ERIELL Group
May 26, 2026
•[ ransomware, energy ]
On or before May 26, 2026, an affiliate of the Nova ransomware operation gained unauthorized access to ERIELL Group and stole corporate data, which the group threatened to publish if the company did not negotiate. Nova subsequently acknowledged that its affiliate had attacked the Uzbekistan-based company, banned the affiliate, claimed that no files were encrypted, and promised not to publish the stolen information.
Baikal Teleport CJSC
May 26, 2026
•[ ddos, technology ]
From 2026-05-26 through 2026-05-28, Baikal Teleport experienced network disruptions caused by a large DDoS attack. The provider confirmed intermittent network outages during the three-day period. The number of affected subscribers, attack volume, perpetrator, and motive were not reported.
Undisclosed external card-printing services provider
May 26, 2026
•[ hack, healthcare, government ]
An undisclosed external card-printing services provider notified Irelands Health Service Executive on the evening of May 26, 2026, that its systems had been attacked and a small number of HSE records had been accessed. HSE systems were not compromised. As a containment measure, HSE paused production of plastic medical, European Health Insurance, GP visit, drugs payment scheme, and long-term illness cards on May 27; plastic-card production remained paused as of July 10. Applications, eligibility, and access to healthcare continued through letters, digital verification, and provisional certificates. The providers identity, registered country, access method, actor, motive, and affected data fields were not disclosed.
Nissan North America, Inc.
May 27, 2026
•[ hack, leak, automotive ]
Between May 27 and June 9, 2026, attackers exploited CVE-2026-35273, a previously unknown vulnerability in Oracle PeopleSoft, and accessed Nissan North America's employee-information environment. Nissan stated that information belonging to current and former employees in the United States, Canada, Mexico, and Brazil may have been stolen. Reporting linked the broader PeopleSoft campaign to ShinyHunters, but Nissan did not publicly attribute its incident to the group.
Sinomax USA
May 28, 2026
•[ ransomware, manufacturing, retail ]
Qilin listed Sinomax USA on May 28, 2026 and threatened to release confidential data unless the company negotiated. DataBreach.com subsequently indexed 96,279 rows associated with the company. Public reporting did not confirm encryption, system unavailability, or operational disruption; therefore, only the achieved data-theft effect is coded.
Group GTI Limited (Oxford CareerConnect platform)
May 28, 2026
•[ hack, leak, technology ]
On May 28, 2026, third-party provider Group GTI informed the University of Oxford that an unauthorized party had accessed the CareerConnect platform through a security vulnerability. The intruder accessed user names, email addresses, and encrypted passwords for non-single-sign-on accounts. GTI patched the vulnerability and added security measures. Oxford's own systems and single-sign-on credentials were not compromised.
EnTrans International LLC
May 28, 2026
•[ ransomware, leak, manufacturing ]
Chaos listed EnTrans International LLC on 28 May, said it had possessed the company's internal data for some time, and threatened publication after a 72-hour deadline. A subsequently published searchable dataset contains personal and vehicle information. EnTrans, which operates as Engineered Transportation International, has not publicly confirmed the incident or disclosed the access method, encryption, or operational impact. No system outage or other operational disruption was identified in public reporting.
Providence Medical Group
May 28, 2026
•[ ransomware, healthcare ]
Providence Medical Group, a physician practice group in the Dayton, Ohio area, was claimed by the Qilin ransomware group on May 28, 2026; a 346,802-row dataset with SSNs and birth dates was later indexed. The group has not publicly confirmed the incident.
HumanEdge
May 28, 2026
•[ ransomware, technology ]
HumanEdge, a staffing and recruiting firm headquartered in White Plains, New York, was claimed as a victim by the Qilin ransomware group on May 28, 2026, which threatened to leak data unless negotiations began. No company statement was found.
Red Hat, Inc.
May 29, 2026
•[ hack, malware, technology ]
On 2026-05-29, a Red Hat GitHub account compromised through a malicious VS Code extension was used to push unauthorized commits to repositories in the RedHatInsights organization. Attackers injected the Miasma credential-stealing worm into 32 @redhat-cloud-services npm packages and altered configuration files to infect developers opening affected directories. Red Hat removed the malicious versions and contained the compromised extension by 2026-06-01. Red Hat confirmed that the packages were not part of released products and that identified managed cloud services and customer environments were not affected.
BCD Travel
May 29, 2026
•[ leak, technology ]
ShinyHunters claimed on May 29, 2026 that it stole more than 700,000 Salesforce records and SharePoint documents totaling more than 30 GB from BCD Travel. The published dataset was subsequently indexed, but BCD Travel did not publicly confirm the actor's full claimed scope. No encryption or operational disruption was documented.
