-
American Tower Corporation
June 12, 2026
•
[ leak, hack, technology ]
ShinyHunters listed American Tower Corporation on June 12, 2026 and claimed theft of more than 5.2 million records and sensitive tower-related information. DataBreach.com later indexed 573,655 rows, while Have I Been Pwned identified approximately 217,000 unique affected email addresses. Public reporting did not document encryption or operational disruption, and American Tower did not publicly confirm the actor's full claimed scope.
-
Kee Wah Bakery Limited
June 12, 2026
•
[ ransomware, retail, technology ]
Kee Wah Bakery discovered on June 12, 2026 that its internal network was not operating normally and subsequently received a ransom note. Its preliminary investigation confirmed a ransomware attack. The company continued operating its physical stores and stated that payment and credit-card information were not affected. Systems containing information concerning employees, business partners, online customers, and loyalty-program members may have been exposed, but Kee Wah had not confirmed data exfiltration or disclosed the number of affected individuals.
-
Catalyst Brands LLC and affiliated retail brands
June 12, 2026
On June 12, 2026, ShinyHunters claimed it had stolen data from JCPenney and affiliated Catalyst Brands and Authentic Brands Group companies. The subsequently published material primarily concerned current and former employees and was reportedly obtained from an Oracle PeopleSoft environment. No operational disruption was reported.
-
Singapore Land Authority
June 12, 2026
•
[ leak, misconfiguration, technology ]
IBM notified SLA on June 12, 2026 of a security incident in an IBM-managed cloud development and systems-integration testing environment supporting STARS and ELS and said by June 15 that personal information may have been accessed. The affected dataset contained real personal data for approximately 70,000 people. SLA said the test environment was separate from live operational systems and no operational systems or other government datasets were compromised. The dataset was encrypted, but authorities did not disclose how the actor obtained access.
-
Undisclosed Indian government entities
June 12, 2026
•
[ espionage, phishing, malware ]
Between June 12 and June 22, 2026, Acronis observed active beaconing from multiple systems compromised by Mustang Panda within Indian government entities, including devices associated with senior administrative personnel. Spear-phishing archives induced users to execute signed Windows applications that sideloaded malicious DLLs and installed SHARDLOADER, MINIRECON, or ZOHOMURK on the endpoints. The malware established persistence, remote command execution, command-and-control, and data-transfer channels through attacker-controlled infrastructure and Zoho WorkDrive. Acronis attributed the campaign to Mustang Panda with high confidence based on tradecraft, malware-code, infrastructure, and development-artifact overlaps and assisted CERT-In with victim notification and remediation. Public reporting associates Mustang Panda with China's Ministry of State Security, although no subordinate bureau, contractor, or operational unit was identified. The operation supported intelligence collection concerning Indian hydropower initiatives and defense cooperation with Taiwan. No operational disruption was reported.
-
Undisclosed Uruguayan advertising agency
June 12, 2026
•
[ ransomware, leak, technology ]
Gunra ransomware listed an undisclosed Uruguayan advertising agency on its leak site on June 12, 2026 and claims it published 40 GB of the firm's files after it refused to pay. The agency has not been named or commented.
-
House of Representatives of the Philippines
June 13, 2026
On June 13, 2026, unauthorized actors defaced the official House of Representatives website with an anti-corruption message, after which the site became temporarily inaccessible while incident-response procedures were activated. Fifteen hacktivist names were publicly identified through logos, greetings, or credits displayed on the defaced page, although the participation of each named actor was not independently confirmed; DICT found no initial evidence that confidential or sensitive government data was compromised.
-
Council of Europe
June 14, 2026
•
[ ransomware, government, leak ]
On 2026-06-14, ShinyHunters claimed that it had stolen approximately 297 GB of Council of Europe data from multiple departments and threatened publication unless the organization began negotiations by 2026-06-16. The group claimed the material included payroll, human-resources, banking, tax, social-security, medical, and applicant records. The Council of Europe stated that it was investigating the allegation but had not publicly confirmed the breach, access method, or claimed data volume at the time of the supplied report. Because no intrusion date was reported, the publication date is used as the event date.
-
Undisclosed operator of shared communications infrastructure used by four Iranian banks
June 14, 2026
•
[ hack, finance, technology ]
A cyberattack on June 14, 2026 targeted shared communications infrastructure used by Bank Melli, Bank Tejarat, Bank Saderat, and the Export Development Bank of Iran. The direct technical disruption occurred at the shared infrastructure layer and temporarily affected some banking services at all four institutions. Later reporting stated that the disruption took several days to resolve. Iran's banking coordination council said that no unauthorized access to customer information occurred and no data was deleted. The infrastructure operator, attack method, and perpetrator were not publicly identified.
-
POKKA PTE. LTD.
