-
Undisclosed operators of at least 10 Ukrainian websites and infected device users
June 1, 2026
•
[ espionage, malware, government ]
CERT-UA attributed the June-July 2026 campaign to UAC-0145, a sub-cluster of SANDWORM. The attackers compromised at least 10 Ukrainian websites, injected SMARTAXE to display fake CAPTCHA instructions and resolve command-and-control infrastructure through an Ethereum smart contract, and deployed multiple Windows and Android malware families for reconnaissance, persistence, remote access, and data collection.
-
At least one PTC Windchill/FlexPLM customer
June 1, 2026
•
[ ransomware, technology, finance ]
Ransom-ISAC assesses that Cl0p affiliates likely began exploiting CVE-2026-12569 as a zero-day in early June 2026 against internet-exposed PTC Windchill and FlexPLM systems. Attackers deployed custom JSP webshells capable of credential theft and large-scale data exfiltration. Extortion emails were observed beginning July 20, and Cl0p later named more than 40 alleged victims, including Shell, Philips, Fiserv, Zebra Technologies, Mindray, and others. Victim-specific stolen-data volumes ranged from about 1 GB to several terabytes according to Cl0p, although many individual claims remain unconfirmed.
-
Undisclosed United States hospitality Wi-Fi operator
June 1, 2026
Storm-2945 compromised a public Wi-Fi gateway at an undisclosed US hospitality operator and altered traffic routing to send guests toward attacker-controlled infrastructure. This is a conservative single-victim record within the wider CaptiveCrunch campaign; credential theft from travelers is not attributed to the venue.
-
City Government of Baguio
June 1, 2026
•
[ leak, government, misconfiguration ]
An attacker used an API connected to Baguio City's BuildPASS portal that lacked proper authentication to retrieve files submitted through the building-permit system. More than 100 data subjects were affected. Emperador later claimed the breach and published samples of the stolen files.
-
Undisclosed organization operating an Azure tenant
June 1, 2026
•
[ hack, technology ]
In early June 2026, JadePuffer (Microsoft Storm-3168) used two compromised Azure service principals belonging to one undisclosed tenant. One identity enumerated cloud assets and a second deleted most of more than 100 targeted storage accounts plus a Key Vault, Function App and App Service plan. The operator also retrieved storage account access keys. Attempts to delete Azure SQL databases and recovery-protection locks failed; no ransom note or exfiltration of stored customer/business files was verified.
-
City of McMinnville
June 1, 2026
•
[ ransomware, government ]
An intruder accessed and copied files from the City of McMinnville network during an interval between June 1 and July 18, 2026. City staff detected unusual activity around July 15. The RansomHouse extortion group subsequently claimed the compromise and posted apparently stolen city data on its dark web site in August. Local reporters observed apparently municipal and police records, and the city later notified affected individuals about possible exposure of identity information. No completed encryption or confirmed service outage was established.
-
Hollard Insurance Group
June 1, 2026
•
[ ransomware, finance, technology ]
South African insurer Hollard's funeral-policyholder data was leaked by The Gentlemen in Sept. 2026 after a June 2026 extortion breach of its administrator MIP Holdings' Jira platform. Hollard says its own systems were not compromised and notified affected customers.
-
PrivatBank
June 1, 2026
•
[ hack, ddos, finance ]
PrivatBank, Ukraine's largest state-owned bank, said an 'unusual' DDoS attack using infected devices of Ukrainian users caused a June 2026 failure of its services, blocking some legitimate customers during filtering. The bank blamed Russia; August outages were a supplier fault.
-
TVING Corporation
June 2, 2026
•
[ leak, technology ]
TVING confirmed unauthorized access to and extraction from its account database on June 2, 2026, after abnormal activity from May 30. September government findings revised the scope to approximately 39.54 million account records, including dormant and test accounts, and reported exposure of some source-code files and encryption keys. The company blocked attacker access and reported the incident to Korean authorities. The attacker has not been publicly identified. This updates the previously coded June incident and is not a second breach.
-
Australian Centre for the Moving Image
June 2, 2026
•
[ leak, hack, technology ]
On June 2, 2026, ACMI identified and contained unauthorized access affecting a third-party system supporting its Cinema 3 online streaming service. The threat actor 2019 published three datasets allegedly containing information from more than 25,000 customers, while ACMI confirmed that names, email addresses, IP addresses, and rental details were exposed but passwords and financial information were not.
