-
Polymarket via undisclosed third-party provider
June 25, 2026
•
[ hack, financial, technology ]
On 2026-06-25, Polymarket disclosed that an undisclosed third-party provider had been compromised, allowing attackers to inject a malicious script into Polymarket's frontend for some users. The script enabled unauthorized cryptocurrency transactions from connected user wallets. Polymarket removed the affected dependency, contained the incident, contacted affected users, and stated that it would reimburse them in full. Blockchain investigators estimated that approximately $2.94 million was stolen from about 11 wallets, but Polymarket did not confirm the exact loss or number of affected users. No intellectual property, organizational data, customer personal data, or broader platform outage was reported.
-
JSC Ukrposhta
June 25, 2026
•
[ hack, leak, government ]
An overnight hostile attack on Ukrposhta's IT systems caused temporary malfunctions in its mobile application on 25 June. Ukrposhta began restoration work and did not report disruption to postal branches or other operations. The pro-Russian IT Army of Russia claimed responsibility and alleged that it had accessed one server several weeks earlier and stolen a user database and internal data, but neither Ukrposhta nor Recorded Future News verified that exfiltration claim. The technical method was not disclosed.
-
GSP Crop Science Limited
June 25, 2026
•
[ ransomware, hack, manufacturing ]
INC Ransom listed GSP Crop Science as a claimed victim on June 25, 2026. GSP later confirmed that an external cybersecurity incident appearing to involve ransomware affected certain non-core IT systems. The company did not publicly attribute the incident or confirm the actor's data-exfiltration claim. Restoration was underway, while core business functions continued without disruption and no material financial or operational loss was identified.
-
Cardiology Associates of Port Huron, P.C.
June 25, 2026
•
[ ransomware, leak, healthcare ]
Orova stated that it compromised Cardiology Associates of Port Huron on June 25, 2026, stole approximately 144 GB of data comprising 244,215 files, and encrypted some servers. The practice did not publicly confirm the attack. Orova subsequently published stolen data, and later independent review of the released material identified more than 150,000 patient records containing personally identifiable and protected health information, corroborating the data-theft component of the group's claim.
-
Undisclosed officials, military personnel, politicians, and activists in Ukraine, Europe, and the United States
June 26, 2026
Russian intelligence services conducted a long-running social-engineering campaign against officials, military personnel, politicians, and activists in Ukraine, Europe, and the United States. The actors impersonated messaging-platform support accounts to obtain verification codes, PINs, and recovery information, allowing them to take over accounts, access communications, impersonate victims, and send additional malicious messages.
-
Undisclosed Australian critical infrastructure operator
June 26, 2026
•
[ espionage, hack, government ]
Australia's Security Intelligence Organisation disclosed that state-sponsored actors had compromised the network of an undisclosed Australian critical infrastructure operator and obtained login details and passwords belonging to active users, including information-technology personnel. ASIO assessed that the actors were preparing to sabotage the network, but no disruptive effect was reported and the sponsoring state was not publicly identified.
-
Wikoff Color Corporation
June 26, 2026
Between June 26 and July 6, 2026, an unauthorized third party accessed Wikoff Color Corporation's internal systems and acquired files. Wikoff later confirmed the incident through a regulatory notice and offered affected individuals 24 months of credit monitoring. Chaos listed Wikoff on its extortion site on July 20 and claimed to possess 650 GB of internal data, including board financial reports and proprietary research formulas. The supplied breach database subsequently indexed 64,930 leaked records containing contact information. No encryption or operational disruption was publicly confirmed.
-
Meerut Development Authority
June 27, 2026
•
[ hack, government ]
Unidentified hackers defaced the Meerut Development Authority's official website on June 27, 2026, replacing its homepage with a black screen containing anti-India and pro-Pakistan messages and slogans. Authorities took the website offline for maintenance and restoration, and police opened an investigation. Public reporting did not establish how long the defacement or subsequent outage lasted.
-
FCCI Insurance Group
June 27, 2026
•
[ phishing, finance, technology ]
Threat-intelligence reporting attributes the FCCI compromise to Redact and dates its detection to 27 June 2026. The attackers reportedly used voice phishing and adversary-in-the-middle session hijacking to compromise cloud identities, register rogue MFA devices, and exfiltrate data through Microsoft Graph, OneDrive, and SharePoint APIs. Redact is described as an extortion-only operation, and no encryption or operational disruption was reported.
