Quest Health Solutions, LLC
June 24, 2026
•[ leak, malware, healthcare ]
Anubis listed Quest Health Solutions on June 24, 2026 and claimed theft of employee data and internal files. DataBreach.com's verified searchable dataset confirms a data compromise. Although Anubis malware can encrypt or wipe data, incident-specific reporting does not establish that either capability was deployed against Quest, and no public victim statement, regulator notice, or report confirming an outage or service interruption was located as of August 12, 2026.
JSC Ukrposhta
June 25, 2026
•[ hack, leak, government ]
An overnight hostile attack on Ukrposhta's IT systems caused temporary malfunctions in its mobile application on 25 June. Ukrposhta began restoration work and did not report disruption to postal branches or other operations. The pro-Russian IT Army of Russia claimed responsibility and alleged that it had accessed one server several weeks earlier and stolen a user database and internal data, but neither Ukrposhta nor Recorded Future News verified that exfiltration claim. The technical method was not disclosed.
Cardiology Associates of Port Huron, P.C.
June 25, 2026
•[ ransomware, leak, healthcare ]
Orova stated that it compromised Cardiology Associates of Port Huron on June 25, 2026, stole approximately 144 GB of data comprising 244,215 files, and encrypted some servers. The practice did not publicly confirm the attack. Orova subsequently published stolen data, and later independent review of the released material identified more than 150,000 patient records containing personally identifiable and protected health information, corroborating the data-theft component of the group's claim.
FCCI Insurance Group
June 27, 2026
•[ phishing, finance, technology ]
Threat-intelligence reporting attributes the FCCI compromise to Redact and dates its detection to 27 June 2026. The attackers reportedly used voice phishing and adversary-in-the-middle session hijacking to compromise cloud identities, register rogue MFA devices, and exfiltrate data through Microsoft Graph, OneDrive, and SharePoint APIs. Redact is described as an extortion-only operation, and no encryption or operational disruption was reported.
Fluke Corporation
July 1, 2026
•[ leak, technology, manufacturing ]
On July 1, 2026, ShinyHunters claimed it had stolen Fluke data from Salesforce and later published more than 100 gigabytes. No operational disruption was reported. This record is separate from Fluke's 2025 third-party business-application breach.
Bethany Lutheran Homes, Inc. d/b/a Eagle Crest Communities
July 1, 2026
•[ ransomware, leak, healthcare ]
SafePay claimed responsibility for compromising Bethany Lutheran Homes, Inc., which operates as Eagle Crest Communities, on 1 July and threatened to publish the full leak unless the organization contacted the group. A verified searchable dataset containing 16,556 name-and-telephone rows confirms that Eagle Crest data was compromised. The access method, encryption, and operational impact were not disclosed, and no service interruption was identified. Anubis separately claimed an Eagle Crest patient-and-employee data breach later in July, but available evidence does not establish whether that represented the same compromise or a separate event.
Accenture plc
July 1, 2026
•[ leak, technology ]
PwnForums actor 888 advertised an Accenture dataset on July 6 and claimed an early-July theft of more than 35 GB from a private Azure DevOps repository. Accenture acknowledged an isolated security matter and said it remediated the source with no impact to operations or service delivery, but did not confirm the claimed contents or volume.
At least one undisclosed Taiwan government agency
July 1, 2026
•[ espionage, government, energy ]
From July 1 to July 4, 2026, attackers used an AI-agent framework to map 21 connected Taiwanese government systems, compromise 85 employee accounts, and extract at least 2,564 personnel-related records across the campaign. The operation also obtained SSO client secrets, database credentials, and internal network information and later scanned government IT vendors, a nuclear safety agency, a government email system, and energy companies. Simplified Chinese operator material and the targeting pattern support state-sponsored intelligence collection, but no named group or actor country has been publicly verified.
Intermarché Drive (Groupement Les Mousquetaires)
July 1, 2026
•[ leak, retail, technology ]
During the final week of July 2026 an unauthorized person gained access to part of Intermarch Drive customer systems and acquired information pertaining to 287,605 individuals. Parent company Groupement Les Mousquetaires confirmed the compromise on August 3 and notified affected customers and the French privacy regulator. Approximately two million was the total Drive customer base, not the number exposed. The attacker, precise intrusion day, and data-use intentions remain unverified.
Oleoductos del Valle S.A. (Oldelval)
July 1, 2026
•[ ransomware, energy, leak ]
Argentina pipeline operator Oldelval disclosed on July 31, 2026 that a cyber incident affected certain administrative computer systems. It activated response and containment procedures and later reported that the affected platforms had been fully restored, without interruption to crude-oil transport. Ransomware/extortion group The Gentlemen listed the operator on its leak site on July 23 and claimed data theft; the company did not independently confirm exfiltration, encryption, or the attackers identity. The date of initial unauthorized access and full technical effects were not disclosed.
Northeast Pediatrics & Adolescent Medicine
July 2, 2026
•[ ransomware, healthcare, leak ]
On July 2, 2026, Anubis added Northeast Pediatrics & Adolescent Medicine to its extortion site and claimed that employee and patient data had been stolen. The precise intrusion date and initial-access method were not disclosed. After reported communications between the practice and Anubis ended, data was published, and the supplied breach database indexed 29,356 records containing names, dates of birth, phone numbers, and street addresses. No operational disruption or successful encryption was publicly confirmed.
