Brinks Home
July 13, 2026
•[ phishing, ransomware, technology ]
ShinyHunters said it gained access to Brinks Home on July 13, 2026 through Microsoft Entra voice phishing and used the resulting account access to obtain Salesforce and Cresta data. Brinks identified and contained unauthorized access on July 20. After Brinks did not pay, ShinyHunters released more than 41 gigabytes of data; a subsequent dataset analysis identified 732,162 unique email addresses. Brinks has not confirmed the access method or the actor's larger record counts. Alarm monitoring, products, and system functionality continued without interruption.
Al Hayat
July 15, 2026
•[ leak, manufacturing, retail ]
Al Hayat, an Iraqi company that produces and distributes Pepsi products, was listed on Global Secret Group's leak site on July 26, 2026; the group claimed theft of 138 GB of internal files (attack est. mid-July). The company has not publicly confirmed the breach.
Shillen Mackall & Seldon
July 15, 2026
•[ ransomware, leak ]
Shillen Mackall & Seldon, a Woodstock, Vermont personal injury law firm, was listed by the DragonForce ransomware group on July 15, 2026, with a claimed dataset later indexed at about 1.25 million rows. The firm has not publicly confirmed a breach.
Craneware plc
July 20, 2026
•[ leak, technology, healthcare ]
Craneware disclosed on July 20, 2026 that an unauthorized party had accessed a subset of its internal data environment and removed employee, customer, and partner records. Chaos claimed responsibility on July 28 and alleged theft of approximately 960 gigabytes, but Craneware has not confirmed the attribution or the actor's claim. Craneware explicitly said neither its operations nor customer services were disrupted.
Upbound Group, Inc.
July 21, 2026
•[ financial, leak, technology ]
Upbound Group disclosed multiple recent cybersecurity incidents in which unauthorized parties obtained customer information and company documents. The stolen information was used to create fraudulent lease-to-own agreements through the Acima platform; Acima paid retailers, while the fraudsters obtained merchandise and did not make the required payments. Upbound attributed approximately $13 million in elevated fraudulent contract losses during the second quarter of 2026 to the incidents. The company enhanced authentication and fraud controls and notified federal law enforcement. No actor, intrusion vector, or operational disruption was disclosed.
North Dakota Department of Health and Human Services
July 21, 2026
•[ phishing, leak, healthcare ]
North Dakota HHS said a phishing email on 21 Jul 2026 let an unauthorized third party into the email accounts of three Developmental Disabilities staff, exposing health data of about 1,700 clients. State IT secured the accounts; notices went out 24 Aug.
LR Reed
July 23, 2026
•[ ransomware, leak, technology ]
Kairos listed Melbourne property-management company LR Reed on its leak site and claimed theft of 335 gigabytes of data. Published samples appeared to contain identifiable employee and internal company records, supporting that unauthorized data access occurred, although the full volume claim was not independently verified. LR Reed said customer data was segregated and unaffected, its core systems remained operational, and it notified the Australian Signals Directorate and Australian Federal Police.
Restaurant Depot, LLC
July 23, 2026
•[ ransomware, leak, retail ]
Play listed Restaurant Depot on July 23, 2026 and claimed exfiltration of internal files. DataBreach.com later indexed 3,697,383 rows containing personal and contact information associated with the company. Restaurant Depot is a wholesale cash-and-carry foodservice supplier headquartered in College Point, New York. No operational disruption has been independently established.
Bank of Baroda
July 24, 2026
•[ leak, insider, finance ]
Threat intelligence attributed the leak-site claim to Triple X, while the material was also advertised under the handle leak-king-F. The bank later confirmed that a compromised employee email account enabled unauthorized access to certain data, but it did not confirm the actor attribution or full leak claim. The incident was contained and the bank said its core banking and transaction systems were not accessed or affected.
French Ministry of National Education (staff-training information system)
July 25, 2026
•[ leak, government, education ]
On the night of July 25, 2026 an attacker used an impersonated or compromised professional account to enter the French Education Ministry staff-training information system. Security personnel were alerted July 26 and suspended external access to contain the intrusion. Information about ministry staff employed in regional academies since 2001 may have been acquired, and affected personnel were notified. ZeroBytes later claimed much wider education data theft and published alleged samples, but the ministry had not confirmed that claimed student population or data volume. This intrusion is distinct from the ministry COMPAS breach in March 2026.
