-
Prince George County
June 11, 2026
•
[ ransomware, government, leak ]
Prince George County identified a cybersecurity incident affecting certain network systems on June 11, 2026. The incident disrupted county phone, internet, and online payment services, while 911 and non-emergency dispatch remained available. Most systems were restored within approximately one week. RansomHouse claimed that it encrypted the county on June 10 and posted an evidence pack, but the county did not confirm the group's attribution, encryption claim, data theft, or a ransom demand; officials later stated that personal information may have been involved.
-
National Association of Insurance Commissioners (NAIC)
June 11, 2026
NAIC identified unauthorized access to part of its environment on June 11, 2026 after attackers exploited a zero-day vulnerability in Oracle PeopleSoft and obtained temporary access to certain data-storage areas. NAIC later confirmed that acquired files were published. The exposed material consisted largely of regulatory financial and ratings information, some of which was already publicly available, plus outdated logs and configuration data. ShinyHunters claimed responsibility and 3.1 TB of data, but NAIC did not confirm the claimed volume and reported no exposure of personal or payment information.
-
AS Latvijas valsts meži
June 11, 2026
•
[ ransomware, financial, technology ]
Intrusion indicators show that the attacker entered AS Latvijas valsts mei systems on 2026-06-11 and remained undetected until malicious activity was identified during the night of 2026-06-22 to 2026-06-23. The attacker exfiltrated company data and deployed ransomware, while LVM disconnected LVM GEO, its map-services system, the Mednis application, and several internal customer- and provider-facing systems. CERT.LV confirmed that 44 GB of stolen data was published, including internal documents, emails, source code, digital certificates, cryptographic keys, and user credentials, and assessed that the attacker likely obtained more data. Timber deliveries were reduced after the attack and returned to full volume on 2026-07-01, although other systems remained under restoration on 2026-07-09. Public threat-monitoring sources identify ByteToBreach as the claimant, but CERT.LV has publicly described the perpetrator only as a foreign financially motivated ransomware actor.
-
Baylor Genetics
June 11, 2026
•
[ hack, healthcare ]
Baylor Genetics determined that an unauthorized party accessed part of its network and information stored there between June 11 and June 17, 2026. The company discovered suspicious activity around June 15, completed its review July 30 and announced notifications August 14. Its HHS report identified 2,810,878 potentially affected people. Genetic testing and laboratory operations continued normally. Neither an actor name nor ransom, sale or other financial objective has been substantiated; Criminal is a provisional inference from the deliberate acquisition of sensitive personal records.
-
American Tower Corporation
June 12, 2026
•
[ leak, hack, technology ]
ShinyHunters listed American Tower Corporation on June 12, 2026 and claimed theft of more than 5.2 million records and sensitive tower-related information. DataBreach.com later indexed 573,655 rows, while Have I Been Pwned identified approximately 217,000 unique affected email addresses. Public reporting did not document encryption or operational disruption, and American Tower did not publicly confirm the actor's full claimed scope.
-
Kee Wah Bakery Limited
June 12, 2026
•
[ ransomware, retail, technology ]
Kee Wah Bakery discovered on June 12, 2026 that its internal network was not operating normally and subsequently received a ransom note. Its preliminary investigation confirmed a ransomware attack. The company continued operating its physical stores and stated that payment and credit-card information were not affected. Systems containing information concerning employees, business partners, online customers, and loyalty-program members may have been exposed, but Kee Wah had not confirmed data exfiltration or disclosed the number of affected individuals.
-
Catalyst Brands LLC and affiliated retail brands
June 12, 2026
On June 12, 2026, ShinyHunters claimed it had stolen data from JCPenney and affiliated Catalyst Brands and Authentic Brands Group companies. The subsequently published material primarily concerned current and former employees and was reportedly obtained from an Oracle PeopleSoft environment. No operational disruption was reported.
-
Singapore Land Authority
June 12, 2026
•
[ leak, misconfiguration, technology ]
IBM notified SLA on June 12, 2026 of a security incident in an IBM-managed cloud development and systems-integration testing environment supporting STARS and ELS and said by June 15 that personal information may have been accessed. The affected dataset contained real personal data for approximately 70,000 people. SLA said the test environment was separate from live operational systems and no operational systems or other government datasets were compromised. The dataset was encrypted, but authorities did not disclose how the actor obtained access.
-
Undisclosed Indian government entities
June 12, 2026
•
[ espionage, phishing, malware ]
Between June 12 and June 22, 2026, Acronis observed active beaconing from multiple systems compromised by Mustang Panda within Indian government entities, including devices associated with senior administrative personnel. Spear-phishing archives induced users to execute signed Windows applications that sideloaded malicious DLLs and installed SHARDLOADER, MINIRECON, or ZOHOMURK on the endpoints. The malware established persistence, remote command execution, command-and-control, and data-transfer channels through attacker-controlled infrastructure and Zoho WorkDrive. Acronis attributed the campaign to Mustang Panda with high confidence based on tradecraft, malware-code, infrastructure, and development-artifact overlaps and assisted CERT-In with victim notification and remediation. Public reporting associates Mustang Panda with China's Ministry of State Security, although no subordinate bureau, contractor, or operational unit was identified. The operation supported intelligence collection concerning Indian hydropower initiatives and defense cooperation with Taiwan. No operational disruption was reported.
