-
State Health Care Accreditation Agency under the Ministry of Health
June 9, 2026
•
[ leak, misconfiguration, healthcare ]
Lithuanian authorities disclosed that approximately 62,000 records containing personal information about doctors and other healthcare specialists were acquired from the State Health Care Accreditation Agency in a cyber incident identified on June 9, 2026. Reporting linked the access to a vulnerability in a server-hosted data system. The actor, motive, detailed data fields, and number of unique affected individuals were not disclosed, and authorities said there was no evidence that the incident was coordinated with other contemporaneous Lithuanian breaches.
-
Reynella East College
June 9, 2026
•
[ ransomware, education, leak ]
On 2026-06-09, Reynella East College notified parents and carers that a cybersecurity breach had taken all of the school's computer systems offline. Classes continued through face-to-face and offline arrangements while the South Australian Department for Education and cybersecurity specialists investigated and restored systems. On 2026-06-23, the Interlock ransomware group claimed responsibility and published more than 600 GB comprising more than 473,000 files in more than 68,000 folders. Reporting reviewed samples that included passport scans, credentials, student and family contact details, teaching documents, contracts, financial reports, and school budgets. The Department for Education acknowledged that information had been posted online but continued assessing which individuals and records were affected.
-
Aflac Life Insurance Japan Ltd.
June 10, 2026
•
[ hack, leak, finance ]
Aflac Life Insurance Japan determined that unauthorized access and data leakage first occurred on 2026-06-10, with multiple unauthorized accesses continuing through 2026-06-25. The incident affected Aflac Yorisou Net and related systems and exposed personal information concerning approximately 4.4 million customers and approximately 40,000 current and former agencies. Aflac temporarily suspended the policyholder portal and several related online services as a containment measure, while claims and other procedures continued through call centers. The initial access method, actor, and motive remained under investigation.
-
First Federal Savings & Loan Association of Pascagoula-Moss Point
June 10, 2026
•
[ leak, finance ]
WorldLeaks listed First Federal Savings & Loan Association of Pascagoula-Moss Point on June 10, 2026 and threatened to publish stolen information. DataBreach.com subsequently indexed 54,751 rows. Public reporting did not identify the access vector or document encryption, system unavailability, or operational disruption.
-
Mackay Sugar Limited
June 10, 2026
•
[ hack, manufacturing, technology ]
Mackay Sugar detected unauthorized external access on June 10, 2026, and shut down affected enterprise and logistics systems while investigating. The incident suspended harvesting, cane haulage, and crushing at the Farleigh and Racecourse mills. Operations resumed in phases beginning June 18, and all three mills were operational by June 26. TheGentlemen claimed responsibility and threatened to publish data, but Mackay Sugar did not publicly attribute the incident to the group or confirm data theft; therefore, the record is coded only for the confirmed operational disruption.
-
Tata Electronics Private Limited
June 10, 2026
World Leaks published more than 630 GB comprising over 204,300 files allegedly stolen from Tata Electronics on June 10, 2026. Tata Electronics confirmed that a cybersecurity incident had affected some systems several weeks earlier but stated that operations were unaffected. TechCrunch and Reuters reviewed samples that appeared to include internal emails, SAP information, employee records, and proprietary Apple and Tesla manufacturing documents, but Tata Electronics did not confirm the actor's claimed volume or contents.
-
Senate of the Philippines
June 10, 2026
Nullsec Philippines defaced the Senate of the Philippines' official website late on June 10, 2026 and replaced legitimate content with a protest message calling for transparency and accountability. Senate personnel restored the site and opened an investigation. Officials reported no evidence that confidential or sensitive information was accessed.
-
Hospital Authority
June 10, 2026
•
[ insider, healthcare ]
An intern doctor surnamed Lai allegedly used another doctor's credentials at Caritas Medical Centre to access Tuen Mun Hospital patient records through the Hospital Authority's Clinical Management System. The Hospital Authority suspended her system access, reported the matter to police, and later dismissed her after finding violations of patient privacy and professional confidentiality; no irregularities in patient treatment were identified.
-
Centra Sota Cooperative
June 10, 2026
•
[ leak, retail, energy ]
WorldLeaks claimed Centra Sota Cooperative on June 10, 2026. DataBreach.com subsequently indexed 93,417 records containing personal and contact information. Centra Sota is a member-owned agricultural cooperative headquartered in Buffalo, Minnesota, with grain, feed, agronomy, energy, retail and related operations. No independently verified operational disruption has been established.
-
Klue Labs, Inc.
June 11, 2026
On 2026-06-11, an attacker used a previously compromised GitHub personal access token to introduce unauthorized code into Klue's integration service and collect OAuth access and refresh tokens, including Salesforce credentials. The actor used the tokens to query Salesforce APIs and copy commercial CRM data from multiple Klue customers. Salesforce notified Klue on 2026-06-12, after which Klue disabled the affected integration infrastructure and rotated credentials; it found no evidence of activity after that date. Icarus claimed responsibility and issued extortion demands. Salesforce stated that the incident was limited to Klue's application connection and was not a Salesforce platform vulnerability.
