-
Norsk Tipping AS
June 3, 2026
•
[ ddos, hack, technology ]
On June 3, after the previous evening's DDoS had been contained and service restored, Norsk Tipping experienced another traffic-flooding attack. Customers reported delays and failed access to some online games. The company confirmed restoration around 23:00, with no data compromise. The attacker was not identified. Sabotage is inferred from repeated efforts to obstruct this state-owned public gambling service.
-
States of Guernsey — Committee for Education, Sport & Culture
June 3, 2026
•
[ social, phishing, government ]
On June 3, an attacker obtained unauthorized access to a Guernsey education employee email account and used it to send a malicious link. The mailbox remained accessible to the intruder for approximately one month and contained information relating to 74 individuals. Officials confirmed the breach but reported no evidence of data exfiltration beyond the Education IT environment. Criminal and Financial are limited inferences from the phishing/credential-abuse pattern; no extortion or political objective was established. Mixed reflects both unauthorized viewing of stored information and fraudulent use of the official mailbox.
-
Urschel Laboratories, Inc.
June 4, 2026
DataBreach.com indexed 6,787 rows associated with Urschel Laboratories and dated the breach to June 4, 2026. The Play group listed Urschel Laboratories on its leak site on June 5. Public reporting did not establish the access vector or document encryption, system unavailability, or operational disruption.
-
Affected Hola Browser for Windows users
June 4, 2026
•
[ malware, technology ]
A localized compromise of Hola's software-distribution pipeline caused an undeclared XMRig cryptocurrency miner to be bundled with some Windows installations of Hola Browser. The miner was installed persistently on affected devices and used their processing resources to generate Monero. Hola estimated that approximately 0.1% of users were affected and reported no evidence that user data was accessed or stolen.
-
Undisclosed cryptocurrency software-development organization
June 4, 2026
In an early-2026 intrusion lasting approximately two weeks, JINX-0164 used a fraudulent LinkedIn business approach and a fake virtual-meeting website to induce a developer at an undisclosed cryptocurrency organization to install AUDIOFIX malware on a macOS device. The attackers stole credentials, accessed internal development systems and CI/CD secrets, moved laterally into code repositories, and modified internal source code in an attempt to compromise additional endpoints and steal cryptocurrency-wallet credentials. The specific victim and country were not disclosed.
-
Madison Square Garden Sports Corp.
June 5, 2026
•
[ social, hack, technology ]
ShinyHunters stated that it breached Madison Square Garden on 2026-06-05 by vishing a low-level employee and abusing Microsoft Entra password-reset access, after which it reached cloud applications including Salesforce. The group demanded payment and published approximately 45 GB of data on 2026-06-16. It claimed more than 26 million customer and corporate records, while later analysis identified 9,782,361 unique email addresses and 2,820,221 unique telephone numbers. Reviewed files included internal talent and risk-assessment records, customer correspondence, and employee material. Reviewed reporting did not confirm that facial-recognition images or payment data were included.
-
Undisclosed organizations in education, transportation, healthcare, and finance
June 5, 2026
•
[ ransomware, education, finance ]
Microsoft reported that The Gentlemen ransomware had affected organizations in the education, transportation, healthcare, and financial sectors across North America, South America, Europe, Africa, and Asia. The self-propagating Go-based encryptor could spread through Windows networks, encrypt local volumes and network shares, delete shadow copies, and leave ransom notes. Microsoft tracks the ransomware operators as Storm-2697, while affiliates conduct the intrusions. Exact victim identities, attack dates, disruption duration, and affected-system counts were not disclosed.
-
PT Tempo Inti Media Tbk
June 5, 2026
•
[ hack, ddos, technology ]
Beginning on 2026-06-05, unidentified attackers used bot-generated traffic in an intermittent DDoS attack against Tempo's news website, making it difficult for the public to access. Tempo recorded 24.9 million malicious requests through 2026-06-08, including 12.97 million during one reported two-hour surge. Tempo suspected the attack was intended to interfere with its journalism and may have followed a separate late-May compromise that temporarily unpublished corruption-related articles, but neither the connection nor the perpetrator was confirmed.
-
Wiese USA
June 5, 2026
•
[ leak, technology ]
Termite claimed Wiese USA on June 8, 2026, with threat-intelligence tracking estimating the underlying attack on June 5. DataBreach.com subsequently indexed 229,721 records containing personal information. Litigation filed after the June incident alleges theft and disclosure of personally identifiable information. No independently verified operational disruption has been established.
-
Access Dental & Orthodontics
June 5, 2026
•
[ ransomware, leak, healthcare ]
WorldLeaks listed Access Dental & Orthodontics on its leak site on June 5, 2026 and issued a countdown associated with its extortion claim. DataBreach.com later indexed 322,387 records containing personal and contact information. Access Dental operates a dental-services organization headquartered in Irving, Texas. No independently verified operational disruption has been established.
