First Federal Savings & Loan Association of Pascagoula-Moss Point
June 10, 2026
•[ leak, finance ]
WorldLeaks listed First Federal Savings & Loan Association of Pascagoula-Moss Point on June 10, 2026 and threatened to publish stolen information. DataBreach.com subsequently indexed 54,751 rows. Public reporting did not identify the access vector or document encryption, system unavailability, or operational disruption.
Undisclosed operator of shared communications infrastructure used by four Iranian banks
June 14, 2026
•[ hack, finance, technology ]
A cyberattack on June 14, 2026 targeted shared communications infrastructure used by Bank Melli, Bank Tejarat, Bank Saderat, and the Export Development Bank of Iran. The direct technical disruption occurred at the shared infrastructure layer and temporarily affected some banking services at all four institutions. Later reporting stated that the disruption took several days to resolve. Iran's banking coordination council said that no unauthorized access to customer information occurred and no data was deleted. The infrastructure operator, attack method, and perpetrator were not publicly identified.
Optimum First Mortgage, Inc.
June 15, 2026
•[ ransomware, finance ]
Optimum First Mortgage learned around June 19, 2026 that an unauthorized party had accessed its network several days earlier. PEAR claimed responsibility, dated the intrusion to June 15, alleged theft of approximately 9.3 TB, and threatened publication. The company disputed the claimed volume and said its investigation had found no evidence that its loan-origination or application-software systems were breached. The affected data categories and number of individuals remained unconfirmed.
River Financial Corporation (River Bank & Trust)
June 16, 2026
•[ ransomware, finance ]
An unauthorized actor accessed River Financial Corporation's network, including River Bank & Trust, on or about June 16, 2026. River detected the activity on June 19 and determined that ransomware had been deployed across portions of its server environment, disrupting certain operations and prompting impacted systems to be taken offline. A July 10 SEC amendment confirmed that the actor also removed certain data, although the contents and scope remained under investigation and River reported no evidence that customer accounts were affected.
Kepler Software Inc. (Mastra)
June 17, 2026
•[ hack, malware, technology ]
During a 45-minute window on June 17, 2026, Sapphire Sleet compromised Mastra maintainer ehindero's NPM account and published 141 Mastra packages containing the malicious easy-day-js dependency. The dependency's post-install script downloaded and executed a second-stage payload targeting cryptocurrency-related browser extensions. The affected package versions were removed, and users who installed Mastra packages during the window were advised to treat their systems as potentially affected.
Allstate Insurance Company
June 19, 2026
•[ leak, finance, technology ]
Allstate learned on July 26, 2026 that information may have been taken without authorization and determined that data had been acquired on June 19. ExfilSquad claimed Allstate on July 26 and described recruitment, licensing, onboarding, personal, and employee-account information. DataBreach.com indexed 939,910 rows. Allstate regulatory filings report 2,604 affected individuals and confirm names, addresses, dates of birth, Social Security numbers, and appointment-related information.
FCCI Insurance Group
June 27, 2026
•[ phishing, finance, technology ]
Threat-intelligence reporting attributes the FCCI compromise to Redact and dates its detection to 27 June 2026. The attackers reportedly used voice phishing and adversary-in-the-middle session hijacking to compromise cloud identities, register rogue MFA devices, and exfiltrate data through Microsoft Graph, OneDrive, and SharePoint APIs. Redact is described as an extortion-only operation, and no encryption or operational disruption was reported.
Apollo Management Holdings, L.P. (Apollo Global Management)
July 6, 2026
•[ social, finance, technology ]
An unidentified actor used social engineering to compromise employee authentication and gain unauthorized access to Apollo cloud platforms between July 6 and July 10, 2026. Personal information including names, birth dates, addresses and Social Security numbers was accessed and stolen. The company reported the breach to regulators, notified affected people and offered monitoring services. The exact victim count, particular cloud application and responsible group were not disclosed.
Thailand Ministry of Finance
July 9, 2026
•[ insider, government, finance ]
An unidentified operator who already had access to the ministry's environment supplied target-specific objectives and tools to Hermes and ran it in unattended YOLO mode. Hunt.io recovered active session cookies, a deployed web shell, stolen credentials, and logs showing Hermes enumerating ministry hosts and traversing files between July 9 and 13. The evidence indicates multiple internal systems were compromised, but neither the ministry nor Thai authorities publicly confirmed the breach and no data exfiltration or operational disruption was demonstrated.
