Bajaj Auto Limited
June 23, 2026
•[ ransomware, manufacturing, technology ]
Bajaj Auto disclosed that a ransomware attack on June 23, 2026 affected systems belonging to the company and its wholly owned subsidiary, Bajaj Auto Technology Limited. The companies activated precautionary measures and response protocols, which Bajaj Auto said had been successful in managing and mitigating the incident. The attacker, access method, disruption duration, and any data theft were not disclosed.
Analog Devices, Inc.
June 23, 2026
•[ hack, leak, technology ]
Analog Devices detected unauthorized access to certain company systems on June 23, 2026 and confirmed that files were exfiltrated. Its SEC filing stated that operations were not interrupted and that the incident was not expected to materially affect the business. No actor or motive was identified. A July 26 ExfilSquad claim involving 570,000 alleged customer records was described by Analog Devices as a separate and unrelated matter and is not incorporated into this record.
GSP Crop Science Limited
June 25, 2026
•[ ransomware, hack, manufacturing ]
INC Ransom listed GSP Crop Science as a claimed victim on June 25, 2026. GSP later confirmed that an external cybersecurity incident appearing to involve ransomware affected certain non-core IT systems. The company did not publicly attribute the incident or confirm the actor's data-exfiltration claim. Restoration was underway, while core business functions continued without disruption and no material financial or operational loss was identified.
PAI Pharma
June 30, 2026
•[ ransomware, healthcare, manufacturing ]
PAI Pharma, a Greenville, South Carolina maker of generic liquid and unit-dose drugs, was listed on Brain Cipher's leak site on June 30, 2026; the group claimed theft of about 1.4 TB and threatened to publish it. PAI Pharma had issued no public notice as of September 2026.
Undisclosed Uruguayan commercial interiors company
June 30, 2026
•[ ransomware, manufacturing ]
Gunra ransomware listed an undisclosed Uruguayan designer and maker of commercial interiors on its leak site on June 30, 2026, claiming theft of 30 GB of data. The company has not been named or commented.
Fluke Corporation
July 1, 2026
•[ leak, technology, manufacturing ]
On July 1, 2026, ShinyHunters claimed it had stolen Fluke data from Salesforce and later published more than 100 gigabytes. No operational disruption was reported. This record is separate from Fluke's 2025 third-party business-application breach.
CorePharma LLC
July 8, 2026
•[ leak, healthcare, manufacturing ]
Chaos listed CorePharma on 8 July and claimed it had breached the pharmaceutical manufacturer's internal network and stolen a comprehensive archive of regulatory, manufacturing-compliance, and operational information. A searchable dataset contains 14,342 contact records. CorePharma has not publicly confirmed the incident, and the access method, total volume, ransom demand, and precise contents remain undisclosed. No encryption or operational disruption was reported.
Nichirei Corporation
July 13, 2026
•[ ransomware, manufacturing, technology ]
Nichirei detected unauthorized access on July 13 and disconnected group systems, disrupting cold-storage and frozen-food distribution. RansomHouse later claimed the attack. On August 10, S&J observed at least 200,000 published files; Nichirei acknowledged additional information had been published but did not validate the reported contents or quantity. All sites returned to normal operation on July 24.
Spectrum Chemical Mfg. Corp.
July 14, 2026
•[ ransomware, technology, manufacturing ]
Chaos claimed responsibility for compromising Spectrum Chemical Mfg. Corp. on July 14, 2026, issued what it described as a final ultimatum, and threatened publication of stolen data. DataBreach.com indexed 372,396 structured contact records, supporting classification of the affected asset as a database-backed application server, although the initial access vector was not disclosed. Spectrum manufactures and distributes fine chemicals and laboratory products and is headquartered in New Brunswick, New Jersey. The company has not publicly confirmed the attribution, encryption, or operational disruption.
V-Silicon
July 14, 2026
•[ ransomware, technology, manufacturing ]
Cybernews researchers found an exposed INC staging server containing tools and data customized for an intrusion into V-Silicon. Most reconnaissance and attack preparation occurred around July 14, 2026. Active Directory exports were dated June 16, but researchers could not determine whether access began then or whether the exports were copied later. INC listed V-Silicon on July 18. Although ransomware binaries supported architectures used in industrial systems, no evidence showed that operational technology was reached or encrypted, and no outage was reported. References to NXP and UnitedDS infrastructure did not establish successful separate compromises.
