-
Undisclosed Indian government entities
June 12, 2026
•
[ espionage, phishing, malware ]
Between June 12 and June 22, 2026, Acronis observed active beaconing from multiple systems compromised by Mustang Panda within Indian government entities, including devices associated with senior administrative personnel. Spear-phishing archives induced users to execute signed Windows applications that sideloaded malicious DLLs and installed SHARDLOADER, MINIRECON, or ZOHOMURK on the endpoints. The malware established persistence, remote command execution, command-and-control, and data-transfer channels through attacker-controlled infrastructure and Zoho WorkDrive. Acronis attributed the campaign to Mustang Panda with high confidence based on tradecraft, malware-code, infrastructure, and development-artifact overlaps and assisted CERT-In with victim notification and remediation. Public reporting associates Mustang Panda with China's Ministry of State Security, although no subordinate bureau, contractor, or operational unit was identified. The operation supported intelligence collection concerning Indian hydropower initiatives and defense cooperation with Taiwan. No operational disruption was reported.
-
Undisclosed Uruguayan advertising agency
June 12, 2026
•
[ ransomware, leak, technology ]
Gunra ransomware listed an undisclosed Uruguayan advertising agency on its leak site on June 12, 2026 and claims it published 40 GB of the firm's files after it refused to pay. The agency has not been named or commented.
-
House of Representatives of the Philippines
June 13, 2026
On June 13, 2026, unauthorized actors defaced the official House of Representatives website with an anti-corruption message, after which the site became temporarily inaccessible while incident-response procedures were activated. Fifteen hacktivist names were publicly identified through logos, greetings, or credits displayed on the defaced page, although the participation of each named actor was not independently confirmed; DICT found no initial evidence that confidential or sensitive government data was compromised.
-
Council of Europe
June 14, 2026
•
[ ransomware, government, leak ]
On 2026-06-14, ShinyHunters claimed that it had stolen approximately 297 GB of Council of Europe data from multiple departments and threatened publication unless the organization began negotiations by 2026-06-16. The group claimed the material included payroll, human-resources, banking, tax, social-security, medical, and applicant records. The Council of Europe stated that it was investigating the allegation but had not publicly confirmed the breach, access method, or claimed data volume at the time of the supplied report. Because no intrusion date was reported, the publication date is used as the event date.
-
Undisclosed operator of shared communications infrastructure used by four Iranian banks
June 14, 2026
•
[ hack, finance, technology ]
A cyberattack on June 14, 2026 targeted shared communications infrastructure used by Bank Melli, Bank Tejarat, Bank Saderat, and the Export Development Bank of Iran. The direct technical disruption occurred at the shared infrastructure layer and temporarily affected some banking services at all four institutions. Later reporting stated that the disruption took several days to resolve. Iran's banking coordination council said that no unauthorized access to customer information occurred and no data was deleted. The infrastructure operator, attack method, and perpetrator were not publicly identified.
-
POKKA PTE. LTD.
June 14, 2026
•
[ ransomware, retail, hack ]
Sapporo Holdings confirmed unauthorized access to POKKA PTE. LTD. on June 14, 2026 after detecting suspicious communications and disconnected related systems and equipment for containment. INC listed pokka.co on July 18 and threatened to leak data unless the company negotiated; monitoring sources described internal files as exfiltrated, but neither the quantity nor contents were disclosed. No attacker-caused operational disruption was reported. Sapporo said its Japanese domestic operations were unaffected and found no causal relationship between the Pokka and Sleeman incidents.
-
Premier Medical Group of the Hudson Valley
June 14, 2026
•
[ healthcare, hack ]
Poughkeepsie, N.Y. medical practice Premier Medical Group said a June 2026 cyberattack disrupted some of its IT systems and that an unauthorized party accessed files with patient data on June 14; 282,075 people were reported to HHS. No group has claimed the attack.
-
Multiple undisclosed Android users
June 15, 2026
Android.MagicAd.1 was embedded in more than 50 games and utility applications distributed through official Android stores, including Xiaomi GetApps and, for earlier versions, Samsung Galaxy Store. Once installed, the trojan hid components, maintained persistence across reboots, and abused trusted system or third-party applications to display advertisements in the background, over other apps, and after the infected app was closed. It could also hide its icon, conceal system interface elements, and block normal closure. The operators were not identified; the activity was financially motivated through advertising.
-
Moody Bible Institute
June 15, 2026
ShinyHunters claimed on June 15, 2026 that it stole more than 23 GB from Moody Bible Institute's Salesforce, PeopleSoft, Horizon, donor, admissions, payroll, and communications systems. Moody acknowledged a data incident involving claims that criminals accessed internal systems and opened an investigation. The stolen data was subsequently published, but Moody did not publicly confirm the actor's full claimed scope. No operational disruption was reported.
