Indra Group (undisclosed subsidiary)
July 1, 2026
•[ ransomware, technology ]
Indra detected ransomware within a non-critical environment belonging to an undisclosed subsidiary and activated its incident-response protocols. The company described the impact as minimal, reported no interruption to critical operations or services, and ruled out propagation to the rest of the group. The Gentlemen claimed the attack and initiated a leak countdown, but Indra did not confirm attribution or data exfiltration.
Oleoductos del Valle S.A. (Oldelval)
July 1, 2026
•[ ransomware, energy, leak ]
Argentina pipeline operator Oldelval disclosed on July 31, 2026 that a cyber incident affected certain administrative computer systems. It activated response and containment procedures and later reported that the affected platforms had been fully restored, without interruption to crude-oil transport. Ransomware/extortion group The Gentlemen listed the operator on its leak site on July 23 and claimed data theft; the company did not independently confirm exfiltration, encryption, or the attackers identity. The date of initial unauthorized access and full technical effects were not disclosed.
Golden State Orthopedics & Spine
July 1, 2026
•[ ransomware, healthcare ]
Walnut Creek, California practice Golden State Orthopedics & Spine detected unusual network activity around July 2, 2026, saying patient data incl. SSNs may have been accessed. Brain Cipher claimed the attack on July 1, alleging 150 GB stolen; ~125,000 records were later indexed.
Northeast Pediatrics & Adolescent Medicine
July 2, 2026
•[ ransomware, healthcare, leak ]
On July 2, 2026, Anubis added Northeast Pediatrics & Adolescent Medicine to its extortion site and claimed that employee and patient data had been stolen. The precise intrusion date and initial-access method were not disclosed. After reported communications between the practice and Anubis ended, data was published, and the supplied breach database indexed 29,356 records containing names, dates of birth, phone numbers, and street addresses. No operational disruption or successful encryption was publicly confirmed.
Ville de Drancy
July 3, 2026
•[ ransomware, government, leak ]
The Ville de Drancy detected ransomware on July 3, 2026, after parts of its municipal IT environment became inaccessible. Officials disconnected all systems to contain the attack, filed a complaint, and rebuilt from clean offsite backups with ANSSI assistance. Municipal services were slowed or degraded, the telephone system was affected, and three online procedures reverted to paper. The city said personal-data leakage was probable but did not confirm its extent. Qilin later claimed responsibility and on August 2 listed 210 GB comprising 241,705 files as published, but the city did not confirm the attribution or data theft and the claim was not independently verified.
Metro Mondego, S.A.
July 6, 2026
•[ ransomware, leak, technology ]
Metro Mondego detected ransomware on July 6, 2026 affecting part of its internal systems, but the Metrobus service continued operating and isolated bank-card payment terminals were unaffected. The Gentlemen listed Metro Mondego on its leak site on July 16 and claimed possession of company information. Metro Mondego subsequently said available evidence made data copying probable and warned personalized-pass holders, email correspondents, employees, suppliers, and contractual counterparties while noting that the exact copied data remained unconfirmed.
Grand Isle Shipyard
July 6, 2026
•[ ransomware, energy ]
Grand Isle Shipyard, an offshore oil and gas services firm in Galliano, Louisiana, was claimed by the Chaos ransomware group on July 6, 2026, alleging theft of 1.1 TB (341,712 files) from its network servers and setting a negotiation deadline. No company statement.
Beaver County Behavioral Health
July 8, 2026
•[ ransomware, healthcare, government ]
Beaver County Behavioral Health, a Pennsylvania county agency, was hit by ransomware from July 8, 2026 that locked staff out of systems and patient files. Hackers copied patient PHI incl. SSNs and diagnoses; the county reportedly paid a ransom and notified patients Sept. 4.
Nihon Kotsu Co., Ltd.
July 11, 2026
•[ ransomware, malware, technology ]
Nihon Kotsu detected unauthorized access and malware early on July 11 and isolated its internal network, leaving several dispatch, reservation, registration, and internal services unavailable. AiLock later claimed responsibility. On July 22, Nihon Kotsu said information believed to have leaked in the attack had appeared online, but the company was still determining its contents and scope and did not confirm AiLock's attribution.
Nichirei Corporation
July 13, 2026
•[ ransomware, manufacturing, technology ]
Nichirei detected unauthorized access on July 13 and disconnected group systems, disrupting cold-storage and frozen-food distribution. RansomHouse later claimed the attack. On August 10, S&J observed at least 200,000 published files; Nichirei acknowledged additional information had been published but did not validate the reported contents or quantity. All sites returned to normal operation on July 24.
Brinks Home
July 13, 2026
•[ phishing, ransomware, technology ]
ShinyHunters said it gained access to Brinks Home on July 13, 2026 through Microsoft Entra voice phishing and used the resulting account access to obtain Salesforce and Cresta data. Brinks identified and contained unauthorized access on July 20. After Brinks did not pay, ShinyHunters released more than 41 gigabytes of data; a subsequent dataset analysis identified 732,162 unique email addresses. Brinks has not confirmed the access method or the actor's larger record counts. Alarm monitoring, products, and system functionality continued without interruption.
