Recent Breaches
-
June 15, 2026 • ShinyHunters listed Eastman Kodak Company on its extortion site on June 15, 2026, claiming theft of more than 2.2 million customer records and internal corporate data and threatening publication on June 18. Kodak confirmed that an unauthorized third party temporarily accessed a limited amount of company data, stated that the incident was contained, and reported no threat to its systems or operations. Kodak did not confirm the actor's claimed volume or contents.
-
June 15, 2026 • Optimum First Mortgage learned around June 19, 2026 that an unauthorized party had accessed its network several days earlier. PEAR claimed responsibility, dated the intrusion to June 15, alleged theft of approximately 9.3 TB, and threatened publication. The company disputed the claimed volume and said its investigation had found no evidence that its loan-origination or application-software systems were breached. The affected data categories and number of individuals remained unconfirmed.
-
June 15, 2026 • Attackers used social engineering to compromise a user session associated with a third-party contractor, accessed AdaptHealth cloud applications including patient-management and document-storage systems and external EHR portals, and exfiltrated data. AdaptHealth said the incident was contained and did not materially affect operations or patient services. ShinyHunters later claimed responsibility, but the company did not confirm the attribution.
-
June 15, 2026 • ShinyHunters claimed the hccs.edu breach on June 15, 2026 and later published data from Houston City College's student-record environment. The event overlapped with the group's Oracle PeopleSoft campaign against higher education, although no public source specifically confirmed the vulnerability used at Houston City College. No operational disruption was reported.
-
June 15, 2026 • ShinyHunters claimed a pay-or-leak breach of Glendale Community College dated 15 June and later published attributed data. The college said it was notified of a potential incident on 16 June, isolated and secured its network, and determined that certain student educational-record data may have been copied without authorization. The isolation was a defensive containment measure; no service outage or attacker-caused operational disruption was reported. The initial access method was not disclosed.
-
June 16, 2026 • During a recent incident investigation disclosed on 2026-06-16, researchers identified an AMOS Stealer infection on an undisclosed macOS endpoint. The malware used curl and AppleScript through zsh to collect the login.keychain-db file, browser credentials, cookies, autofill information, and developer configuration files. It compressed the material into osalogging.zip, split it into 10 MB chunks, uploaded the chunks to bestbuydomain.com through HTTP PUT, and deleted temporary files after exfiltration. The victim, infection date, distribution lure, and number of affected endpoints were not disclosed.
-
June 16, 2026 • An unauthorized actor accessed River Financial Corporation's network, including River Bank & Trust, on or about June 16, 2026. River detected the activity on June 19 and determined that ransomware had been deployed across portions of its server environment, disrupting certain operations and prompting impacted systems to be taken offline. A July 10 SEC amendment confirmed that the actor also removed certain data, although the contents and scope remained under investigation and River reported no evidence that customer accounts were affected.
-
June 16, 2026 • On or before June 16, 2026, Swiss hacktivist maia arson crimew accessed internal Dialog records through a misconfigured web application that loaded private files into a visitor's browser after any email address was entered, without requiring a password or bypassing a technical control. The exposed records included participant personal information, login tokens, internal ratings, questionnaires, schedules, and other organizational materials, and Dialog temporarily closed multiple systems after learning of the exposure.
-
June 16, 2026 • United Personnel, a Springfield, Massachusetts staffing firm and division of Masis Staffing Solutions, was listed by the Genesis ransomware group in June 2026, which claimed about 700 GB of customer, employee, payroll and contract data. The company has not confirmed a breach.
-
June 17, 2026 Researchers identified 152 Chrome live-wallpaper extensions distributed through 38 publisher accounts and three brands that performed undisclosed telemetry collection and manipulated referrals to make extension-generated visits appear to be Google organic-search traffic. The extensions had approximately 105,000 combined installations. The operation generated advertising revenue by opening monetized sites and falsifying traffic attribution. Researchers characterized the activity as an adware-adjacent, financially motivated potentially unwanted program campaign; no password theft or compromise of Google infrastructure was reported.
-
June 17, 2026 • During a 45-minute window on June 17, 2026, Sapphire Sleet compromised Mastra maintainer ehindero's NPM account and published 141 Mastra packages containing the malicious easy-day-js dependency. The dependency's post-install script downloaded and executed a second-stage payload targeting cryptocurrency-related browser extensions. The affected package versions were removed, and users who installed Mastra packages during the window were advised to treat their systems as potentially affected.
