-
May Trucking Company
June 21, 2026
•
[ ransomware, leak ]
May Trucking detected suspicious network activity on June 21, 2026 and determined that an unauthorized party acquired files from its network. The company later confirmed that affected files contained personal information and notified the FBI. Embargo subsequently claimed the company and was reported to have stolen roughly one terabyte of data. DataBreach.com indexed 160,684 records associated with the incident. No independently verified operational disruption has been established.
-
tinyBuild LLC
June 22, 2026
•
[ ddos, technology ]
Beginning with the 2026-06-22 early-access launch of SAND: Raiders of Sophie, unidentified attackers conducted large DDoS attacks against the game's online service. tinyBuild's chief executive reported 12 hours after launch that the team was still responding to the attacks, which hampered gameplay and service stability and contributed to negative user reviews. The exact attack volume, number of affected players, end time, perpetrator, and motive were not reported.
-
Undisclosed organization investigated by Volexity
June 22, 2026
•
[ hack, technology, ransomware ]
UTA0533 compromised two SonicWall SMA1000 appliances at one undisclosed organization. Volexity found compromise artifacts dating to June 22, 2026 and LDAP-capture files dated July 2. The actor intercepted unencrypted authentication traffic to obtain credentials. The event date records the earliest observed compromise, not a proven date for the first credential theft. Ransomware effects reported at other victims are not established for this organization.
-
Inission Power Oy (including Inission Power Finland Oy)
June 22, 2026
•
[ ransomware, technology, manufacturing ]
Inission Power Oy and subsidiary Inission Power Finland Oy disclosed a single ransomware-related compromise of their shared server environment, detected June 22, 2026. The environment was isolated and restored the same day, with normal business operations continuing. Portions of affected databases were later found online. The company did not identify distinct intrusions or separately attributable data theft at each legal entity; successful encryption and attacker-caused operational disruption were not established. The intrusion start and data-acquisition dates remain unknown.
-
Bajaj Auto Limited
June 23, 2026
•
[ ransomware, manufacturing, technology ]
Bajaj Auto disclosed that a ransomware attack on June 23, 2026 affected systems belonging to the company and its wholly owned subsidiary, Bajaj Auto Technology Limited. The companies activated precautionary measures and response protocols, which Bajaj Auto said had been successful in managing and mitigating the incident. The attacker, access method, disruption duration, and any data theft were not disclosed.
-
AYA Bank PCL
June 23, 2026
LAPSUS$ claimed on June 23, 2026 that it breached an outdated AYA Bank application portal and obtained approximately 120 GB of data. AYA Bank confirmed limited unauthorized access involving the legacy portal but said it was isolated from the bank's core systems. The bank reported that core banking, AYA Pay, internet and mobile banking, financial information, and transaction services remained secure and operational. The actor's claimed volume and full data contents were not confirmed.
-
Partnered Health Pty Ltd
June 23, 2026
•
[ ransomware, healthcare, leak ]
On June 23, 2026, Partnered Health became aware that a malicious actor had accessed data in parts of its clinic network. The company currently lists 17 clinics where healthcare-record information was affected and five additional clinics where the extent of impact remains under investigation. Partnered Health later confirmed that 11 files tied to the incident had been published online and that additional patients and some employees were affected. INC claimed responsibility and approximately 500 GB of theft, but Partnered Health has not verified that quantity and was still assessing the published material. No operational or clinical-service disruption was reported.
-
Analog Devices, Inc.
June 23, 2026
•
[ hack, leak, technology ]
Analog Devices detected unauthorized access to certain company systems on June 23, 2026 and confirmed that files were exfiltrated. Its SEC filing stated that operations were not interrupted and that the incident was not expected to materially affect the business. No actor or motive was identified. A July 26 ExfilSquad claim involving 570,000 alleged customer records was described by Analog Devices as a separate and unrelated matter and is not incorporated into this record.
-
Flughafen Wien AG
June 24, 2026
•
[ hack, espionage, technology ]
Flughafen Wien AG confirmed that 2025 aircraft cargo load sheets were removed without authorization from one email inbox. Bashe, also known as APT73 or Eraleig, claimed more than 500,000 emails and 4,473 files and threatened to publish or sell the data, but the airport did not verify those figures and reported no direct ransom demand. Airport operations were unaffected, and no passenger-related or business-critical data was reported affected.
-
Quest Health Solutions, LLC
June 24, 2026
•
[ leak, malware, healthcare ]
Anubis listed Quest Health Solutions on June 24, 2026 and claimed theft of employee data and internal files. DataBreach.com's verified searchable dataset confirms a data compromise. Although Anubis malware can encrypt or wipe data, incident-specific reporting does not establish that either capability was deployed against Quest, and no public victim statement, regulator notice, or report confirming an outage or service interruption was located as of August 12, 2026.
