Undisclosed organization operating Langflow and production MySQL/Alibaba Nacos infrastructure
June 1, 2026
•[ ransomware, technology, hack ]
In late June 2026, an unidentified human operator selected the victim, provisioned the attack infrastructure, and supplied credentials, while an agentic AI system technically carried out the intrusion. The AI exploited CVE-2025-3248 in an internet-facing Langflow instance, dumped its backing Postgres database, harvested credentials and API keys, and pivoted to a production MySQL and Alibaba Nacos server using root credentials obtained through an earlier compromise. It created a backdoor administrator, encrypted all 1,342 Nacos configuration items with an ephemeral key that was never stored or transmitted, dropped the original configuration and history tables, deleted multiple database schemas, and left a Bitcoin ransom demand. Sysdig assigned the JadePuffer tracking label to this human-directed, AI-executed operation; JadePuffer is not the identified name of the human hacker. The human operator's identity and origin remain unknown. The AI asserted that data had been staged externally, but Sysdig found no evidence confirming exfiltration.
Ecopetrol S.A.
June 1, 2026
•[ ransomware, leak, energy ]
An external actor reportedly obtained access through a third party with administrative privileges approximately one month before the incident was disclosed and downloaded files from cloud storage used by 15 Ecopetrol Group companies. Security controls blocked the attempted ransomware encryption, and Ecopetrol reported that operations continued without interruption and that transactional systems were not compromised. The copied information was later published. The Gentlemen claimed responsibility, but Ecopetrol did not publicly confirm the attribution.
At least one PTC Windchill/FlexPLM customer
June 1, 2026
•[ ransomware, technology, finance ]
Ransom-ISAC assesses that Cl0p affiliates likely began exploiting CVE-2026-12569 as a zero-day in early June 2026 against internet-exposed PTC Windchill and FlexPLM systems. Attackers deployed custom JSP webshells capable of credential theft and large-scale data exfiltration. Extortion emails were observed beginning July 20, and Cl0p later named more than 40 alleged victims, including Shell, Philips, Fiserv, Zebra Technologies, Mindray, and others. Victim-specific stolen-data volumes ranged from about 1 GB to several terabytes according to Cl0p, although many individual claims remain unconfirmed.
City of McMinnville
June 1, 2026
•[ ransomware, government ]
An intruder accessed and copied files from the City of McMinnville network during an interval between June 1 and July 18, 2026. City staff detected unusual activity around July 15. The RansomHouse extortion group subsequently claimed the compromise and posted apparently stolen city data on its dark web site in August. Local reporters observed apparently municipal and police records, and the city later notified affected individuals about possible exposure of identity information. No completed encryption or confirmed service outage was established.
Hollard Insurance Group
June 1, 2026
•[ ransomware, finance, technology ]
South African insurer Hollard's funeral-policyholder data was leaked by The Gentlemen in Sept. 2026 after a June 2026 extortion breach of its administrator MIP Holdings' Jira platform. Hollard says its own systems were not compromised and notified affected customers.
Undisclosed organizations in education, transportation, healthcare, and finance
June 5, 2026
•[ ransomware, education, finance ]
Microsoft reported that The Gentlemen ransomware had affected organizations in the education, transportation, healthcare, and financial sectors across North America, South America, Europe, Africa, and Asia. The self-propagating Go-based encryptor could spread through Windows networks, encrypt local volumes and network shares, delete shadow copies, and leave ransom notes. Microsoft tracks the ransomware operators as Storm-2697, while affiliates conduct the intrusions. Exact victim identities, attack dates, disruption duration, and affected-system counts were not disclosed.
Access Dental & Orthodontics
June 5, 2026
•[ ransomware, leak, healthcare ]
WorldLeaks listed Access Dental & Orthodontics on its leak site on June 5, 2026 and issued a countdown associated with its extortion claim. DataBreach.com later indexed 322,387 records containing personal and contact information. Access Dental operates a dental-services organization headquartered in Irving, Texas. No independently verified operational disruption has been established.
United Auto Supply
June 5, 2026
•[ ransomware, leak, retail ]
WorldLeaks publicly listed United Auto Supply on June 5, 2026 as part of its data-theft extortion operation. Independent ransomware monitoring captured the same June 5 claim, and DataBreach.com subsequently indexed 826,018 records containing personal, contact, and vehicle information associated with the company. United Auto Supply has not publicly confirmed the incident, and no operational disruption has been independently established.
Undisclosed organization in Unit 42 Pink-related extortion investigation
June 5, 2026
•[ ransomware, phishing, technology ]
Palo Alto Networks Unit 42 investigated an extortion case involving an unnamed organization. On June 1, 2026, an attacker renewed contact in an existing negotiation, supplied a new qTox identifier and a data-leak site associated with the Pink extortion brand, and referenced essentially the same information claimed taken in an earlier extortion notice. Unit 42 described the broader cluster using voice phishing and cloud-service data theft. The specific initial access, actual exfiltration, victim industry and country, and whether the original intruder was identical to the Pink contact were not established. Event date is a publication-date fallback, not a verified theft date.
City of Acworth
June 8, 2026
•[ ransomware, government, hack ]
On 2026-06-08, the City of Acworth detected an unauthorized cybersecurity incident affecting certain municipal computer systems. The city warned residents that they might experience service interruptions because of network outages, engaged cybersecurity professionals, and notified law enforcement. By 2026-06-18, all affected systems had been restored and city services were fully operational. INC Ransom subsequently claimed responsibility by listing Acworth on its dark-web leak site with alleged data samples. The city has not confirmed INC Ransom's attribution, ransomware deployment, encryption, data theft, a ransom demand, the contents of the alleged samples, or the exact systems and services affected.