Académie de Créteil
July 25, 2026
•[ hack, leak, government ]
France's Acadmie de Crteil confirmed on Sept 22, 2026 that student and guardian data from its student databases and staff directory were exfiltrated in the July 2026 hack of Education Ministry systems. Hacker ZeroBytes claimed Crteil data in August; victim count undisclosed.
Love, Bonito
July 26, 2026
•[ leak, retail, misconfiguration ]
Love, Bonito identified a vulnerability in its website on July 26, 2026 that allowed unauthorized access to some customer account information. The company contained and fixed the vulnerability the same day, notified affected customers on July 30, and reported the incident to law enforcement and data-protection authorities. No attacker, technical vulnerability, affected-customer count, record count, data volume, or confirmed exfiltration was disclosed. No credible threat-actor claim or publicly indexed dataset was located; references to more than 5,000 affected customers concern Love, Bonito's separate 2019 breach.
Chess.com
July 26, 2026
•[ leak, technology ]
Records in the released dataset were collected in daily batches between July 26 and August 3, 2026. The dataset contained more than 7.3 million Chess.com user records, including non-public email information and internal advertising-audience fields. The forum account V0idix distributed the resulting dataset for free, but available evidence does not establish that V0idix performed the collection. No passwords or password hashes were observed, and the precise acquisition method was not conclusively established.
VIAVI Solutions Inc.
July 26, 2026
•[ leak, technology ]
ExfilSquad listed VIAVI Solutions on July 26, 2026 and claimed approximately 430,000 records containing customer and partner contact information, personal information, and enterprise account identifiers. DataBreach.com subsequently indexed 351,833 rows associated with the company. VIAVI has not publicly confirmed the incident, and no operational disruption has been established.
City of Atlanta
July 26, 2026
•[ leak, government ]
ExfilSquad listed the City of Atlanta on July 26, 2026 and claimed approximately 3 million records from city systems, including citizen service requests, addresses, municipal case histories, and internal case-management information. DataBreach.com subsequently indexed 701,869 rows associated with the city. The City of Atlanta has not publicly confirmed the incident, and no operational disruption has been established.
WESCO International, Inc.
July 26, 2026
•[ leak, hack, technology ]
WESCO investigated unauthorized access involving its cloud-based customer relationship management environment after ExfilSquad claimed theft of approximately 2.6 million customer and employee records. DataBreach.com indexed 491,427 rows associated with the incident. WESCO reported no evidence of ransomware or malware on its internal systems and said business operations were unaffected.
Bonava AB
July 26, 2026
•[ leak, retail ]
Bonava was notified by Swedish police on July 27, 2026 and subsequently confirmed unauthorized access to a limited portion of its customer-management and warranty-case systems. ExfilSquad had listed Bonava on July 26. Bonava's investigation confirmed access to customer and prospective-homebuyer personal information and found no evidence that other personal data or documents were accessed. DataBreach.com indexed 525,721 rows.
Cold Front Distribution, LLC
July 26, 2026
•[ ransomware, leak, retail ]
Global Secret Group listed Cold Front Distribution on July 26, 2026, and DataBreach.com subsequently indexed 33,573 leaked records containing personal and contact information. Interlock had previously listed Cold Front Distribution on June 2, 2026 and claimed to have released internal company files. Available evidence does not establish whether the July disclosure resulted from a separate compromise or involved data obtained through the earlier incident.
Police National Legal Database (PNLD)
July 26, 2026
•[ ransomware, leak, government ]
Data from the Police National Legal Database was compromised and published on the dark web, including professional contact information for police and criminal justice personnel and data from some Ask the Police users. ExfilSquad claimed the breach and demanded payment; independent review validated samples associated with the wider ExfilSquad campaign, although PNLD did not itself attribute the intrusion to the group.
Wilbert's Family Enterprises
July 27, 2026
•[ ransomware, leak, automotive ]
Qilin claimed responsibility for an attack on Wilbert's on July 27, 2026 and threatened to release company data unless a settlement was reached. DataBreach.com indexed 106,010 leaked rows containing contact information and vehicle identification numbers. Qilin also claimed that company data had been encrypted, but no independent source has confirmed operational disruption. Wilbert's operates automotive recycling facilities and supplies recycled auto parts from its Webster, New York headquarters and other locations.
