DentaQuest, LLC
May 23, 2026
•[ leak, ransomware, healthcare ]
DentaQuest confirmed unauthorized access to a limited portion of its network and said it acted to contain the incident. ShinyHunters claimed responsibility and published approximately 234 GB of allegedly stolen data after negotiations failed. Have I Been Pwned identified information associated with approximately 2.6 million accounts. DentaQuest said its systems remained fully operational with limited customer-service disruption but did not publicly confirm the actor's claimed volume or attribution.
Orion Telecom
May 24, 2026
•[ ddos, technology ]
Orion Telecom experienced a series of DDoS attack waves from 2026-05-24 through 2026-06-07. The company confirmed that the attacks caused service disruptions and affected service quality for some subscribers, with home-internet outages reported from 2026-05-26. Peak attack traffic reached 1.8 Tbps. Orion said layered traffic filtering prevented substantial prolonged service problems. The company declined to identify the attackers. Although it had prepared for possible hacktivist activity around Russia Day, no group claimed the 2026 attacks and the actor type and motive remain undetermined.
North Dallas Shared Ministries (Now-Forward, Inc.)
May 25, 2026
•[ leak, healthcare, finance ]
cmdorganization listed North Dallas Shared Ministries on May 25, 2026 and threatened to publish the full leak unless contacted. DataBreach.com later indexed 188,961 structured records containing personal identifiers and contact information. The organization, now operating as Now-Forward, provides financial assistance, food, clothing, medical and dental care, and other services to low-income residents. Public court dockets show data-breach class-action petitions against the organization, but no victim or regulator notice publicly established the initial access vector, encryption, or operational disruption.
MIP Holdings (Pty) Ltd
May 25, 2026
•[ ransomware, technology, leak ]
The Gentlemen used credentials that an MIP employee had reused on an unrelated service that was previously breached to reach an employee personal laptop and MIP's legacy Atlassian Jira support environment around 25 May 2026. Jira contained screenshots, attachments, personal information and credentials; credentials obtained there also enabled access to certain FTP/SFTP sites. Attackers remained in the environment until detection on 14 June and exfiltrated about 400,000 records. MIP's core policy-administration systems were not compromised. MIP later confirmed paying a substantial ransom for a deletion promise that was not honored.
Plexsupply Inc.
May 26, 2026
•[ leak, retail ]
DataBreach.com indexed 936,468 rows associated with Plexsupply and dated the breach to May 26, 2026. PEAR listed the company on its leak site on May 30. Public reporting did not identify the access vector or document encryption or operational disruption.
ERIELL Group
May 26, 2026
•[ ransomware, energy ]
On or before May 26, 2026, an affiliate of the Nova ransomware operation gained unauthorized access to ERIELL Group and stole corporate data, which the group threatened to publish if the company did not negotiate. Nova subsequently acknowledged that its affiliate had attacked the Uzbekistan-based company, banned the affiliate, claimed that no files were encrypted, and promised not to publish the stolen information.
Baikal Teleport CJSC
May 26, 2026
•[ ddos, technology ]
From 2026-05-26 through 2026-05-28, Baikal Teleport experienced network disruptions caused by a large DDoS attack. The provider confirmed intermittent network outages during the three-day period. The number of affected subscribers, attack volume, perpetrator, and motive were not reported.
Undisclosed external card-printing services provider
May 26, 2026
•[ hack, healthcare, government ]
An undisclosed external card-printing services provider notified Irelands Health Service Executive on the evening of May 26, 2026, that its systems had been attacked and a small number of HSE records had been accessed. HSE systems were not compromised. As a containment measure, HSE paused production of plastic medical, European Health Insurance, GP visit, drugs payment scheme, and long-term illness cards on May 27; plastic-card production remained paused as of July 10. Applications, eligibility, and access to healthcare continued through letters, digital verification, and provisional certificates. The providers identity, registered country, access method, actor, motive, and affected data fields were not disclosed.
Nissan North America, Inc.
May 27, 2026
•[ hack, leak, automotive ]
Between May 27 and June 9, 2026, attackers exploited CVE-2026-35273, a previously unknown vulnerability in Oracle PeopleSoft, and accessed Nissan North America's employee-information environment. Nissan stated that information belonging to current and former employees in the United States, Canada, Mexico, and Brazil may have been stolen. Reporting linked the broader PeopleSoft campaign to ShinyHunters, but Nissan did not publicly attribute its incident to the group.
