Ecopetrol S.A.
June 1, 2026
•[ ransomware, leak, energy ]
An external actor reportedly obtained access through a third party with administrative privileges approximately one month before the incident was disclosed and downloaded files from cloud storage used by 15 Ecopetrol Group companies. Security controls blocked the attempted ransomware encryption, and Ecopetrol reported that operations continued without interruption and that transactional systems were not compromised. The copied information was later published. The Gentlemen claimed responsibility, but Ecopetrol did not publicly confirm the attribution.
City Government of Baguio
June 1, 2026
•[ leak, government, misconfiguration ]
An attacker used an API connected to Baguio City's BuildPASS portal that lacked proper authentication to retrieve files submitted through the building-permit system. More than 100 data subjects were affected. Emperador later claimed the breach and published samples of the stolen files.
TVING Corporation
June 2, 2026
•[ leak, technology ]
TVING confirmed unauthorized access to and extraction from its account database on June 2, 2026, after abnormal activity from May 30. September government findings revised the scope to approximately 39.54 million account records, including dormant and test accounts, and reported exposure of some source-code files and encryption keys. The company blocked attacker access and reported the incident to Korean authorities. The attacker has not been publicly identified. This updates the previously coded June incident and is not a second breach.
Australian Centre for the Moving Image
June 2, 2026
•[ leak, hack, technology ]
On June 2, 2026, ACMI identified and contained unauthorized access affecting a third-party system supporting its Cinema 3 online streaming service. The threat actor 2019 published three datasets allegedly containing information from more than 25,000 customers, while ACMI confirmed that names, email addresses, IP addresses, and rental details were exposed but passwords and financial information were not.
Indian Institute of Technology Roorkee
June 2, 2026
•[ leak, misconfiguration, education ]
On June 2, 2026, cybersecurity researcher Rylen Anil discovered that a cloud-storage component supporting IIT Roorkees JEE Advanced results system allowed candidate files to be accessed without authentication. Anil downloaded a small number of files to verify the exposure and reported the issue, after which IIT Roorkee restricted access and said its logs showed no bulk download and access to less than 0.05% of the stored data.
Canopy Brands
June 2, 2026
•[ leak, manufacturing ]
Settra publicly listed canopybrands.us on June 26, 2026 and said it would publish the remaining data after releasing a sample. DataBreach.com indexed 12,130 structured records dated June 2 containing names, email addresses, and phone numbers. Canopy Brands is a Concord, North Carolina-based manufacturer and holding company for safety, access, mobility, and infrastructure-product businesses. No victim statement or independent reporting confirmed the initial access vector, encryption, or operational disruption.
C2M LLC d/b/a Click2Mail
June 2, 2026
•[ financial, leak, technology ]
A Click2Mail customer reported that the company's online debit-card checkout process was hijacked on June 2 and again later in the summer, with payment-card information captured during checkout and subsequently associated with fraudulent use. Other customers also publicly reported card fraud following Click2Mail transactions. C2M LLC later filed a breach notice with the Vermont Attorney General on September 15 confirming exposure of financial account codes and credit and debit account information affecting at least seven Vermont residents. The regulatory filing confirms the data exposure but does not disclose the technical intrusion method, full compromise window, total victim count, or responsible actor.
Wiese USA
June 5, 2026
•[ leak, technology ]
Termite claimed Wiese USA on June 8, 2026, with threat-intelligence tracking estimating the underlying attack on June 5. DataBreach.com subsequently indexed 229,721 records containing personal information. Litigation filed after the June incident alleges theft and disclosure of personally identifiable information. No independently verified operational disruption has been established.
Access Dental & Orthodontics
June 5, 2026
•[ ransomware, leak, healthcare ]
WorldLeaks listed Access Dental & Orthodontics on its leak site on June 5, 2026 and issued a countdown associated with its extortion claim. DataBreach.com later indexed 322,387 records containing personal and contact information. Access Dental operates a dental-services organization headquartered in Irving, Texas. No independently verified operational disruption has been established.
United Auto Supply
June 5, 2026
•[ ransomware, leak, retail ]
WorldLeaks publicly listed United Auto Supply on June 5, 2026 as part of its data-theft extortion operation. Independent ransomware monitoring captured the same June 5 claim, and DataBreach.com subsequently indexed 826,018 records containing personal, contact, and vehicle information associated with the company. United Auto Supply has not publicly confirmed the incident, and no operational disruption has been independently established.
Nexstar Media Group, Inc.
June 6, 2026
•[ leak, technology ]
ShinyHunters claimed that it accessed Nexstar Media Group systems on June 6, 2026 and stole more than 1 million Salesforce records and additional internal corporate data. DataBreach.com subsequently indexed 103,128 rows. Nexstar stated that it was investigating reports of a potential IT security incident and that its operations were not disrupted. The company did not publicly confirm the actor's full claimed scope.