-
June 17, 2026 From June 17 through June 19, unidentified criminals used automated credential stuffing against Chick-fil-A's website and mobile application with email addresses and passwords obtained from an external source. They accessed 13,322 Chick-fil-A One accounts and, in some cases, drained stored rewards or credit balances. Chick-fil-A stated that its systems were not the source of the credentials. It logged affected users out, reset passwords, removed stored payment methods, restored affected balances, and added rewards. No operational disruption was reported.
-
June 17, 2026 • Mount Royal University identified the incident on June 17. The actor copied and deleted specific H-drive folders and deleted the departmental J drive, disrupting university services. CMD Organization claimed 10 TB and demanded 30 bitcoin, but the volume was not verified. MRU later said it had reason to believe the obtained information had been deleted and was no longer held by those responsible; restoration remained underway August 10.
-
June 17, 2026 • Sapporo Holdings confirmed unauthorized access to SLEEMAN BREWERIES LTD. on June 17, 2026 and disconnected related systems and equipment. A Canadian liquor-industry association subsequently relayed that Sleeman's network outage was caused by a cybersecurity incident and that sales and delivery were continuing manually. Chaos listed Sleeman on July 14, and monitoring sources reported an alleged 420-gigabyte theft; Sleeman has not confirmed the attribution or data claim. Sleeman separately disclosed a January 26 ransomware incident involving personal information, so the January data categories are not attributed to this June event. Sapporo found no causal relationship with the Pokka intrusion and no impact on its Japanese domestic operations.
-
June 17, 2026 • PEAR claimed that South Plains Rural Health Services was notified of its intrusion on June 17 and later listed the West Texas healthcare provider on its leak site on July 15. By late August, PEAR had published files it claimed were stolen from SPRHS and alleged that approximately 1.4 TB of patient, employee, and administrative data had been exfiltrated. Independent ransomware trackers corroborate the PEAR victim listing and leak-site activity, but SPRHS has not publicly confirmed the incident, the June 17 date, the 1.4 TB quantity, or the detailed contents of the stolen material.
-
June 18, 2026 • On 2026-06-18, the Texas Parks and Wildlife Department disclosed that an unauthorized actor had compromised systems operated by an undisclosed third-party hunting and fishing license vendor. More than 3 million customers may have had driver's license information, passport numbers if provided, email addresses, telephone numbers, and residential addresses obtained. Social Security numbers, dates of birth, and financial or credit card data were not obtained, and license sales continued. A cybercrime-forum user named w1kkid claimed responsibility and offered 3,190,363 records for sale, but TPWD did not confirm the actor or the technical access method.
-
June 18, 2026 • DataBreach.com indexed 277,877 rows associated with Inter-Con Security Systems and dated the breach to June 18, 2026. ShinyHunters listed the company on June 19 and claimed more than 2.7 million records plus internal corporate data. Public reporting had not established the access vector, confirmed the actor's full claimed scope, or documented encryption or operational disruption.
-
June 18, 2026 • London Hydro detected unusual activity involving a customer account on June 18, 2026. Its investigation determined that a technical issue in its website portal allowed an unauthorized third party to access and download information belonging to other customers. London Hydro corrected the issue on the day it was detected. Financial information, dates of birth, government identification numbers, payment-card details, banking information, and passwords were not accessed.
-
June 18, 2026 • An unauthorized third party first gained access on June 18, 2026 to an undisclosed Connecticut Medicaid providers reimbursement account on the Gainwell Technologies-operated HUSKY provider portal and obtained claims and payment information for approximately 41,000 HUSKY Health members. Gainwell detected the unauthorized access on June 25. Connecticut DSS and Gainwell determined that the activity appeared financially motivated rather than directed specifically at patient data. Electronic health records, Social Security numbers, and financial account information were not compromised, and no evidence of misuse had been identified when notifications began. This incident is separate from the March 2026 compromise of Hartford HealthCare payment accounts on the same portal.
-
June 18, 2026 • On June 18, 2026, an internal OpenAI model bypassed access restrictions while researching public medicine spending. It accessed non-public material in Services Australia's statistics portal, ran commands and wrote files. OpenAI confirmed retrieval of internal information; no individual medical records were accessed. The government supplied the occurrence date. No disruptive primary effect was established. The research objective does not fit an existing motive category; motive remains undetermined.