-
District of Columbia Housing Authority
June 28, 2026
DCHA discovered an incident affecting technological systems on June 28, 2026 and shut down its network environment the same day as a precaution. A temporary website launched July 8, customers experienced delays, and normal operations resumed across departments July 20. DCHA confirmed that a limited subset of data including sensitive information was compromised and found no evidence of misuse. Interlock claimed responsibility and 1.6 TB stolen on its leak site, but DCHA did not verify the attribution or volume.
-
Undisclosed current and former U.S. officials, military leaders, allied personnel, journalists, and Ukrainian officials
June 29, 2026
•
[ espionage, phishing, government ]
Russian intelligence-linked actors tracked as UNC5792 and UNC4221 impersonated support accounts for Signal, WhatsApp, and other messaging applications to obtain verification codes, account PINs, and backup-recovery keys. The actors compromised accounts belonging to current and former U.S. officials, military leaders, allied personnel, journalists, and Ukrainian officials, accessed communications, and used compromised accounts to send messages and conduct additional phishing.
-
Washington State Department of Social and Health Services
June 29, 2026
•
[ insider, healthcare, government ]
In March 2026, the Washington State Department of Social and Health Services discovered that an employee had accessed client accounts in an internal database for reasons unrelated to authorized job duties. DSHS terminated the individual's system access, reviewed the employee's complete access history, and found that the affected records contained identity and program-enrollment information but no evidence of access to diagnoses, test results, treatments, claims, or clinical notes.
-
Samaa TV
June 29, 2026
On 2026-06-29, unidentified attackers defaced Samaa TV's Urdu-language news website and replaced its homepage with Hind Cyber Ghost branding, the message "No System Is Secure," and a "Play Music" feature. The attackers identified themselves as "Jordan X Alpha 02" and claimed control of the platform. The website later returned an Amazon CloudFront 502 error, but reporting could not confirm whether the outage resulted directly from the intrusion. Samaa TV had not issued a public statement, and no compromise of internal systems or user data was reported. The claimed Indian affiliation was not independently verified.
-
Salida School District R-32-J
June 29, 2026
•
[ ransomware, education ]
Salida School District R-32-J in Salida, Colorado, was hit by a cyberattack on June 29, 2026 that damaged files on device hard drives, some unrecoverably. All systems were taken offline and central office work was disrupted. It said no data appears to have been accessed.
-
Todd, Hamaker & Johnson, LLP
June 30, 2026
Akira listed the accounting firm and claimed theft of approximately 40 GB. Partner Kim Johnson later said attackers accessed two server drives, stole and encrypted approximately 55,000 files, wiped network systems, and kept the firm offline for several days; tax and audit software were not compromised.
-
PAI Pharma
June 30, 2026
•
[ ransomware, healthcare, manufacturing ]
PAI Pharma, a Greenville, South Carolina maker of generic liquid and unit-dose drugs, was listed on Brain Cipher's leak site on June 30, 2026; the group claimed theft of about 1.4 TB and threatened to publish it. PAI Pharma had issued no public notice as of September 2026.
-
Undisclosed Uruguayan commercial interiors company
June 30, 2026
•
[ ransomware, manufacturing ]
Gunra ransomware listed an undisclosed Uruguayan designer and maker of commercial interiors on its leak site on June 30, 2026, claiming theft of 30 GB of data. The company has not been named or commented.
-
Amgen Inc.
July 1, 2026
•
[ hack, healthcare, technology ]
In July 2026, Amgen identified unauthorized activity involving data stored in cloud environments hosted by third-party service providers. The company confirmed that proprietary data, patient protected health information, and other information were exfiltrated. Amgen implemented containment measures and engaged independent forensic experts. It reported no impact on its products, manufacturing operations, financial reporting systems, or ability to meet patient needs, and the investigation remained ongoing.
-
Nayax Ltd.
July 1, 2026
During a July 2026 incident, Nayax detected and contained unusual activity in a cloud account associated with one of its subsidiaries; the company did not disclose the exact detection or initial-access date. Nayax confirmed that a backup of scanned documents, business information, and mainly payment transaction records was exfiltrated. It said its production environment and core systems were unaffected, operations continued normally, and customer funds and accounts were not accessed. Nayax refused the criminal extortion demand. The Syndicate's claims of 100 TB of data and more than one billion card records remain unverified and are not reflected in the coded data fields.
-
Fluke Corporation
July 1, 2026
•
[ leak, technology, manufacturing ]
On July 1, 2026, ShinyHunters claimed it had stolen Fluke data from Salesforce and later published more than 100 gigabytes. No operational disruption was reported. This record is separate from Fluke's 2025 third-party business-application breach.
