Undisclosed Israeli government organization(s)
July 7, 2026
•[ espionage, government, technology ]
Check Point Research reported that the MOIS-linked Cavern Manticore cluster gained access to undisclosed Israeli government organizations during Operation Epic Fury. The operators used compromised IT service providers, trusted remote-management relationships, and browser-based remote-desktop technology to move into and through victim environments. The Cavern framework provided capabilities for file and database access, credential-related activity, reconnaissance, tunneling, and lateral movement. Check Point observed data exfiltration through remote-printing features in some campaign intrusions but did not state whether those cases involved government victims or disclose the stolen information, victim names, counts, or exact intrusion dates.
Undisclosed Chinese research institution
July 7, 2026
•[ espionage, insider, government ]
According to China's Ministry of State Security, an outsourced database maintenance worker recruited by an unidentified foreign intelligence agency used remote maintenance privileges to download core research data from an undisclosed institution's experimental database and transfer it abroad. The worker was reportedly arrested, but the institution, contractor, foreign service, incident date, and transfer channel were not disclosed. No operational disruption was reported; because the incident date is unknown, event_date defaults to the supplied source's publication date.
Beaver County Behavioral Health
July 8, 2026
•[ ransomware, healthcare, government ]
Beaver County Behavioral Health, a Pennsylvania county agency, was hit by ransomware from July 8, 2026 that locked staff out of systems and patient files. Hackers copied patient PHI incl. SSNs and diagnoses; the county reportedly paid a ransom and notified patients Sept. 4.
Thailand Ministry of Finance
July 9, 2026
•[ insider, government, finance ]
An unidentified operator who already had access to the ministry's environment supplied target-specific objectives and tools to Hermes and ran it in unattended YOLO mode. Hunt.io recovered active session cookies, a deployed web shell, stolen credentials, and logs showing Hermes enumerating ministry hosts and traversing files between July 9 and 13. The evidence indicates multiple internal systems were compromised, but neither the ministry nor Thai authorities publicly confirmed the breach and no data exfiltration or operational disruption was demonstrated.
Elections Alberta
July 9, 2026
•[ social, government ]
An unidentified actor operated electionsab.ca, a lookalike domain mimicking Elections Alberta's legitimate elections.ab.ca address. The site generated fictitious names, addresses, phone numbers, and elector ID numbers while exploiting concern about a separate voter-list exposure. Elections Alberta confirmed that all displayed data was fake and said the apparent intent was to reduce confidence in the agency and Alberta electoral events; enforcement and cybersecurity agencies were contacted for takedown assistance.
Undisclosed Netherlands IP-camera owners or operators
July 14, 2026
•[ espionage, hack, government ]
AIVD and MIVD disclosed that a small number of internet-accessible IP cameras along military logistics routes in the Netherlands had been compromised and that the operators used image-recognition software to identify military vehicles and cargo. The Dutch advisory did not name the Russian service; GRU Unit 26165 is coded from a separate official multinational advisory, cited by the Dutch agencies, that linked the unit to closely matching IP-camera operations.
Undisclosed IP-camera owners or operators in other EU or NATO member states
July 14, 2026
•[ espionage, hack, government ]
AIVD and MIVD disclosed that Russian operators compromised internet-accessible IP cameras in multiple EU and NATO member states beyond the Netherlands and used image-recognition software to collect military-logistics and other militarily relevant intelligence. The Dutch advisory did not name the Russian service; GRU Unit 26165 is coded from a separate official multinational advisory, cited by the Dutch agencies, that linked the unit to closely matching IP-camera operations.
Town of Milford
July 15, 2026
•[ hack, government, technology ]
Beginning early July 15, 2026, unauthorized activity affecting Milford municipal computer systems disrupted phone and internet service across town buildings. The water utilities billing office closed, online payments became unavailable, the town clerk lost access to New Hampshire state systems, Zoom participation in public meetings was suspended, and some services continued through backup procedures with delays. Emergency calls to 911 remained available. On July 22, several systems were still offline for forensic analysis. Milford did not disclose the actor, attack method, malware or ransomware involvement, a ransom demand, encryption, or data theft. Earlier warnings about an internet-accessible town storage system were not publicly linked to this incident.
Město Čelákovice
July 16, 2026
•[ ransomware, government ]
The Gentlemen listed the Czech municipality of elkovice on its leak site on 16 July 2026 and threatened publication of a full leak unless representatives entered negotiations. The supplied Novinky article independently reports that The Gentlemen attacked Czech municipal and city offices on 16 July and threatened release of sensitive data for nonpayment, but elkovice has not publicly confirmed the compromise and victim-specific encryption or outage is not established.
