Optimum First Mortgage, Inc.
June 15, 2026
•[ ransomware, finance ]
Optimum First Mortgage learned around June 19, 2026 that an unauthorized party had accessed its network several days earlier. PEAR claimed responsibility, dated the intrusion to June 15, alleged theft of approximately 9.3 TB, and threatened publication. The company disputed the claimed volume and said its investigation had found no evidence that its loan-origination or application-software systems were breached. The affected data categories and number of individuals remained unconfirmed.
Glendale Community College
June 15, 2026
•[ ransomware, education, leak ]
ShinyHunters claimed a pay-or-leak breach of Glendale Community College dated 15 June and later published attributed data. The college said it was notified of a potential incident on 16 June, isolated and secured its network, and determined that certain student educational-record data may have been copied without authorization. The isolation was a defensive containment measure; no service outage or attacker-caused operational disruption was reported. The initial access method was not disclosed.
River Financial Corporation (River Bank & Trust)
June 16, 2026
•[ ransomware, finance ]
An unauthorized actor accessed River Financial Corporation's network, including River Bank & Trust, on or about June 16, 2026. River detected the activity on June 19 and determined that ransomware had been deployed across portions of its server environment, disrupting certain operations and prompting impacted systems to be taken offline. A July 10 SEC amendment confirmed that the actor also removed certain data, although the contents and scope remained under investigation and River reported no evidence that customer accounts were affected.
United Personnel
June 16, 2026
•[ ransomware, technology ]
United Personnel, a Springfield, Massachusetts staffing firm and division of Masis Staffing Solutions, was listed by the Genesis ransomware group in June 2026, which claimed about 700 GB of customer, employee, payroll and contract data. The company has not confirmed a breach.
Mount Royal University
June 17, 2026
•[ ransomware, education ]
Mount Royal University identified the incident on June 17. The actor copied and deleted specific H-drive folders and deleted the departmental J drive, disrupting university services. CMD Organization claimed 10 TB and demanded 30 bitcoin, but the volume was not verified. MRU later said it had reason to believe the obtained information had been deleted and was no longer held by those responsible; restoration remained underway August 10.
SLEEMAN BREWERIES LTD.
June 17, 2026
•[ ransomware, hack, retail ]
Sapporo Holdings confirmed unauthorized access to SLEEMAN BREWERIES LTD. on June 17, 2026 and disconnected related systems and equipment. A Canadian liquor-industry association subsequently relayed that Sleeman's network outage was caused by a cybersecurity incident and that sales and delivery were continuing manually. Chaos listed Sleeman on July 14, and monitoring sources reported an alleged 420-gigabyte theft; Sleeman has not confirmed the attribution or data claim. Sleeman separately disclosed a January 26 ransomware incident involving personal information, so the January data categories are not attributed to this June event. Sapporo found no causal relationship with the Pokka intrusion and no impact on its Japanese domestic operations.
South Plains Rural Health Services, Inc.
June 17, 2026
•[ ransomware, leak, healthcare ]
PEAR claimed that South Plains Rural Health Services was notified of its intrusion on June 17 and later listed the West Texas healthcare provider on its leak site on July 15. By late August, PEAR had published files it claimed were stolen from SPRHS and alleged that approximately 1.4 TB of patient, employee, and administrative data had been exfiltrated. Independent ransomware trackers corroborate the PEAR victim listing and leak-site activity, but SPRHS has not publicly confirmed the incident, the June 17 date, the 1.4 TB quantity, or the detailed contents of the stolen material.
TINYpulse by WebMD Health Services (affecting Nintendo of America)
June 19, 2026
•[ ransomware, technology, leak ]
Shadowbyt3$ announced on 2026-06-12 that it had obtained Nintendo of America employee data from the cloud environment of TINYpulse, a third-party employee survey platform, and demanded $2 million. Nintendo confirmed that the third-party service was breached but said its own systems and customer data were not compromised. Nintendo described the confirmed exposure as older internal survey content involving a small subset of employees. The actor claimed an 859 MB dataset containing names, corporate email addresses, W-9 forms, bank statements, internal messages, and HR analytics, but Nintendo did not confirm the full claimed contents or volume.
May Trucking Company
June 21, 2026
•[ ransomware, leak ]
May Trucking detected suspicious network activity on June 21, 2026 and determined that an unauthorized party acquired files from its network. The company later confirmed that affected files contained personal information and notified the FBI. Embargo subsequently claimed the company and was reported to have stolen roughly one terabyte of data. DataBreach.com indexed 160,684 records associated with the incident. No independently verified operational disruption has been established.
