Krum Public Library
May 14, 2026
•[ ransomware, government, financial ]
Krum Public Library detected unusual network activity on May 14, 2026 and later confirmed a ransomware attack limited to the library environment. Computer access, printing, and Wi-Fi were unavailable, and checkout was temporarily limited to five items. Forensic investigators determined that some library network files had been accessed without authorization, although the city said Social Security numbers and personal financial account information were not affected. NightSpire claimed responsibility and described financial and human-resources data, but the city did not confirm the attribution or claimed contents.
HDFC Asset Management Company Limited
May 16, 2026
•[ ransomware, leak, finance ]
On 16 May, an HDFC AMC IT administrator detected suspicious activity, and the company received an email from Morpheus claiming to have exfiltrated more than 680 GB of data. HDFC AMC activated containment procedures, isolated affected systems, engaged cybersecurity specialists, and notified regulators and law enforcement. On 29 May, the Bombay High Court restrained Morpheus and others from publishing or using the data. HDFC AMC later said the incident did not interrupt business continuity, did not materially affect its financial results, and did not affect investors' units or portfolio values. The initial access method was not disclosed.
Mid-Cumberland Human Resource Agency
May 18, 2026
•[ ransomware, healthcare, government ]
Insomnia claimed Mid-Cumberland Human Resource Agency as a victim in June 2026 and threatened publication of stolen information. DataBreach.com indexes 196,568 records and dates the underlying breach to May 18, 2026. MCHRA is a Nashville-based nonprofit providing social, health-support, meals, transit, and related human services. No independently verified operational disruption has been established.
Fox Rothschild LLP
May 21, 2026
•[ ransomware, social, finance ]
On 2026-05-21, a sophisticated social-engineering incident enabled unauthorized access associated with one Fox Rothschild user device. Fox Rothschild stated that the activity was limited to that device and that it found no broader access to the firm's systems or network. Silent Ransom Group claimed responsibility, said it exfiltrated confidential client files, demanded payment, and later published data after the ransom deadline passed. The actor attribution, stolen-data scope, and publication details are based on the group's claim and subsequent reporting.
DentaQuest, LLC
May 23, 2026
•[ leak, ransomware, healthcare ]
DentaQuest confirmed unauthorized access to a limited portion of its network and said it acted to contain the incident. ShinyHunters claimed responsibility and published approximately 234 GB of allegedly stolen data after negotiations failed. Have I Been Pwned identified information associated with approximately 2.6 million accounts. DentaQuest said its systems remained fully operational with limited customer-service disruption but did not publicly confirm the actor's claimed volume or attribution.
MIP Holdings (Pty) Ltd
May 25, 2026
•[ ransomware, technology, leak ]
The Gentlemen used credentials that an MIP employee had reused on an unrelated service that was previously breached to reach an employee personal laptop and MIP's legacy Atlassian Jira support environment around 25 May 2026. Jira contained screenshots, attachments, personal information and credentials; credentials obtained there also enabled access to certain FTP/SFTP sites. Attackers remained in the environment until detection on 14 June and exfiltrated about 400,000 records. MIP's core policy-administration systems were not compromised. MIP later confirmed paying a substantial ransom for a deletion promise that was not honored.
ERIELL Group
May 26, 2026
•[ ransomware, energy ]
On or before May 26, 2026, an affiliate of the Nova ransomware operation gained unauthorized access to ERIELL Group and stole corporate data, which the group threatened to publish if the company did not negotiate. Nova subsequently acknowledged that its affiliate had attacked the Uzbekistan-based company, banned the affiliate, claimed that no files were encrypted, and promised not to publish the stolen information.
Sinomax USA
May 28, 2026
•[ ransomware, manufacturing, retail ]
Qilin listed Sinomax USA on May 28, 2026 and threatened to release confidential data unless the company negotiated. DataBreach.com subsequently indexed 96,279 rows associated with the company. Public reporting did not confirm encryption, system unavailability, or operational disruption; therefore, only the achieved data-theft effect is coded.
EnTrans International LLC
May 28, 2026
•[ ransomware, leak, manufacturing ]
Chaos listed EnTrans International LLC on 28 May, said it had possessed the company's internal data for some time, and threatened publication after a 72-hour deadline. A subsequently published searchable dataset contains personal and vehicle information. EnTrans, which operates as Engineered Transportation International, has not publicly confirmed the incident or disclosed the access method, encryption, or operational impact. No system outage or other operational disruption was identified in public reporting.
Providence Medical Group
May 28, 2026
•[ ransomware, healthcare ]
Providence Medical Group, a physician practice group in the Dayton, Ohio area, was claimed by the Qilin ransomware group on May 28, 2026; a 346,802-row dataset with SSNs and birth dates was later indexed. The group has not publicly confirmed the incident.
HumanEdge
May 28, 2026
•[ ransomware, technology ]
HumanEdge, a staffing and recruiting firm headquartered in White Plains, New York, was claimed as a victim by the Qilin ransomware group on May 28, 2026, which threatened to leak data unless negotiations began. No company statement was found.