-
Direction générale des Finances publiques (DGFiP)
June 24, 2026
ZeroBytes used compromised DGFiP employee credentials to access E-Contact and exfiltrate tax correspondence and taxpayer data. Automated extraction was observed June 24-25, 2026, with renewed activity in July; the intrusions were not detected as data theft at the time. DGFiP later restricted access to sensitive applications and affected accounts following the August disclosure. Investigators subsequently distinguished this E-Contact theft from the July-August cadastral compromise and a separate vacant-estates portal incident.
-
Polymarket via undisclosed third-party provider
June 25, 2026
•
[ hack, financial, technology ]
On 2026-06-25, Polymarket disclosed that an undisclosed third-party provider had been compromised, allowing attackers to inject a malicious script into Polymarket's frontend for some users. The script enabled unauthorized cryptocurrency transactions from connected user wallets. Polymarket removed the affected dependency, contained the incident, contacted affected users, and stated that it would reimburse them in full. Blockchain investigators estimated that approximately $2.94 million was stolen from about 11 wallets, but Polymarket did not confirm the exact loss or number of affected users. No intellectual property, organizational data, customer personal data, or broader platform outage was reported.
-
JSC Ukrposhta
June 25, 2026
•
[ hack, leak, government ]
An overnight hostile attack on Ukrposhta's IT systems caused temporary malfunctions in its mobile application on 25 June. Ukrposhta began restoration work and did not report disruption to postal branches or other operations. The pro-Russian IT Army of Russia claimed responsibility and alleged that it had accessed one server several weeks earlier and stolen a user database and internal data, but neither Ukrposhta nor Recorded Future News verified that exfiltration claim. The technical method was not disclosed.
-
GSP Crop Science Limited
June 25, 2026
•
[ ransomware, hack, manufacturing ]
INC Ransom listed GSP Crop Science as a claimed victim on June 25, 2026. GSP later confirmed that an external cybersecurity incident appearing to involve ransomware affected certain non-core IT systems. The company did not publicly attribute the incident or confirm the actor's data-exfiltration claim. Restoration was underway, while core business functions continued without disruption and no material financial or operational loss was identified.
-
Cardiology Associates of Port Huron, P.C.
June 25, 2026
•
[ ransomware, leak, healthcare ]
Orova stated that it compromised Cardiology Associates of Port Huron on June 25, 2026, stole approximately 144 GB of data comprising 244,215 files, and encrypted some servers. The practice did not publicly confirm the attack. Orova subsequently published stolen data, and later independent review of the released material identified more than 150,000 patient records containing personally identifiable and protected health information, corroborating the data-theft component of the group's claim.
-
Undisclosed officials, military personnel, politicians, and activists in Ukraine, Europe, and the United States
June 26, 2026
Russian intelligence services conducted a long-running social-engineering campaign against officials, military personnel, politicians, and activists in Ukraine, Europe, and the United States. The actors impersonated messaging-platform support accounts to obtain verification codes, PINs, and recovery information, allowing them to take over accounts, access communications, impersonate victims, and send additional malicious messages.
-
Undisclosed Australian critical infrastructure operator
June 26, 2026
•
[ espionage, hack, government ]
Australia's Security Intelligence Organisation disclosed that state-sponsored actors had compromised the network of an undisclosed Australian critical infrastructure operator and obtained login details and passwords belonging to active users, including information-technology personnel. ASIO assessed that the actors were preparing to sabotage the network, but no disruptive effect was reported and the sponsoring state was not publicly identified.
-
Wikoff Color Corporation
June 26, 2026
Between June 26 and July 6, 2026, an unauthorized third party accessed Wikoff Color Corporation's internal systems and acquired files. Wikoff later confirmed the incident through a regulatory notice and offered affected individuals 24 months of credit monitoring. Chaos listed Wikoff on its extortion site on July 20 and claimed to possess 650 GB of internal data, including board financial reports and proprietary research formulas. The supplied breach database subsequently indexed 64,930 leaked records containing contact information. No encryption or operational disruption was publicly confirmed.
-
Meerut Development Authority
June 27, 2026
•
[ hack, government ]
Unidentified hackers defaced the Meerut Development Authority's official website on June 27, 2026, replacing its homepage with a black screen containing anti-India and pro-Pakistan messages and slogans. Authorities took the website offline for maintenance and restoration, and police opened an investigation. Public reporting did not establish how long the defacement or subsequent outage lasted.
-
FCCI Insurance Group
June 27, 2026
•
[ phishing, finance, technology ]
Threat-intelligence reporting attributes the FCCI compromise to Redact and dates its detection to 27 June 2026. The attackers reportedly used voice phishing and adversary-in-the-middle session hijacking to compromise cloud identities, register rogue MFA devices, and exfiltrate data through Microsoft Graph, OneDrive, and SharePoint APIs. Redact is described as an extortion-only operation, and no encryption or operational disruption was reported.