Undisclosed organization investigated by Volexity
June 22, 2026
•[ hack, technology, ransomware ]
UTA0533 compromised two SonicWall SMA1000 appliances at one undisclosed organization. Volexity found compromise artifacts dating to June 22, 2026 and LDAP-capture files dated July 2. The actor intercepted unencrypted authentication traffic to obtain credentials. The event date records the earliest observed compromise, not a proven date for the first credential theft. Ransomware effects reported at other victims are not established for this organization.
Inission Power Oy (including Inission Power Finland Oy)
June 22, 2026
•[ ransomware, technology, manufacturing ]
Inission Power Oy and subsidiary Inission Power Finland Oy disclosed a single ransomware-related compromise of their shared server environment, detected June 22, 2026. The environment was isolated and restored the same day, with normal business operations continuing. Portions of affected databases were later found online. The company did not identify distinct intrusions or separately attributable data theft at each legal entity; successful encryption and attacker-caused operational disruption were not established. The intrusion start and data-acquisition dates remain unknown.
Bajaj Auto Limited
June 23, 2026
•[ ransomware, manufacturing, technology ]
Bajaj Auto disclosed that a ransomware attack on June 23, 2026 affected systems belonging to the company and its wholly owned subsidiary, Bajaj Auto Technology Limited. The companies activated precautionary measures and response protocols, which Bajaj Auto said had been successful in managing and mitigating the incident. The attacker, access method, disruption duration, and any data theft were not disclosed.
Partnered Health Pty Ltd
June 23, 2026
•[ ransomware, healthcare, leak ]
On June 23, 2026, Partnered Health became aware that a malicious actor had accessed data in parts of its clinic network. The company currently lists 17 clinics where healthcare-record information was affected and five additional clinics where the extent of impact remains under investigation. Partnered Health later confirmed that 11 files tied to the incident had been published online and that additional patients and some employees were affected. INC claimed responsibility and approximately 500 GB of theft, but Partnered Health has not verified that quantity and was still assessing the published material. No operational or clinical-service disruption was reported.
GSP Crop Science Limited
June 25, 2026
•[ ransomware, hack, manufacturing ]
INC Ransom listed GSP Crop Science as a claimed victim on June 25, 2026. GSP later confirmed that an external cybersecurity incident appearing to involve ransomware affected certain non-core IT systems. The company did not publicly attribute the incident or confirm the actor's data-exfiltration claim. Restoration was underway, while core business functions continued without disruption and no material financial or operational loss was identified.
Cardiology Associates of Port Huron, P.C.
June 25, 2026
•[ ransomware, leak, healthcare ]
Orova stated that it compromised Cardiology Associates of Port Huron on June 25, 2026, stole approximately 144 GB of data comprising 244,215 files, and encrypted some servers. The practice did not publicly confirm the attack. Orova subsequently published stolen data, and later independent review of the released material identified more than 150,000 patient records containing personally identifiable and protected health information, corroborating the data-theft component of the group's claim.
Salida School District R-32-J
June 29, 2026
•[ ransomware, education ]
Salida School District R-32-J in Salida, Colorado, was hit by a cyberattack on June 29, 2026 that damaged files on device hard drives, some unrecoverably. All systems were taken offline and central office work was disrupted. It said no data appears to have been accessed.
PAI Pharma
June 30, 2026
•[ ransomware, healthcare, manufacturing ]
PAI Pharma, a Greenville, South Carolina maker of generic liquid and unit-dose drugs, was listed on Brain Cipher's leak site on June 30, 2026; the group claimed theft of about 1.4 TB and threatened to publish it. PAI Pharma had issued no public notice as of September 2026.
Undisclosed Uruguayan commercial interiors company
June 30, 2026
•[ ransomware, manufacturing ]
Gunra ransomware listed an undisclosed Uruguayan designer and maker of commercial interiors on its leak site on June 30, 2026, claiming theft of 30 GB of data. The company has not been named or commented.
Bethany Lutheran Homes, Inc. d/b/a Eagle Crest Communities
July 1, 2026
•[ ransomware, leak, healthcare ]
SafePay claimed responsibility for compromising Bethany Lutheran Homes, Inc., which operates as Eagle Crest Communities, on 1 July and threatened to publish the full leak unless the organization contacted the group. A verified searchable dataset containing 16,556 name-and-telephone rows confirms that Eagle Crest data was compromised. The access method, encryption, and operational impact were not disclosed, and no service interruption was identified. Anubis separately claimed an Eagle Crest patient-and-employee data breach later in July, but available evidence does not establish whether that represented the same compromise or a separate event.
Ingram Content Group, Inc.
July 1, 2026
•[ ransomware, technology ]
ShinyHunters claimed responsibility for compromising Ingram Content Group on 1 July after attempted ransom negotiations reportedly failed. A verified searchable dataset containing 80,190 rows confirms that Ingram data was compromised. The access method, encryption, and operational impact were not disclosed, and no system outage or other operational disruption was identified.