Sinomax USA
May 28, 2026
•[ ransomware, manufacturing, retail ]
Qilin listed Sinomax USA on May 28, 2026 and threatened to release confidential data unless the company negotiated. DataBreach.com subsequently indexed 96,279 rows associated with the company. Public reporting did not confirm encryption, system unavailability, or operational disruption; therefore, only the achieved data-theft effect is coded.
Group GTI Limited (Oxford CareerConnect platform)
May 28, 2026
•[ hack, leak, technology ]
On May 28, 2026, third-party provider Group GTI informed the University of Oxford that an unauthorized party had accessed the CareerConnect platform through a security vulnerability. The intruder accessed user names, email addresses, and encrypted passwords for non-single-sign-on accounts. GTI patched the vulnerability and added security measures. Oxford's own systems and single-sign-on credentials were not compromised.
EnTrans International LLC
May 28, 2026
•[ ransomware, leak, manufacturing ]
Chaos listed EnTrans International LLC on 28 May, said it had possessed the company's internal data for some time, and threatened publication after a 72-hour deadline. A subsequently published searchable dataset contains personal and vehicle information. EnTrans, which operates as Engineered Transportation International, has not publicly confirmed the incident or disclosed the access method, encryption, or operational impact. No system outage or other operational disruption was identified in public reporting.
Providence Medical Group
May 28, 2026
•[ ransomware, healthcare ]
Providence Medical Group, a physician practice group in the Dayton, Ohio area, was claimed by the Qilin ransomware group on May 28, 2026; a 346,802-row dataset with SSNs and birth dates was later indexed. The group has not publicly confirmed the incident.
HumanEdge
May 28, 2026
•[ ransomware, technology ]
HumanEdge, a staffing and recruiting firm headquartered in White Plains, New York, was claimed as a victim by the Qilin ransomware group on May 28, 2026, which threatened to leak data unless negotiations began. No company statement was found.
Red Hat, Inc.
May 29, 2026
•[ hack, malware, technology ]
On 2026-05-29, a Red Hat GitHub account compromised through a malicious VS Code extension was used to push unauthorized commits to repositories in the RedHatInsights organization. Attackers injected the Miasma credential-stealing worm into 32 @redhat-cloud-services npm packages and altered configuration files to infect developers opening affected directories. Red Hat removed the malicious versions and contained the compromised extension by 2026-06-01. Red Hat confirmed that the packages were not part of released products and that identified managed cloud services and customer environments were not affected.
BCD Travel
May 29, 2026
•[ leak, technology ]
ShinyHunters claimed on May 29, 2026 that it stole more than 700,000 Salesforce records and SharePoint documents totaling more than 30 GB from BCD Travel. The published dataset was subsequently indexed, but BCD Travel did not publicly confirm the actor's full claimed scope. No encryption or operational disruption was documented.
Lab Express International, Inc.
May 29, 2026
•[ ransomware, healthcare, technology ]
INC Ransom claimed that it compromised shared infrastructure used by Lab Express International and Garonit Pharmaceutical and obtained approximately 200 GB of internal data. DataBreach.com later indexed 5,506 name records associated with labexpress.com. Public reporting did not establish encryption or operational disruption.
Vallez Pty Ltd (Ferve Tickets)
May 29, 2026
•[ hack, leak, technology ]
Ferve Tickets identified unauthorized access to the ticketing system it operated for the Melbourne International Film Festival on May 29, 2026 and temporarily suspended access. Further unauthorized access occurred on May 30, when some MIFF customers received unauthorized emails or SMS messages sent through the system. MIFF initially confirmed 26,782 affected customer records and later stated that additional individuals had been identified and notified without publishing a revised total. MIFF also confirmed that the responsible party published customer information online.
Reliance Infrastructure Limited
May 29, 2026
•[ ransomware, leak, energy ]
On May 29, 2026, Yotta detected suspicious activity on a hosted server belonging to Reliance Infrastructure, terminated it, and prevented suspected ransomware execution. Reliance confirmed a partial breach of data on the third-party server. World Leaks later published a reported 858,000 Reliance files, including nearly 19,000 files totaling 14.3 GB associated with the Kudankulam project. Reuters could not independently authenticate the documents. NPCIL said the material concerned conventional balance-of-plant facilities rather than nuclear-safety, security, reactor-core, or plant-control systems; there was no reported compromise of NPCIL or plant systems.
UEI College
May 29, 2026
•[ ransomware, leak, education ]
Termite claimed responsibility for compromising UEI College and threatened to release the institution's data unless negotiations occurred. The group publicly listed the victim on May 30, 2026, with the underlying breach estimated as May 29. DataBreach.com later indexed 5,573,054 leaked rows containing personal and identity information. No independently verified operational disruption has been established.