Origin Energy Limited
July 2, 2026
•[ leak, energy ]
Origin Energy confirmed unauthorized access to customer records disclosed in July 2026. An individual using the unverified alias Edison Walthour contacted the company on July 2 claiming to have obtained records, reportedly using a former employee's credentials to access a customer billing platform; Origin initially could not substantiate the claim. After receiving new evidence on July 22, Origin confirmed the breach July 23 and ultimately identified approximately 900,000 affected current and former customers. The claimant threatened public disclosure and later asserted a settlement, neither confirmed by Origin. By August 21 the company had provided individual notifications and said it had no evidence the stolen information had been published. The actual first-access and extraction dates and perpetrator identity remain unverified; no operational disruption was established.
Cook Medical LLC
July 2, 2026
•[ social, leak, healthcare ]
On July 2, 2026, a Cook Medical employee was deceived through social engineering and gave an outside party access to company systems. Cook identified and contained the access the same day. The company confirmed customer business-contact information, Salesforce communications, employee names and email addresses, and certain SharePoint business files were accessed, while stating that products, manufacturing, and patient/customer services were unaffected. ShinyHunters later claimed the incident and said it obtained more than 182 GB of data after failed extortion negotiations.
Rogers County Jail
July 3, 2026
•[ hack, leak, government ]
Breach Boyz World Wide supplied reporters with accurate personal information for nearly 30 current Rogers County Jail inmates and later sent information about an inmate booked on July 10, demonstrating possession of current data. The group claimed that it compromised the jail in early March using Wi-Fi reconnaissance and captured credentials, but Rogers County said the Oklahoma State Bureau of Investigation, a network security company, and a third reviewer found no evidence that the county network was breached. The source system and access method remain undetermined, as does the groups claimed location in northern Iran.
Ville de Drancy
July 3, 2026
•[ ransomware, government, leak ]
The Ville de Drancy detected ransomware on July 3, 2026, after parts of its municipal IT environment became inaccessible. Officials disconnected all systems to contain the attack, filed a complaint, and rebuilt from clean offsite backups with ANSSI assistance. Municipal services were slowed or degraded, the telephone system was affected, and three online procedures reverted to paper. The city said personal-data leakage was probable but did not confirm its extent. Qilin later claimed responsibility and on August 2 listed 210 GB comprising 241,705 files as published, but the city did not confirm the attribution or data theft and the claim was not independently verified.
Abbott Laboratories, Inc. (Core Laboratory Diagnostics)
July 4, 2026
•[ leak, healthcare, technology ]
On July 4, 2026, ShadowByt3$ claimed to have used compromised customer credentials and a weakness in Abbott's externally facing, third-party-hosted LabCentral portal to query API endpoints and download files. Abbott treated this as a separate incident, said the portal contained only public product-reference material, and reported no known exposure of proprietary, sensitive customer, or business information and no operational impact. The attacker's broader claims about regulatory and technical files remain unverified.
Metro Mondego, S.A.
July 6, 2026
•[ ransomware, leak, technology ]
Metro Mondego detected ransomware on July 6, 2026 affecting part of its internal systems, but the Metrobus service continued operating and isolated bank-card payment terminals were unaffected. The Gentlemen listed Metro Mondego on its leak site on July 16 and claimed possession of company information. Metro Mondego subsequently said available evidence made data copying probable and warned personalized-pass holders, email correspondents, employees, suppliers, and contractual counterparties while noting that the exact copied data remained unconfirmed.
CorePharma LLC
July 8, 2026
•[ leak, healthcare, manufacturing ]
Chaos listed CorePharma on 8 July and claimed it had breached the pharmaceutical manufacturer's internal network and stolen a comprehensive archive of regulatory, manufacturing-compliance, and operational information. A searchable dataset contains 14,342 contact records. CorePharma has not publicly confirmed the incident, and the access method, total volume, ransom demand, and precise contents remain undisclosed. No encryption or operational disruption was reported.
Ksenia Sobchak
July 8, 2026
•[ hack, leak, social ]
Hackers compromised Ksenia Sobchak's email account and used that access to take control of two Telegram channels on July 8, 2026, publishing unauthorized posts containing purported private correspondence. Access was restored after three hours. Black Mirror claimed it stole more than 350 gigabytes of data, released additional material on July 9, and offered the archive for sale; Sobchak said the messages were fabricated, and neither the claimed volume nor the material's authenticity was independently verified.
Chumz (Moneto Ventures Limited)
July 11, 2026
•[ leak, finance, technology ]
DataBreach.com indexed 89,577 structured records associated with Chumz, a mobile savings and investment service operated by Kenya-incorporated Moneto Ventures Limited, on July 11, 2026. The records contained names, email addresses, and phone numbers. The source marked the dataset unverified, and no victim notice, regulator statement, or reliable actor attribution was located. No evidence established financial-account exposure, the initial access vector, or operational disruption.