June 14, 2026
•
[ ransomware, retail, hack ]
Sapporo Holdings confirmed unauthorized access to POKKA PTE. LTD. on June 14, 2026 after detecting suspicious communications and disconnected related systems and equipment for containment. INC listed pokka.co on July 18 and threatened to leak data unless the company negotiated; monitoring sources described internal files as exfiltrated, but neither the quantity nor contents were disclosed. No attacker-caused operational disruption was reported. Sapporo said its Japanese domestic operations were unaffected and found no causal relationship between the Pokka and Sleeman incidents.
-
Premier Medical Group of the Hudson Valley
June 14, 2026
•
[ healthcare, hack ]
Poughkeepsie, N.Y. medical practice Premier Medical Group said a June 2026 cyberattack disrupted some of its IT systems and that an unauthorized party accessed files with patient data on June 14; 282,075 people were reported to HHS. No group has claimed the attack.
-
Multiple undisclosed Android users
June 15, 2026
Android.MagicAd.1 was embedded in more than 50 games and utility applications distributed through official Android stores, including Xiaomi GetApps and, for earlier versions, Samsung Galaxy Store. Once installed, the trojan hid components, maintained persistence across reboots, and abused trusted system or third-party applications to display advertisements in the background, over other apps, and after the infected app was closed. It could also hide its icon, conceal system interface elements, and block normal closure. The operators were not identified; the activity was financially motivated through advertising.
-
Moody Bible Institute
June 15, 2026
ShinyHunters claimed on June 15, 2026 that it stole more than 23 GB from Moody Bible Institute's Salesforce, PeopleSoft, Horizon, donor, admissions, payroll, and communications systems. Moody acknowledged a data incident involving claims that criminals accessed internal systems and opened an investigation. The stolen data was subsequently published, but Moody did not publicly confirm the actor's full claimed scope. No operational disruption was reported.
-
Illinois Central College
June 15, 2026
•
[ hack, leak, education ]
ShinyHunters claimed on June 15, 2026 that it stole more than 28 GB from Illinois Central College systems including PeopleSoft Campus Solutions, human-resources, pension-reporting, Workday-costing, and curriculum systems. DataBreach.com later indexed 21,190 rows from the leak. The college had not publicly confirmed the actor's full claimed scope, and no encryption or operational disruption was documented.
-
Deep Well Services
June 15, 2026
•
[ hack, leak, energy ]
ShinyHunters listed Deep Well Services on June 15, 2026 and claimed theft of customer information and internal corporate data. DataBreach.com later indexed 13,297 rows, while separate analysis identified Salesforce CRM material. Public reporting did not document encryption or operational disruption.
-
Sysco Corporation
June 15, 2026
ShinyHunters listed Sysco Corporation on June 15, 2026 and claimed theft of more than 61 million Salesforce records containing customer, employee, and internal corporate data. DataBreach.com later indexed 4,540,682 rows associated with the leak. Sysco had not publicly confirmed the actor's claimed scope, and no encryption or operational disruption was documented.
-
Eastman Kodak Company
June 15, 2026
•
[ ransomware, leak, technology ]
ShinyHunters listed Eastman Kodak Company on its extortion site on June 15, 2026, claiming theft of more than 2.2 million customer records and internal corporate data and threatening publication on June 18. Kodak confirmed that an unauthorized third party temporarily accessed a limited amount of company data, stated that the incident was contained, and reported no threat to its systems or operations. Kodak did not confirm the actor's claimed volume or contents.
-
Optimum First Mortgage, Inc.
June 15, 2026
•
[ ransomware, finance ]
Optimum First Mortgage learned around June 19, 2026 that an unauthorized party had accessed its network several days earlier. PEAR claimed responsibility, dated the intrusion to June 15, alleged theft of approximately 9.3 TB, and threatened publication. The company disputed the claimed volume and said its investigation had found no evidence that its loan-origination or application-software systems were breached. The affected data categories and number of individuals remained unconfirmed.
-
AdaptHealth Corp.
June 15, 2026
•
[ hack, social, healthcare ]
Attackers used social engineering to compromise a user session associated with a third-party contractor, accessed AdaptHealth cloud applications including patient-management and document-storage systems and external EHR portals, and exfiltrated data. AdaptHealth said the incident was contained and did not materially affect operations or patient services. ShinyHunters later claimed responsibility, but the company did not confirm the attribution.
-
Houston City College
June 15, 2026
•
[ hack, leak, education ]
ShinyHunters claimed the hccs.edu breach on June 15, 2026 and later published data from Houston City College's student-record environment. The event overlapped with the group's Oracle PeopleSoft campaign against higher education, although no public source specifically confirmed the vulnerability used at Houston City College. No operational disruption was reported.
