PHOBS d.o.o.
June 3, 2026
•[ hack, phishing, technology ]
On June 3, 2026, unauthorized actors accessed guest reservation data stored in the PHOBS reservation-management platform. PHOBS said approximately 100,000 booking records may have been affected, exposing information that could be used in targeted phishing and fraudulent payment messages, while payment-card data was not compromised.
States of Guernsey — Committee for Education, Sport & Culture
June 3, 2026
•[ social, phishing, government ]
On June 3, an attacker obtained unauthorized access to a Guernsey education employee email account and used it to send a malicious link. The mailbox remained accessible to the intruder for approximately one month and contained information relating to 74 individuals. Officials confirmed the breach but reported no evidence of data exfiltration beyond the Education IT environment. Criminal and Financial are limited inferences from the phishing/credential-abuse pattern; no extortion or political objective was established. Mixed reflects both unauthorized viewing of stored information and fraudulent use of the official mailbox.
Undisclosed organization in Unit 42 Pink-related extortion investigation
June 5, 2026
•[ ransomware, phishing, technology ]
Palo Alto Networks Unit 42 investigated an extortion case involving an unnamed organization. On June 1, 2026, an attacker renewed contact in an existing negotiation, supplied a new qTox identifier and a data-leak site associated with the Pink extortion brand, and referenced essentially the same information claimed taken in an earlier extortion notice. Unit 42 described the broader cluster using voice phishing and cloud-service data theft. The specific initial access, actual exfiltration, victim industry and country, and whether the original intruder was identical to the Pink contact were not established. Event date is a publication-date fallback, not a verified theft date.
Undisclosed Indian government entities
June 12, 2026
•[ espionage, phishing, malware ]
Between June 12 and June 22, 2026, Acronis observed active beaconing from multiple systems compromised by Mustang Panda within Indian government entities, including devices associated with senior administrative personnel. Spear-phishing archives induced users to execute signed Windows applications that sideloaded malicious DLLs and installed SHARDLOADER, MINIRECON, or ZOHOMURK on the endpoints. The malware established persistence, remote command execution, command-and-control, and data-transfer channels through attacker-controlled infrastructure and Zoho WorkDrive. Acronis attributed the campaign to Mustang Panda with high confidence based on tradecraft, malware-code, infrastructure, and development-artifact overlaps and assisted CERT-In with victim notification and remediation. Public reporting associates Mustang Panda with China's Ministry of State Security, although no subordinate bureau, contractor, or operational unit was identified. The operation supported intelligence collection concerning Indian hydropower initiatives and defense cooperation with Taiwan. No operational disruption was reported.
FCCI Insurance Group
June 27, 2026
•[ phishing, finance, technology ]
Threat-intelligence reporting attributes the FCCI compromise to Redact and dates its detection to 27 June 2026. The attackers reportedly used voice phishing and adversary-in-the-middle session hijacking to compromise cloud identities, register rogue MFA devices, and exfiltrate data through Microsoft Graph, OneDrive, and SharePoint APIs. Redact is described as an extortion-only operation, and no encryption or operational disruption was reported.
Undisclosed current and former U.S. officials, military leaders, allied personnel, journalists, and Ukrainian officials
June 29, 2026
•[ espionage, phishing, government ]
Russian intelligence-linked actors tracked as UNC5792 and UNC4221 impersonated support accounts for Signal, WhatsApp, and other messaging applications to obtain verification codes, account PINs, and backup-recovery keys. The actors compromised accounts belonging to current and former U.S. officials, military leaders, allied personnel, journalists, and Ukrainian officials, accessed communications, and used compromised accounts to send messages and conduct additional phishing.
Undisclosed Minnesota MyChart user
July 1, 2026
•[ phishing, healthcare, financial ]
A Minnesota MyChart user reported to the Federal Trade Commission that a phishing email impersonating MyChart offered a free Medicare Kit in exchange for completing a survey and paying shipping. The victim, who identified Welia Health in Mora as the provider through which they used MyChart, completed the survey, entered credit-card and personal information, and submitted the form. Minutes later, the victim observed a card transaction categorized as an unrelated animal/pet service. Later reporting based on FTC complaints confirmed multiple successful victims of the same broader MyChart impersonation campaign. Epic and Welia Health were not themselves breached.
Undisclosed Illinois MyChart user
July 1, 2026
•[ phishing, healthcare, financial ]
An Illinois MyChart user reported to the Federal Trade Commission that a phishing email impersonating MyChart offered a free Medicare Kit and directed the victim through a survey to a shipping-payment step. The victim submitted Mastercard information before recognizing the message as fraudulent and reported that the scammers had obtained the card information. The complaint is one of several successful victims documented in the broader coordinated MyChart impersonation campaign. MyChart and Epic were not themselves breached.
Brinks Home
July 13, 2026
•[ phishing, ransomware, technology ]
ShinyHunters said it gained access to Brinks Home on July 13, 2026 through Microsoft Entra voice phishing and used the resulting account access to obtain Salesforce and Cresta data. Brinks identified and contained unauthorized access on July 20. After Brinks did not pay, ShinyHunters released more than 41 gigabytes of data; a subsequent dataset analysis identified 732,162 unique email addresses. Brinks has not confirmed the access method or the actor's larger record counts. Alarm monitoring, products, and system functionality continued without interruption.
