KDDI Corporation
May 16, 2026
•[ leak, technology ]
Beginning on May 16, 2026, an unidentified actor exploited a previously unknown vulnerability in third-party software embedded in KDDI's centrally operated email platform for internet service providers and acquired email-account credentials stored in the shared system. KDDI detected and blocked the unauthorized access on June 17; its investigation confirmed exposure of 12,233,087 email addresses and 7,616,173 associated passwords across services provided to STNet, KDDI Web Communications, JCOM, Chubu Telecommunications, NIFTY, and BIGLOBE. KDDI found no suspicious access beyond the exploited component, and its separate au, UQ mobile, and au one net email systems were unaffected.
HDFC Asset Management Company Limited
May 16, 2026
•[ ransomware, leak, finance ]
On 16 May, an HDFC AMC IT administrator detected suspicious activity, and the company received an email from Morpheus claiming to have exfiltrated more than 680 GB of data. HDFC AMC activated containment procedures, isolated affected systems, engaged cybersecurity specialists, and notified regulators and law enforcement. On 29 May, the Bombay High Court restrained Morpheus and others from publishing or using the data. HDFC AMC later said the incident did not interrupt business continuity, did not materially affect its financial results, and did not affect investors' units or portfolio values. The initial access method was not disclosed.
Baker Distributing Company LLC
May 23, 2026
•[ leak, technology, retail ]
ShinyHunters claimed on May 23, 2026 that it accessed Baker Distributing's Salesforce and SharePoint environments and stole customer, employee, lead, and support-ticket data. The data was subsequently published and indexed, but Baker Distributing did not publicly confirm the actor's full claimed scope. No encryption or operational disruption was documented.
DentaQuest, LLC
May 23, 2026
•[ leak, ransomware, healthcare ]
DentaQuest confirmed unauthorized access to a limited portion of its network and said it acted to contain the incident. ShinyHunters claimed responsibility and published approximately 234 GB of allegedly stolen data after negotiations failed. Have I Been Pwned identified information associated with approximately 2.6 million accounts. DentaQuest said its systems remained fully operational with limited customer-service disruption but did not publicly confirm the actor's claimed volume or attribution.
North Dallas Shared Ministries (Now-Forward, Inc.)
May 25, 2026
•[ leak, healthcare, finance ]
cmdorganization listed North Dallas Shared Ministries on May 25, 2026 and threatened to publish the full leak unless contacted. DataBreach.com later indexed 188,961 structured records containing personal identifiers and contact information. The organization, now operating as Now-Forward, provides financial assistance, food, clothing, medical and dental care, and other services to low-income residents. Public court dockets show data-breach class-action petitions against the organization, but no victim or regulator notice publicly established the initial access vector, encryption, or operational disruption.
MIP Holdings (Pty) Ltd
May 25, 2026
•[ ransomware, technology, leak ]
The Gentlemen used credentials that an MIP employee had reused on an unrelated service that was previously breached to reach an employee personal laptop and MIP's legacy Atlassian Jira support environment around 25 May 2026. Jira contained screenshots, attachments, personal information and credentials; credentials obtained there also enabled access to certain FTP/SFTP sites. Attackers remained in the environment until detection on 14 June and exfiltrated about 400,000 records. MIP's core policy-administration systems were not compromised. MIP later confirmed paying a substantial ransom for a deletion promise that was not honored.
Plexsupply Inc.
May 26, 2026
•[ leak, retail ]
DataBreach.com indexed 936,468 rows associated with Plexsupply and dated the breach to May 26, 2026. PEAR listed the company on its leak site on May 30. Public reporting did not identify the access vector or document encryption or operational disruption.
Nissan North America, Inc.
May 27, 2026
•[ hack, leak, automotive ]
Between May 27 and June 9, 2026, attackers exploited CVE-2026-35273, a previously unknown vulnerability in Oracle PeopleSoft, and accessed Nissan North America's employee-information environment. Nissan stated that information belonging to current and former employees in the United States, Canada, Mexico, and Brazil may have been stolen. Reporting linked the broader PeopleSoft campaign to ShinyHunters, but Nissan did not publicly attribute its incident to the group.
Group GTI Limited (Oxford CareerConnect platform)
May 28, 2026
•[ hack, leak, technology ]
On May 28, 2026, third-party provider Group GTI informed the University of Oxford that an unauthorized party had accessed the CareerConnect platform through a security vulnerability. The intruder accessed user names, email addresses, and encrypted passwords for non-single-sign-on accounts. GTI patched the vulnerability and added security measures. Oxford's own systems and single-sign-on credentials were not compromised.
EnTrans International LLC
May 28, 2026
•[ ransomware, leak, manufacturing ]
Chaos listed EnTrans International LLC on 28 May, said it had possessed the company's internal data for some time, and threatened publication after a 72-hour deadline. A subsequently published searchable dataset contains personal and vehicle information. EnTrans, which operates as Engineered Transportation International, has not publicly confirmed the incident or disclosed the access method, encryption, or operational impact. No system outage or other operational disruption was identified in public reporting.
