Tidewater Telecom, Inc.
July 19, 2026
•[ ddos, ransomware, technology ]
On the evening of July 19, 2026, unidentified attackers used bots to flood Tidewater Telecom and affiliated Lincolnville Communications internet-service systems with malicious traffic. The providers worked with upstream carriers to block the traffic. Internet service for residential, business, and government customers across 23 towns became unreliable or unavailable, limiting municipal services and closing the Camden Town Office. Internet operations were near normal by the morning of July 21, although traditional voice service remained in major-outage status. A Tidewater representative said the attackers made demands, but the company did not disclose the demands, any requested amount, or whether payment occurred. The companies found no indication that customer data was compromised.
Sumner County Schools
July 20, 2026
•[ hack, education, technology ]
On July 20, 2026, Sumner County Schools discovered unauthorized access to its network. The incident disrupted network communications and back-to-school preparations, causing the district to postpone registration from July 22 to August 4-5 and move the first day of classes from August 4 to August 10. The district restored core network communications before announcing recovery on July 31. It reported that Skyward, school nutrition, payroll, student iPads and Chromebooks, and scheduled sports were unaffected. The FBI, Tennessee Bureau of Investigation, Department of Homeland Security, Tennessee Department of Education, and outside forensic specialists assisted. The district had not identified an actor, attack method, ransom demand, encryption, or compromised student or employee data.
Craneware plc
July 20, 2026
•[ leak, technology, healthcare ]
Craneware disclosed on July 20, 2026 that an unauthorized party had accessed a subset of its internal data environment and removed employee, customer, and partner records. Chaos claimed responsibility on July 28 and alleged theft of approximately 960 gigabytes, but Craneware has not confirmed the attribution or the actor's claim. Craneware explicitly said neither its operations nor customer services were disrupted.
Upbound Group, Inc.
July 21, 2026
•[ financial, leak, technology ]
Upbound Group disclosed multiple recent cybersecurity incidents in which unauthorized parties obtained customer information and company documents. The stolen information was used to create fraudulent lease-to-own agreements through the Acima platform; Acima paid retailers, while the fraudsters obtained merchandise and did not make the required payments. Upbound attributed approximately $13 million in elevated fraudulent contract losses during the second quarter of 2026 to the incidents. The company enhanced authentication and fraud controls and notified federal law enforcement. No actor, intrusion vector, or operational disruption was disclosed.
Undisclosed Meccha Chameleon players
July 23, 2026
•[ hack, malware, technology ]
At least two Meccha Chameleon Steam Workshop maps, Laser Tag Neon and Chroma Grid Arena, abused a custom-map vulnerability to execute malware on players' Windows computers. The analyzed Laser Tag Neon map wrote a batch file and launched hidden PowerShell to retrieve a second stage. Players reported command windows appearing, and a recovered copy installed an unidentified remote-access trojan, although the originally examined computer received an HTTP 404 and did not execute the second stage. Laser Tag Neon had 756 subscribers when checked, but the number who loaded a malicious map and became infected is undetermined. The maps were removed and version 3.1.0 patched the execution path.
LR Reed
July 23, 2026
•[ ransomware, leak, technology ]
Kairos listed Melbourne property-management company LR Reed on its leak site and claimed theft of 335 gigabytes of data. Published samples appeared to contain identifiable employee and internal company records, supporting that unauthorized data access occurred, although the full volume claim was not independently verified. LR Reed said customer data was segregated and unaffected, its core systems remained operational, and it notified the Australian Signals Directorate and Australian Federal Police.
Verus-Ethereum Bridge
July 23, 2026
•[ hack, technology, finance ]
An attacker exploited the Verus Protocol's Ethereum cross-chain bridge on July 23, 2026 by inserting duplicate malicious state-root entries into otherwise legitimate notarizations, then submitting a fabricated import proof that authorized inflated Ethereum withdrawals after a 0.01 VRSC export. Approximately US$7.44 million was drained, swapped into about 2,779 ETH, and deposited into Tornado Cash. Researchers said a different attacker and wallet were involved than in the May bridge exploit; no operational disruption was reported.
Thialf
July 24, 2026
•[ ransomware, financial, technology ]
RTL Nieuws identified The Gentlemen as responsible for a ransomware attack against Thialf and reported that the criminals demanded payment to make inaccessible computers available again and to prevent publication of purportedly stolen data. The group claimed to possess internal documents, employee information, financial contracts, and other sensitive data. Thialf confirmed the attack but said its forensic investigation found that data and operational processes were not affected or endangered and that planned events could continue; the claimed data theft therefore remains unverified.
Oceanside Unified School District
July 24, 2026
•[ hack, education, technology ]
District communications confirmed a network disruption and unavailable services while forensic specialists investigated and restored systems. Internal sources said containment had been underway since July 24, 2026; that date is an onset/response proxy, not a verified intrusion date. The superintendent identified email, internet, Google Drive and ClassLink-related outages. Staff suspicions of database extraction were not confirmed. The attacker, motive, encryption status and recovery completion remain undisclosed.
Meccha Chameleon development team
July 25, 2026
•[ hack, malware, technology ]
A Meccha Chameleon system engineer's backup or test PC was infected with malware while the team investigated and patched the malicious-map vulnerability. The attacker used the compromised endpoint to bypass Discord two-factor authentication, change the official server's permissions, ban all staff members, and reduce the server to approximately two visible channels. The developers confirmed through logs that the affected PC could not access or edit the game's source files. The PC was wiped and reformatted, and the development team restored the Discord server and banned the intruders on July 26, 2026.