North Dakota Department of Health and Human Services
July 21, 2026
•[ phishing, leak, healthcare ]
North Dakota HHS said a phishing email on 21 Jul 2026 let an unauthorized third party into the email accounts of three Developmental Disabilities staff, exposing health data of about 1,700 clients. State IT secured the accounts; notices went out 24 Aug.
Questel SAS
August 1, 2026
•[ phishing, technology, leak ]
Questel confirmed that a voice-phishing call resulted in unauthorized access to part of its Microsoft 365 environment, specifically a Sales SharePoint site. ShinyHunters subsequently published data after an unsuccessful extortion attempt. Independent analysis identified 1,226,209 unique email addresses in the released corpus. Questel said its production tools and intellectual-property platforms were not accessed and operations continued normally.
Undisclosed Indiana MyChart user
August 1, 2026
•[ phishing, financial, healthcare ]
An Indiana MyChart user reported to the Federal Trade Commission that a phishing email impersonating MyChart offered a free Medicare first-aid kit in exchange for completing a survey and paying $9.95 shipping. After the victim submitted payment information, the card was charged $9.95 and then immediately charged another $29.95 by a separate scam company. The complaint confirms successful acquisition and fraudulent use of payment data within the broader coordinated MyChart impersonation campaign. MyChart and Epic were not themselves breached.
Troutman Pepper Locke LLP
August 7, 2026
•[ social, phishing, ransomware ]
A Troutman Pepper Locke employee was deceived by communications that appeared legitimate and sent documents to an unauthorized party on August 7, 2026. The firm said the unauthorized party never accessed its environment and operations were not affected. Silent Ransom Group subsequently claimed responsibility and published data.
Undisclosed Middle Eastern government organization
August 14, 2026
•[ espionage, government, malware ]
Jewelbug compromised government users through malicious code inserted into a shared Middle Eastern government webmail platform. When employees logged in, the script exfiltrated webmail cookies and institutional email addresses; selected users were then presented with a fake Adobe update that delivered the Antino backdoor and malicious PDF Viewer browser extension. At least one confirmed victim showed authenticated access to internal virtualization-management infrastructure. This conservative record represents at least one government organization within a broader campaign that successfully watering-holed more than 15 government webmail tenants.
At least one Singapore cryptocurrency user
August 15, 2026
•[ hack, phishing, finance ]
Singapore Police reported an increase since mid-August 2026 in cases where scammers gained unauthorized access to victims' email accounts and then compromised linked cryptocurrency accounts. Investigations found that several affected email accounts had appeared in previous data breaches, suggesting attackers exploited exposed credentials and password reuse. Attackers could search compromised inboxes for cryptocurrency exchanges, create rules to hide exchange messages, and intercept password-reset links, OTPs and verification emails. The specific perpetrators, their country of origin, number of victims and losses were not disclosed.
SafePal (SkyGenesis Holdings Limited)
August 17, 2026
•[ leak, phishing, technology ]
SafePal confirmed that an authorization flaw in an order-tracking plugin allowed unauthorized external access to customer order information affecting 39,798 customers. The precise access date has not been established. Customers reported phishing and impersonation attempts using detailed SafePal order information by early July, and SafePal later identified more than 30 fraudulent websites or phishing links associated with scam activity. A threat actor subsequently advertised a dataset matching the affected population for sale. Seed phrases, private keys, wallet passwords, payment information and government identification were not affected.
Seyfarth Shaw LLP
August 18, 2026
•[ social, phishing, leak ]
Chicago law firm Seyfarth Shaw said an attacker posing as its IT help desk tricked an employee on Aug. 18, 2026, into emailing client documents with names and SSNs to an outside account. It says its network was not entered; it notified state AGs and offered credit monitoring.
Cambrian High School & College
August 19, 2026
•[ phishing, malware, education ]
Check Point Research confirmed by August 19 that the legitimate website of Cambrian High School & College in Bangladesh had been compromised and was hosting a malicious page at cambrianschoolbd.com/mail/. The page had displayed a fake Spotify-branded security-verification CAPTCHA and was flagged by multiple threat-intelligence sources as an information-stealer and malware-distribution site. The precise intrusion date, responsible actor, and duration of the compromise are unknown. The activity occurred in the context of broader financially motivated cybercriminal phishing and malware campaigns targeting the education sector, but no downstream visitor infection or credential theft was publicly confirmed.
McKesson Corporation
August 21, 2026
•[ phishing, healthcare, leak ]
McKesson discovered the intrusion on August 25, 2026. ShinyHunters claimed it used voice phishing against employees to compromise Okta single-sign-on accounts and access Salesforce and Snowflake environments, with approximately 1 TB exfiltrated between August 21 and August 25. McKesson confirmed customer-data exfiltration from third-party applications but has not confirmed the claimed access method, volume, record count, or data categories. Company services remained operational.
ReliaQuest, LLC
August 22, 2026
•[ social, phishing, technology ]
ShinyHunters targeted ReliaQuest on August 22, 2026 using voice phishing, a lookalike single-sign-on page, and impersonation of a named ReliaQuest security employee. One employee entered a password and approved an MFA push, allowing the attacker to establish a temporary authenticated identity session and obtain view-only access to the employees Okta dashboard. Device-trust controls blocked every attempt to open business applications, and ReliaQuest terminated the session, expired the password, and reset authentication factors. ShinyHunters later posted screenshots from the identity dashboard, but no customer data or broader internal systems were accessed.
