system access, reviewed the employee's complete access history, and found that the affected records contained identity and program-enrollment information but no evidence of access to diagnoses, test results, treatments, claims, or clinical notes.
• Samaa TV June 29, 2026 On 2026-06-29, unidentified attackers defaced Samaa TV's Urdu-language news website and replaced its homepage with Hind Cyber Ghost branding, the message "No System Is Secure," and a "Play Music" feature. The attackers identified themselves as "Jordan X Alpha 02" and claimed control of the platform. The website later returned an Amazon CloudFront 502 error, but reporting could not confirm whether the outage resulted directly from the intrusion. Samaa TV had not issued a public statement, and no compromise of internal systems or user data was reported. The claimed Indian affiliation was not independently verified.
• Salida School District R-32-J June 29, 2026 • [ ransomware, education ] Salida School District R-32-J in Salida, Colorado, was hit by a cyberattack on June 29, 2026 that damaged files on device hard drives, some unrecoverably. All systems were taken offline and central office work was disrupted. It said no data appears to have been accessed.
• Todd, Hamaker & Johnson, LLP June 30, 2026 Akira listed the accounting firm and claimed theft of approximately 40 GB. Partner Kim Johnson later said attackers accessed two server drives, stole and encrypted approximately 55,000 files, wiped network systems, and kept the firm offline for several days; tax and audit software were not compromised.
• PAI Pharma June 30, 2026 • [ ransomware, healthcare, manufacturing ] PAI Pharma, a Greenville, South Carolina maker of generic liquid and unit-dose drugs, was listed on Brain Cipher's leak site on June 30, 2026; the group claimed theft of about 1.4 TB and threatened to publish it. PAI Pharma had issued no public notice as of September 2026.
• Undisclosed Uruguayan commercial interiors company June 30, 2026 • [ ransomware, manufacturing ] Gunra ransomware listed an undisclosed Uruguayan designer and maker of commercial interiors on its leak site on June 30, 2026, claiming theft of 30 GB of data. The company has not been named or commented.
• Amgen Inc. July 1, 2026 • [ hack, healthcare, technology ] In July 2026, Amgen identified unauthorized activity involving data stored in cloud environments hosted by third-party service providers. The company confirmed that proprietary data, patient protected health information, and other information were exfiltrated. Amgen implemented containment measures and engaged independent forensic experts. It reported no impact on its products, manufacturing operations, financial reporting systems, or ability to meet patient needs, and the investigation remained ongoing.
• Nayax Ltd. July 1, 2026 During a July 2026 incident, Nayax detected and contained unusual activity in a cloud account associated with one of its subsidiaries; the company did not disclose the exact detection or initial-access date. Nayax confirmed that a backup of scanned documents, business information, and mainly payment transaction records was exfiltrated. It said its production environment and core systems were unaffected, operations continued normally, and customer funds and accounts were not accessed. Nayax refused the criminal extortion demand. The Syndicate's claims of 100 TB of data and more than one billion card records remain unverified and are not reflected in the coded data fields.
• Fluke Corporation July 1, 2026 • [ leak, technology, manufacturing ] On July 1, 2026, ShinyHunters claimed it had stolen Fluke data from Salesforce and later published more than 100 gigabytes. No operational disruption was reported. This record is separate from Fluke's 2025 third-party business-application breach.
• Bethany Lutheran Homes, Inc. d/b/a Eagle Crest Communities July 1, 2026 • [ ransomware, leak, healthcare ] SafePay claimed responsibility for compromising Bethany Lutheran Homes, Inc., which operates as Eagle Crest Communities, on 1 July and threatened to publish the full leak unless the organization contacted the group. A verified searchable dataset containing 16,556 name-and-telephone rows confirms that Eagle Crest data was compromised. The access method, encryption, and operational impact were not disclosed, and no service interruption was identified. Anubis separately claimed an Eagle Crest patient-and-employee data breach later in July, but available evidence does not establish whether that represented the same compromise or a separate event.
• Ingram Content Group, Inc. July 1, 2026 • [ ransomware, technology ] ShinyHunters claimed responsibility for compromising Ingram Content Group on 1 July after attempted ransom negotiations reportedly failed. A verified searchable dataset containing 80,190 rows confirms that Ingram data was compromised. The access method, encryption, and operational impact were not disclosed, and no system outage or other operational disruption was identified.
• Accenture plc July 1, 2026 • [ leak, technology ] PwnForums actor 888 advertised an Accenture dataset on July 6 and claimed an early-July theft of more than 35 GB from a private Azure DevOps repository. Accenture acknowledged an isolated security matter and said it remediated the source with no impact to operations or service delivery, but did not confirm the claimed contents or volume.
• Indra Group (undisclosed subsidiary) July 1, 2026 • [ ransomware, technology ] Indra detected ransomware within a non-critical environment belonging to an undisclosed subsidiary and activated its incident-response protocols. The company described the impact as minimal, reported no interruption to critical operations or services, and ruled out propagation to the rest of the group. The Gentlemen claimed the attack and initiated a leak countdown, but Indra did not confirm attribution or data exfiltration.
• At least one undisclosed small business July 1, 2026 An unidentified criminal campaign impersonated Interpol investigators in emails sent to small businesses. A Proton Drive link delivered a password-protected archive containing a custom ransomware executable disguised as video evidence. When executed, the malware encrypted files on available drives and directed victims to negotiate through Tox. Bitdefender observed targets across Europe, Asia, the Middle East, and the United States in several industries but did not disclose the number or identities of successfully infected organizations.