United States Department of Homeland Security
May 15, 2026
•[ espionage, hack, malware ]
An unidentified actor compromised DHS's Homeland Security Information Network servers and an associated SharePoint environment. From May 15 through May 24, analysts observed altered files on testing and production servers, malicious code executed through a legitimate web-server program, and deleted activity logs, but the activity was dismissed as a false positive. Similar activity continued from May 25 through June 3. On June 4, the attackers installed hidden backdoors and stole credential files, prompting confirmation of the breach. DHS isolated affected systems and mitigated the vulnerability; HSIN remained operational, classified networks were not affected, and neither the actor nor any theft of additional HSIN documents had been established.
Mid-Cumberland Human Resource Agency
May 18, 2026
•[ ransomware, healthcare, government ]
Insomnia claimed Mid-Cumberland Human Resource Agency as a victim in June 2026 and threatened publication of stolen information. DataBreach.com indexes 196,568 records and dates the underlying breach to May 18, 2026. MCHRA is a Nashville-based nonprofit providing social, health-support, meals, transit, and related human services. No independently verified operational disruption has been established.
Connecticut Department of Children and Families
May 20, 2026
•[ phishing, government ]
An external phishing email compromised two Connecticut Department of Children and Families employee accounts on May 20, 2026, allowing an outside attacker to download emails. State IT personnel removed the attacker the same day, pulled the malicious email from agency inboxes, and temporarily disabled the two accounts. The review and law-enforcement investigation remained active; no operational disruption was reported.
Undisclosed external card-printing services provider
May 26, 2026
•[ hack, healthcare, government ]
An undisclosed external card-printing services provider notified Irelands Health Service Executive on the evening of May 26, 2026, that its systems had been attacked and a small number of HSE records had been accessed. HSE systems were not compromised. As a containment measure, HSE paused production of plastic medical, European Health Insurance, GP visit, drugs payment scheme, and long-term illness cards on May 27; plastic-card production remained paused as of July 10. Applications, eligibility, and access to healthcare continued through letters, digital verification, and provisional certificates. The providers identity, registered country, access method, actor, motive, and affected data fields were not disclosed.
Reliance Infrastructure Limited
May 29, 2026
•[ ransomware, leak, energy ]
On May 29, 2026, Yotta detected suspicious activity on a hosted server belonging to Reliance Infrastructure, terminated it, and prevented suspected ransomware execution. Reliance confirmed a partial breach of data on the third-party server. World Leaks later published a reported 858,000 Reliance files, including nearly 19,000 files totaling 14.3 GB associated with the Kudankulam project. Reuters could not independently authenticate the documents. NPCIL said the material concerned conventional balance-of-plant facilities rather than nuclear-safety, security, reactor-core, or plant-control systems; there was no reported compromise of NPCIL or plant systems.
Independent National Electoral Commission (INEC)
May 30, 2026
•[ insider, leak, government ]
INEC confirmed that a specific voter record belonging to Emeka Ike was retrieved from its restricted Continuous Voter Registration administrative portal using valid credentials assigned to authorized personnel and was released without authority. The information was posted on social media on May 30, 2026. INEC stated that there was no external intrusion or broader compromise of its database containing more than 90 million voter records. The individual responsible for retrieving or releasing the record had not been publicly identified.
Chief Master Sgt. John Bentivegna (U.S. Space Force)
May 31, 2026
•[ hack, social, government ]
Hackers took control of Chief Master Sgt. of the Space Force John Bentivegna's Instagram account on May 31, 2026 and posted multiple pro-Iranian and anti-U.S. images and stories. The unauthorized content remained visible for several hours before the account was recovered. The compromise appeared limited to the Instagram account, and the perpetrators were not identified.
Undisclosed operators of at least 10 Ukrainian websites and infected device users
June 1, 2026
•[ espionage, malware, government ]
CERT-UA attributed the June-July 2026 campaign to UAC-0145, a sub-cluster of SANDWORM. The attackers compromised at least 10 Ukrainian websites, injected SMARTAXE to display fake CAPTCHA instructions and resolve command-and-control infrastructure through an Ethereum smart contract, and deployed multiple Windows and Android malware families for reconnaissance, persistence, remote access, and data collection.
City Government of Baguio
June 1, 2026
•[ leak, government, misconfiguration ]
An attacker used an API connected to Baguio City's BuildPASS portal that lacked proper authentication to retrieve files submitted through the building-permit system. More than 100 data subjects were affected. Emperador later claimed the breach and published samples of the stolen files.
City of McMinnville
June 1, 2026
•[ ransomware, government ]
An intruder accessed and copied files from the City of McMinnville network during an interval between June 1 and July 18, 2026. City staff detected unusual activity around July 15. The RansomHouse extortion group subsequently claimed the compromise and posted apparently stolen city data on its dark web site in August. Local reporters observed apparently municipal and police records, and the city later notified affected individuals about possible exposure of identity information. No completed encryption or confirmed service outage was established.