Office of the President of Kenya
July 18, 2026
•[ hack, government, financial ]
Attackers replaced the homepage of Kenya's official presidential website with an anti-government message, a cryptocurrency wallet, and a demand for five bitcoins while threatening to publish unspecified information about President William Ruto. Authorities temporarily restricted access for containment and restored the site by July 20; the government found no evidence of sensitive-data access, exfiltration, or loss.
Indonesian Ministry of Home Affairs Legal Documentation and Information Network
July 18, 2026
•[ hack, government ]
The Indonesian Ministry of Home Affairs legal-documentation portal was defaced and made unavailable on July 18, 2026. The altered homepage displayed the self-claimed identity Dua Pemuda Pembawa Bencana and messages stating that Indonesia was experiencing a corruption emergency and calling for taxes to be stopped to combat corruption. No official evidence established access to stored data or broader ministry systems, and no recovery time was reported.
Prefettura di Reggio Calabria
July 21, 2026
•[ ransomware, malware, social ]
Attackers took over a certified (PEC) email account of Italy's Reggio Calabria Prefecture, reportedly via infostealer, and posed as authorities to get data on ~680 Revolut customers (July 21, 2026). Group iamnotavillain demanded ransom; prosecutors are investigating.
North Dakota Department of Health and Human Services
July 21, 2026
•[ phishing, leak, healthcare ]
North Dakota HHS said a phishing email on 21 Jul 2026 let an unauthorized third party into the email accounts of three Developmental Disabilities staff, exposing health data of about 1,700 clients. State IT secured the accounts; notices went out 24 Aug.
Undisclosed Western government organization
July 22, 2026
•[ espionage, government, misconfiguration ]
An unnamed Western government organization lost more than 18,000 records from its backend database on July 22, 2026 after an attacker exploited its WordPress site, per GreyNoise, which links the suspected Chinese-speaking actor to the Red Heron group and a ZyXEL switch campaign.
French Ministry of National Education (staff-training information system)
July 25, 2026
•[ leak, government, education ]
On the night of July 25, 2026 an attacker used an impersonated or compromised professional account to enter the French Education Ministry staff-training information system. Security personnel were alerted July 26 and suspended external access to contain the intrusion. Information about ministry staff employed in regional academies since 2001 may have been acquired, and affected personnel were notified. ZeroBytes later claimed much wider education data theft and published alleged samples, but the ministry had not confirmed that claimed student population or data volume. This intrusion is distinct from the ministry COMPAS breach in March 2026.
Académie de Créteil
July 25, 2026
•[ hack, leak, government ]
France's Acadmie de Crteil confirmed on Sept 22, 2026 that student and guardian data from its student databases and staff directory were exfiltrated in the July 2026 hack of Education Ministry systems. Hacker ZeroBytes claimed Crteil data in August; victim count undisclosed.
City of Plymouth Water and Sewer Utility
July 26, 2026
•[ hack, espionage, energy ]
Beginning at approximately 7:30 p.m. on July 26, 2026, Plymouth lost SCADA communications with cellular-connected programmable logic controllers at two water towers and 14 sanitary-sewer lift stations. A second facility stopped communicating shortly after midnight, prompting a coordinated response. The city disconnected affected equipment, used manual site checks and procedures, hard-reset and secured systems location by location, and restored normal communications by the afternoon of July 28. Water levels, pressure, treatment, quality, and delivery remained unaffected. No data theft, ransom demand, or specific actor was disclosed. U.S. intelligence agencies preliminarily assessed that Iran was likely responsible for the coordinated Minnesota campaign, but attribution was not final.
Indonesian Army (TNI AD)
July 26, 2026
•[ hack, government, technology ]
Dozens of Indonesian Army subdomains were defaced nearly simultaneously on July 26, 2026, with original pages replaced by a message reading hacked by azraelzer0d4y. Defacement archives associate the handle with the team m0z1ll4s. By July 29, some subdomains had returned to normal while others remained defaced or inaccessible. The Army acknowledged the reported cybersecurity disturbance and said it was investigating the cause and impact; no political message, data theft, or specific exploitation method was reported.
City of Atlanta
July 26, 2026
•[ leak, government ]
ExfilSquad listed the City of Atlanta on July 26, 2026 and claimed approximately 3 million records from city systems, including citizen service requests, addresses, municipal case histories, and internal case-management information. DataBreach.com subsequently indexed 701,869 rows associated with the city. The City of Atlanta has not publicly confirmed the incident, and no operational disruption has been established.
Police National Legal Database (PNLD)
July 26, 2026
•[ ransomware, leak, government ]
Data from the Police National Legal Database was compromised and published on the dark web, including professional contact information for police and criminal justice personnel and data from some Ask the Police users. ExfilSquad claimed the breach and demanded payment; independent review validated samples associated with the wider ExfilSquad campaign, although PNLD did not itself attribute the intrusion to the group.
