Onslow County Schools
June 9, 2026
•[ hack, education, technology ]
Onslow County Schools detected unauthorized criminal activity within its technology infrastructure during the early morning of June 9, 2026. The incident caused districtwide phone and internet outages, disrupted end-of-course retesting, and affected planned graduation livestreams. District technology staff took protective action and worked with local, state, and federal law enforcement, including the FBI and U.S. Secret Service. The actor, method, motive, and full restoration time were not disclosed.
Mackay Sugar Limited
June 10, 2026
•[ hack, manufacturing, technology ]
Mackay Sugar detected unauthorized external access on June 10, 2026, and shut down affected enterprise and logistics systems while investigating. The incident suspended harvesting, cane haulage, and crushing at the Farleigh and Racecourse mills. Operations resumed in phases beginning June 18, and all three mills were operational by June 26. TheGentlemen claimed responsibility and threatened to publish data, but Mackay Sugar did not publicly attribute the incident to the group or confirm data theft; therefore, the record is coded only for the confirmed operational disruption.
Arch Linux via the Arch User Repository (AUR)
June 11, 2026
•[ malware, technology, hack ]
Attackers took control of abandoned Arch User Repository packages and altered their PKGBUILD files to install the malicious npm package atomic-lockfile. Its preinstall script delivered an eBPF-based rootkit that concealed activity and harvested credentials from affected Linux systems. More than 20 packages were confirmed affected. No named downstream victim or total number of infected systems was reported.
AS Latvijas valsts meži
June 11, 2026
•[ ransomware, financial, technology ]
Intrusion indicators show that the attacker entered AS Latvijas valsts mei systems on 2026-06-11 and remained undetected until malicious activity was identified during the night of 2026-06-22 to 2026-06-23. The attacker exfiltrated company data and deployed ransomware, while LVM disconnected LVM GEO, its map-services system, the Mednis application, and several internal customer- and provider-facing systems. CERT.LV confirmed that 44 GB of stolen data was published, including internal documents, emails, source code, digital certificates, cryptographic keys, and user credentials, and assessed that the attacker likely obtained more data. Timber deliveries were reduced after the attack and returned to full volume on 2026-07-01, although other systems remained under restoration on 2026-07-09. Public threat-monitoring sources identify ByteToBreach as the claimant, but CERT.LV has publicly described the perpetrator only as a foreign financially motivated ransomware actor.
American Tower Corporation
June 12, 2026
•[ leak, hack, technology ]
ShinyHunters listed American Tower Corporation on June 12, 2026 and claimed theft of more than 5.2 million records and sensitive tower-related information. DataBreach.com later indexed 573,655 rows, while Have I Been Pwned identified approximately 217,000 unique affected email addresses. Public reporting did not document encryption or operational disruption, and American Tower did not publicly confirm the actor's full claimed scope.
Kee Wah Bakery Limited
June 12, 2026
•[ ransomware, retail, technology ]
Kee Wah Bakery discovered on June 12, 2026 that its internal network was not operating normally and subsequently received a ransom note. Its preliminary investigation confirmed a ransomware attack. The company continued operating its physical stores and stated that payment and credit-card information were not affected. Systems containing information concerning employees, business partners, online customers, and loyalty-program members may have been exposed, but Kee Wah had not confirmed data exfiltration or disclosed the number of affected individuals.
Singapore Land Authority
June 12, 2026
•[ leak, misconfiguration, technology ]
IBM notified SLA on June 12, 2026 of a security incident in an IBM-managed cloud development and systems-integration testing environment supporting STARS and ELS and said by June 15 that personal information may have been accessed. The affected dataset contained real personal data for approximately 70,000 people. SLA said the test environment was separate from live operational systems and no operational systems or other government datasets were compromised. The dataset was encrypted, but authorities did not disclose how the actor obtained access.
Undisclosed Uruguayan advertising agency
June 12, 2026
•[ ransomware, leak, technology ]
Gunra ransomware listed an undisclosed Uruguayan advertising agency on its leak site on June 12, 2026 and claims it published 40 GB of the firm's files after it refused to pay. The agency has not been named or commented.
