-
Thermo King Eastern Canada
June 8, 2026
Dark Project claimed theft of 70+ GB, incl. customer and bank/financial documents, from Thermo King Eastern Canada (thermoking.ca), a Mississauga, Ontario transport refrigeration dealer, citing an attack on 'Genesis'; listed Aug. 5, 2026. No company statement.
-
University of Nottingham
June 9, 2026
•
[ hack, leak, education ]
On 2026-06-09, the University of Nottingham detected unauthorized access to its Campus Solutions student-records system and took the affected system offline as a containment measure. The university confirmed that a significant amount of student and alumni data had been accessed. ShinyHunters claimed responsibility and published more than 40 GB of data. Have I Been Pwned identified approximately 455,000 unique email addresses in the leak. The university did not publicly attribute the intrusion.
-
Central Bank of Libya
June 9, 2026
•
[ ransomware, finance, government ]
On 2026-06-09, the Central Bank of Libya confirmed a cyberattack affecting a limited number of systems and technical services. The bank activated emergency response and business-continuity procedures and isolated affected systems. Qilin claimed responsibility on 2026-06-22 and threatened to release confidential banking data. The bank later said it was investigating material published on the dark web. The access method, data categories, volume, and effects on customers or financial assets were not publicly established, and the Qilin attribution remains an attacker claim.
-
Onslow County Schools
June 9, 2026
•
[ hack, education, technology ]
Onslow County Schools detected unauthorized criminal activity within its technology infrastructure during the early morning of June 9, 2026. The incident caused districtwide phone and internet outages, disrupted end-of-course retesting, and affected planned graduation livestreams. District technology staff took protective action and worked with local, state, and federal law enforcement, including the FBI and U.S. Secret Service. The actor, method, motive, and full restoration time were not disclosed.
-
State Health Care Accreditation Agency under the Ministry of Health
June 9, 2026
•
[ leak, misconfiguration, healthcare ]
Lithuanian authorities disclosed that approximately 62,000 records containing personal information about doctors and other healthcare specialists were acquired from the State Health Care Accreditation Agency in a cyber incident identified on June 9, 2026. Reporting linked the access to a vulnerability in a server-hosted data system. The actor, motive, detailed data fields, and number of unique affected individuals were not disclosed, and authorities said there was no evidence that the incident was coordinated with other contemporaneous Lithuanian breaches.
-
Reynella East College
June 9, 2026
•
[ ransomware, education, leak ]
On 2026-06-09, Reynella East College notified parents and carers that a cybersecurity breach had taken all of the school's computer systems offline. Classes continued through face-to-face and offline arrangements while the South Australian Department for Education and cybersecurity specialists investigated and restored systems. On 2026-06-23, the Interlock ransomware group claimed responsibility and published more than 600 GB comprising more than 473,000 files in more than 68,000 folders. Reporting reviewed samples that included passport scans, credentials, student and family contact details, teaching documents, contracts, financial reports, and school budgets. The Department for Education acknowledged that information had been posted online but continued assessing which individuals and records were affected.
-
Aflac Life Insurance Japan Ltd.
June 10, 2026
•
[ hack, leak, finance ]
Aflac Life Insurance Japan determined that unauthorized access and data leakage first occurred on 2026-06-10, with multiple unauthorized accesses continuing through 2026-06-25. The incident affected Aflac Yorisou Net and related systems and exposed personal information concerning approximately 4.4 million customers and approximately 40,000 current and former agencies. Aflac temporarily suspended the policyholder portal and several related online services as a containment measure, while claims and other procedures continued through call centers. The initial access method, actor, and motive remained under investigation.
-
First Federal Savings & Loan Association of Pascagoula-Moss Point
June 10, 2026
•
[ leak, finance ]
WorldLeaks listed First Federal Savings & Loan Association of Pascagoula-Moss Point on June 10, 2026 and threatened to publish stolen information. DataBreach.com subsequently indexed 54,751 rows. Public reporting did not identify the access vector or document encryption, system unavailability, or operational disruption.
-
Mackay Sugar Limited
June 10, 2026
•
[ hack, manufacturing, technology ]
Mackay Sugar detected unauthorized external access on June 10, 2026, and shut down affected enterprise and logistics systems while investigating. The incident suspended harvesting, cane haulage, and crushing at the Farleigh and Racecourse mills. Operations resumed in phases beginning June 18, and all three mills were operational by June 26. TheGentlemen claimed responsibility and threatened to publish data, but Mackay Sugar did not publicly attribute the incident to the group or confirm data theft; therefore, the record is coded only for the confirmed operational disruption.
-
Tata Electronics Private Limited
June 10, 2026
World Leaks published more than 630 GB comprising over 204,300 files allegedly stolen from Tata Electronics on June 10, 2026. Tata Electronics confirmed that a cybersecurity incident had affected some systems several weeks earlier but stated that operations were unaffected. TechCrunch and Reuters reviewed samples that appeared to include internal emails, SAP information, employee records, and proprietary Apple and Tesla manufacturing documents, but Tata Electronics did not confirm the actor's claimed volume or contents.
