Access Dental & Orthodontics
June 5, 2026
•[ ransomware, leak, healthcare ]
WorldLeaks listed Access Dental & Orthodontics on its leak site on June 5, 2026 and issued a countdown associated with its extortion claim. DataBreach.com later indexed 322,387 records containing personal and contact information. Access Dental operates a dental-services organization headquartered in Irving, Texas. No independently verified operational disruption has been established.
United Auto Supply
June 5, 2026
•[ ransomware, leak, retail ]
WorldLeaks publicly listed United Auto Supply on June 5, 2026 as part of its data-theft extortion operation. Independent ransomware monitoring captured the same June 5 claim, and DataBreach.com subsequently indexed 826,018 records containing personal, contact, and vehicle information associated with the company. United Auto Supply has not publicly confirmed the incident, and no operational disruption has been independently established.
Undisclosed organization in Unit 42 Pink-related extortion investigation
June 5, 2026
•[ ransomware, phishing, technology ]
Palo Alto Networks Unit 42 investigated an extortion case involving an unnamed organization. On June 1, 2026, an attacker renewed contact in an existing negotiation, supplied a new qTox identifier and a data-leak site associated with the Pink extortion brand, and referenced essentially the same information claimed taken in an earlier extortion notice. Unit 42 described the broader cluster using voice phishing and cloud-service data theft. The specific initial access, actual exfiltration, victim industry and country, and whether the original intruder was identical to the Pink contact were not established. Event date is a publication-date fallback, not a verified theft date.
City of Acworth
June 8, 2026
•[ ransomware, government, hack ]
On 2026-06-08, the City of Acworth detected an unauthorized cybersecurity incident affecting certain municipal computer systems. The city warned residents that they might experience service interruptions because of network outages, engaged cybersecurity professionals, and notified law enforcement. By 2026-06-18, all affected systems had been restored and city services were fully operational. INC Ransom subsequently claimed responsibility by listing Acworth on its dark-web leak site with alleged data samples. The city has not confirmed INC Ransom's attribution, ransomware deployment, encryption, data theft, a ransom demand, the contents of the alleged samples, or the exact systems and services affected.
Undisclosed third-party law firm used by Navient
June 8, 2026
•[ ransomware, finance ]
Navient learned on June 8, 2026, that ransomware had affected certain information systems at an undisclosed third-party law firm providing it legal services. An unauthorized actor accessed Navient-related data held by the firm, including sensitive borrower information. The incident was limited to the law firm's environment; Navient found no access to its own systems and experienced no disruption to operations or customer services. Public disclosures did not identify the law firm, ransomware operator, affected-person count, access method, or any operational disruption at the firm.
Central Bank of Libya
June 9, 2026
•[ ransomware, finance, government ]
On 2026-06-09, the Central Bank of Libya confirmed a cyberattack affecting a limited number of systems and technical services. The bank activated emergency response and business-continuity procedures and isolated affected systems. Qilin claimed responsibility on 2026-06-22 and threatened to release confidential banking data. The bank later said it was investigating material published on the dark web. The access method, data categories, volume, and effects on customers or financial assets were not publicly established, and the Qilin attribution remains an attacker claim.
Reynella East College
June 9, 2026
•[ ransomware, education, leak ]
On 2026-06-09, Reynella East College notified parents and carers that a cybersecurity breach had taken all of the school's computer systems offline. Classes continued through face-to-face and offline arrangements while the South Australian Department for Education and cybersecurity specialists investigated and restored systems. On 2026-06-23, the Interlock ransomware group claimed responsibility and published more than 600 GB comprising more than 473,000 files in more than 68,000 folders. Reporting reviewed samples that included passport scans, credentials, student and family contact details, teaching documents, contracts, financial reports, and school budgets. The Department for Education acknowledged that information had been posted online but continued assessing which individuals and records were affected.
Prince George County
June 11, 2026
•[ ransomware, government, leak ]
Prince George County identified a cybersecurity incident affecting certain network systems on June 11, 2026. The incident disrupted county phone, internet, and online payment services, while 911 and non-emergency dispatch remained available. Most systems were restored within approximately one week. RansomHouse claimed that it encrypted the county on June 10 and posted an evidence pack, but the county did not confirm the group's attribution, encryption claim, data theft, or a ransom demand; officials later stated that personal information may have been involved.
AS Latvijas valsts meži
June 11, 2026
•[ ransomware, financial, technology ]
Intrusion indicators show that the attacker entered AS Latvijas valsts mei systems on 2026-06-11 and remained undetected until malicious activity was identified during the night of 2026-06-22 to 2026-06-23. The attacker exfiltrated company data and deployed ransomware, while LVM disconnected LVM GEO, its map-services system, the Mednis application, and several internal customer- and provider-facing systems. CERT.LV confirmed that 44 GB of stolen data was published, including internal documents, emails, source code, digital certificates, cryptographic keys, and user credentials, and assessed that the attacker likely obtained more data. Timber deliveries were reduced after the attack and returned to full volume on 2026-07-01, although other systems remained under restoration on 2026-07-09. Public threat-monitoring sources identify ByteToBreach as the claimant, but CERT.LV has publicly described the perpetrator only as a foreign financially motivated ransomware actor.