-
California Water Service Company
June 11, 2026
•
[ hack, espionage, energy ]
On 2026-06-11, the Iran-linked Handala group claimed that it had compromised California Water Service and published a 5 GB proof-of-concept dataset. Dataminr analysis identified customer billing records, RTKBase GPS correction-system credentials, NTRIP passwords, and network details covering at least seven service districts; records associated with the Chico District were independently confirmed. Handala described the operation as retaliation for U.S. actions in Iran and claimed it could disrupt water service, but no access to water treatment or distribution controls and no operational disruption were confirmed. Handala is linked by threat researchers to Iran's Ministry of Intelligence and Security.
-
Arch Linux via the Arch User Repository (AUR)
June 11, 2026
•
[ malware, technology, hack ]
Attackers took control of abandoned Arch User Repository packages and altered their PKGBUILD files to install the malicious npm package atomic-lockfile. Its preinstall script delivered an eBPF-based rootkit that concealed activity and harvested credentials from affected Linux systems. More than 20 packages were confirmed affected. No named downstream victim or total number of infected systems was reported.
-
Prince George County
June 11, 2026
•
[ ransomware, government, leak ]
Prince George County identified a cybersecurity incident affecting certain network systems on June 11, 2026. The incident disrupted county phone, internet, and online payment services, while 911 and non-emergency dispatch remained available. Most systems were restored within approximately one week. RansomHouse claimed that it encrypted the county on June 10 and posted an evidence pack, but the county did not confirm the group's attribution, encryption claim, data theft, or a ransom demand; officials later stated that personal information may have been involved.
-
National Association of Insurance Commissioners (NAIC)
June 11, 2026
NAIC identified unauthorized access to part of its environment on June 11, 2026 after attackers exploited a zero-day vulnerability in Oracle PeopleSoft and obtained temporary access to certain data-storage areas. NAIC later confirmed that acquired files were published. The exposed material consisted largely of regulatory financial and ratings information, some of which was already publicly available, plus outdated logs and configuration data. ShinyHunters claimed responsibility and 3.1 TB of data, but NAIC did not confirm the claimed volume and reported no exposure of personal or payment information.
-
AS Latvijas valsts meži
June 11, 2026
•
[ ransomware, financial, technology ]
Intrusion indicators show that the attacker entered AS Latvijas valsts mei systems on 2026-06-11 and remained undetected until malicious activity was identified during the night of 2026-06-22 to 2026-06-23. The attacker exfiltrated company data and deployed ransomware, while LVM disconnected LVM GEO, its map-services system, the Mednis application, and several internal customer- and provider-facing systems. CERT.LV confirmed that 44 GB of stolen data was published, including internal documents, emails, source code, digital certificates, cryptographic keys, and user credentials, and assessed that the attacker likely obtained more data. Timber deliveries were reduced after the attack and returned to full volume on 2026-07-01, although other systems remained under restoration on 2026-07-09. Public threat-monitoring sources identify ByteToBreach as the claimant, but CERT.LV has publicly described the perpetrator only as a foreign financially motivated ransomware actor.
-
Baylor Genetics
June 11, 2026
•
[ hack, healthcare ]
Baylor Genetics determined that an unauthorized party accessed part of its network and information stored there between June 11 and June 17, 2026. The company discovered suspicious activity around June 15, completed its review July 30 and announced notifications August 14. Its HHS report identified 2,810,878 potentially affected people. Genetic testing and laboratory operations continued normally. Neither an actor name nor ransom, sale or other financial objective has been substantiated; Criminal is a provisional inference from the deliberate acquisition of sensitive personal records.
-
American Tower Corporation
June 12, 2026
•
[ leak, hack, technology ]
ShinyHunters listed American Tower Corporation on June 12, 2026 and claimed theft of more than 5.2 million records and sensitive tower-related information. DataBreach.com later indexed 573,655 rows, while Have I Been Pwned identified approximately 217,000 unique affected email addresses. Public reporting did not document encryption or operational disruption, and American Tower did not publicly confirm the actor's full claimed scope.
-
Kee Wah Bakery Limited
June 12, 2026
•
[ ransomware, retail, technology ]
Kee Wah Bakery discovered on June 12, 2026 that its internal network was not operating normally and subsequently received a ransom note. Its preliminary investigation confirmed a ransomware attack. The company continued operating its physical stores and stated that payment and credit-card information were not affected. Systems containing information concerning employees, business partners, online customers, and loyalty-program members may have been exposed, but Kee Wah had not confirmed data exfiltration or disclosed the number of affected individuals.
-
Catalyst Brands LLC and affiliated retail brands
June 12, 2026
On June 12, 2026, ShinyHunters claimed it had stolen data from JCPenney and affiliated Catalyst Brands and Authentic Brands Group companies. The subsequently published material primarily concerned current and former employees and was reportedly obtained from an Oracle PeopleSoft environment. No operational disruption was reported.
-
Singapore Land Authority
June 12, 2026
•
[ leak, misconfiguration, technology ]
IBM notified SLA on June 12, 2026 of a security incident in an IBM-managed cloud development and systems-integration testing environment supporting STARS and ELS and said by June 15 that personal information may have been accessed. The affected dataset contained real personal data for approximately 70,000 people. SLA said the test environment was separate from live operational systems and no operational systems or other government datasets were compromised. The dataset was encrypted, but authorities did not disclose how the actor obtained access.