-
Undisclosed Uruguayan advertising agency
June 12, 2026
•
[ ransomware, leak, technology ]
Gunra ransomware listed an undisclosed Uruguayan advertising agency on its leak site on June 12, 2026 and claims it published 40 GB of the firm's files after it refused to pay. The agency has not been named or commented.
-
House of Representatives of the Philippines
June 13, 2026
On June 13, 2026, unauthorized actors defaced the official House of Representatives website with an anti-corruption message, after which the site became temporarily inaccessible while incident-response procedures were activated. Fifteen hacktivist names were publicly identified through logos, greetings, or credits displayed on the defaced page, although the participation of each named actor was not independently confirmed; DICT found no initial evidence that confidential or sensitive government data was compromised.
-
Council of Europe
June 14, 2026
•
[ ransomware, government, leak ]
On 2026-06-14, ShinyHunters claimed that it had stolen approximately 297 GB of Council of Europe data from multiple departments and threatened publication unless the organization began negotiations by 2026-06-16. The group claimed the material included payroll, human-resources, banking, tax, social-security, medical, and applicant records. The Council of Europe stated that it was investigating the allegation but had not publicly confirmed the breach, access method, or claimed data volume at the time of the supplied report. Because no intrusion date was reported, the publication date is used as the event date.
-
Undisclosed operator of shared communications infrastructure used by four Iranian banks
June 14, 2026
•
[ hack, finance, technology ]
A cyberattack on June 14, 2026 targeted shared communications infrastructure used by Bank Melli, Bank Tejarat, Bank Saderat, and the Export Development Bank of Iran. The direct technical disruption occurred at the shared infrastructure layer and temporarily affected some banking services at all four institutions. Later reporting stated that the disruption took several days to resolve. Iran's banking coordination council said that no unauthorized access to customer information occurred and no data was deleted. The infrastructure operator, attack method, and perpetrator were not publicly identified.
-
POKKA PTE. LTD.
June 14, 2026
•
[ ransomware, retail, hack ]
Sapporo Holdings confirmed unauthorized access to POKKA PTE. LTD. on June 14, 2026 after detecting suspicious communications and disconnected related systems and equipment for containment. INC listed pokka.co on July 18 and threatened to leak data unless the company negotiated; monitoring sources described internal files as exfiltrated, but neither the quantity nor contents were disclosed. No attacker-caused operational disruption was reported. Sapporo said its Japanese domestic operations were unaffected and found no causal relationship between the Pokka and Sleeman incidents.
-
Premier Medical Group of the Hudson Valley
June 14, 2026
•
[ healthcare, hack ]
Poughkeepsie, N.Y. medical practice Premier Medical Group said a June 2026 cyberattack disrupted some of its IT systems and that an unauthorized party accessed files with patient data on June 14; 282,075 people were reported to HHS. No group has claimed the attack.
-
Multiple undisclosed Android users
June 15, 2026
Android.MagicAd.1 was embedded in more than 50 games and utility applications distributed through official Android stores, including Xiaomi GetApps and, for earlier versions, Samsung Galaxy Store. Once installed, the trojan hid components, maintained persistence across reboots, and abused trusted system or third-party applications to display advertisements in the background, over other apps, and after the infected app was closed. It could also hide its icon, conceal system interface elements, and block normal closure. The operators were not identified; the activity was financially motivated through advertising.
-
Moody Bible Institute
June 15, 2026
ShinyHunters claimed on June 15, 2026 that it stole more than 23 GB from Moody Bible Institute's Salesforce, PeopleSoft, Horizon, donor, admissions, payroll, and communications systems. Moody acknowledged a data incident involving claims that criminals accessed internal systems and opened an investigation. The stolen data was subsequently published, but Moody did not publicly confirm the actor's full claimed scope. No operational disruption was reported.
-
Illinois Central College
June 15, 2026
•
[ hack, leak, education ]
ShinyHunters claimed on June 15, 2026 that it stole more than 28 GB from Illinois Central College systems including PeopleSoft Campus Solutions, human-resources, pension-reporting, Workday-costing, and curriculum systems. DataBreach.com later indexed 21,190 rows from the leak. The college had not publicly confirmed the actor's full claimed scope, and no encryption or operational disruption was documented.
-
Deep Well Services
June 15, 2026
•
[ hack, leak, energy ]
ShinyHunters listed Deep Well Services on June 15, 2026 and claimed theft of customer information and internal corporate data. DataBreach.com later indexed 13,297 rows, while separate analysis identified Salesforce CRM material. Public reporting did not document encryption or operational disruption.
-
Sysco Corporation
June 15, 2026
ShinyHunters listed Sysco Corporation on June 15, 2026 and claimed theft of more than 61 million Salesforce records containing customer, employee, and internal corporate data. DataBreach.com later indexed 4,540,682 rows associated with the leak. Sysco had not publicly confirmed the actor's claimed scope, and no encryption or operational disruption was documented.
