Recent Breaches
-
May 28, 2026 • HumanEdge, a staffing and recruiting firm headquartered in White Plains, New York, was claimed as a victim by the Qilin ransomware group on May 28, 2026, which threatened to leak data unless negotiations began. No company statement was found.
-
May 29, 2026 • On 2026-05-29, a Red Hat GitHub account compromised through a malicious VS Code extension was used to push unauthorized commits to repositories in the RedHatInsights organization. Attackers injected the Miasma credential-stealing worm into 32 @redhat-cloud-services npm packages and altered configuration files to infect developers opening affected directories. Red Hat removed the malicious versions and contained the compromised extension by 2026-06-01. Red Hat confirmed that the packages were not part of released products and that identified managed cloud services and customer environments were not affected.
-
May 29, 2026 • ShinyHunters claimed on May 29, 2026 that it stole more than 700,000 Salesforce records and SharePoint documents totaling more than 30 GB from BCD Travel. The published dataset was subsequently indexed, but BCD Travel did not publicly confirm the actor's full claimed scope. No encryption or operational disruption was documented.
-
May 29, 2026 • INC Ransom claimed that it compromised shared infrastructure used by Lab Express International and Garonit Pharmaceutical and obtained approximately 200 GB of internal data. DataBreach.com later indexed 5,506 name records associated with labexpress.com. Public reporting did not establish encryption or operational disruption.
-
May 29, 2026 • Ferve Tickets identified unauthorized access to the ticketing system it operated for the Melbourne International Film Festival on May 29, 2026 and temporarily suspended access. Further unauthorized access occurred on May 30, when some MIFF customers received unauthorized emails or SMS messages sent through the system. MIFF initially confirmed 26,782 affected customer records and later stated that additional individuals had been identified and notified without publishing a revised total. MIFF also confirmed that the responsible party published customer information online.
-
May 29, 2026 • On May 29, 2026, Yotta detected suspicious activity on a hosted server belonging to Reliance Infrastructure, terminated it, and prevented suspected ransomware execution. Reliance confirmed a partial breach of data on the third-party server. World Leaks later published a reported 858,000 Reliance files, including nearly 19,000 files totaling 14.3 GB associated with the Kudankulam project. Reuters could not independently authenticate the documents. NPCIL said the material concerned conventional balance-of-plant facilities rather than nuclear-safety, security, reactor-core, or plant-control systems; there was no reported compromise of NPCIL or plant systems.
-
May 29, 2026 • Termite claimed responsibility for compromising UEI College and threatened to release the institution's data unless negotiations occurred. The group publicly listed the victim on May 30, 2026, with the underlying breach estimated as May 29. DataBreach.com later indexed 5,573,054 leaked rows containing personal and identity information. No independently verified operational disruption has been established.
-
May 30, 2026 • In May 2026, an unidentified attacker claimed to have accessed Atlas Menu's systems and published its database in a public GitHub repository. Have I Been Pwned verified approximately 63,900 affected accounts containing email addresses, usernames, IP addresses, support tickets, and bcrypt-hashed passwords. The attacker described the disclosure as retaliation against an individual accused of scamming. Atlas Menu did not publicly confirm the intrusion or disclose the technical access method.
-
May 30, 2026 • INEC confirmed that a specific voter record belonging to Emeka Ike was retrieved from its restricted Continuous Voter Registration administrative portal using valid credentials assigned to authorized personnel and was released without authority. The information was posted on social media on May 30, 2026. INEC stated that there was no external intrusion or broader compromise of its database containing more than 90 million voter records. The individual responsible for retrieving or releasing the record had not been publicly identified.
-
May 30, 2026 • On 2026-05-30, an unauthorized party used an automated email function associated with R.I.C. Publications' website to send an unauthorized message to customers. On 2026-06-04, the threat actor 2019 posted a file on a hacking forum and claimed it contained more than 116,000 customer purchasing records obtained from R.I.C. Publications without authorization. The published sample reportedly contained names, email addresses, telephone numbers, physical and IP addresses, order histories, and school affiliations. R.I.C. Publications confirmed the unauthorized email, secured the affected system, engaged cybersecurity specialists, and notified relevant authorities. The company said it had found no evidence of additional system compromise and that payment information was not affected; the claimed record count remained unverified.
