-
Bajaj Auto Limited
June 23, 2026
•
[ ransomware, manufacturing, technology ]
Bajaj Auto disclosed that a ransomware attack on June 23, 2026 affected systems belonging to the company and its wholly owned subsidiary, Bajaj Auto Technology Limited. The companies activated precautionary measures and response protocols, which Bajaj Auto said had been successful in managing and mitigating the incident. The attacker, access method, disruption duration, and any data theft were not disclosed.
-
AYA Bank PCL
June 23, 2026
LAPSUS$ claimed on June 23, 2026 that it breached an outdated AYA Bank application portal and obtained approximately 120 GB of data. AYA Bank confirmed limited unauthorized access involving the legacy portal but said it was isolated from the bank's core systems. The bank reported that core banking, AYA Pay, internet and mobile banking, financial information, and transaction services remained secure and operational. The actor's claimed volume and full data contents were not confirmed.
-
Partnered Health Pty Ltd
June 23, 2026
•
[ ransomware, healthcare, leak ]
On June 23, 2026, Partnered Health became aware that a malicious actor had accessed data in parts of its clinic network. The company currently lists 17 clinics where healthcare-record information was affected and five additional clinics where the extent of impact remains under investigation. Partnered Health later confirmed that 11 files tied to the incident had been published online and that additional patients and some employees were affected. INC claimed responsibility and approximately 500 GB of theft, but Partnered Health has not verified that quantity and was still assessing the published material. No operational or clinical-service disruption was reported.
-
Analog Devices, Inc.
June 23, 2026
•
[ hack, leak, technology ]
Analog Devices detected unauthorized access to certain company systems on June 23, 2026 and confirmed that files were exfiltrated. Its SEC filing stated that operations were not interrupted and that the incident was not expected to materially affect the business. No actor or motive was identified. A July 26 ExfilSquad claim involving 570,000 alleged customer records was described by Analog Devices as a separate and unrelated matter and is not incorporated into this record.
-
Flughafen Wien AG
June 24, 2026
•
[ hack, espionage, technology ]
Flughafen Wien AG confirmed that 2025 aircraft cargo load sheets were removed without authorization from one email inbox. Bashe, also known as APT73 or Eraleig, claimed more than 500,000 emails and 4,473 files and threatened to publish or sell the data, but the airport did not verify those figures and reported no direct ransom demand. Airport operations were unaffected, and no passenger-related or business-critical data was reported affected.
-
Quest Health Solutions, LLC
June 24, 2026
•
[ leak, malware, healthcare ]
Anubis listed Quest Health Solutions on June 24, 2026 and claimed theft of employee data and internal files. DataBreach.com's verified searchable dataset confirms a data compromise. Although Anubis malware can encrypt or wipe data, incident-specific reporting does not establish that either capability was deployed against Quest, and no public victim statement, regulator notice, or report confirming an outage or service interruption was located as of August 12, 2026.
-
Direction générale des Finances publiques (DGFiP)
June 24, 2026
ZeroBytes used compromised DGFiP employee credentials to access E-Contact and exfiltrate tax correspondence and taxpayer data. Automated extraction was observed June 24-25, 2026, with renewed activity in July; the intrusions were not detected as data theft at the time. DGFiP later restricted access to sensitive applications and affected accounts following the August disclosure. Investigators subsequently distinguished this E-Contact theft from the July-August cadastral compromise and a separate vacant-estates portal incident.
-
Polymarket via undisclosed third-party provider
June 25, 2026
•
[ hack, financial, technology ]
On 2026-06-25, Polymarket disclosed that an undisclosed third-party provider had been compromised, allowing attackers to inject a malicious script into Polymarket's frontend for some users. The script enabled unauthorized cryptocurrency transactions from connected user wallets. Polymarket removed the affected dependency, contained the incident, contacted affected users, and stated that it would reimburse them in full. Blockchain investigators estimated that approximately $2.94 million was stolen from about 11 wallets, but Polymarket did not confirm the exact loss or number of affected users. No intellectual property, organizational data, customer personal data, or broader platform outage was reported.
-
JSC Ukrposhta
June 25, 2026
•
[ hack, leak, government ]
An overnight hostile attack on Ukrposhta's IT systems caused temporary malfunctions in its mobile application on 25 June. Ukrposhta began restoration work and did not report disruption to postal branches or other operations. The pro-Russian IT Army of Russia claimed responsibility and alleged that it had accessed one server several weeks earlier and stolen a user database and internal data, but neither Ukrposhta nor Recorded Future News verified that exfiltration claim. The technical method was not disclosed.
-
GSP Crop Science Limited
June 25, 2026
•
[ ransomware, hack, manufacturing ]
INC Ransom listed GSP Crop Science as a claimed victim on June 25, 2026. GSP later confirmed that an external cybersecurity incident appearing to involve ransomware affected certain non-core IT systems. The company did not publicly attribute the incident or confirm the actor's data-exfiltration claim. Restoration was underway, while core business functions continued without disruption and no material financial or operational loss was identified.