-
Indian Institute of Technology Roorkee
June 2, 2026
•
[ leak, misconfiguration, education ]
On June 2, 2026, cybersecurity researcher Rylen Anil discovered that a cloud-storage component supporting IIT Roorkees JEE Advanced results system allowed candidate files to be accessed without authentication. Anil downloaded a small number of files to verify the exposure and reported the issue, after which IIT Roorkee restricted access and said its logs showed no bulk download and access to less than 0.05% of the stored data.
-
Canopy Brands
June 2, 2026
•
[ leak, manufacturing ]
Settra publicly listed canopybrands.us on June 26, 2026 and said it would publish the remaining data after releasing a sample. DataBreach.com indexed 12,130 structured records dated June 2 containing names, email addresses, and phone numbers. Canopy Brands is a Concord, North Carolina-based manufacturer and holding company for safety, access, mobility, and infrastructure-product businesses. No victim statement or independent reporting confirmed the initial access vector, encryption, or operational disruption.
-
C2M LLC d/b/a Click2Mail
June 2, 2026
•
[ financial, leak, technology ]
A Click2Mail customer reported that the company's online debit-card checkout process was hijacked on June 2 and again later in the summer, with payment-card information captured during checkout and subsequently associated with fraudulent use. Other customers also publicly reported card fraud following Click2Mail transactions. C2M LLC later filed a breach notice with the Vermont Attorney General on September 15 confirming exposure of financial account codes and credit and debit account information affecting at least seven Vermont residents. The regulatory filing confirms the data exposure but does not disclose the technical intrusion method, full compromise window, total victim count, or responsible actor.
-
Norsk Tipping AS
June 2, 2026
•
[ ddos, hack, technology ]
A DDoS attack against Norsk Tipping began shortly before 20:30 June 2 and intensified about 21:00, overloading gaming services, especially KongKasino. Telenor mitigated the traffic and the company said traffic normalized about 23:00. No customer-data breach was reported. The operator remains unidentified. Sabotage is inferred from deliberate service interference against a government-owned national gambling operator, not from a proven political or financial demand.
-
Edgewood Surgical Hospital
June 3, 2026
TheGentlemen listed Edgewood Surgical Hospital in early June 2026 and claimed theft of approximately 500 GB of patient medical and surgical information. DataBreach.com subsequently indexed 4,901 rows associated with the hospital. Public reporting did not document attacker-caused encryption or operational disruption.
-
PHOBS d.o.o.
June 3, 2026
•
[ hack, phishing, technology ]
On June 3, 2026, unauthorized actors accessed guest reservation data stored in the PHOBS reservation-management platform. PHOBS said approximately 100,000 booking records may have been affected, exposing information that could be used in targeted phishing and fraudulent payment messages, while payment-card data was not compromised.
-
Norsk Tipping AS
June 3, 2026
•
[ ddos, hack, technology ]
On June 3, after the previous evening's DDoS had been contained and service restored, Norsk Tipping experienced another traffic-flooding attack. Customers reported delays and failed access to some online games. The company confirmed restoration around 23:00, with no data compromise. The attacker was not identified. Sabotage is inferred from repeated efforts to obstruct this state-owned public gambling service.
-
States of Guernsey — Committee for Education, Sport & Culture
June 3, 2026
•
[ social, phishing, government ]
On June 3, an attacker obtained unauthorized access to a Guernsey education employee email account and used it to send a malicious link. The mailbox remained accessible to the intruder for approximately one month and contained information relating to 74 individuals. Officials confirmed the breach but reported no evidence of data exfiltration beyond the Education IT environment. Criminal and Financial are limited inferences from the phishing/credential-abuse pattern; no extortion or political objective was established. Mixed reflects both unauthorized viewing of stored information and fraudulent use of the official mailbox.
-
Urschel Laboratories, Inc.
June 4, 2026
DataBreach.com indexed 6,787 rows associated with Urschel Laboratories and dated the breach to June 4, 2026. The Play group listed Urschel Laboratories on its leak site on June 5. Public reporting did not establish the access vector or document encryption, system unavailability, or operational disruption.
-
Affected Hola Browser for Windows users
June 4, 2026
•
[ malware, technology ]
A localized compromise of Hola's software-distribution pipeline caused an undeclared XMRig cryptocurrency miner to be bundled with some Windows installations of Hola Browser. The miner was installed persistently on affected devices and used their processing resources to generate Monero. Hola estimated that approximately 0.1% of users were affected and reported no evidence that user data was accessed or stolen.