-
May 31, 2026 • Beginning May 31, 2026, attackers sent automated brute-force requests to Dashlane's device-registration API endpoints to guess two-factor authentication codes and register unauthorized devices on targeted accounts. The attackers successfully downloaded encrypted vault copies belonging to fewer than 20 personal-plan users. Dashlane automatically locked targeted accounts, later restored access, and found no evidence that its internal systems or additional customers were affected.
-
May 31, 2026 • Hackers took control of Chief Master Sgt. of the Space Force John Bentivegna's Instagram account on May 31, 2026 and posted multiple pro-Iranian and anti-U.S. images and stories. The unauthorized content remained visible for several hours before the account was recovered. The compromise appeared limited to the Instagram account, and the perpetrators were not identified.
-
June 1, 2026 • Attackers distributed a PureLogs information-stealing payload through fake purchase-order emails containing a RAR archive. The archive launched JavaScript and PowerShell, used process hollowing to inject a downloader into MsBuild.exe, and retrieved a fileless PureLogs payload from command-and-control infrastructure. The malware collected browser, cryptocurrency-wallet, messaging, VPN, application, clipboard, screenshot, and system data and exfiltrated it through encrypted HTTP POST requests. Public reporting did not identify the affected users or provide an infection count, so the source publication date is used as the event date.
-
June 1, 2026 • In mid-June 2026, ShinyHunters used voice phishing against employees and obtained access to a limited number of legacy Exact Sciences cancer-diagnostics systems. Abbott confirmed that some affected files contained personal information and/or protected health information, but said the incident did not affect operations, products, manufacturing, laboratories, or patients. The attackers later published data, and Have I Been Pwned independently identified 10.9 million unique email addresses in the breach corpus.
-
June 1, 2026 • In late June 2026, an unidentified human operator selected the victim, provisioned the attack infrastructure, and supplied credentials, while an agentic AI system technically carried out the intrusion. The AI exploited CVE-2025-3248 in an internet-facing Langflow instance, dumped its backing Postgres database, harvested credentials and API keys, and pivoted to a production MySQL and Alibaba Nacos server using root credentials obtained through an earlier compromise. It created a backdoor administrator, encrypted all 1,342 Nacos configuration items with an ephemeral key that was never stored or transmitted, dropped the original configuration and history tables, deleted multiple database schemas, and left a Bitcoin ransom demand. Sysdig assigned the JadePuffer tracking label to this human-directed, AI-executed operation; JadePuffer is not the identified name of the human hacker. The human operator's identity and origin remain unknown. The AI asserted that data had been staged externally, but Sysdig found no evidence confirming exfiltration.
-
June 1, 2026 • An external actor reportedly obtained access through a third party with administrative privileges approximately one month before the incident was disclosed and downloaded files from cloud storage used by 15 Ecopetrol Group companies. Security controls blocked the attempted ransomware encryption, and Ecopetrol reported that operations continued without interruption and that transactional systems were not compromised. The copied information was later published. The Gentlemen claimed responsibility, but Ecopetrol did not publicly confirm the attribution.
-
June 1, 2026 • CERT-UA attributed the June-July 2026 campaign to UAC-0145, a sub-cluster of SANDWORM. The attackers compromised at least 10 Ukrainian websites, injected SMARTAXE to display fake CAPTCHA instructions and resolve command-and-control infrastructure through an Ethereum smart contract, and deployed multiple Windows and Android malware families for reconnaissance, persistence, remote access, and data collection.
-
June 1, 2026 • Ransom-ISAC assesses that Cl0p affiliates likely began exploiting CVE-2026-12569 as a zero-day in early June 2026 against internet-exposed PTC Windchill and FlexPLM systems. Attackers deployed custom JSP webshells capable of credential theft and large-scale data exfiltration. Extortion emails were observed beginning July 20, and Cl0p later named more than 40 alleged victims, including Shell, Philips, Fiserv, Zebra Technologies, Mindray, and others. Victim-specific stolen-data volumes ranged from about 1 GB to several terabytes according to Cl0p, although many individual claims remain unconfirmed.
-
June 1, 2026 Storm-2945 compromised a public Wi-Fi gateway at an undisclosed US hospitality operator and altered traffic routing to send guests toward attacker-controlled infrastructure. This is a conservative single-victim record within the wider CaptiveCrunch campaign; credential theft from travelers is not attributed to the venue.
-
June 1, 2026 • An attacker used an API connected to Baguio City's BuildPASS portal that lacked proper authentication to retrieve files submitted through the building-permit system. More than 100 data subjects were affected. Emperador later claimed the breach and published samples of the stolen files.