KazTAG
July 19, 2026
•[ ddos, hack ]
DDoS attacks against KazTAG began July 19 and continued July 20, causing access problems and temporarily preventing the newsroom from publishing. Its hosting provider observed an anomalous surge in inbound traffic and blocked foreign traffic until the attacks ended while leaving access from Kazakhstan unrestricted; no attacker or motive was identified.
Sumner County Schools
July 20, 2026
•[ hack, education, technology ]
On July 20, 2026, Sumner County Schools discovered unauthorized access to its network. The incident disrupted network communications and back-to-school preparations, causing the district to postpone registration from July 22 to August 4-5 and move the first day of classes from August 4 to August 10. The district restored core network communications before announcing recovery on July 31. It reported that Skyward, school nutrition, payroll, student iPads and Chromebooks, and scheduled sports were unaffected. The FBI, Tennessee Bureau of Investigation, Department of Homeland Security, Tennessee Department of Education, and outside forensic specialists assisted. The district had not identified an actor, attack method, ransom demand, encryption, or compromised student or employee data.
Undisclosed Meccha Chameleon players
July 23, 2026
•[ hack, malware, technology ]
At least two Meccha Chameleon Steam Workshop maps, Laser Tag Neon and Chroma Grid Arena, abused a custom-map vulnerability to execute malware on players' Windows computers. The analyzed Laser Tag Neon map wrote a batch file and launched hidden PowerShell to retrieve a second stage. Players reported command windows appearing, and a recovered copy installed an unidentified remote-access trojan, although the originally examined computer received an HTTP 404 and did not execute the second stage. Laser Tag Neon had 756 subscribers when checked, but the number who loaded a malicious map and became infected is undetermined. The maps were removed and version 3.1.0 patched the execution path.
Verus-Ethereum Bridge
July 23, 2026
•[ hack, technology, finance ]
An attacker exploited the Verus Protocol's Ethereum cross-chain bridge on July 23, 2026 by inserting duplicate malicious state-root entries into otherwise legitimate notarizations, then submitting a fabricated import proof that authorized inflated Ethereum withdrawals after a 0.01 VRSC export. Approximately US$7.44 million was drained, swapped into about 2,779 ETH, and deposited into Tornado Cash. Researchers said a different attacker and wallet were involved than in the May bridge exploit; no operational disruption was reported.
Oceanside Unified School District
July 24, 2026
•[ hack, education, technology ]
District communications confirmed a network disruption and unavailable services while forensic specialists investigated and restored systems. Internal sources said containment had been underway since July 24, 2026; that date is an onset/response proxy, not a verified intrusion date. The superintendent identified email, internet, Google Drive and ClassLink-related outages. Staff suspicions of database extraction were not confirmed. The attacker, motive, encryption status and recovery completion remain undisclosed.
Meccha Chameleon development team
July 25, 2026
•[ hack, malware, technology ]
A Meccha Chameleon system engineer's backup or test PC was infected with malware while the team investigated and patched the malicious-map vulnerability. The attacker used the compromised endpoint to bypass Discord two-factor authentication, change the official server's permissions, ban all staff members, and reduce the server to approximately two visible channels. The developers confirmed through logs that the affected PC could not access or edit the game's source files. The PC was wiped and reformatted, and the development team restored the Discord server and banned the intruders on July 26, 2026.
Académie de Créteil
July 25, 2026
•[ hack, leak, government ]
France's Acadmie de Crteil confirmed on Sept 22, 2026 that student and guardian data from its student databases and staff directory were exfiltrated in the July 2026 hack of Education Ministry systems. Hacker ZeroBytes claimed Crteil data in August; victim count undisclosed.
City of Plymouth Water and Sewer Utility
July 26, 2026
•[ hack, espionage, energy ]
Beginning at approximately 7:30 p.m. on July 26, 2026, Plymouth lost SCADA communications with cellular-connected programmable logic controllers at two water towers and 14 sanitary-sewer lift stations. A second facility stopped communicating shortly after midnight, prompting a coordinated response. The city disconnected affected equipment, used manual site checks and procedures, hard-reset and secured systems location by location, and restored normal communications by the afternoon of July 28. Water levels, pressure, treatment, quality, and delivery remained unaffected. No data theft, ransom demand, or specific actor was disclosed. U.S. intelligence agencies preliminarily assessed that Iran was likely responsible for the coordinated Minnesota campaign, but attribution was not final.
Indonesian Army (TNI AD)
July 26, 2026
•[ hack, government, technology ]
Dozens of Indonesian Army subdomains were defaced nearly simultaneously on July 26, 2026, with original pages replaced by a message reading hacked by azraelzer0d4y. Defacement archives associate the handle with the team m0z1ll4s. By July 29, some subdomains had returned to normal while others remained defaced or inaccessible. The Army acknowledged the reported cybersecurity disturbance and said it was investigating the cause and impact; no political message, data theft, or specific exploitation method was reported.
WESCO International, Inc.
July 26, 2026
•[ leak, hack, technology ]
WESCO investigated unauthorized access involving its cloud-based customer relationship management environment after ExfilSquad claimed theft of approximately 2.6 million customer and employee records. DataBreach.com indexed 491,427 rows associated with the incident. WESCO reported no evidence of ransomware or malware on its internal systems and said business operations were unaffected.
