South Plains Rural Health Services, Inc.
June 17, 2026
•[ ransomware, leak, healthcare ]
PEAR claimed that South Plains Rural Health Services was notified of its intrusion on June 17 and later listed the West Texas healthcare provider on its leak site on July 15. By late August, PEAR had published files it claimed were stolen from SPRHS and alleged that approximately 1.4 TB of patient, employee, and administrative data had been exfiltrated. Independent ransomware trackers corroborate the PEAR victim listing and leak-site activity, but SPRHS has not publicly confirmed the incident, the June 17 date, the 1.4 TB quantity, or the detailed contents of the stolen material.
TINYpulse by WebMD Health Services (affecting Nintendo of America)
June 19, 2026
•[ ransomware, technology, leak ]
Shadowbyt3$ announced on 2026-06-12 that it had obtained Nintendo of America employee data from the cloud environment of TINYpulse, a third-party employee survey platform, and demanded $2 million. Nintendo confirmed that the third-party service was breached but said its own systems and customer data were not compromised. Nintendo described the confirmed exposure as older internal survey content involving a small subset of employees. The actor claimed an 859 MB dataset containing names, corporate email addresses, W-9 forms, bank statements, internal messages, and HR analytics, but Nintendo did not confirm the full claimed contents or volume.
May Trucking Company
June 21, 2026
•[ ransomware, leak ]
May Trucking detected suspicious network activity on June 21, 2026 and determined that an unauthorized party acquired files from its network. The company later confirmed that affected files contained personal information and notified the FBI. Embargo subsequently claimed the company and was reported to have stolen roughly one terabyte of data. DataBreach.com indexed 160,684 records associated with the incident. No independently verified operational disruption has been established.
Undisclosed organization investigated by Volexity
June 22, 2026
•[ hack, technology, ransomware ]
UTA0533 compromised two SonicWall SMA1000 appliances at one undisclosed organization. Volexity found compromise artifacts dating to June 22, 2026 and LDAP-capture files dated July 2. The actor intercepted unencrypted authentication traffic to obtain credentials. The event date records the earliest observed compromise, not a proven date for the first credential theft. Ransomware effects reported at other victims are not established for this organization.
Inission Power Oy (including Inission Power Finland Oy)
June 22, 2026
•[ ransomware, technology, manufacturing ]
Inission Power Oy and subsidiary Inission Power Finland Oy disclosed a single ransomware-related compromise of their shared server environment, detected June 22, 2026. The environment was isolated and restored the same day, with normal business operations continuing. Portions of affected databases were later found online. The company did not identify distinct intrusions or separately attributable data theft at each legal entity; successful encryption and attacker-caused operational disruption were not established. The intrusion start and data-acquisition dates remain unknown.
Bajaj Auto Limited
June 23, 2026
•[ ransomware, manufacturing, technology ]
Bajaj Auto disclosed that a ransomware attack on June 23, 2026 affected systems belonging to the company and its wholly owned subsidiary, Bajaj Auto Technology Limited. The companies activated precautionary measures and response protocols, which Bajaj Auto said had been successful in managing and mitigating the incident. The attacker, access method, disruption duration, and any data theft were not disclosed.
Partnered Health Pty Ltd
June 23, 2026
•[ ransomware, healthcare, leak ]
On June 23, 2026, Partnered Health became aware that a malicious actor had accessed data in parts of its clinic network. The company currently lists 17 clinics where healthcare-record information was affected and five additional clinics where the extent of impact remains under investigation. Partnered Health later confirmed that 11 files tied to the incident had been published online and that additional patients and some employees were affected. INC claimed responsibility and approximately 500 GB of theft, but Partnered Health has not verified that quantity and was still assessing the published material. No operational or clinical-service disruption was reported.
GSP Crop Science Limited
June 25, 2026
•[ ransomware, hack, manufacturing ]
INC Ransom listed GSP Crop Science as a claimed victim on June 25, 2026. GSP later confirmed that an external cybersecurity incident appearing to involve ransomware affected certain non-core IT systems. The company did not publicly attribute the incident or confirm the actor's data-exfiltration claim. Restoration was underway, while core business functions continued without disruption and no material financial or operational loss was identified.
Cardiology Associates of Port Huron, P.C.
June 25, 2026
•[ ransomware, leak, healthcare ]
Orova stated that it compromised Cardiology Associates of Port Huron on June 25, 2026, stole approximately 144 GB of data comprising 244,215 files, and encrypted some servers. The practice did not publicly confirm the attack. Orova subsequently published stolen data, and later independent review of the released material identified more than 150,000 patient records containing personally identifiable and protected health information, corroborating the data-theft component of the group's claim.
Salida School District R-32-J
June 29, 2026
•[ ransomware, education ]
Salida School District R-32-J in Salida, Colorado, was hit by a cyberattack on June 29, 2026 that damaged files on device hard drives, some unrecoverably. All systems were taken offline and central office work was disrupted. It said no data appears to have been accessed.