Stadler Rail AG
July 15, 2026
•[ ransomware, technology, manufacturing ]
In mid-July, attackers used compromised credentials to access a data-exchange platform shared with a Stadler supplier and stole technical information belonging to that supplier. Everest demanded CHF 10 million from Stadler, which refused to pay and filed a criminal complaint. Stadler confirmed that its internal IT systems, production sites, and in-service rail vehicles were unaffected and that no relevant personal data was stolen. The precise intrusion date was not disclosed; 15 July is used as the approximate midpoint of the reported period.
Oklahoma Manufacturing Alliance
July 15, 2026
•[ ransomware, manufacturing, technology ]
On July 15, 2026, ransomware activity affected two employee computers at the Oklahoma Manufacturing Alliance and disrupted access to part of its local network. Staff isolated the affected devices and restored access through a separate secure network later that morning. Booba Project subsequently listed the alliance as a victim on July 28 and claimed theft of 10 GB of data, but the organization reported finding no evidence of removed information or compromised client records. The attacker and encryption behavior have not been independently verified.
Al Hayat
July 15, 2026
•[ leak, manufacturing, retail ]
Al Hayat, an Iraqi company that produces and distributes Pepsi products, was listed on Global Secret Group's leak site on July 26, 2026; the group claimed theft of 138 GB of internal files (attack est. mid-July). The company has not publicly confirmed the breach.
Fairlife, LLC (Coca-Cola subsidiary)
July 16, 2026
•[ ransomware, manufacturing, technology ]
Fairlife identified unauthorized third-party access to a portion of its systems, including production-related systems, in connection with a ransomware event. The incident temporarily suspended production at all four U.S. facilities. Coca-Cola confirmed that certain data was taken, while Anubis claimed it had locked servers and stolen 1 TB of confidential information. By July 27, most U.S. production had resumed. Canadian production, product quality and safety, and retail availability were largely unaffected.
OFS Brands Holdings, Inc.
July 26, 2026
•[ ransomware, manufacturing ]
Global Secret Group publicly listed OFS on July 26, 2026 as part of a multi-victim data-theft extortion campaign. Independent ransomware monitoring captured the same claim, and DataBreach.com subsequently indexed 36,624 records associated with OFS. Federal and OSHA records identify OFS Brands Holdings as an office-furniture manufacturer headquartered in Huntingburg, Indiana. No independently verified operational disruption has been established.
Undisclosed South Korean manufacturing website owner or operator
July 30, 2026
•[ espionage, manufacturing, technology ]
An unnamed state-sponsored group compromised at least one South Korean manufacturing website and used it as a watering hole against selected visitors. Fifteen legitimate South Korean websites across several sectors were used as watering holes, but the exact number in the manufacturing sector, individual compromise dates, and specific server-access method were not disclosed. No operational disruption or data theft from the website owner was reported.
Leviton
July 31, 2026
•[ ransomware, manufacturing, technology ]
Leviton, an electrical products maker in Melville, New York, was listed by the Dark Project ransomware group on August 5, 2026; the group claimed about 1.4 TB from an attack around July 31, incl. financial records, schematics and employee data. Leviton has not confirmed it.
VL Prosperity
August 7, 2026
•[ hack, espionage, manufacturing ]
Sources told ABC News that VL Prosperity was hacked while transiting the Strait of Gibraltar and lost communications for more than 30 hours. The Coast Guard and FBI later said foreign cyber actors had compromised the vessel's network and boarded the ship on 21 August to investigate and mitigate the threat. Subsequent reporting citing unnamed U.S. officials said investigators found temporary access to a propulsion-linked digital system, but the vessel manager later said Coast Guard, classification-society and internal IT reviews found no evidence the propulsion system was compromised. The initial access vector and perpetrator remain unknown; the 7 August date comes from contemporaneous reporting and has not been publicly confirmed by U.S. authorities.
Koninklijke Philips N.V.
August 18, 2026
•[ ransomware, technology, healthcare ]
Philips identified and contained unauthorized activity affecting a specific enterprise server used to store internal data and isolated the affected server. Philips reported no impact to customer environments. In a September 14 update, Philips said incident-response activities were complete and investigation findings supported closure of the incident, while additional analysis of a subset of downloaded data remained ongoing. Cl0p claimed approximately 13.5 GB of drawings, diagrams, and blueprints.
Boston Scientific Corporation
August 25, 2026
•[ hack, healthcare, manufacturing ]
Boston Scientific identified unauthorized activity on August 25, 2026 that caused a global network outage affecting certain on-premises and internal-facing systems. Manufacturing, order processing, shipping, and new LATITUDE remote-monitoring activations were disrupted. The company reported no indication of related unauthorized activity after August 25 and fully restored manufacturing, order fulfillment, and shipping on September 9. As of September 15, no credible cybercrime or ransomware group has publicly claimed responsibility and Boston Scientific has not attributed the attack.
