Prefettura di Reggio Calabria
July 21, 2026
•[ ransomware, malware, social ]
Attackers took over a certified (PEC) email account of Italy's Reggio Calabria Prefecture, reportedly via infostealer, and posed as authorities to get data on ~680 Revolut customers (July 21, 2026). Group iamnotavillain demanded ransom; prosecutors are investigating.
LR Reed
July 23, 2026
•[ ransomware, leak, technology ]
Kairos listed Melbourne property-management company LR Reed on its leak site and claimed theft of 335 gigabytes of data. Published samples appeared to contain identifiable employee and internal company records, supporting that unauthorized data access occurred, although the full volume claim was not independently verified. LR Reed said customer data was segregated and unaffected, its core systems remained operational, and it notified the Australian Signals Directorate and Australian Federal Police.
Restaurant Depot, LLC
July 23, 2026
•[ ransomware, leak, retail ]
Play listed Restaurant Depot on July 23, 2026 and claimed exfiltration of internal files. DataBreach.com later indexed 3,697,383 rows containing personal and contact information associated with the company. Restaurant Depot is a wholesale cash-and-carry foodservice supplier headquartered in College Point, New York. No operational disruption has been independently established.
Thialf
July 24, 2026
•[ ransomware, financial, technology ]
RTL Nieuws identified The Gentlemen as responsible for a ransomware attack against Thialf and reported that the criminals demanded payment to make inaccessible computers available again and to prevent publication of purportedly stolen data. The group claimed to possess internal documents, employee information, financial contracts, and other sensitive data. Thialf confirmed the attack but said its forensic investigation found that data and operational processes were not affected or endangered and that planned events could continue; the claimed data theft therefore remains unverified.
Novum Energy Trading, Inc.
July 26, 2026
•[ ransomware, energy ]
Global Secret Group listed Novum Energy on July 26, 2026 and threatened publication unless the company negotiated. DataBreach.com's verified searchable dataset confirms a data compromise. No public victim statement, regulator notice, or incident-specific report confirming encryption, unavailable systems, or interrupted trading or logistics operations was located as of August 12, 2026.
OFS Brands Holdings, Inc.
July 26, 2026
•[ ransomware, manufacturing ]
Global Secret Group publicly listed OFS on July 26, 2026 as part of a multi-victim data-theft extortion campaign. Independent ransomware monitoring captured the same claim, and DataBreach.com subsequently indexed 36,624 records associated with OFS. Federal and OSHA records identify OFS Brands Holdings as an office-furniture manufacturer headquartered in Huntingburg, Indiana. No independently verified operational disruption has been established.
Cold Front Distribution, LLC
July 26, 2026
•[ ransomware, leak, retail ]
Global Secret Group listed Cold Front Distribution on July 26, 2026, and DataBreach.com subsequently indexed 33,573 leaked records containing personal and contact information. Interlock had previously listed Cold Front Distribution on June 2, 2026 and claimed to have released internal company files. Available evidence does not establish whether the July disclosure resulted from a separate compromise or involved data obtained through the earlier incident.
AnMed
July 26, 2026
•[ ransomware, malware, healthcare ]
On July 26, 2026 AnMed detected malware that locked access to computer-network files and disrupted telephone, internet, medical-office and clinical IT services, causing multiple temporary facility closures. Files stored on certain local systems were also copied without authorization in July; AnMed later confirmed the theft but said its cloud-based electronic health records were not affected. On August 11 attackers claiming to be The Gentlemen posted ransom demands through AnMed social-media accounts and claimed theft of 6 TB; AnMed did not verify the volume. Care and communications services were progressively restored and an investigation to identify affected individuals continued.
Police National Legal Database (PNLD)
July 26, 2026
•[ ransomware, leak, government ]
Data from the Police National Legal Database was compromised and published on the dark web, including professional contact information for police and criminal justice personnel and data from some Ask the Police users. ExfilSquad claimed the breach and demanded payment; independent review validated samples associated with the wider ExfilSquad campaign, although PNLD did not itself attribute the intrusion to the group.
Wilbert's Family Enterprises
July 27, 2026
•[ ransomware, leak, automotive ]
Qilin claimed responsibility for an attack on Wilbert's on July 27, 2026 and threatened to release company data unless a settlement was reached. DataBreach.com indexed 106,010 leaked rows containing contact information and vehicle identification numbers. Qilin also claimed that company data had been encrypted, but no independent source has confirmed operational disruption. Wilbert's operates automotive recycling facilities and supplies recycled auto parts from its Webster, New York headquarters and other locations.
