-
Multiple undisclosed Android users
June 15, 2026
Android.MagicAd.1 was embedded in more than 50 games and utility applications distributed through official Android stores, including Xiaomi GetApps and, for earlier versions, Samsung Galaxy Store. Once installed, the trojan hid components, maintained persistence across reboots, and abused trusted system or third-party applications to display advertisements in the background, over other apps, and after the infected app was closed. It could also hide its icon, conceal system interface elements, and block normal closure. The operators were not identified; the activity was financially motivated through advertising.
-
Moody Bible Institute
June 15, 2026
ShinyHunters claimed on June 15, 2026 that it stole more than 23 GB from Moody Bible Institute's Salesforce, PeopleSoft, Horizon, donor, admissions, payroll, and communications systems. Moody acknowledged a data incident involving claims that criminals accessed internal systems and opened an investigation. The stolen data was subsequently published, but Moody did not publicly confirm the actor's full claimed scope. No operational disruption was reported.
-
Illinois Central College
June 15, 2026
•
[ hack, leak, education ]
ShinyHunters claimed on June 15, 2026 that it stole more than 28 GB from Illinois Central College systems including PeopleSoft Campus Solutions, human-resources, pension-reporting, Workday-costing, and curriculum systems. DataBreach.com later indexed 21,190 rows from the leak. The college had not publicly confirmed the actor's full claimed scope, and no encryption or operational disruption was documented.
-
Deep Well Services
June 15, 2026
•
[ hack, leak, energy ]
ShinyHunters listed Deep Well Services on June 15, 2026 and claimed theft of customer information and internal corporate data. DataBreach.com later indexed 13,297 rows, while separate analysis identified Salesforce CRM material. Public reporting did not document encryption or operational disruption.
-
Sysco Corporation
June 15, 2026
ShinyHunters listed Sysco Corporation on June 15, 2026 and claimed theft of more than 61 million Salesforce records containing customer, employee, and internal corporate data. DataBreach.com later indexed 4,540,682 rows associated with the leak. Sysco had not publicly confirmed the actor's claimed scope, and no encryption or operational disruption was documented.
-
Eastman Kodak Company
June 15, 2026
•
[ ransomware, leak, technology ]
ShinyHunters listed Eastman Kodak Company on its extortion site on June 15, 2026, claiming theft of more than 2.2 million customer records and internal corporate data and threatening publication on June 18. Kodak confirmed that an unauthorized third party temporarily accessed a limited amount of company data, stated that the incident was contained, and reported no threat to its systems or operations. Kodak did not confirm the actor's claimed volume or contents.
-
Optimum First Mortgage, Inc.
June 15, 2026
•
[ ransomware, finance ]
Optimum First Mortgage learned around June 19, 2026 that an unauthorized party had accessed its network several days earlier. PEAR claimed responsibility, dated the intrusion to June 15, alleged theft of approximately 9.3 TB, and threatened publication. The company disputed the claimed volume and said its investigation had found no evidence that its loan-origination or application-software systems were breached. The affected data categories and number of individuals remained unconfirmed.
-
AdaptHealth Corp.
June 15, 2026
•
[ hack, social, healthcare ]
Attackers used social engineering to compromise a user session associated with a third-party contractor, accessed AdaptHealth cloud applications including patient-management and document-storage systems and external EHR portals, and exfiltrated data. AdaptHealth said the incident was contained and did not materially affect operations or patient services. ShinyHunters later claimed responsibility, but the company did not confirm the attribution.
-
Houston City College
June 15, 2026
•
[ hack, leak, education ]
ShinyHunters claimed the hccs.edu breach on June 15, 2026 and later published data from Houston City College's student-record environment. The event overlapped with the group's Oracle PeopleSoft campaign against higher education, although no public source specifically confirmed the vulnerability used at Houston City College. No operational disruption was reported.
-
Glendale Community College
June 15, 2026
•
[ ransomware, education, leak ]
ShinyHunters claimed a pay-or-leak breach of Glendale Community College dated 15 June and later published attributed data. The college said it was notified of a potential incident on 16 June, isolated and secured its network, and determined that certain student educational-record data may have been copied without authorization. The isolation was a defensive containment measure; no service outage or attacker-caused operational disruption was reported. The initial access method was not disclosed.
-
Undisclosed macOS user or organization
June 16, 2026
•
[ malware, technology ]
During a recent incident investigation disclosed on 2026-06-16, researchers identified an AMOS Stealer infection on an undisclosed macOS endpoint. The malware used curl and AppleScript through zsh to collect the login.keychain-db file, browser credentials, cookies, autofill information, and developer configuration files. It compressed the material into osalogging.zip, split it into 10 MB chunks, uploaded the chunks to bestbuydomain.com through HTTP PUT, and deleted temporary files after exfiltration. The victim, infection date, distribution lure, and number of affected endpoints were not disclosed.