Undisclosed third-party law firm used by Navient
June 8, 2026
•[ ransomware, finance ]
Navient learned on June 8, 2026, that ransomware had affected certain information systems at an undisclosed third-party law firm providing it legal services. An unauthorized actor accessed Navient-related data held by the firm, including sensitive borrower information. The incident was limited to the law firm's environment; Navient found no access to its own systems and experienced no disruption to operations or customer services. Public disclosures did not identify the law firm, ransomware operator, affected-person count, access method, or any operational disruption at the firm.
Central Bank of Libya
June 9, 2026
•[ ransomware, finance, government ]
On 2026-06-09, the Central Bank of Libya confirmed a cyberattack affecting a limited number of systems and technical services. The bank activated emergency response and business-continuity procedures and isolated affected systems. Qilin claimed responsibility on 2026-06-22 and threatened to release confidential banking data. The bank later said it was investigating material published on the dark web. The access method, data categories, volume, and effects on customers or financial assets were not publicly established, and the Qilin attribution remains an attacker claim.
Reynella East College
June 9, 2026
•[ ransomware, education, leak ]
On 2026-06-09, Reynella East College notified parents and carers that a cybersecurity breach had taken all of the school's computer systems offline. Classes continued through face-to-face and offline arrangements while the South Australian Department for Education and cybersecurity specialists investigated and restored systems. On 2026-06-23, the Interlock ransomware group claimed responsibility and published more than 600 GB comprising more than 473,000 files in more than 68,000 folders. Reporting reviewed samples that included passport scans, credentials, student and family contact details, teaching documents, contracts, financial reports, and school budgets. The Department for Education acknowledged that information had been posted online but continued assessing which individuals and records were affected.
Prince George County
June 11, 2026
•[ ransomware, government, leak ]
Prince George County identified a cybersecurity incident affecting certain network systems on June 11, 2026. The incident disrupted county phone, internet, and online payment services, while 911 and non-emergency dispatch remained available. Most systems were restored within approximately one week. RansomHouse claimed that it encrypted the county on June 10 and posted an evidence pack, but the county did not confirm the group's attribution, encryption claim, data theft, or a ransom demand; officials later stated that personal information may have been involved.
AS Latvijas valsts meži
June 11, 2026
•[ ransomware, financial, technology ]
Intrusion indicators show that the attacker entered AS Latvijas valsts mei systems on 2026-06-11 and remained undetected until malicious activity was identified during the night of 2026-06-22 to 2026-06-23. The attacker exfiltrated company data and deployed ransomware, while LVM disconnected LVM GEO, its map-services system, the Mednis application, and several internal customer- and provider-facing systems. CERT.LV confirmed that 44 GB of stolen data was published, including internal documents, emails, source code, digital certificates, cryptographic keys, and user credentials, and assessed that the attacker likely obtained more data. Timber deliveries were reduced after the attack and returned to full volume on 2026-07-01, although other systems remained under restoration on 2026-07-09. Public threat-monitoring sources identify ByteToBreach as the claimant, but CERT.LV has publicly described the perpetrator only as a foreign financially motivated ransomware actor.
Kee Wah Bakery Limited
June 12, 2026
•[ ransomware, retail, technology ]
Kee Wah Bakery discovered on June 12, 2026 that its internal network was not operating normally and subsequently received a ransom note. Its preliminary investigation confirmed a ransomware attack. The company continued operating its physical stores and stated that payment and credit-card information were not affected. Systems containing information concerning employees, business partners, online customers, and loyalty-program members may have been exposed, but Kee Wah had not confirmed data exfiltration or disclosed the number of affected individuals.
Undisclosed Uruguayan advertising agency
June 12, 2026
•[ ransomware, leak, technology ]
Gunra ransomware listed an undisclosed Uruguayan advertising agency on its leak site on June 12, 2026 and claims it published 40 GB of the firm's files after it refused to pay. The agency has not been named or commented.
Council of Europe
June 14, 2026
•[ ransomware, government, leak ]
On 2026-06-14, ShinyHunters claimed that it had stolen approximately 297 GB of Council of Europe data from multiple departments and threatened publication unless the organization began negotiations by 2026-06-16. The group claimed the material included payroll, human-resources, banking, tax, social-security, medical, and applicant records. The Council of Europe stated that it was investigating the allegation but had not publicly confirmed the breach, access method, or claimed data volume at the time of the supplied report. Because no intrusion date was reported, the publication date is used as the event date.
POKKA PTE. LTD.
June 14, 2026
•[ ransomware, retail, hack ]
Sapporo Holdings confirmed unauthorized access to POKKA PTE. LTD. on June 14, 2026 after detecting suspicious communications and disconnected related systems and equipment for containment. INC listed pokka.co on July 18 and threatened to leak data unless the company negotiated; monitoring sources described internal files as exfiltrated, but neither the quantity nor contents were disclosed. No attacker-caused operational disruption was reported. Sapporo said its Japanese domestic operations were unaffected and found no causal relationship between the Pokka and Sleeman incidents.
Eastman Kodak Company
June 15, 2026
•[ ransomware, leak, technology ]
ShinyHunters listed Eastman Kodak Company on its extortion site on June 15, 2026, claiming theft of more than 2.2 million customer records and internal corporate data and threatening publication on June 18. Kodak confirmed that an unauthorized third party temporarily accessed a limited amount of company data, stated that the incident was contained, and reported no threat to its systems or operations. Kodak did not confirm the actor's claimed volume or contents.