-
United Auto Supply
June 5, 2026
•
[ ransomware, leak, retail ]
WorldLeaks publicly listed United Auto Supply on June 5, 2026 as part of its data-theft extortion operation. Independent ransomware monitoring captured the same June 5 claim, and DataBreach.com subsequently indexed 826,018 records containing personal, contact, and vehicle information associated with the company. United Auto Supply has not publicly confirmed the incident, and no operational disruption has been independently established.
-
Undisclosed organization in Unit 42 Pink-related extortion investigation
June 5, 2026
•
[ ransomware, phishing, technology ]
Palo Alto Networks Unit 42 investigated an extortion case involving an unnamed organization. On June 1, 2026, an attacker renewed contact in an existing negotiation, supplied a new qTox identifier and a data-leak site associated with the Pink extortion brand, and referenced essentially the same information claimed taken in an earlier extortion notice. Unit 42 described the broader cluster using voice phishing and cloud-service data theft. The specific initial access, actual exfiltration, victim industry and country, and whether the original intruder was identical to the Pink contact were not established. Event date is a publication-date fallback, not a verified theft date.
-
Norsk Tipping AS
June 5, 2026
A third separately reported attack struck Norsk Tipping around noon June 5. Telenor blocked malicious DDoS traffic and online gaming services returned to normal that afternoon. The earlier June 2 and 3 waves had ended, establishing a new disruptive episode. No attacker, ransom demand, or data theft was reported. Sabotage is a contextual inference based on intentional denial of the state-owned operator's services.
-
Nexstar Media Group, Inc.
June 6, 2026
•
[ leak, technology ]
ShinyHunters claimed that it accessed Nexstar Media Group systems on June 6, 2026 and stole more than 1 million Salesforce records and additional internal corporate data. DataBreach.com subsequently indexed 103,128 rows. Nexstar stated that it was investigating reports of a potential IT security incident and that its operations were not disrupted. The company did not publicly confirm the actor's full claimed scope.
-
Strand Fitness Pty Ltd (North Shore)
June 6, 2026
•
[ leak, insider ]
Strand Fitness Pty Ltd confirmed a data breach affecting current and former members of its North Shore gym in Burdell. Queensland Police found gym member information on a USB drive during a police raid in late May 2026 and opened an investigation. Several police officers were among the affected members. Strand Fitness said the information varied by individual and may have included contact details, health information, identity documents, and payment information. The company contacted affected members, notified Queensland Police and the Office of the Australian Information Commissioner, and took additional steps to secure its systems. The breach did not affect the company's other locations. The date, method, duration, perpetrator, motive, and number of affected members were not reported.
-
Evanston Township High School District 202
June 7, 2026
A ransomware incident beginning on 2026-06-07 disrupted Evanston Township High School District 202 systems, internet services, and computer infrastructure. The district closed its campus on 2026-06-08 and 2026-06-09 and canceled summer school, sports camps, and other on-campus activities. The campus later reopened, but system access remained limited and recovery was still underway on 2026-07-06. The district required district-issued devices to be reviewed and reimaged and stated that it had not yet determined whether personal data was accessed or acquired.
-
French Interministerial Directorate for Digital Affairs (DINUM) – Tchap
June 7, 2026
•
[ hack, government, technology ]
On June 7, 2026, an attacker hijacked a Tchap user account and accessed public, unencrypted chat rooms on the French government's messaging platform. DINUM confirmed that 73,467 registered government users were affected and that account information including names, email addresses, affiliated entities, and avatars was potentially exposed. The actor misere additionally claimed theft of 13.5 GB containing more than 643,000 messages and files, but that claim was not independently verified.
-
Undisclosed Turkish defense contractor
June 7, 2026
•
[ espionage, hack, government ]
Beginning on or after June 7, 2026, unidentified operators associated with the FortiBleed campaign used a captured FortiGate VPN session cookie to enter an undisclosed Turkish defense contractor's internal network and access two SMB file shares with an administrator account. They exfiltrated more than 12,000 files totaling 105 GB, including sensitive military documentation, technical files, field imagery, diagnostic records, and employee identification documents.
-
Multiple undisclosed macOS users
June 8, 2026
•
[ malware, technology, hack ]
Operation FlutterBridge used malicious Google advertisements to distribute signed and notarized macOS applications masquerading as a podcast player or PDF viewers. The FlutterShell payload modified Chrome settings to redirect traffic through attacker-controlled advertising sites and provided command execution, file-system manipulation, and environment-variable collection capabilities. Unit 42 observed multiple infected hosts but did not identify individual victims. Because no specific infection date was reported in the supplied source, the publication date is used as the event date.
-
One Medical Seniors via an undisclosed third-party file storage provider
June 8, 2026
•
[ leak, healthcare, technology ]
An unauthorized third party accessed a third-party file storage system containing archived One Medical Seniors patient information between 2026-06-08 and 2026-06-11. One Medical discovered the access on 2026-06-13, revoked access, rotated credentials, and stated that the incident was limited to the storage platform and did not affect other One Medical clinics, services, or its electronic medical record system. ShinyHunters claimed to have stolen 8.8 TB and threatened publication, but One Medical did not publicly attribute the breach or confirm the claimed volume.