-
River Financial Corporation (River Bank & Trust)
June 16, 2026
•
[ ransomware, finance ]
An unauthorized actor accessed River Financial Corporation's network, including River Bank & Trust, on or about June 16, 2026. River detected the activity on June 19 and determined that ransomware had been deployed across portions of its server environment, disrupting certain operations and prompting impacted systems to be taken offline. A July 10 SEC amendment confirmed that the actor also removed certain data, although the contents and scope remained under investigation and River reported no evidence that customer accounts were affected.
-
Dialog
June 16, 2026
•
[ hack, misconfiguration, technology ]
On or before June 16, 2026, Swiss hacktivist maia arson crimew accessed internal Dialog records through a misconfigured web application that loaded private files into a visitor's browser after any email address was entered, without requiring a password or bypassing a technical control. The exposed records included participant personal information, login tokens, internal ratings, questionnaires, schedules, and other organizational materials, and Dialog temporarily closed multiple systems after learning of the exposure.
-
United Personnel
June 16, 2026
•
[ ransomware, technology ]
United Personnel, a Springfield, Massachusetts staffing firm and division of Masis Staffing Solutions, was listed by the Genesis ransomware group in June 2026, which claimed about 700 GB of customer, employee, payroll and contract data. The company has not confirmed a breach.
-
Multiple undisclosed Chrome extension users
June 17, 2026
Researchers identified 152 Chrome live-wallpaper extensions distributed through 38 publisher accounts and three brands that performed undisclosed telemetry collection and manipulated referrals to make extension-generated visits appear to be Google organic-search traffic. The extensions had approximately 105,000 combined installations. The operation generated advertising revenue by opening monetized sites and falsifying traffic attribution. Researchers characterized the activity as an adware-adjacent, financially motivated potentially unwanted program campaign; no password theft or compromise of Google infrastructure was reported.
-
Kepler Software Inc. (Mastra)
June 17, 2026
•
[ hack, malware, technology ]
During a 45-minute window on June 17, 2026, Sapphire Sleet compromised Mastra maintainer ehindero's NPM account and published 141 Mastra packages containing the malicious easy-day-js dependency. The dependency's post-install script downloaded and executed a second-stage payload targeting cryptocurrency-related browser extensions. The affected package versions were removed, and users who installed Mastra packages during the window were advised to treat their systems as potentially affected.
-
Chick-fil-A, Inc.
June 17, 2026
From June 17 through June 19, unidentified criminals used automated credential stuffing against Chick-fil-A's website and mobile application with email addresses and passwords obtained from an external source. They accessed 13,322 Chick-fil-A One accounts and, in some cases, drained stored rewards or credit balances. Chick-fil-A stated that its systems were not the source of the credentials. It logged affected users out, reset passwords, removed stored payment methods, restored affected balances, and added rewards. No operational disruption was reported.
-
Mount Royal University
June 17, 2026
•
[ ransomware, education ]
Mount Royal University identified the incident on June 17. The actor copied and deleted specific H-drive folders and deleted the departmental J drive, disrupting university services. CMD Organization claimed 10 TB and demanded 30 bitcoin, but the volume was not verified. MRU later said it had reason to believe the obtained information had been deleted and was no longer held by those responsible; restoration remained underway August 10.
-
SLEEMAN BREWERIES LTD.
June 17, 2026
•
[ ransomware, hack, retail ]
Sapporo Holdings confirmed unauthorized access to SLEEMAN BREWERIES LTD. on June 17, 2026 and disconnected related systems and equipment. A Canadian liquor-industry association subsequently relayed that Sleeman's network outage was caused by a cybersecurity incident and that sales and delivery were continuing manually. Chaos listed Sleeman on July 14, and monitoring sources reported an alleged 420-gigabyte theft; Sleeman has not confirmed the attribution or data claim. Sleeman separately disclosed a January 26 ransomware incident involving personal information, so the January data categories are not attributed to this June event. Sapporo found no causal relationship with the Pokka intrusion and no impact on its Japanese domestic operations.
-
South Plains Rural Health Services, Inc.
June 17, 2026
•
[ ransomware, leak, healthcare ]
PEAR claimed that South Plains Rural Health Services was notified of its intrusion on June 17 and later listed the West Texas healthcare provider on its leak site on July 15. By late August, PEAR had published files it claimed were stolen from SPRHS and alleged that approximately 1.4 TB of patient, employee, and administrative data had been exfiltrated. Independent ransomware trackers corroborate the PEAR victim listing and leak-site activity, but SPRHS has not publicly confirmed the incident, the June 17 date, the 1.4 TB quantity, or the detailed contents of the stolen material.
