Scope Systems Pty Ltd
May 5, 2026
•[ ransomware, technology ]
On May 5, 2026, an unidentified ransomware actor accessed Scope Systems' network, encrypted its hosted client servers, and disrupted customer access to Pronto Xi, its support portal, APIs, and other cloud services. The actor remained in the network for less than 24 hours and exfiltrated data from Scope Systems' internal file server, while Scope reported that data stored on client servers was not accessed and restored all client servers from backups by May 17.
Champaign-Urbana Public Health District
May 6, 2026
•[ ransomware, healthcare, government ]
Champaign-Urbana Public Health District detected suspicious network activity on May 7, 2026. Its investigation determined that an unauthorized actor copied files from its computer network between May 6 and May 7. Reporting during the incident indicated that its primary website was disrupted and an alternate site was used. INC Ransom claimed responsibility and threatened to release data, but the district did not publicly confirm the attribution, encryption, or the number of affected individuals.
Wilmer Cutler Pickering Hale and Dorr LLP
May 8, 2026
•[ social, ransomware, finance ]
On May 8, 2026, a WilmerHale employee provided personal information to an unauthorized third party who misrepresented their identity. The firm said the actor did not directly access its systems or network; the information had been obtained through legal services and may have included names and Social Security numbers. WilmerHale reported no known further disclosure or misuse. Later reporting attributed the incident to Silent Ransom Group, also known as Luna Moth, and alleged that WilmerHale paid at least $18 million, including a $10 million primary cyber-insurance layer; WilmerHale and the insurer did not publicly confirm those payment claims.
Lifelong Access
May 10, 2026
•[ ransomware, healthcare, leak ]
Lynx listed Lifelong Access on its extortion site on 10 May and threatened to publish stolen information unless the organization negotiated. A subsequently published searchable dataset contains 98,974 records with personal contact and birth-date information. Lifelong Access has not publicly confirmed the incident or disclosed the intrusion method, ransom demand, encryption, or operational impact. No service disruption was identified in public reporting.
Waterford Hotel Group
May 11, 2026
•[ ransomware, financial, technology ]
Waterford Hotel Group, a Connecticut hotel and conference center manager, was listed by the Interlock ransomware group on May 11, 2026; Interlock claimed to hold personal, confidential, partner and financial data from the chain and its divisions. No company confirmation.
Pratiksha Foundation Charitable Trust
May 12, 2026
•[ ransomware, healthcare, education ]
By 2026-05-12, FulcrumSec had contacted Pratiksha Foundation Charitable Trust after compromising educational databases and demanded $750,000 to prevent disclosure. The compromised information included children's medical and mental-health details, travel and location information, and parental income data. The Bombay High Court issued an ex parte interim order on 2026-06-12 restraining FulcrumSec from publishing or disseminating the stolen information and directing service providers to block identifiers used by the group.
Krum Public Library
May 14, 2026
•[ ransomware, government, financial ]
Krum Public Library detected unusual network activity on May 14, 2026 and later confirmed a ransomware attack limited to the library environment. Computer access, printing, and Wi-Fi were unavailable, and checkout was temporarily limited to five items. Forensic investigators determined that some library network files had been accessed without authorization, although the city said Social Security numbers and personal financial account information were not affected. NightSpire claimed responsibility and described financial and human-resources data, but the city did not confirm the attribution or claimed contents.
HDFC Asset Management Company Limited
May 16, 2026
•[ ransomware, leak, finance ]
On 16 May, an HDFC AMC IT administrator detected suspicious activity, and the company received an email from Morpheus claiming to have exfiltrated more than 680 GB of data. HDFC AMC activated containment procedures, isolated affected systems, engaged cybersecurity specialists, and notified regulators and law enforcement. On 29 May, the Bombay High Court restrained Morpheus and others from publishing or using the data. HDFC AMC later said the incident did not interrupt business continuity, did not materially affect its financial results, and did not affect investors' units or portfolio values. The initial access method was not disclosed.
Mid-Cumberland Human Resource Agency
May 18, 2026
•[ ransomware, healthcare, government ]
Insomnia claimed Mid-Cumberland Human Resource Agency as a victim in June 2026 and threatened publication of stolen information. DataBreach.com indexes 196,568 records and dates the underlying breach to May 18, 2026. MCHRA is a Nashville-based nonprofit providing social, health-support, meals, transit, and related human services. No independently verified operational disruption has been established.