Chumz (Moneto Ventures Limited)
July 11, 2026
•[ leak, finance, technology ]
DataBreach.com indexed 89,577 structured records associated with Chumz, a mobile savings and investment service operated by Kenya-incorporated Moneto Ventures Limited, on July 11, 2026. The records contained names, email addresses, and phone numbers. The source marked the dataset unverified, and no victim notice, regulator statement, or reliable actor attribution was located. No evidence established financial-account exposure, the initial access vector, or operational disruption.
Prefettura di Reggio Calabria
July 21, 2026
•[ ransomware, malware, social ]
Attackers took over a certified (PEC) email account of Italy's Reggio Calabria Prefecture, reportedly via infostealer, and posed as authorities to get data on ~680 Revolut customers (July 21, 2026). Group iamnotavillain demanded ransom; prosecutors are investigating.
Verus-Ethereum Bridge
July 23, 2026
•[ hack, technology, finance ]
An attacker exploited the Verus Protocol's Ethereum cross-chain bridge on July 23, 2026 by inserting duplicate malicious state-root entries into otherwise legitimate notarizations, then submitting a fabricated import proof that authorized inflated Ethereum withdrawals after a 0.01 VRSC export. Approximately US$7.44 million was drained, swapped into about 2,779 ETH, and deposited into Tornado Cash. Researchers said a different attacker and wallet were involved than in the May bridge exploit; no operational disruption was reported.
Bank of Baroda
July 24, 2026
•[ leak, insider, finance ]
Threat intelligence attributed the leak-site claim to Triple X, while the material was also advertised under the handle leak-king-F. The bank later confirmed that a compromised employee email account enabled unauthorized access to certain data, but it did not confirm the actor attribution or full leak claim. The incident was contained and the bank said its core banking and transaction systems were not accessed or affected.
Office of Justice – Register of Beneficial Owners (VwbP)
July 30, 2026
•[ hack, leak, government ]
Unknown attackers gained unauthorized access to Liechtenstein's Register of Beneficial Owners during the night of July 29-30 and exfiltrated copies of data relating to approximately 31,000 legal entities. Authorities found no indication that data was modified or deleted; the register was taken offline by the government as a defensive response rather than as an attacker-caused disruption.
Zenith Bank Plc
August 5, 2026
•[ hack, finance ]
Zenith Bank disclosed unauthorized access to limited customer information, including email addresses and phone numbers, as part of what it described as a broader global cyberattack affecting organizations across multiple sectors. The bank activated its incident-response procedures and said its banking systems, digital channels, customer funds, credentials, and financial information remained secure and operational.
Westland Insurance Group Ltd.
August 7, 2026
•[ ransomware, leak, finance ]
Helix listed Westland Insurance Group on its extortion site on August 7, 2026 and said negotiations had stalled after Westland received a ransom demand. Helix subsequently claimed the data had been published. DataBreach.com indexed 1,520,799 records containing personal, contact, and vehicle information. Westland has not publicly confirmed the incident, and no operational disruption has been independently established.
Coggins Insurance Agency, Inc.
August 10, 2026
•[ leak, finance, ransomware ]
Global Secret Group listed Coggins Insurance Agency on its leak site on August 10, 2026. DataBreach.com later indexed 21,657 records containing names, email addresses, and phone numbers. Coggins is an independent insurance agency in Pensacola, Florida. No independently verified operational disruption has been established.
Osmo Wallet
August 10, 2026
•[ ransomware, finance, technology ]
Osmo Wallet, a Guatemala City-based fintech and bitcoin remittance app, was listed on the Direwolf ransomware group's leak site on August 10, 2026, with a threat to publish stolen data unless the company made contact. No company confirmation.
Hogan Lovells Cadwalader
August 12, 2026
•[ ransomware, finance, leak ]
Silent Ransom Group claimed it accessed law firm Hogan Lovells Cadwalader's legacy infrastructure on Aug 12, 2026 for about 24 hours, stole over 50 GB and posted it on its leak site after rejecting offers of up to $5.34M against a $20M demand. The firm did not respond.
Quinn Emanuel Urquhart & Sullivan LLP
August 14, 2026
•[ social, espionage, leak ]
On August 14, 2026 an unauthorized third party used social engineering to obtain access through one temporarily compromised Quinn Emanuel user account to stored files in a single software application. The intruder accessed a limited number of client documents including material concerning Muddy Waters from litigation in Florida. The law firm notified affected parties and law enforcement, and said unauthorized access was no longer ongoing. A separate 2023 Quinn Emanuel client-data exposure involved a third-party data center and is not this incident.