PrivatBank
June 1, 2026
•[ hack, ddos, finance ]
PrivatBank, Ukraine's largest state-owned bank, said an 'unusual' DDoS attack using infected devices of Ukrainian users caused a June 2026 failure of its services, blocking some legitimate customers during filtering. The bank blamed Russia; August outages were a supplier fault.
States of Guernsey — Committee for Education, Sport & Culture
June 3, 2026
•[ social, phishing, government ]
On June 3, an attacker obtained unauthorized access to a Guernsey education employee email account and used it to send a malicious link. The mailbox remained accessible to the intruder for approximately one month and contained information relating to 74 individuals. Officials confirmed the breach but reported no evidence of data exfiltration beyond the Education IT environment. Criminal and Financial are limited inferences from the phishing/credential-abuse pattern; no extortion or political objective was established. Mixed reflects both unauthorized viewing of stored information and fraudulent use of the official mailbox.
French Interministerial Directorate for Digital Affairs (DINUM) – Tchap
June 7, 2026
•[ hack, government, technology ]
On June 7, 2026, an attacker hijacked a Tchap user account and accessed public, unencrypted chat rooms on the French government's messaging platform. DINUM confirmed that 73,467 registered government users were affected and that account information including names, email addresses, affiliated entities, and avatars was potentially exposed. The actor misere additionally claimed theft of 13.5 GB containing more than 643,000 messages and files, but that claim was not independently verified.
Undisclosed Turkish defense contractor
June 7, 2026
•[ espionage, hack, government ]
Beginning on or after June 7, 2026, unidentified operators associated with the FortiBleed campaign used a captured FortiGate VPN session cookie to enter an undisclosed Turkish defense contractor's internal network and access two SMB file shares with an administrator account. They exfiltrated more than 12,000 files totaling 105 GB, including sensitive military documentation, technical files, field imagery, diagnostic records, and employee identification documents.
City of Acworth
June 8, 2026
•[ ransomware, government, hack ]
On 2026-06-08, the City of Acworth detected an unauthorized cybersecurity incident affecting certain municipal computer systems. The city warned residents that they might experience service interruptions because of network outages, engaged cybersecurity professionals, and notified law enforcement. By 2026-06-18, all affected systems had been restored and city services were fully operational. INC Ransom subsequently claimed responsibility by listing Acworth on its dark-web leak site with alleged data samples. The city has not confirmed INC Ransom's attribution, ransomware deployment, encryption, data theft, a ransom demand, the contents of the alleged samples, or the exact systems and services affected.
Central Bank of Libya
June 9, 2026
•[ ransomware, finance, government ]
On 2026-06-09, the Central Bank of Libya confirmed a cyberattack affecting a limited number of systems and technical services. The bank activated emergency response and business-continuity procedures and isolated affected systems. Qilin claimed responsibility on 2026-06-22 and threatened to release confidential banking data. The bank later said it was investigating material published on the dark web. The access method, data categories, volume, and effects on customers or financial assets were not publicly established, and the Qilin attribution remains an attacker claim.
State Health Care Accreditation Agency under the Ministry of Health
June 9, 2026
•[ leak, misconfiguration, healthcare ]
Lithuanian authorities disclosed that approximately 62,000 records containing personal information about doctors and other healthcare specialists were acquired from the State Health Care Accreditation Agency in a cyber incident identified on June 9, 2026. Reporting linked the access to a vulnerability in a server-hosted data system. The actor, motive, detailed data fields, and number of unique affected individuals were not disclosed, and authorities said there was no evidence that the incident was coordinated with other contemporaneous Lithuanian breaches.
California Water Service Company
June 11, 2026
•[ hack, espionage, energy ]
On 2026-06-11, the Iran-linked Handala group claimed that it had compromised California Water Service and published a 5 GB proof-of-concept dataset. Dataminr analysis identified customer billing records, RTKBase GPS correction-system credentials, NTRIP passwords, and network details covering at least seven service districts; records associated with the Chico District were independently confirmed. Handala described the operation as retaliation for U.S. actions in Iran and claimed it could disrupt water service, but no access to water treatment or distribution controls and no operational disruption were confirmed. Handala is linked by threat researchers to Iran's Ministry of Intelligence and Security.
Prince George County
June 11, 2026
•[ ransomware, government, leak ]
Prince George County identified a cybersecurity incident affecting certain network systems on June 11, 2026. The incident disrupted county phone, internet, and online payment services, while 911 and non-emergency dispatch remained available. Most systems were restored within approximately one week. RansomHouse claimed that it encrypted the county on June 10 and posted an evidence pack, but the county did not confirm the group's attribution, encryption claim, data theft, or a ransom demand; officials later stated that personal information may have been involved.
Singapore Land Authority
June 12, 2026
•[ leak, misconfiguration, technology ]
IBM notified SLA on June 12, 2026 of a security incident in an IBM-managed cloud development and systems-integration testing environment supporting STARS and ELS and said by June 15 that personal information may have been accessed. The affected dataset contained real personal data for approximately 70,000 people. SLA said the test environment was separate from live operational systems and no operational systems or other government datasets were compromised. The dataset was encrypted, but authorities did not disclose how the actor obtained access.
