Recent Breaches
-
June 19, 2026 • Beginning around 23:40 on 2026-06-19, an unauthorized actor used Brazil's Civil Defense Alert platform to send multiple false extreme emergency alerts, including messages containing the term misantropi4, to phones in at least seven states. Authorities blocked access after the first alert, but the actor regained access and sent additional messages. The platform was taken offline at 01:30 on 2026-06-20, and the Federal Police opened an investigation. The handle mizanthropiaz was associated with a public claim of responsibility, but the government did not confirm the attribution or identify the access method.
-
June 19, 2026 • Shadowbyt3$ announced on 2026-06-12 that it had obtained Nintendo of America employee data from the cloud environment of TINYpulse, a third-party employee survey platform, and demanded $2 million. Nintendo confirmed that the third-party service was breached but said its own systems and customer data were not compromised. Nintendo described the confirmed exposure as older internal survey content involving a small subset of employees. The actor claimed an 859 MB dataset containing names, corporate email addresses, W-9 forms, bank statements, internal messages, and HR analytics, but Nintendo did not confirm the full claimed contents or volume.
-
June 19, 2026 • A malicious cyberattack disrupted University City's network connections and prevented access to municipal systems and online services. Staff used telephone, in-person, and other manual processes while systems were rebuilt and restored. The city reported full restoration on August 6, 2026 and said its investigation found no evidence that personal information was accessed, removed, or compromised. The attack method, actor, and motive were not disclosed.
-
June 19, 2026 • Allstate learned on July 26, 2026 that information may have been taken without authorization and determined that data had been acquired on June 19. ExfilSquad claimed Allstate on July 26 and described recruitment, licensing, onboarding, personal, and employee-account information. DataBreach.com indexed 939,910 rows. Allstate regulatory filings report 2,604 affected individuals and confirm names, addresses, dates of birth, Social Security numbers, and appointment-related information.
-
June 21, 2026 • May Trucking detected suspicious network activity on June 21, 2026 and determined that an unauthorized party acquired files from its network. The company later confirmed that affected files contained personal information and notified the FBI. Embargo subsequently claimed the company and was reported to have stolen roughly one terabyte of data. DataBreach.com indexed 160,684 records associated with the incident. No independently verified operational disruption has been established.
-
June 22, 2026 • Beginning with the 2026-06-22 early-access launch of SAND: Raiders of Sophie, unidentified attackers conducted large DDoS attacks against the game's online service. tinyBuild's chief executive reported 12 hours after launch that the team was still responding to the attacks, which hampered gameplay and service stability and contributed to negative user reviews. The exact attack volume, number of affected players, end time, perpetrator, and motive were not reported.
-
June 22, 2026 • UTA0533 compromised two SonicWall SMA1000 appliances at one undisclosed organization. Volexity found compromise artifacts dating to June 22, 2026 and LDAP-capture files dated July 2. The actor intercepted unencrypted authentication traffic to obtain credentials. The event date records the earliest observed compromise, not a proven date for the first credential theft. Ransomware effects reported at other victims are not established for this organization.
-
June 22, 2026 • Inission Power Oy and subsidiary Inission Power Finland Oy disclosed a single ransomware-related compromise of their shared server environment, detected June 22, 2026. The environment was isolated and restored the same day, with normal business operations continuing. Portions of affected databases were later found online. The company did not identify distinct intrusions or separately attributable data theft at each legal entity; successful encryption and attacker-caused operational disruption were not established. The intrusion start and data-acquisition dates remain unknown.
-
June 23, 2026 • Bajaj Auto disclosed that a ransomware attack on June 23, 2026 affected systems belonging to the company and its wholly owned subsidiary, Bajaj Auto Technology Limited. The companies activated precautionary measures and response protocols, which Bajaj Auto said had been successful in managing and mitigating the incident. The attacker, access method, disruption duration, and any data theft were not disclosed.
-
June 23, 2026 LAPSUS$ claimed on June 23, 2026 that it breached an outdated AYA Bank application portal and obtained approximately 120 GB of data. AYA Bank confirmed limited unauthorized access involving the legacy portal but said it was isolated from the bank's core systems. The bank reported that core banking, AYA Pay, internet and mobile banking, financial information, and transaction services remained secure and operational. The actor's claimed volume and full data contents were not confirmed.
