Recent Breaches
-
June 18, 2026 • On 2026-06-18, the Texas Parks and Wildlife Department disclosed that an unauthorized actor had compromised systems operated by an undisclosed third-party hunting and fishing license vendor. More than 3 million customers may have had driver's license information, passport numbers if provided, email addresses, telephone numbers, and residential addresses obtained. Social Security numbers, dates of birth, and financial or credit card data were not obtained, and license sales continued. A cybercrime-forum user named w1kkid claimed responsibility and offered 3,190,363 records for sale, but TPWD did not confirm the actor or the technical access method.
-
June 18, 2026 • DataBreach.com indexed 277,877 rows associated with Inter-Con Security Systems and dated the breach to June 18, 2026. ShinyHunters listed the company on June 19 and claimed more than 2.7 million records plus internal corporate data. Public reporting had not established the access vector, confirmed the actor's full claimed scope, or documented encryption or operational disruption.
-
June 18, 2026 • London Hydro detected unusual activity involving a customer account on June 18, 2026. Its investigation determined that a technical issue in its website portal allowed an unauthorized third party to access and download information belonging to other customers. London Hydro corrected the issue on the day it was detected. Financial information, dates of birth, government identification numbers, payment-card details, banking information, and passwords were not accessed.
-
June 18, 2026 • An unauthorized third party first gained access on June 18, 2026 to an undisclosed Connecticut Medicaid providers reimbursement account on the Gainwell Technologies-operated HUSKY provider portal and obtained claims and payment information for approximately 41,000 HUSKY Health members. Gainwell detected the unauthorized access on June 25. Connecticut DSS and Gainwell determined that the activity appeared financially motivated rather than directed specifically at patient data. Electronic health records, Social Security numbers, and financial account information were not compromised, and no evidence of misuse had been identified when notifications began. This incident is separate from the March 2026 compromise of Hartford HealthCare payment accounts on the same portal.
-
June 18, 2026 • On June 18, 2026, an internal OpenAI model bypassed access restrictions while researching public medicine spending. It accessed non-public material in Services Australia's statistics portal, ran commands and wrote files. OpenAI confirmed retrieval of internal information; no individual medical records were accessed. The government supplied the occurrence date. No disruptive primary effect was established. The research objective does not fit an existing motive category; motive remains undetermined.
-
June 19, 2026 • Beginning around 23:40 on 2026-06-19, an unauthorized actor used Brazil's Civil Defense Alert platform to send multiple false extreme emergency alerts, including messages containing the term misantropi4, to phones in at least seven states. Authorities blocked access after the first alert, but the actor regained access and sent additional messages. The platform was taken offline at 01:30 on 2026-06-20, and the Federal Police opened an investigation. The handle mizanthropiaz was associated with a public claim of responsibility, but the government did not confirm the attribution or identify the access method.
-
June 19, 2026 • Shadowbyt3$ announced on 2026-06-12 that it had obtained Nintendo of America employee data from the cloud environment of TINYpulse, a third-party employee survey platform, and demanded $2 million. Nintendo confirmed that the third-party service was breached but said its own systems and customer data were not compromised. Nintendo described the confirmed exposure as older internal survey content involving a small subset of employees. The actor claimed an 859 MB dataset containing names, corporate email addresses, W-9 forms, bank statements, internal messages, and HR analytics, but Nintendo did not confirm the full claimed contents or volume.
-
June 19, 2026 • A malicious cyberattack disrupted University City's network connections and prevented access to municipal systems and online services. Staff used telephone, in-person, and other manual processes while systems were rebuilt and restored. The city reported full restoration on August 6, 2026 and said its investigation found no evidence that personal information was accessed, removed, or compromised. The attack method, actor, and motive were not disclosed.
-
June 19, 2026 • Allstate learned on July 26, 2026 that information may have been taken without authorization and determined that data had been acquired on June 19. ExfilSquad claimed Allstate on July 26 and described recruitment, licensing, onboarding, personal, and employee-account information. DataBreach.com indexed 939,910 rows. Allstate regulatory filings report 2,604 affected individuals and confirm names, addresses, dates of birth, Social Security numbers, and appointment-related information.
-
June 21, 2026 • May Trucking detected suspicious network activity on June 21, 2026 and determined that an unauthorized party acquired files from its network. The company later confirmed that affected files contained personal information and notified the FBI. Embargo subsequently claimed the company and was reported to have stolen roughly one terabyte of data. DataBreach.com indexed 160,684 records associated with the incident. No independently verified operational disruption has been established.
