DealMed Medical Supplies LLC
June 7, 2025
•[ ransomware, data leak ]
DealMed Medical Supplies LLC reported that an unauthorized party accessed its network on or around June 7, 2025, viewing or obtaining files containing protected health information, including names and Social Security numbers. DealMed confirmed the exposure on October 31, 2025. The DragonForce ransomware group listed DealMed on its leak site and claimed to have exfiltrated nearly 106 GB of data. Notification letters have been issued to affected individuals.
Russian Railways (RZD)
June 6, 2025
•[ denial of service ]
On June 6 2025, Russian Railways reported that its website and mobile app were targeted by a distributed denial-of-service attack, temporarily disrupting online ticketing. Physical ticket counters operated normally, and no data theft or encryption occurred.
Belize High Court Registry
June 6, 2025
•[ ransomware ]
In early June 2025, Belizes High Court Registry suffered a suspected ransomware incident that fully disabled its digital filing and record-keeping systems for approximately 34 days. Several servers were taken offline, forcing manual operations and halting court filings nationwide. Officials reported no evidence of data theft and have not identified the attacker.
Multiple Ukrainian Government Ministries
June 6, 2025
•[ wiper malware, data destruction, government ]
Pro-Russian wiper campaign deployed PathWiper malware across multiple Ukrainian government networks around June 6, 2025; Cisco Talos and CERT-UA confirmed data destruction without exfiltration; activity attributed to a Russia-linked APT.
Undisclosed Ukrainian Energy Organization
June 6, 2025
•[ malware, apt, data destruction ]
PathWiper malware associated with a pro-Russian APT destroyed data at an undisclosed Ukrainian energy organization on June 6, 2025; Cisco Talos and CERT-UA confirmed data destruction; no data theft reported.
Lexington-Richland School District 5
June 5, 2025
•[ ransomware, phishing, education ]
On June 3, 2025, Lexington-Richland School District 5 detected a network intrusion following a phishing email that disrupted systems, delayed summer school and staff bonuses. Over 1.03 TB of data has been confirmed under review. Though Interlock claimed responsibility, this is unverified. The district refused ransom demands and is offering credit monitoring to affected individuals.
Chess.com
June 5, 2025
•[ hack ]
Chess.com says 4,500 people had data stolen during June breach.
United Natural Foods, Inc. (UNFI)
June 5, 2025
•[ ransomware ]
UNFI detected unauthorized activity in its IT systems on June 5 2025, believed to involve a financially motivated criminal intrusion that disrupted electronic ordering and product distribution to thousands of retail clients. The outage caused an estimated $350$400 million in lost sales before core systems were restored on June 26 2025; no data theft has been confirmed.
HM Revenue and Customs (HMRC)
June 5, 2025
•[ data leak, compromised credentials, fraud ]
Compromised credentials and personal data from 100,000 taxpayer accounts used in fraudulent refund claims totaling 47 million.
Surmodics, Inc.
June 5, 2025
•[ data leak ]
Surmodics shut down parts of its IT systems after detecting unauthorized access on June 5; SEC filing notes restoration ongoing and potential data theft being analyzed.
Rajkot Municipal Corporation (GIS Website)
June 3, 2025
•[ data leak ]
Cyberattack on the Rajkot Municipal Corporations GIS website in India resulted in exfiltration of roughly 400 GB of civic and citizen data; systems taken offline for investigation; no ransomware or encryption reported; attacker identity unconfirmed.
Tupolev
June 3, 2025
•[ data leak, website defacement, state-sponsored ]
Ukrainian intelligence (GUR) compromised Tupolevs internal servers and exfiltrated 4.4 GB of files including personnel records, procurement documents, internal memos, and meeting minutes. The companys website was briefly defaced following the breach.
KiranaPro
June 3, 2025
•[ hacking, server deletion, data wipe ]
TechCrunch reported Indian grocery delivery startup KiranaPro was hacked and its servers were deleted, with the founder confirming the companys data had been wiped. The report described the incident as catastrophic to operations (platform disruption) but did not confirm in that initial story whether customer data was accessed or exfiltrated, focusing on the destructive effect of wiping infrastructure and data.
Highlands Oncology Group
June 2, 2025
•[ ransomware, healthcare ]
Highlands Oncology Group notifies 113,575 people after ransomware attack by Medusa
National Council of Notaries of Morocco (Tawtik.ma Platform)
June 2, 2025
•[ data leak, hacktivism ]
Hacktivist group Jabaroot DZ exfiltrated data from Moroccos Tawtik.ma platform used by the National Council of Notaries; DGSSI confirmed the breach was limited to this platform and did not affect ANCFCC; attackers claimed to have accessed 4 TB of non-classified notarial records.
Connex Credit Union systems
June 2, 2025
•[ data leak ]
An unauthorized access between June 23, 2025, allowed attackers to steal sensitive personal and financial data; no evidence of account compromise; notifications began late July into early August; credit monitoring offered
Microsoft Outlook / Office 365 Customers
June 1, 2025
•[ social, phishing, technology ]
Threat actors abused Proofpoint and Intermedia email-link wrapping services to deliver phishing emails posing as Teams notifications and voicemails, leading to theft of Microsoft Outlook / Office 365 login credentials from global users. No encryption occurred; actor identity unknown.
Ingonyama Trust Board
June 1, 2025
•[ ransomware, malware, government ]
On June 1, 2025, the NightSpire ransomware group attacked the Ingonyama Trust Board in South Africa, stealing around 30 GB of potentially sensitive organizational data. Reports confirm exfiltration but no encryption or disruption of systems. The incident became public on August 29, 2025.
Multiple diplomatic and international organizations (particpating in Gaza peace talks)
June 1, 2025
•[ espionage, social, phishing ]
Homeland Justice, an Iranian MOIS-linked group, compromised an Omani Embassy email account and used it to deliver spear-phishing attachments to diplomats and international mediators engaged in Gaza ceasefire negotiations. This was an espionage operation with no service disruption reported. ~72K+ malicious Word emails sent via spear-phishing from a compromised Omani Embassy in Paris account; targeted Egyptian officials, U.S. and Qatari mediators, and organizations such as UN, UNICEF, World Bank, and African Union during Gaza ceasefire talks
WhatsApp/Apple
June 1, 2025
•[ espionage, malware, technology ]
A zero-click spyware campaign exploited WhatsApp and Apple zero-day flaws, infecting fewer than 200 civil society individuals globally between June and August 2025. Attackers likely state-sponsored.
