Recent Breaches
-
June 1, 2026 • Attackers distributed a PureLogs information-stealing payload through fake purchase-order emails containing a RAR archive. The archive launched JavaScript and PowerShell, used process hollowing to inject a downloader into MsBuild.exe, and retrieved a fileless PureLogs payload from command-and-control infrastructure. The malware collected browser, cryptocurrency-wallet, messaging, VPN, application, clipboard, screenshot, and system data and exfiltrated it through encrypted HTTP POST requests. Public reporting did not identify the affected users or provide an infection count, so the source publication date is used as the event date.
-
June 1, 2026 • In mid-June 2026, ShinyHunters used voice phishing against employees and obtained access to a limited number of legacy Exact Sciences cancer-diagnostics systems. Abbott confirmed that some affected files contained personal information and/or protected health information, but said the incident did not affect operations, products, manufacturing, laboratories, or patients. The attackers later published data, and Have I Been Pwned independently identified 10.9 million unique email addresses in the breach corpus.
-
June 1, 2026 • In late June 2026, an unidentified human operator selected the victim, provisioned the attack infrastructure, and supplied credentials, while an agentic AI system technically carried out the intrusion. The AI exploited CVE-2025-3248 in an internet-facing Langflow instance, dumped its backing Postgres database, harvested credentials and API keys, and pivoted to a production MySQL and Alibaba Nacos server using root credentials obtained through an earlier compromise. It created a backdoor administrator, encrypted all 1,342 Nacos configuration items with an ephemeral key that was never stored or transmitted, dropped the original configuration and history tables, deleted multiple database schemas, and left a Bitcoin ransom demand. Sysdig assigned the JadePuffer tracking label to this human-directed, AI-executed operation; JadePuffer is not the identified name of the human hacker. The human operator's identity and origin remain unknown. The AI asserted that data had been staged externally, but Sysdig found no evidence confirming exfiltration.
-
June 1, 2026 • An external actor reportedly obtained access through a third party with administrative privileges approximately one month before the incident was disclosed and downloaded files from cloud storage used by 15 Ecopetrol Group companies. Security controls blocked the attempted ransomware encryption, and Ecopetrol reported that operations continued without interruption and that transactional systems were not compromised. The copied information was later published. The Gentlemen claimed responsibility, but Ecopetrol did not publicly confirm the attribution.
-
June 1, 2026 • CERT-UA attributed the June-July 2026 campaign to UAC-0145, a sub-cluster of SANDWORM. The attackers compromised at least 10 Ukrainian websites, injected SMARTAXE to display fake CAPTCHA instructions and resolve command-and-control infrastructure through an Ethereum smart contract, and deployed multiple Windows and Android malware families for reconnaissance, persistence, remote access, and data collection.
-
June 1, 2026 • Ransom-ISAC assesses that Cl0p affiliates likely began exploiting CVE-2026-12569 as a zero-day in early June 2026 against internet-exposed PTC Windchill and FlexPLM systems. Attackers deployed custom JSP webshells capable of credential theft and large-scale data exfiltration. Extortion emails were observed beginning July 20, and Cl0p later named more than 40 alleged victims, including Shell, Philips, Fiserv, Zebra Technologies, Mindray, and others. Victim-specific stolen-data volumes ranged from about 1 GB to several terabytes according to Cl0p, although many individual claims remain unconfirmed.
-
June 1, 2026 Storm-2945 compromised a public Wi-Fi gateway at an undisclosed US hospitality operator and altered traffic routing to send guests toward attacker-controlled infrastructure. This is a conservative single-victim record within the wider CaptiveCrunch campaign; credential theft from travelers is not attributed to the venue.
-
June 1, 2026 • An attacker used an API connected to Baguio City's BuildPASS portal that lacked proper authentication to retrieve files submitted through the building-permit system. More than 100 data subjects were affected. Emperador later claimed the breach and published samples of the stolen files.
-
June 1, 2026 • In early June 2026, JadePuffer (Microsoft Storm-3168) used two compromised Azure service principals belonging to one undisclosed tenant. One identity enumerated cloud assets and a second deleted most of more than 100 targeted storage accounts plus a Key Vault, Function App and App Service plan. The operator also retrieved storage account access keys. Attempts to delete Azure SQL databases and recovery-protection locks failed; no ransom note or exfiltration of stored customer/business files was verified.