BCD Travel
May 29, 2026
•[ leak, technology ]
ShinyHunters claimed on May 29, 2026 that it stole more than 700,000 Salesforce records and SharePoint documents totaling more than 30 GB from BCD Travel. The published dataset was subsequently indexed, but BCD Travel did not publicly confirm the actor's full claimed scope. No encryption or operational disruption was documented.
Vallez Pty Ltd (Ferve Tickets)
May 29, 2026
•[ hack, leak, technology ]
Ferve Tickets identified unauthorized access to the ticketing system it operated for the Melbourne International Film Festival on May 29, 2026 and temporarily suspended access. Further unauthorized access occurred on May 30, when some MIFF customers received unauthorized emails or SMS messages sent through the system. MIFF initially confirmed 26,782 affected customer records and later stated that additional individuals had been identified and notified without publishing a revised total. MIFF also confirmed that the responsible party published customer information online.
Reliance Infrastructure Limited
May 29, 2026
•[ ransomware, leak, energy ]
On May 29, 2026, Yotta detected suspicious activity on a hosted server belonging to Reliance Infrastructure, terminated it, and prevented suspected ransomware execution. Reliance confirmed a partial breach of data on the third-party server. World Leaks later published a reported 858,000 Reliance files, including nearly 19,000 files totaling 14.3 GB associated with the Kudankulam project. Reuters could not independently authenticate the documents. NPCIL said the material concerned conventional balance-of-plant facilities rather than nuclear-safety, security, reactor-core, or plant-control systems; there was no reported compromise of NPCIL or plant systems.
UEI College
May 29, 2026
•[ ransomware, leak, education ]
Termite claimed responsibility for compromising UEI College and threatened to release the institution's data unless negotiations occurred. The group publicly listed the victim on May 30, 2026, with the underlying breach estimated as May 29. DataBreach.com later indexed 5,573,054 leaked rows containing personal and identity information. No independently verified operational disruption has been established.
Atlas Menu
May 30, 2026
•[ leak, hack, technology ]
In May 2026, an unidentified attacker claimed to have accessed Atlas Menu's systems and published its database in a public GitHub repository. Have I Been Pwned verified approximately 63,900 affected accounts containing email addresses, usernames, IP addresses, support tickets, and bcrypt-hashed passwords. The attacker described the disclosure as retaliation against an individual accused of scamming. Atlas Menu did not publicly confirm the intrusion or disclose the technical access method.
Independent National Electoral Commission (INEC)
May 30, 2026
•[ insider, leak, government ]
INEC confirmed that a specific voter record belonging to Emeka Ike was retrieved from its restricted Continuous Voter Registration administrative portal using valid credentials assigned to authorized personnel and was released without authority. The information was posted on social media on May 30, 2026. INEC stated that there was no external intrusion or broader compromise of its database containing more than 90 million voter records. The individual responsible for retrieving or releasing the record had not been publicly identified.
R.I.C. Publications Pty Ltd
May 30, 2026
•[ leak, education, technology ]
On 2026-05-30, an unauthorized party used an automated email function associated with R.I.C. Publications' website to send an unauthorized message to customers. On 2026-06-04, the threat actor 2019 posted a file on a hacking forum and claimed it contained more than 116,000 customer purchasing records obtained from R.I.C. Publications without authorization. The published sample reportedly contained names, email addresses, telephone numbers, physical and IP addresses, order histories, and school affiliations. R.I.C. Publications confirmed the unauthorized email, secured the affected system, engaged cybersecurity specialists, and notified relevant authorities. The company said it had found no evidence of additional system compromise and that payment information was not affected; the claimed record count remained unverified.
Dashlane personal-plan users
May 31, 2026
•[ brute-force, technology, leak ]
Beginning May 31, 2026, attackers sent automated brute-force requests to Dashlane's device-registration API endpoints to guess two-factor authentication codes and register unauthorized devices on targeted accounts. The attackers successfully downloaded encrypted vault copies belonging to fewer than 20 personal-plan users. Dashlane automatically locked targeted accounts, later restored access, and found no evidence that its internal systems or additional customers were affected.
Multiple undisclosed Windows users
June 1, 2026
•[ leak, malware, phishing ]
Attackers distributed a PureLogs information-stealing payload through fake purchase-order emails containing a RAR archive. The archive launched JavaScript and PowerShell, used process hollowing to inject a downloader into MsBuild.exe, and retrieved a fileless PureLogs payload from command-and-control infrastructure. The malware collected browser, cryptocurrency-wallet, messaging, VPN, application, clipboard, screenshot, and system data and exfiltrated it through encrypted HTTP POST requests. Public reporting did not identify the affected users or provide an infection count, so the source publication date is used as the event date.
Exact Sciences Corporation (Abbott Cancer Diagnostics)
June 1, 2026
•[ phishing, healthcare, leak ]
In mid-June 2026, ShinyHunters used voice phishing against employees and obtained access to a limited number of legacy Exact Sciences cancer-diagnostics systems. Abbott confirmed that some affected files contained personal information and/or protected health information, but said the incident did not affect operations, products, manufacturing, laboratories, or patients. The attackers later published data, and Have I Been Pwned independently identified 10.9 million unique email addresses in the breach corpus.