-
Senate of the Philippines
June 10, 2026
Nullsec Philippines defaced the Senate of the Philippines' official website late on June 10, 2026 and replaced legitimate content with a protest message calling for transparency and accountability. Senate personnel restored the site and opened an investigation. Officials reported no evidence that confidential or sensitive information was accessed.
-
Hospital Authority
June 10, 2026
•
[ insider, healthcare ]
An intern doctor surnamed Lai allegedly used another doctor's credentials at Caritas Medical Centre to access Tuen Mun Hospital patient records through the Hospital Authority's Clinical Management System. The Hospital Authority suspended her system access, reported the matter to police, and later dismissed her after finding violations of patient privacy and professional confidentiality; no irregularities in patient treatment were identified.
-
Centra Sota Cooperative
June 10, 2026
•
[ leak, retail, energy ]
WorldLeaks claimed Centra Sota Cooperative on June 10, 2026. DataBreach.com subsequently indexed 93,417 records containing personal and contact information. Centra Sota is a member-owned agricultural cooperative headquartered in Buffalo, Minnesota, with grain, feed, agronomy, energy, retail and related operations. No independently verified operational disruption has been established.
-
Klue Labs, Inc.
June 11, 2026
On 2026-06-11, an attacker used a previously compromised GitHub personal access token to introduce unauthorized code into Klue's integration service and collect OAuth access and refresh tokens, including Salesforce credentials. The actor used the tokens to query Salesforce APIs and copy commercial CRM data from multiple Klue customers. Salesforce notified Klue on 2026-06-12, after which Klue disabled the affected integration infrastructure and rotated credentials; it found no evidence of activity after that date. Icarus claimed responsibility and issued extortion demands. Salesforce stated that the incident was limited to Klue's application connection and was not a Salesforce platform vulnerability.
-
California Water Service Company
June 11, 2026
•
[ hack, espionage, energy ]
On 2026-06-11, the Iran-linked Handala group claimed that it had compromised California Water Service and published a 5 GB proof-of-concept dataset. Dataminr analysis identified customer billing records, RTKBase GPS correction-system credentials, NTRIP passwords, and network details covering at least seven service districts; records associated with the Chico District were independently confirmed. Handala described the operation as retaliation for U.S. actions in Iran and claimed it could disrupt water service, but no access to water treatment or distribution controls and no operational disruption were confirmed. Handala is linked by threat researchers to Iran's Ministry of Intelligence and Security.
-
Arch Linux via the Arch User Repository (AUR)
June 11, 2026
•
[ malware, technology, hack ]
Attackers took control of abandoned Arch User Repository packages and altered their PKGBUILD files to install the malicious npm package atomic-lockfile. Its preinstall script delivered an eBPF-based rootkit that concealed activity and harvested credentials from affected Linux systems. More than 20 packages were confirmed affected. No named downstream victim or total number of infected systems was reported.
-
Prince George County
June 11, 2026
•
[ ransomware, government, leak ]
Prince George County identified a cybersecurity incident affecting certain network systems on June 11, 2026. The incident disrupted county phone, internet, and online payment services, while 911 and non-emergency dispatch remained available. Most systems were restored within approximately one week. RansomHouse claimed that it encrypted the county on June 10 and posted an evidence pack, but the county did not confirm the group's attribution, encryption claim, data theft, or a ransom demand; officials later stated that personal information may have been involved.
-
National Association of Insurance Commissioners (NAIC)
June 11, 2026
NAIC identified unauthorized access to part of its environment on June 11, 2026 after attackers exploited a zero-day vulnerability in Oracle PeopleSoft and obtained temporary access to certain data-storage areas. NAIC later confirmed that acquired files were published. The exposed material consisted largely of regulatory financial and ratings information, some of which was already publicly available, plus outdated logs and configuration data. ShinyHunters claimed responsibility and 3.1 TB of data, but NAIC did not confirm the claimed volume and reported no exposure of personal or payment information.
-
AS Latvijas valsts meži
June 11, 2026
•
[ ransomware, financial, technology ]
Intrusion indicators show that the attacker entered AS Latvijas valsts mei systems on 2026-06-11 and remained undetected until malicious activity was identified during the night of 2026-06-22 to 2026-06-23. The attacker exfiltrated company data and deployed ransomware, while LVM disconnected LVM GEO, its map-services system, the Mednis application, and several internal customer- and provider-facing systems. CERT.LV confirmed that 44 GB of stolen data was published, including internal documents, emails, source code, digital certificates, cryptographic keys, and user credentials, and assessed that the attacker likely obtained more data. Timber deliveries were reduced after the attack and returned to full volume on 2026-07-01, although other systems remained under restoration on 2026-07-09. Public threat-monitoring sources identify ByteToBreach as the claimant, but CERT.LV has publicly described the perpetrator only as a foreign financially motivated ransomware actor.
-
Baylor Genetics
June 11, 2026
•
[ hack, healthcare ]
Baylor Genetics determined that an unauthorized party accessed part of its network and information stored there between June 11 and June 17, 2026. The company discovered suspicious activity around June 15, completed its review July 30 and announced notifications August 14. Its HHS report identified 2,810,878 potentially affected people. Genetic testing and laboratory operations continued normally. Neither an actor name nor ransom, sale or other financial objective has been substantiated; Criminal is a provisional inference from the deliberate acquisition of sensitive personal records.