Lab Express International, Inc.
May 29, 2026
•[ ransomware, healthcare, technology ]
INC Ransom claimed that it compromised shared infrastructure used by Lab Express International and Garonit Pharmaceutical and obtained approximately 200 GB of internal data. DataBreach.com later indexed 5,506 name records associated with labexpress.com. Public reporting did not establish encryption or operational disruption.
Vallez Pty Ltd (Ferve Tickets)
May 29, 2026
•[ hack, leak, technology ]
Ferve Tickets identified unauthorized access to the ticketing system it operated for the Melbourne International Film Festival on May 29, 2026 and temporarily suspended access. Further unauthorized access occurred on May 30, when some MIFF customers received unauthorized emails or SMS messages sent through the system. MIFF initially confirmed 26,782 affected customer records and later stated that additional individuals had been identified and notified without publishing a revised total. MIFF also confirmed that the responsible party published customer information online.
Reliance Infrastructure Limited
May 29, 2026
•[ ransomware, leak, energy ]
On May 29, 2026, Yotta detected suspicious activity on a hosted server belonging to Reliance Infrastructure, terminated it, and prevented suspected ransomware execution. Reliance confirmed a partial breach of data on the third-party server. World Leaks later published a reported 858,000 Reliance files, including nearly 19,000 files totaling 14.3 GB associated with the Kudankulam project. Reuters could not independently authenticate the documents. NPCIL said the material concerned conventional balance-of-plant facilities rather than nuclear-safety, security, reactor-core, or plant-control systems; there was no reported compromise of NPCIL or plant systems.
UEI College
May 29, 2026
•[ ransomware, leak, education ]
Termite claimed responsibility for compromising UEI College and threatened to release the institution's data unless negotiations occurred. The group publicly listed the victim on May 30, 2026, with the underlying breach estimated as May 29. DataBreach.com later indexed 5,573,054 leaked rows containing personal and identity information. No independently verified operational disruption has been established.
Atlas Menu
May 30, 2026
•[ leak, hack, technology ]
In May 2026, an unidentified attacker claimed to have accessed Atlas Menu's systems and published its database in a public GitHub repository. Have I Been Pwned verified approximately 63,900 affected accounts containing email addresses, usernames, IP addresses, support tickets, and bcrypt-hashed passwords. The attacker described the disclosure as retaliation against an individual accused of scamming. Atlas Menu did not publicly confirm the intrusion or disclose the technical access method.
Independent National Electoral Commission (INEC)
May 30, 2026
•[ insider, leak, government ]
INEC confirmed that a specific voter record belonging to Emeka Ike was retrieved from its restricted Continuous Voter Registration administrative portal using valid credentials assigned to authorized personnel and was released without authority. The information was posted on social media on May 30, 2026. INEC stated that there was no external intrusion or broader compromise of its database containing more than 90 million voter records. The individual responsible for retrieving or releasing the record had not been publicly identified.
R.I.C. Publications Pty Ltd
May 30, 2026
•[ leak, education, technology ]
On 2026-05-30, an unauthorized party used an automated email function associated with R.I.C. Publications' website to send an unauthorized message to customers. On 2026-06-04, the threat actor 2019 posted a file on a hacking forum and claimed it contained more than 116,000 customer purchasing records obtained from R.I.C. Publications without authorization. The published sample reportedly contained names, email addresses, telephone numbers, physical and IP addresses, order histories, and school affiliations. R.I.C. Publications confirmed the unauthorized email, secured the affected system, engaged cybersecurity specialists, and notified relevant authorities. The company said it had found no evidence of additional system compromise and that payment information was not affected; the claimed record count remained unverified.
Dashlane personal-plan users
May 31, 2026
•[ brute-force, technology, leak ]
Beginning May 31, 2026, attackers sent automated brute-force requests to Dashlane's device-registration API endpoints to guess two-factor authentication codes and register unauthorized devices on targeted accounts. The attackers successfully downloaded encrypted vault copies belonging to fewer than 20 personal-plan users. Dashlane automatically locked targeted accounts, later restored access, and found no evidence that its internal systems or additional customers were affected.
Chief Master Sgt. John Bentivegna (U.S. Space Force)
May 31, 2026
•[ hack, social, government ]
Hackers took control of Chief Master Sgt. of the Space Force John Bentivegna's Instagram account on May 31, 2026 and posted multiple pro-Iranian and anti-U.S. images and stories. The unauthorized content remained visible for several hours before the account was recovered. The compromise appeared limited to the Instagram account, and the perpetrators were not identified.