-
Cardiology Associates of Port Huron, P.C.
June 25, 2026
•
[ ransomware, leak, healthcare ]
Orova stated that it compromised Cardiology Associates of Port Huron on June 25, 2026, stole approximately 144 GB of data comprising 244,215 files, and encrypted some servers. The practice did not publicly confirm the attack. Orova subsequently published stolen data, and later independent review of the released material identified more than 150,000 patient records containing personally identifiable and protected health information, corroborating the data-theft component of the group's claim.
-
Undisclosed officials, military personnel, politicians, and activists in Ukraine, Europe, and the United States
June 26, 2026
Russian intelligence services conducted a long-running social-engineering campaign against officials, military personnel, politicians, and activists in Ukraine, Europe, and the United States. The actors impersonated messaging-platform support accounts to obtain verification codes, PINs, and recovery information, allowing them to take over accounts, access communications, impersonate victims, and send additional malicious messages.
-
Undisclosed Australian critical infrastructure operator
June 26, 2026
•
[ espionage, hack, government ]
Australia's Security Intelligence Organisation disclosed that state-sponsored actors had compromised the network of an undisclosed Australian critical infrastructure operator and obtained login details and passwords belonging to active users, including information-technology personnel. ASIO assessed that the actors were preparing to sabotage the network, but no disruptive effect was reported and the sponsoring state was not publicly identified.
-
Wikoff Color Corporation
June 26, 2026
Between June 26 and July 6, 2026, an unauthorized third party accessed Wikoff Color Corporation's internal systems and acquired files. Wikoff later confirmed the incident through a regulatory notice and offered affected individuals 24 months of credit monitoring. Chaos listed Wikoff on its extortion site on July 20 and claimed to possess 650 GB of internal data, including board financial reports and proprietary research formulas. The supplied breach database subsequently indexed 64,930 leaked records containing contact information. No encryption or operational disruption was publicly confirmed.
-
Meerut Development Authority
June 27, 2026
•
[ hack, government ]
Unidentified hackers defaced the Meerut Development Authority's official website on June 27, 2026, replacing its homepage with a black screen containing anti-India and pro-Pakistan messages and slogans. Authorities took the website offline for maintenance and restoration, and police opened an investigation. Public reporting did not establish how long the defacement or subsequent outage lasted.
-
FCCI Insurance Group
June 27, 2026
•
[ phishing, finance, technology ]
Threat-intelligence reporting attributes the FCCI compromise to Redact and dates its detection to 27 June 2026. The attackers reportedly used voice phishing and adversary-in-the-middle session hijacking to compromise cloud identities, register rogue MFA devices, and exfiltrate data through Microsoft Graph, OneDrive, and SharePoint APIs. Redact is described as an extortion-only operation, and no encryption or operational disruption was reported.
-
District of Columbia Housing Authority
June 28, 2026
DCHA discovered an incident affecting technological systems on June 28, 2026 and shut down its network environment the same day as a precaution. A temporary website launched July 8, customers experienced delays, and normal operations resumed across departments July 20. DCHA confirmed that a limited subset of data including sensitive information was compromised and found no evidence of misuse. Interlock claimed responsibility and 1.6 TB stolen on its leak site, but DCHA did not verify the attribution or volume.
-
Undisclosed current and former U.S. officials, military leaders, allied personnel, journalists, and Ukrainian officials
June 29, 2026
•
[ espionage, phishing, government ]
Russian intelligence-linked actors tracked as UNC5792 and UNC4221 impersonated support accounts for Signal, WhatsApp, and other messaging applications to obtain verification codes, account PINs, and backup-recovery keys. The actors compromised accounts belonging to current and former U.S. officials, military leaders, allied personnel, journalists, and Ukrainian officials, accessed communications, and used compromised accounts to send messages and conduct additional phishing.
-
Washington State Department of Social and Health Services
June 29, 2026
•
[ insider, healthcare, government ]
In March 2026, the Washington State Department of Social and Health Services discovered that an employee had accessed client accounts in an internal database for reasons unrelated to authorized job duties. DSHS terminated the individual's system access, reviewed the employee's complete access history, and found that the affected records contained identity and program-enrollment information but no evidence of access to diagnoses, test results, treatments, claims, or clinical notes.
-
Samaa TV
June 29, 2026
On 2026-06-29, unidentified attackers defaced Samaa TV's Urdu-language news website and replaced its homepage with Hind Cyber Ghost branding, the message "No System Is Secure," and a "Play Music" feature. The attackers identified themselves as "Jordan X Alpha 02" and claimed control of the platform. The website later returned an Amazon CloudFront 502 error, but reporting could not confirm whether the outage resulted directly from the intrusion. Samaa TV had not issued a public statement, and no compromise of internal systems or user data was reported. The claimed Indian affiliation was not independently verified.