United Kingdom Department for Education
July 29, 2026
•[ leak, government, education ]
ExfilSquad claimed that it obtained approximately 607,000 records from the United Kingdom Department for Educations Customer Help Portal and Turing Scheme portal and published samples on the dark web. DfE became aware after the claims appeared over the weekend of July 2526. It said the figure represented records rather than unique individuals and that the affected information was limited to contact details. As a precaution, DfE took both portals offline for investigation and remediation. The Customer Help Portal was operating normally again by August 5, but the Turing Scheme portal remained unavailable as of August 11. Contemporaneous leak-site screenshots showed a payment demand for withholding the remaining data, although a group representative later denied demanding ransom and characterized the broader campaign as publicity-driven.
Romanian National Administration of Penitentiaries
July 29, 2026
•[ ransomware, government, technology ]
A ransomware attack affected multiple Romanian National Administration of Penitentiaries workstations and servers on July 29, 2026. ANP physically isolated affected equipment and operated in emergency mode while IMS Web, Infokiosk, inmate telephones, the visit-scheduling portal, inter-facility VPN connections, and the ANP website were unavailable. Routine inmate transfers and approved temporary-leave rewards were suspended, and Vaslui Penitentiary used limited calls, manual visit scheduling, and paper requests. Romania's DNSC director assessed Babuk as the most likely actor, although the investigation remained open.
Southeastern Oklahoma State University
July 30, 2026
•[ ransomware, leak, education ]
A cybersecurity incident beginning July 30, 2026 caused Southeastern Oklahoma State University to take some systems offline and close its Durant campus on July 30, July 31, and August 3. The university later confirmed that an unauthorized actor accessed some computer systems and may have acquired files. Interlock subsequently claimed 710 GB containing 171,499 files and 19,366 folders, and DataBreach.com indexed 582,315 leaked rows.
Leviton
July 31, 2026
•[ ransomware, manufacturing, technology ]
Leviton, an electrical products maker in Melville, New York, was listed by the Dark Project ransomware group on August 5, 2026; the group claimed about 1.4 TB from an attack around July 31, incl. financial records, schematics and employee data. Leviton has not confirmed it.
Ambition DX Holdings Co., Ltd.
August 1, 2026
•[ ransomware, retail ]
The SETTRA ransomware group claimed in August 2026 to have stolen 437 GB of data from Ambition DX Holdings, a Tokyo-based real estate leasing and property management company. The company's response was not reported.
Ministerio de Justicia y del Derecho (Colombian Ministry of Justice)
August 2, 2026
•[ ransomware, government, technology ]
On August 2, 2026 a ransomware infection struck the Colombian Ministry of Justice, disrupting administrative IT and digital services. The ministry isolated affected systems and switched document submission and citizen assistance to in-person, telephone and temporary email channels. By August 15 the cannabis-control licensing platform (MICC) remained unavailable and SICOQ operated only partially; the electronic archive document system (SGDEA) remained out of service on August 20, restricting access to registered petitions. No verified file theft, attacker identity or completed encryption extent was disclosed.
Undisclosed organization investigated by QUIRSO
August 4, 2026
•[ ransomware, technology, hack ]
Attackers exploited a VMware vCenter server at an unnamed organization, terminated running virtual machines and encrypted datastore files with Babuk-derived ransomware on August 4. This documented attack occurred within a larger global vCenter exploitation campaign; ransomware deployment at other victims is unverified.
Healthcare Highways, Inc.
August 4, 2026
•[ ransomware, leak, healthcare ]
Chaos listed Healthcare Highways on its leak site on August 4, 2026 and threatened to publish a 235 GB cache of company and client records if the company did not make contact. The data was subsequently published and was reported to contain protected health information, health insurance claims, and internal corporate documents. Healthcare Highways has not publicly confirmed the incident or independently verified the reported scope of the data.
City of Coweta
August 5, 2026
•[ ransomware, government ]
The City of Coweta experienced a system-wide ransomware attack on August 5, 2026. Local reporting identified the ransomware as Anubis. City computers and files became inoperable, while the website, third-party billing portal, and separately hosted police, fire, and 911 systems remained available. The City restored systems from off-site backups, and most systems and normal day-to-day operations had returned by August 18. The City said it had no evidence at that time that personal information was accessed or acquired.
Uber Freight
August 6, 2026
•[ ransomware, financial, technology ]
Uber Freight confirmed unauthorized access to portions of its systems and data repositories. The Helix extortion group listed Uber Freight on its leak site August 6, 2026, claiming nearly one million stolen files from cloud storage, email and logistics/accounting records. An external breach index separately reported approximately 5.44 million data rows, but Uber Freight did not verify the posted data or the scale of theft. Google links Helix infrastructure to the financially motivated UNC6671 cluster; company-specific attribution remains claim-based. Uber Freight said the incident was contained and remediated without operational disruption. The actual date of the initial intrusion or data extraction was not established; August 6 is the earliest documented public-leak date, not the verified intrusion date.
