Arch Linux via the Arch User Repository (AUR)
June 11, 2026
•[ malware, technology, hack ]
Attackers took control of abandoned Arch User Repository packages and altered their PKGBUILD files to install the malicious npm package atomic-lockfile. Its preinstall script delivered an eBPF-based rootkit that concealed activity and harvested credentials from affected Linux systems. More than 20 packages were confirmed affected. No named downstream victim or total number of infected systems was reported.
Baylor Genetics
June 11, 2026
•[ hack, healthcare ]
Baylor Genetics determined that an unauthorized party accessed part of its network and information stored there between June 11 and June 17, 2026. The company discovered suspicious activity around June 15, completed its review July 30 and announced notifications August 14. Its HHS report identified 2,810,878 potentially affected people. Genetic testing and laboratory operations continued normally. Neither an actor name nor ransom, sale or other financial objective has been substantiated; Criminal is a provisional inference from the deliberate acquisition of sensitive personal records.
American Tower Corporation
June 12, 2026
•[ leak, hack, technology ]
ShinyHunters listed American Tower Corporation on June 12, 2026 and claimed theft of more than 5.2 million records and sensitive tower-related information. DataBreach.com later indexed 573,655 rows, while Have I Been Pwned identified approximately 217,000 unique affected email addresses. Public reporting did not document encryption or operational disruption, and American Tower did not publicly confirm the actor's full claimed scope.
Undisclosed operator of shared communications infrastructure used by four Iranian banks
June 14, 2026
•[ hack, finance, technology ]
A cyberattack on June 14, 2026 targeted shared communications infrastructure used by Bank Melli, Bank Tejarat, Bank Saderat, and the Export Development Bank of Iran. The direct technical disruption occurred at the shared infrastructure layer and temporarily affected some banking services at all four institutions. Later reporting stated that the disruption took several days to resolve. Iran's banking coordination council said that no unauthorized access to customer information occurred and no data was deleted. The infrastructure operator, attack method, and perpetrator were not publicly identified.
POKKA PTE. LTD.
June 14, 2026
•[ ransomware, retail, hack ]
Sapporo Holdings confirmed unauthorized access to POKKA PTE. LTD. on June 14, 2026 after detecting suspicious communications and disconnected related systems and equipment for containment. INC listed pokka.co on July 18 and threatened to leak data unless the company negotiated; monitoring sources described internal files as exfiltrated, but neither the quantity nor contents were disclosed. No attacker-caused operational disruption was reported. Sapporo said its Japanese domestic operations were unaffected and found no causal relationship between the Pokka and Sleeman incidents.
Premier Medical Group of the Hudson Valley
June 14, 2026
•[ healthcare, hack ]
Poughkeepsie, N.Y. medical practice Premier Medical Group said a June 2026 cyberattack disrupted some of its IT systems and that an unauthorized party accessed files with patient data on June 14; 282,075 people were reported to HHS. No group has claimed the attack.
Illinois Central College
June 15, 2026
•[ hack, leak, education ]
ShinyHunters claimed on June 15, 2026 that it stole more than 28 GB from Illinois Central College systems including PeopleSoft Campus Solutions, human-resources, pension-reporting, Workday-costing, and curriculum systems. DataBreach.com later indexed 21,190 rows from the leak. The college had not publicly confirmed the actor's full claimed scope, and no encryption or operational disruption was documented.
Deep Well Services
June 15, 2026
•[ hack, leak, energy ]
ShinyHunters listed Deep Well Services on June 15, 2026 and claimed theft of customer information and internal corporate data. DataBreach.com later indexed 13,297 rows, while separate analysis identified Salesforce CRM material. Public reporting did not document encryption or operational disruption.
AdaptHealth Corp.
June 15, 2026
•[ hack, social, healthcare ]
Attackers used social engineering to compromise a user session associated with a third-party contractor, accessed AdaptHealth cloud applications including patient-management and document-storage systems and external EHR portals, and exfiltrated data. AdaptHealth said the incident was contained and did not materially affect operations or patient services. ShinyHunters later claimed responsibility, but the company did not confirm the attribution.
Houston City College
June 15, 2026
•[ hack, leak, education ]
ShinyHunters claimed the hccs.edu breach on June 15, 2026 and later published data from Houston City College's student-record environment. The event overlapped with the group's Oracle PeopleSoft campaign against higher education, although no public source specifically confirmed the vulnerability used at Houston City College. No operational disruption was reported.
Dialog
June 16, 2026
•[ hack, misconfiguration, technology ]
On or before June 16, 2026, Swiss hacktivist maia arson crimew accessed internal Dialog records through a misconfigured web application that loaded private files into a visitor's browser after any email address was entered, without requiring a password or bypassing a technical control. The exposed records included participant personal information, login tokens, internal ratings, questionnaires, schedules, and other organizational materials, and Dialog temporarily closed multiple systems after learning of the exposure.
