World Food Programme
May 14, 2026
•[ leak, government, technology ]
On 2026-05-14, unauthorized actors accessed the World Food Programme's Self-Registration Application for Palestine, which Gaza residents used to register for food and cash assistance. The breach exposed names, identification numbers, mobile telephone numbers, and location data associated with approximately 600,000 households. WFP stated that the incident was isolated to the Palestine application, temporarily shut down the platform, contained the intrusion, and strengthened security controls. No actor claimed responsibility, and the access method was not disclosed.
Krum Public Library
May 14, 2026
•[ ransomware, government, financial ]
Krum Public Library detected unusual network activity on May 14, 2026 and later confirmed a ransomware attack limited to the library environment. Computer access, printing, and Wi-Fi were unavailable, and checkout was temporarily limited to five items. Forensic investigators determined that some library network files had been accessed without authorization, although the city said Social Security numbers and personal financial account information were not affected. NightSpire claimed responsibility and described financial and human-resources data, but the city did not confirm the attribution or claimed contents.
Undisclosed U.S. gas station operators in multiple states
May 15, 2026
•[ espionage, misconfiguration, energy ]
Attackers breached internet-connected automatic tank gauge systems serving gas stations in multiple U.S. states by accessing devices that lacked password protection. The intruders altered displayed fuel-level readings but could not change the actual amount of fuel in the tanks, and no physical damage or safety incidents were reported. U.S. officials suspected Iranian state-sponsored actors, but no specific Iranian group was publicly identified.
United States Department of Homeland Security
May 15, 2026
•[ espionage, hack, malware ]
An unidentified actor compromised DHS's Homeland Security Information Network servers and an associated SharePoint environment. From May 15 through May 24, analysts observed altered files on testing and production servers, malicious code executed through a legitimate web-server program, and deleted activity logs, but the activity was dismissed as a false positive. Similar activity continued from May 25 through June 3. On June 4, the attackers installed hidden backdoors and stole credential files, prompting confirmation of the breach. DHS isolated affected systems and mitigated the vulnerability; HSIN remained operational, classified networks were not affected, and neither the actor nor any theft of additional HSIN documents had been established.
KDDI Corporation
May 16, 2026
•[ leak, technology ]
Beginning on May 16, 2026, an unidentified actor exploited a previously unknown vulnerability in third-party software embedded in KDDI's centrally operated email platform for internet service providers and acquired email-account credentials stored in the shared system. KDDI detected and blocked the unauthorized access on June 17; its investigation confirmed exposure of 12,233,087 email addresses and 7,616,173 associated passwords across services provided to STNet, KDDI Web Communications, JCOM, Chubu Telecommunications, NIFTY, and BIGLOBE. KDDI found no suspicious access beyond the exploited component, and its separate au, UQ mobile, and au one net email systems were unaffected.
HDFC Asset Management Company Limited
May 16, 2026
•[ ransomware, leak, finance ]
On 16 May, an HDFC AMC IT administrator detected suspicious activity, and the company received an email from Morpheus claiming to have exfiltrated more than 680 GB of data. HDFC AMC activated containment procedures, isolated affected systems, engaged cybersecurity specialists, and notified regulators and law enforcement. On 29 May, the Bombay High Court restrained Morpheus and others from publishing or using the data. HDFC AMC later said the incident did not interrupt business continuity, did not materially affect its financial results, and did not affect investors' units or portfolio values. The initial access method was not disclosed.
Mid-Cumberland Human Resource Agency
May 18, 2026
•[ ransomware, healthcare, government ]
Insomnia claimed Mid-Cumberland Human Resource Agency as a victim in June 2026 and threatened publication of stolen information. DataBreach.com indexes 196,568 records and dates the underlying breach to May 18, 2026. MCHRA is a Nashville-based nonprofit providing social, health-support, meals, transit, and related human services. No independently verified operational disruption has been established.
Connecticut Department of Children and Families
May 20, 2026
•[ phishing, government ]
An external phishing email compromised two Connecticut Department of Children and Families employee accounts on May 20, 2026, allowing an outside attacker to download emails. State IT personnel removed the attacker the same day, pulled the malicious email from agency inboxes, and temporarily disabled the two accounts. The review and law-enforcement investigation remained active; no operational disruption was reported.
Fox Rothschild LLP
May 21, 2026
•[ ransomware, social, finance ]
On 2026-05-21, a sophisticated social-engineering incident enabled unauthorized access associated with one Fox Rothschild user device. Fox Rothschild stated that the activity was limited to that device and that it found no broader access to the firm's systems or network. Silent Ransom Group claimed responsibility, said it exfiltrated confidential client files, demanded payment, and later published data after the ransom deadline passed. The actor attribution, stolen-data scope, and publication details are based on the group's claim and subsequent reporting.
Clark County School District
May 22, 2026
•[ hack, phishing, financial ]
Hackers scammed three Clark County School District employees, accessed their login credentials, and used direct-deposit information to fraudulently withdraw money from the employees accounts.