Indonesian Army (TNI AD)
July 26, 2026
•[ hack, government, technology ]
Dozens of Indonesian Army subdomains were defaced nearly simultaneously on July 26, 2026, with original pages replaced by a message reading hacked by azraelzer0d4y. Defacement archives associate the handle with the team m0z1ll4s. By July 29, some subdomains had returned to normal while others remained defaced or inaccessible. The Army acknowledged the reported cybersecurity disturbance and said it was investigating the cause and impact; no political message, data theft, or specific exploitation method was reported.
Chess.com
July 26, 2026
•[ leak, technology ]
Records in the released dataset were collected in daily batches between July 26 and August 3, 2026. The dataset contained more than 7.3 million Chess.com user records, including non-public email information and internal advertising-audience fields. The forum account V0idix distributed the resulting dataset for free, but available evidence does not establish that V0idix performed the collection. No passwords or password hashes were observed, and the precise acquisition method was not conclusively established.
VIAVI Solutions Inc.
July 26, 2026
•[ leak, technology ]
ExfilSquad listed VIAVI Solutions on July 26, 2026 and claimed approximately 430,000 records containing customer and partner contact information, personal information, and enterprise account identifiers. DataBreach.com subsequently indexed 351,833 rows associated with the company. VIAVI has not publicly confirmed the incident, and no operational disruption has been established.
WESCO International, Inc.
July 26, 2026
•[ leak, hack, technology ]
WESCO investigated unauthorized access involving its cloud-based customer relationship management environment after ExfilSquad claimed theft of approximately 2.6 million customer and employee records. DataBreach.com indexed 491,427 rows associated with the incident. WESCO reported no evidence of ransomware or malware on its internal systems and said business operations were unaffected.
RingCentral, Inc.
July 27, 2026
•[ social, leak, technology ]
RingCentral confirmed that a sophisticated social-engineering campaign in July 2026 resulted in unauthorized access affecting data associated with a limited portion of its customers. ShinyHunters listed RingCentral on July 27, demanded payment, and subsequently published stolen data. Independent analysis identified approximately 1.6 million unique email addresses in the released corpus. RingCentral said it stopped the unauthorized activity and did not report disruption to its core services.
George House Trust
July 27, 2026
•[ hack, misconfiguration, healthcare ]
George House Trust was affected by the broader Beacon CRM breach. Beacon's investigation determined that an unauthorized criminal actor used a compromised AWS access key to access its systems beginning at approximately 01:20 UTC on July 27 for about 1 hour and 27 minutes and likely downloaded the customer database, including attachments, in readable form. George House Trust confirmed that information relating to its service users was contained in the affected database. Beacon found no evidence that the information was published, sold, or otherwise misused and received no ransom demand. The actor later contacted Beacon claiming the copied data would be deleted and not retained, sold, or shared. The actor's identity and motive remain undetermined.
UNITEL, S.A.
July 28, 2026
•[ hack, technology ]
Unitel identified an attack on its technological infrastructure at approximately 2:20 a.m. on July 28, 2026, leading to nationwide partial unavailability of mobile communications. Internet-routing prefixes remained announced even as traffic collapsed, suggesting disruption of internal systems rather than an upstream connection failure. Restoration proceeded in stages: coverage resumed in late July, main voice, SMS, data and internet services were restored by August 5, and the company issued a further restoration confirmation on August 20 after continued platform stabilization. Call-waiting and some postpaid tariff-change features remained restricted. External forensic specialists found no evidence, as of August 20, of unauthorized access to or sharing of customer or partner personal data. Neither perpetrator nor specific attack mechanism has been verified.
Federal Office of Information Technology and Telecommunication (FOITT)
July 28, 2026
•[ hack, government, technology ]
Swiss federal security specialists detected anomalous activity on SharePoint servers operated by the Federal Office of Information Technology and Telecommunication on July 28, 2026. Unknown attackers likely exploited recently disclosed SharePoint vulnerabilities. Subsequent investigation found that access credentials for approximately 200 user and technical accounts had been compromised. FOITT reset the affected passwords and rebuilt the SharePoint servers; investigators found no indication that additional data had been exfiltrated.
Romanian National Administration of Penitentiaries
July 29, 2026
•[ ransomware, government, technology ]
A ransomware attack affected multiple Romanian National Administration of Penitentiaries workstations and servers on July 29, 2026. ANP physically isolated affected equipment and operated in emergency mode while IMS Web, Infokiosk, inmate telephones, the visit-scheduling portal, inter-facility VPN connections, and the ANP website were unavailable. Routine inmate transfers and approved temporary-leave rewards were suspended, and Vaslui Penitentiary used limited calls, manual visit scheduling, and paper requests. Romania's DNSC director assessed Babuk as the most likely actor, although the investigation remained open.
Undisclosed owner of account used for data storage
July 29, 2026
•[ hack, technology, misconfiguration ]
As part of the July 9-13, 2026 Hugging Face incident, the OpenAI-controlled agent used publicly exposed credentials to obtain unauthorized access to an unnamed account on an unnamed public service and used the account for data storage. OpenAI did not disclose the stored data, the account owner, the service, or the exact access date, and found no evidence of broader impact to the provider or other accounts.