Kepler Software Inc. (Mastra)
June 17, 2026
•[ hack, malware, technology ]
During a 45-minute window on June 17, 2026, Sapphire Sleet compromised Mastra maintainer ehindero's NPM account and published 141 Mastra packages containing the malicious easy-day-js dependency. The dependency's post-install script downloaded and executed a second-stage payload targeting cryptocurrency-related browser extensions. The affected package versions were removed, and users who installed Mastra packages during the window were advised to treat their systems as potentially affected.
SLEEMAN BREWERIES LTD.
June 17, 2026
•[ ransomware, hack, retail ]
Sapporo Holdings confirmed unauthorized access to SLEEMAN BREWERIES LTD. on June 17, 2026 and disconnected related systems and equipment. A Canadian liquor-industry association subsequently relayed that Sleeman's network outage was caused by a cybersecurity incident and that sales and delivery were continuing manually. Chaos listed Sleeman on July 14, and monitoring sources reported an alleged 420-gigabyte theft; Sleeman has not confirmed the attribution or data claim. Sleeman separately disclosed a January 26 ransomware incident involving personal information, so the January data categories are not attributed to this June event. Sapporo found no causal relationship with the Pokka intrusion and no impact on its Japanese domestic operations.
National Secretariat for Protection and Civil Defense
June 19, 2026
•[ hack, government ]
Beginning around 23:40 on 2026-06-19, an unauthorized actor used Brazil's Civil Defense Alert platform to send multiple false extreme emergency alerts, including messages containing the term misantropi4, to phones in at least seven states. Authorities blocked access after the first alert, but the actor regained access and sent additional messages. The platform was taken offline at 01:30 on 2026-06-20, and the Federal Police opened an investigation. The handle mizanthropiaz was associated with a public claim of responsibility, but the government did not confirm the attribution or identify the access method.
City of University City
June 19, 2026
•[ government, hack ]
A malicious cyberattack disrupted University City's network connections and prevented access to municipal systems and online services. Staff used telephone, in-person, and other manual processes while systems were rebuilt and restored. The city reported full restoration on August 6, 2026 and said its investigation found no evidence that personal information was accessed, removed, or compromised. The attack method, actor, and motive were not disclosed.
Undisclosed organization investigated by Volexity
June 22, 2026
•[ hack, technology, ransomware ]
UTA0533 compromised two SonicWall SMA1000 appliances at one undisclosed organization. Volexity found compromise artifacts dating to June 22, 2026 and LDAP-capture files dated July 2. The actor intercepted unencrypted authentication traffic to obtain credentials. The event date records the earliest observed compromise, not a proven date for the first credential theft. Ransomware effects reported at other victims are not established for this organization.
Analog Devices, Inc.
June 23, 2026
•[ hack, leak, technology ]
Analog Devices detected unauthorized access to certain company systems on June 23, 2026 and confirmed that files were exfiltrated. Its SEC filing stated that operations were not interrupted and that the incident was not expected to materially affect the business. No actor or motive was identified. A July 26 ExfilSquad claim involving 570,000 alleged customer records was described by Analog Devices as a separate and unrelated matter and is not incorporated into this record.
Flughafen Wien AG
June 24, 2026
•[ hack, espionage, technology ]
Flughafen Wien AG confirmed that 2025 aircraft cargo load sheets were removed without authorization from one email inbox. Bashe, also known as APT73 or Eraleig, claimed more than 500,000 emails and 4,473 files and threatened to publish or sell the data, but the airport did not verify those figures and reported no direct ransom demand. Airport operations were unaffected, and no passenger-related or business-critical data was reported affected.
Polymarket via undisclosed third-party provider
June 25, 2026
•[ hack, financial, technology ]
On 2026-06-25, Polymarket disclosed that an undisclosed third-party provider had been compromised, allowing attackers to inject a malicious script into Polymarket's frontend for some users. The script enabled unauthorized cryptocurrency transactions from connected user wallets. Polymarket removed the affected dependency, contained the incident, contacted affected users, and stated that it would reimburse them in full. Blockchain investigators estimated that approximately $2.94 million was stolen from about 11 wallets, but Polymarket did not confirm the exact loss or number of affected users. No intellectual property, organizational data, customer personal data, or broader platform outage was reported.
JSC Ukrposhta
June 25, 2026
•[ hack, leak, government ]
An overnight hostile attack on Ukrposhta's IT systems caused temporary malfunctions in its mobile application on 25 June. Ukrposhta began restoration work and did not report disruption to postal branches or other operations. The pro-Russian IT Army of Russia claimed responsibility and alleged that it had accessed one server several weeks earlier and stolen a user database and internal data, but neither Ukrposhta nor Recorded Future News verified that exfiltration claim. The technical method was not disclosed.