Strand Fitness Pty Ltd (North Shore)
June 6, 2026
•[ leak, insider ]
Strand Fitness Pty Ltd confirmed a data breach affecting current and former members of its North Shore gym in Burdell. Queensland Police found gym member information on a USB drive during a police raid in late May 2026 and opened an investigation. Several police officers were among the affected members. Strand Fitness said the information varied by individual and may have included contact details, health information, identity documents, and payment information. The company contacted affected members, notified Queensland Police and the Office of the Australian Information Commissioner, and took additional steps to secure its systems. The breach did not affect the company's other locations. The date, method, duration, perpetrator, motive, and number of affected members were not reported.
One Medical Seniors via an undisclosed third-party file storage provider
June 8, 2026
•[ leak, healthcare, technology ]
An unauthorized third party accessed a third-party file storage system containing archived One Medical Seniors patient information between 2026-06-08 and 2026-06-11. One Medical discovered the access on 2026-06-13, revoked access, rotated credentials, and stated that the incident was limited to the storage platform and did not affect other One Medical clinics, services, or its electronic medical record system. ShinyHunters claimed to have stolen 8.8 TB and threatened publication, but One Medical did not publicly attribute the breach or confirm the claimed volume.
University of Nottingham
June 9, 2026
•[ hack, leak, education ]
On 2026-06-09, the University of Nottingham detected unauthorized access to its Campus Solutions student-records system and took the affected system offline as a containment measure. The university confirmed that a significant amount of student and alumni data had been accessed. ShinyHunters claimed responsibility and published more than 40 GB of data. Have I Been Pwned identified approximately 455,000 unique email addresses in the leak. The university did not publicly attribute the intrusion.
State Health Care Accreditation Agency under the Ministry of Health
June 9, 2026
•[ leak, misconfiguration, healthcare ]
Lithuanian authorities disclosed that approximately 62,000 records containing personal information about doctors and other healthcare specialists were acquired from the State Health Care Accreditation Agency in a cyber incident identified on June 9, 2026. Reporting linked the access to a vulnerability in a server-hosted data system. The actor, motive, detailed data fields, and number of unique affected individuals were not disclosed, and authorities said there was no evidence that the incident was coordinated with other contemporaneous Lithuanian breaches.
Reynella East College
June 9, 2026
•[ ransomware, education, leak ]
On 2026-06-09, Reynella East College notified parents and carers that a cybersecurity breach had taken all of the school's computer systems offline. Classes continued through face-to-face and offline arrangements while the South Australian Department for Education and cybersecurity specialists investigated and restored systems. On 2026-06-23, the Interlock ransomware group claimed responsibility and published more than 600 GB comprising more than 473,000 files in more than 68,000 folders. Reporting reviewed samples that included passport scans, credentials, student and family contact details, teaching documents, contracts, financial reports, and school budgets. The Department for Education acknowledged that information had been posted online but continued assessing which individuals and records were affected.
Aflac Life Insurance Japan Ltd.
June 10, 2026
•[ hack, leak, finance ]
Aflac Life Insurance Japan determined that unauthorized access and data leakage first occurred on 2026-06-10, with multiple unauthorized accesses continuing through 2026-06-25. The incident affected Aflac Yorisou Net and related systems and exposed personal information concerning approximately 4.4 million customers and approximately 40,000 current and former agencies. Aflac temporarily suspended the policyholder portal and several related online services as a containment measure, while claims and other procedures continued through call centers. The initial access method, actor, and motive remained under investigation.
First Federal Savings & Loan Association of Pascagoula-Moss Point
June 10, 2026
•[ leak, finance ]
WorldLeaks listed First Federal Savings & Loan Association of Pascagoula-Moss Point on June 10, 2026 and threatened to publish stolen information. DataBreach.com subsequently indexed 54,751 rows. Public reporting did not identify the access vector or document encryption, system unavailability, or operational disruption.
Centra Sota Cooperative
June 10, 2026
•[ leak, retail, energy ]
WorldLeaks claimed Centra Sota Cooperative on June 10, 2026. DataBreach.com subsequently indexed 93,417 records containing personal and contact information. Centra Sota is a member-owned agricultural cooperative headquartered in Buffalo, Minnesota, with grain, feed, agronomy, energy, retail and related operations. No independently verified operational disruption has been established.
Prince George County
June 11, 2026
•[ ransomware, government, leak ]
Prince George County identified a cybersecurity incident affecting certain network systems on June 11, 2026. The incident disrupted county phone, internet, and online payment services, while 911 and non-emergency dispatch remained available. Most systems were restored within approximately one week. RansomHouse claimed that it encrypted the county on June 10 and posted an evidence pack, but the county did not confirm the group's attribution, encryption claim, data theft, or a ransom demand; officials later stated that personal information may have been involved.