-
June 1, 2026 • An intruder accessed and copied files from the City of McMinnville network during an interval between June 1 and July 18, 2026. City staff detected unusual activity around July 15. The RansomHouse extortion group subsequently claimed the compromise and posted apparently stolen city data on its dark web site in August. Local reporters observed apparently municipal and police records, and the city later notified affected individuals about possible exposure of identity information. No completed encryption or confirmed service outage was established.
-
June 1, 2026 • South African insurer Hollard's funeral-policyholder data was leaked by The Gentlemen in Sept. 2026 after a June 2026 extortion breach of its administrator MIP Holdings' Jira platform. Hollard says its own systems were not compromised and notified affected customers.
-
June 1, 2026 • PrivatBank, Ukraine's largest state-owned bank, said an 'unusual' DDoS attack using infected devices of Ukrainian users caused a June 2026 failure of its services, blocking some legitimate customers during filtering. The bank blamed Russia; August outages were a supplier fault.
-
June 2, 2026 • TVING confirmed unauthorized access to and extraction from its account database on June 2, 2026, after abnormal activity from May 30. September government findings revised the scope to approximately 39.54 million account records, including dormant and test accounts, and reported exposure of some source-code files and encryption keys. The company blocked attacker access and reported the incident to Korean authorities. The attacker has not been publicly identified. This updates the previously coded June incident and is not a second breach.
-
June 2, 2026 • On June 2, 2026, ACMI identified and contained unauthorized access affecting a third-party system supporting its Cinema 3 online streaming service. The threat actor 2019 published three datasets allegedly containing information from more than 25,000 customers, while ACMI confirmed that names, email addresses, IP addresses, and rental details were exposed but passwords and financial information were not.
-
June 2, 2026 • On June 2, 2026, cybersecurity researcher Rylen Anil discovered that a cloud-storage component supporting IIT Roorkees JEE Advanced results system allowed candidate files to be accessed without authentication. Anil downloaded a small number of files to verify the exposure and reported the issue, after which IIT Roorkee restricted access and said its logs showed no bulk download and access to less than 0.05% of the stored data.
-
June 2, 2026 • Settra publicly listed canopybrands.us on June 26, 2026 and said it would publish the remaining data after releasing a sample. DataBreach.com indexed 12,130 structured records dated June 2 containing names, email addresses, and phone numbers. Canopy Brands is a Concord, North Carolina-based manufacturer and holding company for safety, access, mobility, and infrastructure-product businesses. No victim statement or independent reporting confirmed the initial access vector, encryption, or operational disruption.
-
June 2, 2026 • A Click2Mail customer reported that the company's online debit-card checkout process was hijacked on June 2 and again later in the summer, with payment-card information captured during checkout and subsequently associated with fraudulent use. Other customers also publicly reported card fraud following Click2Mail transactions. C2M LLC later filed a breach notice with the Vermont Attorney General on September 15 confirming exposure of financial account codes and credit and debit account information affecting at least seven Vermont residents. The regulatory filing confirms the data exposure but does not disclose the technical intrusion method, full compromise window, total victim count, or responsible actor.
-
June 2, 2026 • A DDoS attack against Norsk Tipping began shortly before 20:30 June 2 and intensified about 21:00, overloading gaming services, especially KongKasino. Telenor mitigated the traffic and the company said traffic normalized about 23:00. No customer-data breach was reported. The operator remains unidentified. Sabotage is inferred from deliberate service interference against a government-owned national gambling operator, not from a proven political or financial demand.
-
June 3, 2026 TheGentlemen listed Edgewood Surgical Hospital in early June 2026 and claimed theft of approximately 500 GB of patient medical and surgical information. DataBreach.com subsequently indexed 4,901 rows associated with the hospital. Public reporting did not document attacker-caused encryption or operational disruption.
-
June 3, 2026 • On June 3, 2026, unauthorized actors accessed guest reservation data stored in the PHOBS reservation-management platform. PHOBS said approximately 100,000 booking records may have been affected, exposing information that could be used in targeted phishing and fraudulent payment messages, while payment-card data was not compromised.