-
Illinois Central College
June 15, 2026
•
[ hack, leak, education ]
ShinyHunters claimed on June 15, 2026 that it stole more than 28 GB from Illinois Central College systems including PeopleSoft Campus Solutions, human-resources, pension-reporting, Workday-costing, and curriculum systems. DataBreach.com later indexed 21,190 rows from the leak. The college had not publicly confirmed the actor's full claimed scope, and no encryption or operational disruption was documented.
-
Deep Well Services
June 15, 2026
•
[ hack, leak, energy ]
ShinyHunters listed Deep Well Services on June 15, 2026 and claimed theft of customer information and internal corporate data. DataBreach.com later indexed 13,297 rows, while separate analysis identified Salesforce CRM material. Public reporting did not document encryption or operational disruption.
-
Sysco Corporation
June 15, 2026
ShinyHunters listed Sysco Corporation on June 15, 2026 and claimed theft of more than 61 million Salesforce records containing customer, employee, and internal corporate data. DataBreach.com later indexed 4,540,682 rows associated with the leak. Sysco had not publicly confirmed the actor's claimed scope, and no encryption or operational disruption was documented.
-
Eastman Kodak Company
June 15, 2026
•
[ ransomware, leak, technology ]
ShinyHunters listed Eastman Kodak Company on its extortion site on June 15, 2026, claiming theft of more than 2.2 million customer records and internal corporate data and threatening publication on June 18. Kodak confirmed that an unauthorized third party temporarily accessed a limited amount of company data, stated that the incident was contained, and reported no threat to its systems or operations. Kodak did not confirm the actor's claimed volume or contents.
-
Optimum First Mortgage, Inc.
June 15, 2026
•
[ ransomware, finance ]
Optimum First Mortgage learned around June 19, 2026 that an unauthorized party had accessed its network several days earlier. PEAR claimed responsibility, dated the intrusion to June 15, alleged theft of approximately 9.3 TB, and threatened publication. The company disputed the claimed volume and said its investigation had found no evidence that its loan-origination or application-software systems were breached. The affected data categories and number of individuals remained unconfirmed.
-
AdaptHealth Corp.
June 15, 2026
•
[ hack, social, healthcare ]
Attackers used social engineering to compromise a user session associated with a third-party contractor, accessed AdaptHealth cloud applications including patient-management and document-storage systems and external EHR portals, and exfiltrated data. AdaptHealth said the incident was contained and did not materially affect operations or patient services. ShinyHunters later claimed responsibility, but the company did not confirm the attribution.
-
Houston City College
June 15, 2026
•
[ hack, leak, education ]
ShinyHunters claimed the hccs.edu breach on June 15, 2026 and later published data from Houston City College's student-record environment. The event overlapped with the group's Oracle PeopleSoft campaign against higher education, although no public source specifically confirmed the vulnerability used at Houston City College. No operational disruption was reported.
-
Glendale Community College
June 15, 2026
•
[ ransomware, education, leak ]
ShinyHunters claimed a pay-or-leak breach of Glendale Community College dated 15 June and later published attributed data. The college said it was notified of a potential incident on 16 June, isolated and secured its network, and determined that certain student educational-record data may have been copied without authorization. The isolation was a defensive containment measure; no service outage or attacker-caused operational disruption was reported. The initial access method was not disclosed.
-
Undisclosed macOS user or organization
June 16, 2026
•
[ malware, technology ]
During a recent incident investigation disclosed on 2026-06-16, researchers identified an AMOS Stealer infection on an undisclosed macOS endpoint. The malware used curl and AppleScript through zsh to collect the login.keychain-db file, browser credentials, cookies, autofill information, and developer configuration files. It compressed the material into osalogging.zip, split it into 10 MB chunks, uploaded the chunks to bestbuydomain.com through HTTP PUT, and deleted temporary files after exfiltration. The victim, infection date, distribution lure, and number of affected endpoints were not disclosed.
-
River Financial Corporation (River Bank & Trust)
June 16, 2026
•
[ ransomware, finance ]
An unauthorized actor accessed River Financial Corporation's network, including River Bank & Trust, on or about June 16, 2026. River detected the activity on June 19 and determined that ransomware had been deployed across portions of its server environment, disrupting certain operations and prompting impacted systems to be taken offline. A July 10 SEC amendment confirmed that the actor also removed certain data, although the contents and scope remained under investigation and River reported no evidence that customer accounts were affected.
-
Dialog
June 16, 2026
•
[ hack, misconfiguration, technology ]
On or before June 16, 2026, Swiss hacktivist maia arson crimew accessed internal Dialog records through a misconfigured web application that loaded private files into a visitor's browser after any email address was entered, without requiring a password or bypassing a technical control. The exposed records included participant personal information, login tokens, internal ratings, questionnaires, schedules, and other organizational materials, and Dialog temporarily closed multiple systems after learning of the exposure.
