-
Wiese USA
June 5, 2026
•
[ leak, technology ]
Termite claimed Wiese USA on June 8, 2026, with threat-intelligence tracking estimating the underlying attack on June 5. DataBreach.com subsequently indexed 229,721 records containing personal information. Litigation filed after the June incident alleges theft and disclosure of personally identifiable information. No independently verified operational disruption has been established.
-
Access Dental & Orthodontics
June 5, 2026
•
[ ransomware, leak, healthcare ]
WorldLeaks listed Access Dental & Orthodontics on its leak site on June 5, 2026 and issued a countdown associated with its extortion claim. DataBreach.com later indexed 322,387 records containing personal and contact information. Access Dental operates a dental-services organization headquartered in Irving, Texas. No independently verified operational disruption has been established.
-
United Auto Supply
June 5, 2026
•
[ ransomware, leak, retail ]
WorldLeaks publicly listed United Auto Supply on June 5, 2026 as part of its data-theft extortion operation. Independent ransomware monitoring captured the same June 5 claim, and DataBreach.com subsequently indexed 826,018 records containing personal, contact, and vehicle information associated with the company. United Auto Supply has not publicly confirmed the incident, and no operational disruption has been independently established.
-
Undisclosed organization in Unit 42 Pink-related extortion investigation
June 5, 2026
•
[ ransomware, phishing, technology ]
Palo Alto Networks Unit 42 investigated an extortion case involving an unnamed organization. On June 1, 2026, an attacker renewed contact in an existing negotiation, supplied a new qTox identifier and a data-leak site associated with the Pink extortion brand, and referenced essentially the same information claimed taken in an earlier extortion notice. Unit 42 described the broader cluster using voice phishing and cloud-service data theft. The specific initial access, actual exfiltration, victim industry and country, and whether the original intruder was identical to the Pink contact were not established. Event date is a publication-date fallback, not a verified theft date.
-
Norsk Tipping AS
June 5, 2026
A third separately reported attack struck Norsk Tipping around noon June 5. Telenor blocked malicious DDoS traffic and online gaming services returned to normal that afternoon. The earlier June 2 and 3 waves had ended, establishing a new disruptive episode. No attacker, ransom demand, or data theft was reported. Sabotage is a contextual inference based on intentional denial of the state-owned operator's services.
-
Nexstar Media Group, Inc.
June 6, 2026
•
[ leak, technology ]
ShinyHunters claimed that it accessed Nexstar Media Group systems on June 6, 2026 and stole more than 1 million Salesforce records and additional internal corporate data. DataBreach.com subsequently indexed 103,128 rows. Nexstar stated that it was investigating reports of a potential IT security incident and that its operations were not disrupted. The company did not publicly confirm the actor's full claimed scope.
-
Strand Fitness Pty Ltd (North Shore)
June 6, 2026
•
[ leak, insider ]
Strand Fitness Pty Ltd confirmed a data breach affecting current and former members of its North Shore gym in Burdell. Queensland Police found gym member information on a USB drive during a police raid in late May 2026 and opened an investigation. Several police officers were among the affected members. Strand Fitness said the information varied by individual and may have included contact details, health information, identity documents, and payment information. The company contacted affected members, notified Queensland Police and the Office of the Australian Information Commissioner, and took additional steps to secure its systems. The breach did not affect the company's other locations. The date, method, duration, perpetrator, motive, and number of affected members were not reported.
-
Evanston Township High School District 202
June 7, 2026
A ransomware incident beginning on 2026-06-07 disrupted Evanston Township High School District 202 systems, internet services, and computer infrastructure. The district closed its campus on 2026-06-08 and 2026-06-09 and canceled summer school, sports camps, and other on-campus activities. The campus later reopened, but system access remained limited and recovery was still underway on 2026-07-06. The district required district-issued devices to be reviewed and reimaged and stated that it had not yet determined whether personal data was accessed or acquired.
-
French Interministerial Directorate for Digital Affairs (DINUM) – Tchap
June 7, 2026
•
[ hack, government, technology ]
On June 7, 2026, an attacker hijacked a Tchap user account and accessed public, unencrypted chat rooms on the French government's messaging platform. DINUM confirmed that 73,467 registered government users were affected and that account information including names, email addresses, affiliated entities, and avatars was potentially exposed. The actor misere additionally claimed theft of 13.5 GB containing more than 643,000 messages and files, but that claim was not independently verified.
-
Undisclosed Turkish defense contractor
June 7, 2026
•
[ espionage, hack, government ]
Beginning on or after June 7, 2026, unidentified operators associated with the FortiBleed campaign used a captured FortiGate VPN session cookie to enter an undisclosed Turkish defense contractor's internal network and access two SMB file shares with an administrator account. They exfiltrated more than 12,000 files totaling 105 GB, including sensitive military documentation, technical files, field imagery, diagnostic records, and employee identification documents.