Spectrum Chemical Mfg. Corp.
July 14, 2026
•[ ransomware, technology, manufacturing ]
Chaos claimed responsibility for compromising Spectrum Chemical Mfg. Corp. on July 14, 2026, issued what it described as a final ultimatum, and threatened publication of stolen data. DataBreach.com indexed 372,396 structured contact records, supporting classification of the affected asset as a database-backed application server, although the initial access vector was not disclosed. Spectrum manufactures and distributes fine chemicals and laboratory products and is headquartered in New Brunswick, New Jersey. The company has not publicly confirmed the attribution, encryption, or operational disruption.
V-Silicon
July 14, 2026
•[ ransomware, technology, manufacturing ]
Cybernews researchers found an exposed INC staging server containing tools and data customized for an intrusion into V-Silicon. Most reconnaissance and attack preparation occurred around July 14, 2026. Active Directory exports were dated June 16, but researchers could not determine whether access began then or whether the exports were copied later. INC listed V-Silicon on July 18. Although ransomware binaries supported architectures used in industrial systems, no evidence showed that operational technology was reached or encrypted, and no outage was reported. References to NXP and UnitedDS infrastructure did not establish successful separate compromises.
Stadler Rail AG
July 15, 2026
•[ ransomware, technology, manufacturing ]
In mid-July, attackers used compromised credentials to access a data-exchange platform shared with a Stadler supplier and stole technical information belonging to that supplier. Everest demanded CHF 10 million from Stadler, which refused to pay and filed a criminal complaint. Stadler confirmed that its internal IT systems, production sites, and in-service rail vehicles were unaffected and that no relevant personal data was stolen. The precise intrusion date was not disclosed; 15 July is used as the approximate midpoint of the reported period.
WebHot ApS
July 15, 2026
•[ ransomware, technology ]
WebHot ApS took all systems offline on July 15, 2026, after ransomware encrypted nearly every system within minutes. Investigators concluded that normal recovery was impossible, forcing the Danish hosting provider to rebuild its environment from scratch. Email service resumed on July 17 at 15:22, but all customer email predating restoration was permanently lost and users had to recreate their accounts. No data exfiltration or responsible group was reported.
Oklahoma Manufacturing Alliance
July 15, 2026
•[ ransomware, manufacturing, technology ]
On July 15, 2026, ransomware activity affected two employee computers at the Oklahoma Manufacturing Alliance and disrupted access to part of its local network. Staff isolated the affected devices and restored access through a separate secure network later that morning. Booba Project subsequently listed the alliance as a victim on July 28 and claimed theft of 10 GB of data, but the organization reported finding no evidence of removed information or compromised client records. The attacker and encryption behavior have not been independently verified.
Shillen Mackall & Seldon
July 15, 2026
•[ ransomware, leak ]
Shillen Mackall & Seldon, a Woodstock, Vermont personal injury law firm, was listed by the DragonForce ransomware group on July 15, 2026, with a claimed dataset later indexed at about 1.25 million rows. The firm has not publicly confirmed a breach.
Fairlife, LLC (Coca-Cola subsidiary)
July 16, 2026
•[ ransomware, manufacturing, technology ]
Fairlife identified unauthorized third-party access to a portion of its systems, including production-related systems, in connection with a ransomware event. The incident temporarily suspended production at all four U.S. facilities. Coca-Cola confirmed that certain data was taken, while Anubis claimed it had locked servers and stolen 1 TB of confidential information. By July 27, most U.S. production had resumed. Canadian production, product quality and safety, and retail availability were largely unaffected.
Město Čelákovice
July 16, 2026
•[ ransomware, government ]
The Gentlemen listed the Czech municipality of elkovice on its leak site on 16 July 2026 and threatened publication of a full leak unless representatives entered negotiations. The supplied Novinky article independently reports that The Gentlemen attacked Czech municipal and city offices on 16 July and threatened release of sensitive data for nonpayment, but elkovice has not publicly confirmed the compromise and victim-specific encryption or outage is not established.
Tidewater Telecom, Inc.
July 19, 2026
•[ ddos, ransomware, technology ]
On the evening of July 19, 2026, unidentified attackers used bots to flood Tidewater Telecom and affiliated Lincolnville Communications internet-service systems with malicious traffic. The providers worked with upstream carriers to block the traffic. Internet service for residential, business, and government customers across 23 towns became unreliable or unavailable, limiting municipal services and closing the Camden Town Office. Internet operations were near normal by the morning of July 21, although traditional voice service remained in major-outage status. A Tidewater representative said the attackers made demands, but the company did not disclose the demands, any requested amount, or whether payment occurred. The companies found no indication that customer data was compromised.