Kee Wah Bakery Limited
June 12, 2026
•[ ransomware, retail, technology ]
Kee Wah Bakery discovered on June 12, 2026 that its internal network was not operating normally and subsequently received a ransom note. Its preliminary investigation confirmed a ransomware attack. The company continued operating its physical stores and stated that payment and credit-card information were not affected. Systems containing information concerning employees, business partners, online customers, and loyalty-program members may have been exposed, but Kee Wah had not confirmed data exfiltration or disclosed the number of affected individuals.
Undisclosed Uruguayan advertising agency
June 12, 2026
•[ ransomware, leak, technology ]
Gunra ransomware listed an undisclosed Uruguayan advertising agency on its leak site on June 12, 2026 and claims it published 40 GB of the firm's files after it refused to pay. The agency has not been named or commented.
Council of Europe
June 14, 2026
•[ ransomware, government, leak ]
On 2026-06-14, ShinyHunters claimed that it had stolen approximately 297 GB of Council of Europe data from multiple departments and threatened publication unless the organization began negotiations by 2026-06-16. The group claimed the material included payroll, human-resources, banking, tax, social-security, medical, and applicant records. The Council of Europe stated that it was investigating the allegation but had not publicly confirmed the breach, access method, or claimed data volume at the time of the supplied report. Because no intrusion date was reported, the publication date is used as the event date.
POKKA PTE. LTD.
June 14, 2026
•[ ransomware, retail, hack ]
Sapporo Holdings confirmed unauthorized access to POKKA PTE. LTD. on June 14, 2026 after detecting suspicious communications and disconnected related systems and equipment for containment. INC listed pokka.co on July 18 and threatened to leak data unless the company negotiated; monitoring sources described internal files as exfiltrated, but neither the quantity nor contents were disclosed. No attacker-caused operational disruption was reported. Sapporo said its Japanese domestic operations were unaffected and found no causal relationship between the Pokka and Sleeman incidents.
Eastman Kodak Company
June 15, 2026
•[ ransomware, leak, technology ]
ShinyHunters listed Eastman Kodak Company on its extortion site on June 15, 2026, claiming theft of more than 2.2 million customer records and internal corporate data and threatening publication on June 18. Kodak confirmed that an unauthorized third party temporarily accessed a limited amount of company data, stated that the incident was contained, and reported no threat to its systems or operations. Kodak did not confirm the actor's claimed volume or contents.
Optimum First Mortgage, Inc.
June 15, 2026
•[ ransomware, finance ]
Optimum First Mortgage learned around June 19, 2026 that an unauthorized party had accessed its network several days earlier. PEAR claimed responsibility, dated the intrusion to June 15, alleged theft of approximately 9.3 TB, and threatened publication. The company disputed the claimed volume and said its investigation had found no evidence that its loan-origination or application-software systems were breached. The affected data categories and number of individuals remained unconfirmed.
Glendale Community College
June 15, 2026
•[ ransomware, education, leak ]
ShinyHunters claimed a pay-or-leak breach of Glendale Community College dated 15 June and later published attributed data. The college said it was notified of a potential incident on 16 June, isolated and secured its network, and determined that certain student educational-record data may have been copied without authorization. The isolation was a defensive containment measure; no service outage or attacker-caused operational disruption was reported. The initial access method was not disclosed.
River Financial Corporation (River Bank & Trust)
June 16, 2026
•[ ransomware, finance ]
An unauthorized actor accessed River Financial Corporation's network, including River Bank & Trust, on or about June 16, 2026. River detected the activity on June 19 and determined that ransomware had been deployed across portions of its server environment, disrupting certain operations and prompting impacted systems to be taken offline. A July 10 SEC amendment confirmed that the actor also removed certain data, although the contents and scope remained under investigation and River reported no evidence that customer accounts were affected.
United Personnel
June 16, 2026
•[ ransomware, technology ]
United Personnel, a Springfield, Massachusetts staffing firm and division of Masis Staffing Solutions, was listed by the Genesis ransomware group in June 2026, which claimed about 700 GB of customer, employee, payroll and contract data. The company has not confirmed a breach.
Mount Royal University
June 17, 2026
•[ ransomware, education ]
Mount Royal University identified the incident on June 17. The actor copied and deleted specific H-drive folders and deleted the departmental J drive, disrupting university services. CMD Organization claimed 10 TB and demanded 30 bitcoin, but the volume was not verified. MRU later said it had reason to believe the obtained information had been deleted and was no longer held by those responsible; restoration remained underway August 10.
SLEEMAN BREWERIES LTD.
June 17, 2026
•[ ransomware, hack, retail ]
Sapporo Holdings confirmed unauthorized access to SLEEMAN BREWERIES LTD. on June 17, 2026 and disconnected related systems and equipment. A Canadian liquor-industry association subsequently relayed that Sleeman's network outage was caused by a cybersecurity incident and that sales and delivery were continuing manually. Chaos listed Sleeman on July 14, and monitoring sources reported an alleged 420-gigabyte theft; Sleeman has not confirmed the attribution or data claim. Sleeman separately disclosed a January 26 ransomware incident involving personal information, so the January data categories are not attributed to this June event. Sapporo found no causal relationship with the Pokka intrusion and no impact on its Japanese domestic operations.