Baker Distributing Company LLC
May 23, 2026
•[ leak, technology, retail ]
ShinyHunters claimed on May 23, 2026 that it accessed Baker Distributing's Salesforce and SharePoint environments and stole customer, employee, lead, and support-ticket data. The data was subsequently published and indexed, but Baker Distributing did not publicly confirm the actor's full claimed scope. No encryption or operational disruption was documented.
DentaQuest, LLC
May 23, 2026
•[ leak, ransomware, healthcare ]
DentaQuest confirmed unauthorized access to a limited portion of its network and said it acted to contain the incident. ShinyHunters claimed responsibility and published approximately 234 GB of allegedly stolen data after negotiations failed. Have I Been Pwned identified information associated with approximately 2.6 million accounts. DentaQuest said its systems remained fully operational with limited customer-service disruption but did not publicly confirm the actor's claimed volume or attribution.
Orion Telecom
May 24, 2026
•[ ddos, technology ]
Orion Telecom experienced a series of DDoS attack waves from 2026-05-24 through 2026-06-07. The company confirmed that the attacks caused service disruptions and affected service quality for some subscribers, with home-internet outages reported from 2026-05-26. Peak attack traffic reached 1.8 Tbps. Orion said layered traffic filtering prevented substantial prolonged service problems. The company declined to identify the attackers. Although it had prepared for possible hacktivist activity around Russia Day, no group claimed the 2026 attacks and the actor type and motive remain undetermined.
North Dallas Shared Ministries (Now-Forward, Inc.)
May 25, 2026
•[ leak, healthcare, finance ]
cmdorganization listed North Dallas Shared Ministries on May 25, 2026 and threatened to publish the full leak unless contacted. DataBreach.com later indexed 188,961 structured records containing personal identifiers and contact information. The organization, now operating as Now-Forward, provides financial assistance, food, clothing, medical and dental care, and other services to low-income residents. Public court dockets show data-breach class-action petitions against the organization, but no victim or regulator notice publicly established the initial access vector, encryption, or operational disruption.
MIP Holdings (Pty) Ltd
May 25, 2026
•[ ransomware, technology, leak ]
The Gentlemen used credentials that an MIP employee had reused on an unrelated service that was previously breached to reach an employee personal laptop and MIP's legacy Atlassian Jira support environment around 25 May 2026. Jira contained screenshots, attachments, personal information and credentials; credentials obtained there also enabled access to certain FTP/SFTP sites. Attackers remained in the environment until detection on 14 June and exfiltrated about 400,000 records. MIP's core policy-administration systems were not compromised. MIP later confirmed paying a substantial ransom for a deletion promise that was not honored.
Plexsupply Inc.
May 26, 2026
•[ leak, retail ]
DataBreach.com indexed 936,468 rows associated with Plexsupply and dated the breach to May 26, 2026. PEAR listed the company on its leak site on May 30. Public reporting did not identify the access vector or document encryption or operational disruption.
ERIELL Group
May 26, 2026
•[ ransomware, energy ]
On or before May 26, 2026, an affiliate of the Nova ransomware operation gained unauthorized access to ERIELL Group and stole corporate data, which the group threatened to publish if the company did not negotiate. Nova subsequently acknowledged that its affiliate had attacked the Uzbekistan-based company, banned the affiliate, claimed that no files were encrypted, and promised not to publish the stolen information.
Baikal Teleport CJSC
May 26, 2026
•[ ddos, technology ]
From 2026-05-26 through 2026-05-28, Baikal Teleport experienced network disruptions caused by a large DDoS attack. The provider confirmed intermittent network outages during the three-day period. The number of affected subscribers, attack volume, perpetrator, and motive were not reported.
Undisclosed external card-printing services provider
May 26, 2026
•[ hack, healthcare, government ]
An undisclosed external card-printing services provider notified Irelands Health Service Executive on the evening of May 26, 2026, that its systems had been attacked and a small number of HSE records had been accessed. HSE systems were not compromised. As a containment measure, HSE paused production of plastic medical, European Health Insurance, GP visit, drugs payment scheme, and long-term illness cards on May 27; plastic-card production remained paused as of July 10. Applications, eligibility, and access to healthcare continued through letters, digital verification, and provisional certificates. The providers identity, registered country, access method, actor, motive, and affected data fields were not disclosed.
Nissan North America, Inc.
May 27, 2026
•[ hack, leak, automotive ]
Between May 27 and June 9, 2026, attackers exploited CVE-2026-35273, a previously unknown vulnerability in Oracle PeopleSoft, and accessed Nissan North America's employee-information environment. Nissan stated that information belonging to current and former employees in the United States, Canada, Mexico, and Brazil may have been stolen. Reporting linked the broader PeopleSoft campaign to ShinyHunters, but Nissan did not publicly attribute its incident to the group.