PAI Pharma
June 30, 2026
•[ ransomware, healthcare, manufacturing ]
PAI Pharma, a Greenville, South Carolina maker of generic liquid and unit-dose drugs, was listed on Brain Cipher's leak site on June 30, 2026; the group claimed theft of about 1.4 TB and threatened to publish it. PAI Pharma had issued no public notice as of September 2026.
Undisclosed Uruguayan commercial interiors company
June 30, 2026
•[ ransomware, manufacturing ]
Gunra ransomware listed an undisclosed Uruguayan designer and maker of commercial interiors on its leak site on June 30, 2026, claiming theft of 30 GB of data. The company has not been named or commented.
Bethany Lutheran Homes, Inc. d/b/a Eagle Crest Communities
July 1, 2026
•[ ransomware, leak, healthcare ]
SafePay claimed responsibility for compromising Bethany Lutheran Homes, Inc., which operates as Eagle Crest Communities, on 1 July and threatened to publish the full leak unless the organization contacted the group. A verified searchable dataset containing 16,556 name-and-telephone rows confirms that Eagle Crest data was compromised. The access method, encryption, and operational impact were not disclosed, and no service interruption was identified. Anubis separately claimed an Eagle Crest patient-and-employee data breach later in July, but available evidence does not establish whether that represented the same compromise or a separate event.
Ingram Content Group, Inc.
July 1, 2026
•[ ransomware, technology ]
ShinyHunters claimed responsibility for compromising Ingram Content Group on 1 July after attempted ransom negotiations reportedly failed. A verified searchable dataset containing 80,190 rows confirms that Ingram data was compromised. The access method, encryption, and operational impact were not disclosed, and no system outage or other operational disruption was identified.
Indra Group (undisclosed subsidiary)
July 1, 2026
•[ ransomware, technology ]
Indra detected ransomware within a non-critical environment belonging to an undisclosed subsidiary and activated its incident-response protocols. The company described the impact as minimal, reported no interruption to critical operations or services, and ruled out propagation to the rest of the group. The Gentlemen claimed the attack and initiated a leak countdown, but Indra did not confirm attribution or data exfiltration.
Oleoductos del Valle S.A. (Oldelval)
July 1, 2026
•[ ransomware, energy, leak ]
Argentina pipeline operator Oldelval disclosed on July 31, 2026 that a cyber incident affected certain administrative computer systems. It activated response and containment procedures and later reported that the affected platforms had been fully restored, without interruption to crude-oil transport. Ransomware/extortion group The Gentlemen listed the operator on its leak site on July 23 and claimed data theft; the company did not independently confirm exfiltration, encryption, or the attackers identity. The date of initial unauthorized access and full technical effects were not disclosed.
Golden State Orthopedics & Spine
July 1, 2026
•[ ransomware, healthcare ]
Walnut Creek, California practice Golden State Orthopedics & Spine detected unusual network activity around July 2, 2026, saying patient data incl. SSNs may have been accessed. Brain Cipher claimed the attack on July 1, alleging 150 GB stolen; ~125,000 records were later indexed.
Northeast Pediatrics & Adolescent Medicine
July 2, 2026
•[ ransomware, healthcare, leak ]
On July 2, 2026, Anubis added Northeast Pediatrics & Adolescent Medicine to its extortion site and claimed that employee and patient data had been stolen. The precise intrusion date and initial-access method were not disclosed. After reported communications between the practice and Anubis ended, data was published, and the supplied breach database indexed 29,356 records containing names, dates of birth, phone numbers, and street addresses. No operational disruption or successful encryption was publicly confirmed.
Ville de Drancy
July 3, 2026
•[ ransomware, government, leak ]
The Ville de Drancy detected ransomware on July 3, 2026, after parts of its municipal IT environment became inaccessible. Officials disconnected all systems to contain the attack, filed a complaint, and rebuilt from clean offsite backups with ANSSI assistance. Municipal services were slowed or degraded, the telephone system was affected, and three online procedures reverted to paper. The city said personal-data leakage was probable but did not confirm its extent. Qilin later claimed responsibility and on August 2 listed 210 GB comprising 241,705 files as published, but the city did not confirm the attribution or data theft and the claim was not independently verified.
Metro Mondego, S.A.
July 6, 2026
•[ ransomware, leak, technology ]
Metro Mondego detected ransomware on July 6, 2026 affecting part of its internal systems, but the Metrobus service continued operating and isolated bank-card payment terminals were unaffected. The Gentlemen listed Metro Mondego on its leak site on July 16 and claimed possession of company information. Metro Mondego subsequently said available evidence made data copying probable and warned personalized-pass holders, email correspondents, employees, suppliers, and contractual counterparties while noting that the exact copied data remained unconfirmed.