Lab Express International, Inc.
May 29, 2026
•[ ransomware, healthcare, technology ]
INC Ransom claimed that it compromised shared infrastructure used by Lab Express International and Garonit Pharmaceutical and obtained approximately 200 GB of internal data. DataBreach.com later indexed 5,506 name records associated with labexpress.com. Public reporting did not establish encryption or operational disruption.
Reliance Infrastructure Limited
May 29, 2026
•[ ransomware, leak, energy ]
On May 29, 2026, Yotta detected suspicious activity on a hosted server belonging to Reliance Infrastructure, terminated it, and prevented suspected ransomware execution. Reliance confirmed a partial breach of data on the third-party server. World Leaks later published a reported 858,000 Reliance files, including nearly 19,000 files totaling 14.3 GB associated with the Kudankulam project. Reuters could not independently authenticate the documents. NPCIL said the material concerned conventional balance-of-plant facilities rather than nuclear-safety, security, reactor-core, or plant-control systems; there was no reported compromise of NPCIL or plant systems.
UEI College
May 29, 2026
•[ ransomware, leak, education ]
Termite claimed responsibility for compromising UEI College and threatened to release the institution's data unless negotiations occurred. The group publicly listed the victim on May 30, 2026, with the underlying breach estimated as May 29. DataBreach.com later indexed 5,573,054 leaked rows containing personal and identity information. No independently verified operational disruption has been established.
Undisclosed organization operating Langflow and production MySQL/Alibaba Nacos infrastructure
June 1, 2026
•[ ransomware, technology, hack ]
In late June 2026, an unidentified human operator selected the victim, provisioned the attack infrastructure, and supplied credentials, while an agentic AI system technically carried out the intrusion. The AI exploited CVE-2025-3248 in an internet-facing Langflow instance, dumped its backing Postgres database, harvested credentials and API keys, and pivoted to a production MySQL and Alibaba Nacos server using root credentials obtained through an earlier compromise. It created a backdoor administrator, encrypted all 1,342 Nacos configuration items with an ephemeral key that was never stored or transmitted, dropped the original configuration and history tables, deleted multiple database schemas, and left a Bitcoin ransom demand. Sysdig assigned the JadePuffer tracking label to this human-directed, AI-executed operation; JadePuffer is not the identified name of the human hacker. The human operator's identity and origin remain unknown. The AI asserted that data had been staged externally, but Sysdig found no evidence confirming exfiltration.
Ecopetrol S.A.
June 1, 2026
•[ ransomware, leak, energy ]
An external actor reportedly obtained access through a third party with administrative privileges approximately one month before the incident was disclosed and downloaded files from cloud storage used by 15 Ecopetrol Group companies. Security controls blocked the attempted ransomware encryption, and Ecopetrol reported that operations continued without interruption and that transactional systems were not compromised. The copied information was later published. The Gentlemen claimed responsibility, but Ecopetrol did not publicly confirm the attribution.
At least one PTC Windchill/FlexPLM customer
June 1, 2026
•[ ransomware, technology, finance ]
Ransom-ISAC assesses that Cl0p affiliates likely began exploiting CVE-2026-12569 as a zero-day in early June 2026 against internet-exposed PTC Windchill and FlexPLM systems. Attackers deployed custom JSP webshells capable of credential theft and large-scale data exfiltration. Extortion emails were observed beginning July 20, and Cl0p later named more than 40 alleged victims, including Shell, Philips, Fiserv, Zebra Technologies, Mindray, and others. Victim-specific stolen-data volumes ranged from about 1 GB to several terabytes according to Cl0p, although many individual claims remain unconfirmed.
City of McMinnville
June 1, 2026
•[ ransomware, government ]
An intruder accessed and copied files from the City of McMinnville network during an interval between June 1 and July 18, 2026. City staff detected unusual activity around July 15. The RansomHouse extortion group subsequently claimed the compromise and posted apparently stolen city data on its dark web site in August. Local reporters observed apparently municipal and police records, and the city later notified affected individuals about possible exposure of identity information. No completed encryption or confirmed service outage was established.
Hollard Insurance Group
June 1, 2026
•[ ransomware, finance, technology ]
South African insurer Hollard's funeral-policyholder data was leaked by The Gentlemen in Sept. 2026 after a June 2026 extortion breach of its administrator MIP Holdings' Jira platform. Hollard says its own systems were not compromised and notified affected customers.
Undisclosed organizations in education, transportation, healthcare, and finance
June 5, 2026
•[ ransomware, education, finance ]
Microsoft reported that The Gentlemen ransomware had affected organizations in the education, transportation, healthcare, and financial sectors across North America, South America, Europe, Africa, and Asia. The self-propagating Go-based encryptor could spread through Windows networks, encrypt local volumes and network shares, delete shadow copies, and leave ransom notes. Microsoft tracks the ransomware operators as Storm-2697, while affiliates conduct the intrusions. Exact victim identities, attack dates, disruption duration, and affected-system counts were not disclosed.
