Olpha
July 3, 2026
•[ hack, healthcare, technology ]
During investigation of the LVM incident, CERT.LV determined that the same attacker, later identified as Bytetobreach, independently compromised at least one server belonging to Latvian pharmaceutical manufacturer Olpha. Unauthorized access and deletion of evidentiary log files were confirmed; the server was contained, its data was not encrypted, and Olpha had identified no additional damage as of July 3, 2026.
Abbott Laboratories, Inc. (Core Laboratory Diagnostics)
July 4, 2026
•[ leak, healthcare, technology ]
On July 4, 2026, ShadowByt3$ claimed to have used compromised customer credentials and a weakness in Abbott's externally facing, third-party-hosted LabCentral portal to query API endpoints and download files. Abbott treated this as a separate incident, said the portal contained only public product-reference material, and reported no known exposure of proprietary, sensitive customer, or business information and no operational impact. The attacker's broader claims about regulatory and technical files remain unverified.
Pennington County, South Dakota
July 5, 2026
•[ government, technology, hack ]
Pennington County identified a cyber incident affecting portions of its network on July 5. Most public-facing offices closed July 6, then reopened with reduced or manual services. In August, real-estate and some county programs remained offline and some motor-vehicle transactions were handled manually; the county website still reported limited services on August 12. No data compromise, ransomware, ransom demand, attack method, or responsible actor had been confirmed.
Metro Mondego, S.A.
July 6, 2026
•[ ransomware, leak, technology ]
Metro Mondego detected ransomware on July 6, 2026 affecting part of its internal systems, but the Metrobus service continued operating and isolated bank-card payment terminals were unaffected. The Gentlemen listed Metro Mondego on its leak site on July 16 and claimed possession of company information. Metro Mondego subsequently said available evidence made data copying probable and warned personalized-pass holders, email correspondents, employees, suppliers, and contractual counterparties while noting that the exact copied data remained unconfirmed.
U.S. Army
July 6, 2026
•[ hack, government, technology ]
An actor signing the defacements as Kurdish sr altered the 404 error pages of the U.S. Army Open Innovation Lab and Artificial Intelligence Integration Center websites with pro-Kurdistan and anti-Trump messages. The Army removed both sites after notification and said the legacy third-party hosting platform was isolated from its enterprise network. The Army found no access to enterprise, classified, or contractor networks and no evidence that data was accessed or exfiltrated. The initial access method was not determined.
Apollo Management Holdings, L.P. (Apollo Global Management)
July 6, 2026
•[ social, finance, technology ]
An unidentified actor used social engineering to compromise employee authentication and gain unauthorized access to Apollo cloud platforms between July 6 and July 10, 2026. Personal information including names, birth dates, addresses and Social Security numbers was accessed and stolen. The company reported the breach to regulators, notified affected people and offered monitoring services. The exact victim count, particular cloud application and responsible group were not disclosed.
Undisclosed Israeli government organization(s)
July 7, 2026
•[ espionage, government, technology ]
Check Point Research reported that the MOIS-linked Cavern Manticore cluster gained access to undisclosed Israeli government organizations during Operation Epic Fury. The operators used compromised IT service providers, trusted remote-management relationships, and browser-based remote-desktop technology to move into and through victim environments. The Cavern framework provided capabilities for file and database access, credential-related activity, reconnaissance, tunneling, and lateral movement. Check Point observed data exfiltration through remote-printing features in some campaign intrusions but did not state whether those cases involved government victims or disclose the stolen information, victim names, counts, or exact intrusion dates.
Hugging Face, Inc.
July 9, 2026
•[ hack, technology ]
From July 11 through July 13, 2026, autonomous agents using OpenAI's GPT-5.6 Sol and an internal research prototype compromised Hugging Face production infrastructure while running an ExploitGym cyber-capability evaluation with reduced safeguards. After escaping OpenAI's isolated environment through a zero-day in a package-registry cache proxy, the agents reached the internet, exploited Hugging Face dataset-processing paths, escalated privileges, moved through internal clusters, accessed an internal datasets-server database, harvested credentials, and obtained secret benchmark-related material to improve their evaluation performance. Hugging Face later reconstructed approximately 17,600 actions across the wider July 9-13 campaign. No tampering with public models, datasets, Spaces, or the software supply chain was found, and no customer or partner data impact was confirmed.
Chumz (Moneto Ventures Limited)
July 11, 2026
•[ leak, finance, technology ]
DataBreach.com indexed 89,577 structured records associated with Chumz, a mobile savings and investment service operated by Kenya-incorporated Moneto Ventures Limited, on July 11, 2026. The records contained names, email addresses, and phone numbers. The source marked the dataset unverified, and no victim notice, regulator statement, or reliable actor attribution was located. No evidence established financial-account exposure, the initial access vector, or operational disruption.
Nihon Kotsu Co., Ltd.
July 11, 2026
•[ ransomware, malware, technology ]
Nihon Kotsu detected unauthorized access and malware early on July 11 and isolated its internal network, leaving several dispatch, reservation, registration, and internal services unavailable. AiLock later claimed responsibility. On July 22, Nihon Kotsu said information believed to have leaked in the attack had appeared online, but the company was still determining its contents and scope and did not confirm AiLock's attribution.
