-
iRhythm Technologies, Inc.
June 8, 2026
On June 8, 2026, iRhythm identified unauthorized activity involving data maintained on third-party-hosted business applications. The company said the attackers used social engineering and confirmed that data was exfiltrated. On June 9, the threat actor demanded payment and claimed to possess proprietary information, patient protected health information, and other personal data. iRhythm had not confirmed those claimed contents or the number of affected individuals and reported no impact to products, clinical or device systems, manufacturing, distribution, patient safety, or financial reporting.
-
VTB Bank (PJSC)
June 8, 2026
•
[ ddos, finance, hack ]
On June 8, 2026, a DDoS attack disrupted VTB Banks online services, preventing some customers from logging into mobile and web banking or completing payments and transfers. Complaints increased around 11:00 Moscow time, and VTB reported that service availability had been fully restored after 17:00.
-
City of Acworth
June 8, 2026
•
[ ransomware, government, hack ]
On 2026-06-08, the City of Acworth detected an unauthorized cybersecurity incident affecting certain municipal computer systems. The city warned residents that they might experience service interruptions because of network outages, engaged cybersecurity professionals, and notified law enforcement. By 2026-06-18, all affected systems had been restored and city services were fully operational. INC Ransom subsequently claimed responsibility by listing Acworth on its dark-web leak site with alleged data samples. The city has not confirmed INC Ransom's attribution, ransomware deployment, encryption, data theft, a ransom demand, the contents of the alleged samples, or the exact systems and services affected.
-
Undisclosed third-party law firm used by Navient
June 8, 2026
•
[ ransomware, finance ]
Navient learned on June 8, 2026, that ransomware had affected certain information systems at an undisclosed third-party law firm providing it legal services. An unauthorized actor accessed Navient-related data held by the firm, including sensitive borrower information. The incident was limited to the law firm's environment; Navient found no access to its own systems and experienced no disruption to operations or customer services. Public disclosures did not identify the law firm, ransomware operator, affected-person count, access method, or any operational disruption at the firm.
-
Thermo King Eastern Canada
June 8, 2026
Dark Project claimed theft of 70+ GB, incl. customer and bank/financial documents, from Thermo King Eastern Canada (thermoking.ca), a Mississauga, Ontario transport refrigeration dealer, citing an attack on 'Genesis'; listed Aug. 5, 2026. No company statement.
-
University of Nottingham
June 9, 2026
•
[ hack, leak, education ]
On 2026-06-09, the University of Nottingham detected unauthorized access to its Campus Solutions student-records system and took the affected system offline as a containment measure. The university confirmed that a significant amount of student and alumni data had been accessed. ShinyHunters claimed responsibility and published more than 40 GB of data. Have I Been Pwned identified approximately 455,000 unique email addresses in the leak. The university did not publicly attribute the intrusion.
-
Central Bank of Libya
June 9, 2026
•
[ ransomware, finance, government ]
On 2026-06-09, the Central Bank of Libya confirmed a cyberattack affecting a limited number of systems and technical services. The bank activated emergency response and business-continuity procedures and isolated affected systems. Qilin claimed responsibility on 2026-06-22 and threatened to release confidential banking data. The bank later said it was investigating material published on the dark web. The access method, data categories, volume, and effects on customers or financial assets were not publicly established, and the Qilin attribution remains an attacker claim.
-
Onslow County Schools
June 9, 2026
•
[ hack, education, technology ]
Onslow County Schools detected unauthorized criminal activity within its technology infrastructure during the early morning of June 9, 2026. The incident caused districtwide phone and internet outages, disrupted end-of-course retesting, and affected planned graduation livestreams. District technology staff took protective action and worked with local, state, and federal law enforcement, including the FBI and U.S. Secret Service. The actor, method, motive, and full restoration time were not disclosed.
-
State Health Care Accreditation Agency under the Ministry of Health
June 9, 2026
•
[ leak, misconfiguration, healthcare ]
Lithuanian authorities disclosed that approximately 62,000 records containing personal information about doctors and other healthcare specialists were acquired from the State Health Care Accreditation Agency in a cyber incident identified on June 9, 2026. Reporting linked the access to a vulnerability in a server-hosted data system. The actor, motive, detailed data fields, and number of unique affected individuals were not disclosed, and authorities said there was no evidence that the incident was coordinated with other contemporaneous Lithuanian breaches.
-
Reynella East College
June 9, 2026
•
[ ransomware, education, leak ]
On 2026-06-09, Reynella East College notified parents and carers that a cybersecurity breach had taken all of the school's computer systems offline. Classes continued through face-to-face and offline arrangements while the South Australian Department for Education and cybersecurity specialists investigated and restored systems. On 2026-06-23, the Interlock ransomware group claimed responsibility and published more than 600 GB comprising more than 473,000 files in more than 68,000 folders. Reporting reviewed samples that included passport scans, credentials, student and family contact details, teaching documents, contracts, financial reports, and school budgets. The Department for Education acknowledged that information had been posted online but continued assessing which individuals and records were affected.