-
June 23, 2026 • On June 23, 2026, Partnered Health became aware that a malicious actor had accessed data in parts of its clinic network. The company currently lists 17 clinics where healthcare-record information was affected and five additional clinics where the extent of impact remains under investigation. Partnered Health later confirmed that 11 files tied to the incident had been published online and that additional patients and some employees were affected. INC claimed responsibility and approximately 500 GB of theft, but Partnered Health has not verified that quantity and was still assessing the published material. No operational or clinical-service disruption was reported.
-
June 23, 2026 • Analog Devices detected unauthorized access to certain company systems on June 23, 2026 and confirmed that files were exfiltrated. Its SEC filing stated that operations were not interrupted and that the incident was not expected to materially affect the business. No actor or motive was identified. A July 26 ExfilSquad claim involving 570,000 alleged customer records was described by Analog Devices as a separate and unrelated matter and is not incorporated into this record.
-
June 24, 2026 • Flughafen Wien AG confirmed that 2025 aircraft cargo load sheets were removed without authorization from one email inbox. Bashe, also known as APT73 or Eraleig, claimed more than 500,000 emails and 4,473 files and threatened to publish or sell the data, but the airport did not verify those figures and reported no direct ransom demand. Airport operations were unaffected, and no passenger-related or business-critical data was reported affected.
-
June 24, 2026 • Anubis listed Quest Health Solutions on June 24, 2026 and claimed theft of employee data and internal files. DataBreach.com's verified searchable dataset confirms a data compromise. Although Anubis malware can encrypt or wipe data, incident-specific reporting does not establish that either capability was deployed against Quest, and no public victim statement, regulator notice, or report confirming an outage or service interruption was located as of August 12, 2026.
-
June 24, 2026 ZeroBytes used compromised DGFiP employee credentials to access E-Contact and exfiltrate tax correspondence and taxpayer data. Automated extraction was observed June 24-25, 2026, with renewed activity in July; the intrusions were not detected as data theft at the time. DGFiP later restricted access to sensitive applications and affected accounts following the August disclosure. Investigators subsequently distinguished this E-Contact theft from the July-August cadastral compromise and a separate vacant-estates portal incident.
-
June 25, 2026 • On 2026-06-25, Polymarket disclosed that an undisclosed third-party provider had been compromised, allowing attackers to inject a malicious script into Polymarket's frontend for some users. The script enabled unauthorized cryptocurrency transactions from connected user wallets. Polymarket removed the affected dependency, contained the incident, contacted affected users, and stated that it would reimburse them in full. Blockchain investigators estimated that approximately $2.94 million was stolen from about 11 wallets, but Polymarket did not confirm the exact loss or number of affected users. No intellectual property, organizational data, customer personal data, or broader platform outage was reported.
-
June 25, 2026 • An overnight hostile attack on Ukrposhta's IT systems caused temporary malfunctions in its mobile application on 25 June. Ukrposhta began restoration work and did not report disruption to postal branches or other operations. The pro-Russian IT Army of Russia claimed responsibility and alleged that it had accessed one server several weeks earlier and stolen a user database and internal data, but neither Ukrposhta nor Recorded Future News verified that exfiltration claim. The technical method was not disclosed.
-
June 25, 2026 • INC Ransom listed GSP Crop Science as a claimed victim on June 25, 2026. GSP later confirmed that an external cybersecurity incident appearing to involve ransomware affected certain non-core IT systems. The company did not publicly attribute the incident or confirm the actor's data-exfiltration claim. Restoration was underway, while core business functions continued without disruption and no material financial or operational loss was identified.
-
June 25, 2026 • Orova stated that it compromised Cardiology Associates of Port Huron on June 25, 2026, stole approximately 144 GB of data comprising 244,215 files, and encrypted some servers. The practice did not publicly confirm the attack. Orova subsequently published stolen data, and later independent review of the released material identified more than 150,000 patient records containing personally identifiable and protected health information, corroborating the data-theft component of the group's claim.
-
June 26, 2026 Russian intelligence services conducted a long-running social-engineering campaign against officials, military personnel, politicians, and activists in Ukraine, Europe, and the United States. The actors impersonated messaging-platform support accounts to obtain verification codes, PINs, and recovery information, allowing them to take over accounts, access communications, impersonate victims, and send additional malicious messages.