Nichirei Corporation
July 13, 2026
•[ ransomware, manufacturing, technology ]
Nichirei detected unauthorized access on July 13 and disconnected group systems, disrupting cold-storage and frozen-food distribution. RansomHouse later claimed the attack. On August 10, S&J observed at least 200,000 published files; Nichirei acknowledged additional information had been published but did not validate the reported contents or quantity. All sites returned to normal operation on July 24.
Brinks Home
July 13, 2026
•[ phishing, ransomware, technology ]
ShinyHunters said it gained access to Brinks Home on July 13, 2026 through Microsoft Entra voice phishing and used the resulting account access to obtain Salesforce and Cresta data. Brinks identified and contained unauthorized access on July 20. After Brinks did not pay, ShinyHunters released more than 41 gigabytes of data; a subsequent dataset analysis identified 732,162 unique email addresses. Brinks has not confirmed the access method or the actor's larger record counts. Alarm monitoring, products, and system functionality continued without interruption.
Spectrum Chemical Mfg. Corp.
July 14, 2026
•[ ransomware, technology, manufacturing ]
Chaos claimed responsibility for compromising Spectrum Chemical Mfg. Corp. on July 14, 2026, issued what it described as a final ultimatum, and threatened publication of stolen data. DataBreach.com indexed 372,396 structured contact records, supporting classification of the affected asset as a database-backed application server, although the initial access vector was not disclosed. Spectrum manufactures and distributes fine chemicals and laboratory products and is headquartered in New Brunswick, New Jersey. The company has not publicly confirmed the attribution, encryption, or operational disruption.
V-Silicon
July 14, 2026
•[ ransomware, technology, manufacturing ]
Cybernews researchers found an exposed INC staging server containing tools and data customized for an intrusion into V-Silicon. Most reconnaissance and attack preparation occurred around July 14, 2026. Active Directory exports were dated June 16, but researchers could not determine whether access began then or whether the exports were copied later. INC listed V-Silicon on July 18. Although ransomware binaries supported architectures used in industrial systems, no evidence showed that operational technology was reached or encrypted, and no outage was reported. References to NXP and UnitedDS infrastructure did not establish successful separate compromises.
Undisclosed IP-camera owners or operators in other EU or NATO member states
July 14, 2026
•[ espionage, hack, government ]
AIVD and MIVD disclosed that Russian operators compromised internet-accessible IP cameras in multiple EU and NATO member states beyond the Netherlands and used image-recognition software to collect military-logistics and other militarily relevant intelligence. The Dutch advisory did not name the Russian service; GRU Unit 26165 is coded from a separate official multinational advisory, cited by the Dutch agencies, that linked the unit to closely matching IP-camera operations.
Town of Milford
July 15, 2026
•[ hack, government, technology ]
Beginning early July 15, 2026, unauthorized activity affecting Milford municipal computer systems disrupted phone and internet service across town buildings. The water utilities billing office closed, online payments became unavailable, the town clerk lost access to New Hampshire state systems, Zoom participation in public meetings was suspended, and some services continued through backup procedures with delays. Emergency calls to 911 remained available. On July 22, several systems were still offline for forensic analysis. Milford did not disclose the actor, attack method, malware or ransomware involvement, a ransom demand, encryption, or data theft. Earlier warnings about an internet-accessible town storage system were not publicly linked to this incident.
Stadler Rail AG
July 15, 2026
•[ ransomware, technology, manufacturing ]
In mid-July, attackers used compromised credentials to access a data-exchange platform shared with a Stadler supplier and stole technical information belonging to that supplier. Everest demanded CHF 10 million from Stadler, which refused to pay and filed a criminal complaint. Stadler confirmed that its internal IT systems, production sites, and in-service rail vehicles were unaffected and that no relevant personal data was stolen. The precise intrusion date was not disclosed; 15 July is used as the approximate midpoint of the reported period.
WebHot ApS
July 15, 2026
•[ ransomware, technology ]
WebHot ApS took all systems offline on July 15, 2026, after ransomware encrypted nearly every system within minutes. Investigators concluded that normal recovery was impossible, forcing the Danish hosting provider to rebuild its environment from scratch. Email service resumed on July 17 at 15:22, but all customer email predating restoration was permanently lost and users had to recreate their accounts. No data exfiltration or responsible group was reported.
Oklahoma Manufacturing Alliance
July 15, 2026
•[ ransomware, manufacturing, technology ]
On July 15, 2026, ransomware activity affected two employee computers at the Oklahoma Manufacturing Alliance and disrupted access to part of its local network. Staff isolated the affected devices and restored access through a separate secure network later that morning. Booba Project subsequently listed the alliance as a victim on July 28 and claimed theft of 10 GB of data, but the organization reported finding no evidence of removed information or compromised client records. The attacker and encryption behavior have not been independently verified.
Fairlife, LLC (Coca-Cola subsidiary)
July 16, 2026
•[ ransomware, manufacturing, technology ]
Fairlife identified unauthorized third-party access to a portion of its systems, including production-related systems, in connection with a ransomware event. The incident temporarily suspended production at all four U.S. facilities. Coca-Cola confirmed that certain data was taken, while Anubis claimed it had locked servers and stolen 1 TB of confidential information. By July 27, most U.S. production had resumed. Canadian production, product quality and safety, and retail availability were largely unaffected.