Fox Rothschild LLP
May 21, 2026
•[ ransomware, social, finance ]
On 2026-05-21, a sophisticated social-engineering incident enabled unauthorized access associated with one Fox Rothschild user device. Fox Rothschild stated that the activity was limited to that device and that it found no broader access to the firm's systems or network. Silent Ransom Group claimed responsibility, said it exfiltrated confidential client files, demanded payment, and later published data after the ransom deadline passed. The actor attribution, stolen-data scope, and publication details are based on the group's claim and subsequent reporting.
DentaQuest, LLC
May 23, 2026
•[ leak, ransomware, healthcare ]
DentaQuest confirmed unauthorized access to a limited portion of its network and said it acted to contain the incident. ShinyHunters claimed responsibility and published approximately 234 GB of allegedly stolen data after negotiations failed. Have I Been Pwned identified information associated with approximately 2.6 million accounts. DentaQuest said its systems remained fully operational with limited customer-service disruption but did not publicly confirm the actor's claimed volume or attribution.
MIP Holdings (Pty) Ltd
May 25, 2026
•[ ransomware, technology, leak ]
The Gentlemen used credentials that an MIP employee had reused on an unrelated service that was previously breached to reach an employee personal laptop and MIP's legacy Atlassian Jira support environment around 25 May 2026. Jira contained screenshots, attachments, personal information and credentials; credentials obtained there also enabled access to certain FTP/SFTP sites. Attackers remained in the environment until detection on 14 June and exfiltrated about 400,000 records. MIP's core policy-administration systems were not compromised. MIP later confirmed paying a substantial ransom for a deletion promise that was not honored.
ERIELL Group
May 26, 2026
•[ ransomware, energy ]
On or before May 26, 2026, an affiliate of the Nova ransomware operation gained unauthorized access to ERIELL Group and stole corporate data, which the group threatened to publish if the company did not negotiate. Nova subsequently acknowledged that its affiliate had attacked the Uzbekistan-based company, banned the affiliate, claimed that no files were encrypted, and promised not to publish the stolen information.
Sinomax USA
May 28, 2026
•[ ransomware, manufacturing, retail ]
Qilin listed Sinomax USA on May 28, 2026 and threatened to release confidential data unless the company negotiated. DataBreach.com subsequently indexed 96,279 rows associated with the company. Public reporting did not confirm encryption, system unavailability, or operational disruption; therefore, only the achieved data-theft effect is coded.
EnTrans International LLC
May 28, 2026
•[ ransomware, leak, manufacturing ]
Chaos listed EnTrans International LLC on 28 May, said it had possessed the company's internal data for some time, and threatened publication after a 72-hour deadline. A subsequently published searchable dataset contains personal and vehicle information. EnTrans, which operates as Engineered Transportation International, has not publicly confirmed the incident or disclosed the access method, encryption, or operational impact. No system outage or other operational disruption was identified in public reporting.
Providence Medical Group
May 28, 2026
•[ ransomware, healthcare ]
Providence Medical Group, a physician practice group in the Dayton, Ohio area, was claimed by the Qilin ransomware group on May 28, 2026; a 346,802-row dataset with SSNs and birth dates was later indexed. The group has not publicly confirmed the incident.
HumanEdge
May 28, 2026
•[ ransomware, technology ]
HumanEdge, a staffing and recruiting firm headquartered in White Plains, New York, was claimed as a victim by the Qilin ransomware group on May 28, 2026, which threatened to leak data unless negotiations began. No company statement was found.
Lab Express International, Inc.
May 29, 2026
•[ ransomware, healthcare, technology ]
INC Ransom claimed that it compromised shared infrastructure used by Lab Express International and Garonit Pharmaceutical and obtained approximately 200 GB of internal data. DataBreach.com later indexed 5,506 name records associated with labexpress.com. Public reporting did not establish encryption or operational disruption.
Reliance Infrastructure Limited
May 29, 2026
•[ ransomware, leak, energy ]
On May 29, 2026, Yotta detected suspicious activity on a hosted server belonging to Reliance Infrastructure, terminated it, and prevented suspected ransomware execution. Reliance confirmed a partial breach of data on the third-party server. World Leaks later published a reported 858,000 Reliance files, including nearly 19,000 files totaling 14.3 GB associated with the Kudankulam project. Reuters could not independently authenticate the documents. NPCIL said the material concerned conventional balance-of-plant facilities rather than nuclear-safety, security, reactor-core, or plant-control systems; there was no reported compromise of NPCIL or plant systems.
UEI College
May 29, 2026
•[ ransomware, leak, education ]
Termite claimed responsibility for compromising UEI College and threatened to release the institution's data unless negotiations occurred. The group publicly listed the victim on May 30, 2026, with the underlying breach estimated as May 29. DataBreach.com later indexed 5,573,054 leaked rows containing personal and identity information. No independently verified operational disruption has been established.