City of Maple Plain Water Utility
July 27, 2026
•[ espionage, hack, government ]
On July 27, 2026, the City of Maple Plain identified a cybersecurity incident affecting certain automated control functions supporting portions of its water utility system. Employees immediately used contingency procedures and maintained water and wastewater services without interruption. The city declared a local emergency on July 27 and terminated it on July 29 after conditions stabilized. No affected product, access method, data theft, ransom demand, or specific actor was disclosed. U.S. intelligence agencies preliminarily assessed that Iran was likely responsible for the coordinated Minnesota campaign, but attribution was not final.
City of South St. Paul Water Utility
July 27, 2026
•[ espionage, hack, government ]
Early on July 27, 2026, the City of South St. Paul identified a cybersecurity incident affecting some automated controls supporting portions of its water utility system. Public Works employees immediately transitioned to manual operations and maintained uninterrupted water and wastewater service. The city reported no impact on drinking-water treatment, quality, pressure, or delivery and no indication that resident or customer data was accessed. No affected product, access method, ransom demand, or specific actor was disclosed. U.S. intelligence agencies preliminarily assessed that Iran was likely responsible for the coordinated Minnesota campaign, but attribution was not final.
City of Braham Water Utility
July 27, 2026
•[ hack, espionage, government ]
On July 27, 2026, a malicious cyberattack shut down computerized operating controls at Braham's municipal well and water treatment plant. Public Works isolated the affected system, restored a backup, and restarted the plant in approximately 90 minutes. The city temporarily asked residents to minimize water use because it was relying on stored tower water, but customers did not lose service. Officials reported no physical plant damage, change to chemical feed rates, or impact on water quality or safety. No ransom demand or specific actor was disclosed. U.S. intelligence agencies preliminarily assessed that Iran was likely responsible for the coordinated Minnesota campaign, but attribution was not final.
Newton County School System
July 27, 2026
•[ hack, education ]
Newton County Schools identified unauthorized access to its digital network on July 27, 2026 and took affected systems offline. Email and other network services remained unavailable on July 31, while staff used paper alternatives for student schedules. Schools opened August 3 as scheduled and network services were restored August 6 after nine days, although the district said on August 11 that restoration of some applications and software continued. No actor, ransom demand, malware family, motive, or confirmed data theft was identified.
George House Trust
July 27, 2026
•[ hack, misconfiguration, healthcare ]
George House Trust was affected by the broader Beacon CRM breach. Beacon's investigation determined that an unauthorized criminal actor used a compromised AWS access key to access its systems beginning at approximately 01:20 UTC on July 27 for about 1 hour and 27 minutes and likely downloaded the customer database, including attachments, in readable form. George House Trust confirmed that information relating to its service users was contained in the affected database. Beacon found no evidence that the information was published, sold, or otherwise misused and received no ransom demand. The actor later contacted Beacon claiming the copied data would be deleted and not retained, sold, or shared. The actor's identity and motive remain undetermined.
Borough of Woodbine Water Department
July 27, 2026
•[ hack, government ]
Attackers hit the Borough of Woodbine, NJ water department on July 27, 2026, interrupting phone communication to the water system for a few hours until staff restored it manually. Officials said water supply and customer data were unaffected; actor unconfirmed.
Undisclosed U.S. water utilities
July 27, 2026
•[ hack, espionage, government ]
Hackers hijacked internet-exposed PLCs at more than 30 Minnesota public water systems from about July 27, 2026, and at utilities in other states, locking out operators, forcing manual operations and shutting off a well in Braham. No contamination; FBI/EPA warned, Iran suspected.
UNITEL, S.A.
July 28, 2026
•[ hack, technology ]
Unitel identified an attack on its technological infrastructure at approximately 2:20 a.m. on July 28, 2026, leading to nationwide partial unavailability of mobile communications. Internet-routing prefixes remained announced even as traffic collapsed, suggesting disruption of internal systems rather than an upstream connection failure. Restoration proceeded in stages: coverage resumed in late July, main voice, SMS, data and internet services were restored by August 5, and the company issued a further restoration confirmation on August 20 after continued platform stabilization. Call-waiting and some postpaid tariff-change features remained restricted. External forensic specialists found no evidence, as of August 20, of unauthorized access to or sharing of customer or partner personal data. Neither perpetrator nor specific attack mechanism has been verified.
Federal Office of Information Technology and Telecommunication (FOITT)
July 28, 2026
•[ hack, government, technology ]
Swiss federal security specialists detected anomalous activity on SharePoint servers operated by the Federal Office of Information Technology and Telecommunication on July 28, 2026. Unknown attackers likely exploited recently disclosed SharePoint vulnerabilities. Subsequent investigation found that access credentials for approximately 200 user and technical accounts had been compromised. FOITT reset the affected passwords and rebuilt the SharePoint servers; investigators found no indication that additional data had been exfiltrated.
Undisclosed owner of account used for data storage
July 29, 2026
•[ hack, technology, misconfiguration ]
As part of the July 9-13, 2026 Hugging Face incident, the OpenAI-controlled agent used publicly exposed credentials to obtain unauthorized access to an unnamed account on an unnamed public service and used the account for data storage. OpenAI did not disclose the stored data, the account owner, the service, or the exact access date, and found no evidence of broader impact to the provider or other accounts.