-
Multiple undisclosed macOS users
June 8, 2026
•
[ malware, technology, hack ]
Operation FlutterBridge used malicious Google advertisements to distribute signed and notarized macOS applications masquerading as a podcast player or PDF viewers. The FlutterShell payload modified Chrome settings to redirect traffic through attacker-controlled advertising sites and provided command execution, file-system manipulation, and environment-variable collection capabilities. Unit 42 observed multiple infected hosts but did not identify individual victims. Because no specific infection date was reported in the supplied source, the publication date is used as the event date.
-
One Medical Seniors via an undisclosed third-party file storage provider
June 8, 2026
•
[ leak, healthcare, technology ]
An unauthorized third party accessed a third-party file storage system containing archived One Medical Seniors patient information between 2026-06-08 and 2026-06-11. One Medical discovered the access on 2026-06-13, revoked access, rotated credentials, and stated that the incident was limited to the storage platform and did not affect other One Medical clinics, services, or its electronic medical record system. ShinyHunters claimed to have stolen 8.8 TB and threatened publication, but One Medical did not publicly attribute the breach or confirm the claimed volume.
-
iRhythm Technologies, Inc.
June 8, 2026
On June 8, 2026, iRhythm identified unauthorized activity involving data maintained on third-party-hosted business applications. The company said the attackers used social engineering and confirmed that data was exfiltrated. On June 9, the threat actor demanded payment and claimed to possess proprietary information, patient protected health information, and other personal data. iRhythm had not confirmed those claimed contents or the number of affected individuals and reported no impact to products, clinical or device systems, manufacturing, distribution, patient safety, or financial reporting.
-
VTB Bank (PJSC)
June 8, 2026
•
[ ddos, finance, hack ]
On June 8, 2026, a DDoS attack disrupted VTB Banks online services, preventing some customers from logging into mobile and web banking or completing payments and transfers. Complaints increased around 11:00 Moscow time, and VTB reported that service availability had been fully restored after 17:00.
-
City of Acworth
June 8, 2026
•
[ ransomware, government, hack ]
On 2026-06-08, the City of Acworth detected an unauthorized cybersecurity incident affecting certain municipal computer systems. The city warned residents that they might experience service interruptions because of network outages, engaged cybersecurity professionals, and notified law enforcement. By 2026-06-18, all affected systems had been restored and city services were fully operational. INC Ransom subsequently claimed responsibility by listing Acworth on its dark-web leak site with alleged data samples. The city has not confirmed INC Ransom's attribution, ransomware deployment, encryption, data theft, a ransom demand, the contents of the alleged samples, or the exact systems and services affected.
-
Undisclosed third-party law firm used by Navient
June 8, 2026
•
[ ransomware, finance ]
Navient learned on June 8, 2026, that ransomware had affected certain information systems at an undisclosed third-party law firm providing it legal services. An unauthorized actor accessed Navient-related data held by the firm, including sensitive borrower information. The incident was limited to the law firm's environment; Navient found no access to its own systems and experienced no disruption to operations or customer services. Public disclosures did not identify the law firm, ransomware operator, affected-person count, access method, or any operational disruption at the firm.
-
Thermo King Eastern Canada
June 8, 2026
Dark Project claimed theft of 70+ GB, incl. customer and bank/financial documents, from Thermo King Eastern Canada (thermoking.ca), a Mississauga, Ontario transport refrigeration dealer, citing an attack on 'Genesis'; listed Aug. 5, 2026. No company statement.
-
University of Nottingham
June 9, 2026
•
[ hack, leak, education ]
On 2026-06-09, the University of Nottingham detected unauthorized access to its Campus Solutions student-records system and took the affected system offline as a containment measure. The university confirmed that a significant amount of student and alumni data had been accessed. ShinyHunters claimed responsibility and published more than 40 GB of data. Have I Been Pwned identified approximately 455,000 unique email addresses in the leak. The university did not publicly attribute the intrusion.
-
Central Bank of Libya
June 9, 2026
•
[ ransomware, finance, government ]
On 2026-06-09, the Central Bank of Libya confirmed a cyberattack affecting a limited number of systems and technical services. The bank activated emergency response and business-continuity procedures and isolated affected systems. Qilin claimed responsibility on 2026-06-22 and threatened to release confidential banking data. The bank later said it was investigating material published on the dark web. The access method, data categories, volume, and effects on customers or financial assets were not publicly established, and the Qilin attribution remains an attacker claim.
-
Onslow County Schools
June 9, 2026
•
[ hack, education, technology ]
Onslow County Schools detected unauthorized criminal activity within its technology infrastructure during the early morning of June 9, 2026. The incident caused districtwide phone and internet outages, disrupted end-of-course retesting, and affected planned graduation livestreams. District technology staff took protective action and worked with local, state, and federal law enforcement, including the FBI and U.S. Secret Service. The actor, method, motive, and full restoration time were not disclosed.