-
Aflac Life Insurance Japan Ltd.
June 10, 2026
•
[ hack, leak, finance ]
Aflac Life Insurance Japan determined that unauthorized access and data leakage first occurred on 2026-06-10, with multiple unauthorized accesses continuing through 2026-06-25. The incident affected Aflac Yorisou Net and related systems and exposed personal information concerning approximately 4.4 million customers and approximately 40,000 current and former agencies. Aflac temporarily suspended the policyholder portal and several related online services as a containment measure, while claims and other procedures continued through call centers. The initial access method, actor, and motive remained under investigation.
-
First Federal Savings & Loan Association of Pascagoula-Moss Point
June 10, 2026
•
[ leak, finance ]
WorldLeaks listed First Federal Savings & Loan Association of Pascagoula-Moss Point on June 10, 2026 and threatened to publish stolen information. DataBreach.com subsequently indexed 54,751 rows. Public reporting did not identify the access vector or document encryption, system unavailability, or operational disruption.
-
Mackay Sugar Limited
June 10, 2026
•
[ hack, manufacturing, technology ]
Mackay Sugar detected unauthorized external access on June 10, 2026, and shut down affected enterprise and logistics systems while investigating. The incident suspended harvesting, cane haulage, and crushing at the Farleigh and Racecourse mills. Operations resumed in phases beginning June 18, and all three mills were operational by June 26. TheGentlemen claimed responsibility and threatened to publish data, but Mackay Sugar did not publicly attribute the incident to the group or confirm data theft; therefore, the record is coded only for the confirmed operational disruption.
-
Tata Electronics Private Limited
June 10, 2026
World Leaks published more than 630 GB comprising over 204,300 files allegedly stolen from Tata Electronics on June 10, 2026. Tata Electronics confirmed that a cybersecurity incident had affected some systems several weeks earlier but stated that operations were unaffected. TechCrunch and Reuters reviewed samples that appeared to include internal emails, SAP information, employee records, and proprietary Apple and Tesla manufacturing documents, but Tata Electronics did not confirm the actor's claimed volume or contents.
-
Senate of the Philippines
June 10, 2026
Nullsec Philippines defaced the Senate of the Philippines' official website late on June 10, 2026 and replaced legitimate content with a protest message calling for transparency and accountability. Senate personnel restored the site and opened an investigation. Officials reported no evidence that confidential or sensitive information was accessed.
-
Hospital Authority
June 10, 2026
•
[ insider, healthcare ]
An intern doctor surnamed Lai allegedly used another doctor's credentials at Caritas Medical Centre to access Tuen Mun Hospital patient records through the Hospital Authority's Clinical Management System. The Hospital Authority suspended her system access, reported the matter to police, and later dismissed her after finding violations of patient privacy and professional confidentiality; no irregularities in patient treatment were identified.
-
Centra Sota Cooperative
June 10, 2026
•
[ leak, retail, energy ]
WorldLeaks claimed Centra Sota Cooperative on June 10, 2026. DataBreach.com subsequently indexed 93,417 records containing personal and contact information. Centra Sota is a member-owned agricultural cooperative headquartered in Buffalo, Minnesota, with grain, feed, agronomy, energy, retail and related operations. No independently verified operational disruption has been established.
-
Klue Labs, Inc.
June 11, 2026
On 2026-06-11, an attacker used a previously compromised GitHub personal access token to introduce unauthorized code into Klue's integration service and collect OAuth access and refresh tokens, including Salesforce credentials. The actor used the tokens to query Salesforce APIs and copy commercial CRM data from multiple Klue customers. Salesforce notified Klue on 2026-06-12, after which Klue disabled the affected integration infrastructure and rotated credentials; it found no evidence of activity after that date. Icarus claimed responsibility and issued extortion demands. Salesforce stated that the incident was limited to Klue's application connection and was not a Salesforce platform vulnerability.
-
California Water Service Company
June 11, 2026
•
[ hack, espionage, energy ]
On 2026-06-11, the Iran-linked Handala group claimed that it had compromised California Water Service and published a 5 GB proof-of-concept dataset. Dataminr analysis identified customer billing records, RTKBase GPS correction-system credentials, NTRIP passwords, and network details covering at least seven service districts; records associated with the Chico District were independently confirmed. Handala described the operation as retaliation for U.S. actions in Iran and claimed it could disrupt water service, but no access to water treatment or distribution controls and no operational disruption were confirmed. Handala is linked by threat researchers to Iran's Ministry of Intelligence and Security.
-
Arch Linux via the Arch User Repository (AUR)
June 11, 2026
•
[ malware, technology, hack ]
Attackers took control of abandoned Arch User Repository packages and altered their PKGBUILD files to install the malicious npm package atomic-lockfile. Its preinstall script delivered an eBPF-based rootkit that concealed activity and harvested credentials from affected Linux systems. More than 20 packages were confirmed affected. No named downstream victim or total number of infected systems was reported.