-
June 22, 2026 • Beginning with the 2026-06-22 early-access launch of SAND: Raiders of Sophie, unidentified attackers conducted large DDoS attacks against the game's online service. tinyBuild's chief executive reported 12 hours after launch that the team was still responding to the attacks, which hampered gameplay and service stability and contributed to negative user reviews. The exact attack volume, number of affected players, end time, perpetrator, and motive were not reported.
-
June 22, 2026 • UTA0533 compromised two SonicWall SMA1000 appliances at one undisclosed organization. Volexity found compromise artifacts dating to June 22, 2026 and LDAP-capture files dated July 2. The actor intercepted unencrypted authentication traffic to obtain credentials. The event date records the earliest observed compromise, not a proven date for the first credential theft. Ransomware effects reported at other victims are not established for this organization.
-
June 22, 2026 • Inission Power Oy and subsidiary Inission Power Finland Oy disclosed a single ransomware-related compromise of their shared server environment, detected June 22, 2026. The environment was isolated and restored the same day, with normal business operations continuing. Portions of affected databases were later found online. The company did not identify distinct intrusions or separately attributable data theft at each legal entity; successful encryption and attacker-caused operational disruption were not established. The intrusion start and data-acquisition dates remain unknown.
-
June 23, 2026 • Bajaj Auto disclosed that a ransomware attack on June 23, 2026 affected systems belonging to the company and its wholly owned subsidiary, Bajaj Auto Technology Limited. The companies activated precautionary measures and response protocols, which Bajaj Auto said had been successful in managing and mitigating the incident. The attacker, access method, disruption duration, and any data theft were not disclosed.
-
June 23, 2026 LAPSUS$ claimed on June 23, 2026 that it breached an outdated AYA Bank application portal and obtained approximately 120 GB of data. AYA Bank confirmed limited unauthorized access involving the legacy portal but said it was isolated from the bank's core systems. The bank reported that core banking, AYA Pay, internet and mobile banking, financial information, and transaction services remained secure and operational. The actor's claimed volume and full data contents were not confirmed.
-
June 23, 2026 • On June 23, 2026, Partnered Health became aware that a malicious actor had accessed data in parts of its clinic network. The company currently lists 17 clinics where healthcare-record information was affected and five additional clinics where the extent of impact remains under investigation. Partnered Health later confirmed that 11 files tied to the incident had been published online and that additional patients and some employees were affected. INC claimed responsibility and approximately 500 GB of theft, but Partnered Health has not verified that quantity and was still assessing the published material. No operational or clinical-service disruption was reported.
-
June 23, 2026 • Analog Devices detected unauthorized access to certain company systems on June 23, 2026 and confirmed that files were exfiltrated. Its SEC filing stated that operations were not interrupted and that the incident was not expected to materially affect the business. No actor or motive was identified. A July 26 ExfilSquad claim involving 570,000 alleged customer records was described by Analog Devices as a separate and unrelated matter and is not incorporated into this record.
-
June 24, 2026 • Flughafen Wien AG confirmed that 2025 aircraft cargo load sheets were removed without authorization from one email inbox. Bashe, also known as APT73 or Eraleig, claimed more than 500,000 emails and 4,473 files and threatened to publish or sell the data, but the airport did not verify those figures and reported no direct ransom demand. Airport operations were unaffected, and no passenger-related or business-critical data was reported affected.
-
June 24, 2026 • Anubis listed Quest Health Solutions on June 24, 2026 and claimed theft of employee data and internal files. DataBreach.com's verified searchable dataset confirms a data compromise. Although Anubis malware can encrypt or wipe data, incident-specific reporting does not establish that either capability was deployed against Quest, and no public victim statement, regulator notice, or report confirming an outage or service interruption was located as of August 12, 2026.
-
June 24, 2026 ZeroBytes used compromised DGFiP employee credentials to access E-Contact and exfiltrate tax correspondence and taxpayer data. Automated extraction was observed June 24-25, 2026, with renewed activity in July; the intrusions were not detected as data theft at the time. DGFiP later restricted access to sensitive applications and affected accounts following the August disclosure. Investigators subsequently distinguished this E-Contact theft from the July-August cadastral compromise and a separate vacant-estates portal incident.