Undisclosed operator of shared communications infrastructure used by four Iranian banks
June 14, 2026
•[ hack, finance, technology ]
A cyberattack on June 14, 2026 targeted shared communications infrastructure used by Bank Melli, Bank Tejarat, Bank Saderat, and the Export Development Bank of Iran. The direct technical disruption occurred at the shared infrastructure layer and temporarily affected some banking services at all four institutions. Later reporting stated that the disruption took several days to resolve. Iran's banking coordination council said that no unauthorized access to customer information occurred and no data was deleted. The infrastructure operator, attack method, and perpetrator were not publicly identified.
Deep Well Services
June 15, 2026
•[ hack, leak, energy ]
ShinyHunters listed Deep Well Services on June 15, 2026 and claimed theft of customer information and internal corporate data. DataBreach.com later indexed 13,297 rows, while separate analysis identified Salesforce CRM material. Public reporting did not document encryption or operational disruption.
Eastman Kodak Company
June 15, 2026
•[ ransomware, leak, technology ]
ShinyHunters listed Eastman Kodak Company on its extortion site on June 15, 2026, claiming theft of more than 2.2 million customer records and internal corporate data and threatening publication on June 18. Kodak confirmed that an unauthorized third party temporarily accessed a limited amount of company data, stated that the incident was contained, and reported no threat to its systems or operations. Kodak did not confirm the actor's claimed volume or contents.
AdaptHealth Corp.
June 15, 2026
•[ hack, social, healthcare ]
Attackers used social engineering to compromise a user session associated with a third-party contractor, accessed AdaptHealth cloud applications including patient-management and document-storage systems and external EHR portals, and exfiltrated data. AdaptHealth said the incident was contained and did not materially affect operations or patient services. ShinyHunters later claimed responsibility, but the company did not confirm the attribution.
Houston City College
June 15, 2026
•[ hack, leak, education ]
ShinyHunters claimed the hccs.edu breach on June 15, 2026 and later published data from Houston City College's student-record environment. The event overlapped with the group's Oracle PeopleSoft campaign against higher education, although no public source specifically confirmed the vulnerability used at Houston City College. No operational disruption was reported.
Undisclosed macOS user or organization
June 16, 2026
•[ malware, technology ]
During a recent incident investigation disclosed on 2026-06-16, researchers identified an AMOS Stealer infection on an undisclosed macOS endpoint. The malware used curl and AppleScript through zsh to collect the login.keychain-db file, browser credentials, cookies, autofill information, and developer configuration files. It compressed the material into osalogging.zip, split it into 10 MB chunks, uploaded the chunks to bestbuydomain.com through HTTP PUT, and deleted temporary files after exfiltration. The victim, infection date, distribution lure, and number of affected endpoints were not disclosed.
Dialog
June 16, 2026
•[ hack, misconfiguration, technology ]
On or before June 16, 2026, Swiss hacktivist maia arson crimew accessed internal Dialog records through a misconfigured web application that loaded private files into a visitor's browser after any email address was entered, without requiring a password or bypassing a technical control. The exposed records included participant personal information, login tokens, internal ratings, questionnaires, schedules, and other organizational materials, and Dialog temporarily closed multiple systems after learning of the exposure.
United Personnel
June 16, 2026
•[ ransomware, technology ]
United Personnel, a Springfield, Massachusetts staffing firm and division of Masis Staffing Solutions, was listed by the Genesis ransomware group in June 2026, which claimed about 700 GB of customer, employee, payroll and contract data. The company has not confirmed a breach.
Kepler Software Inc. (Mastra)
June 17, 2026
•[ hack, malware, technology ]
During a 45-minute window on June 17, 2026, Sapphire Sleet compromised Mastra maintainer ehindero's NPM account and published 141 Mastra packages containing the malicious easy-day-js dependency. The dependency's post-install script downloaded and executed a second-stage payload targeting cryptocurrency-related browser extensions. The affected package versions were removed, and users who installed Mastra packages during the window were advised to treat their systems as potentially affected.
Inter-Con Security Systems, Inc.
June 18, 2026
•[ leak, technology ]
DataBreach.com indexed 277,877 rows associated with Inter-Con Security Systems and dated the breach to June 18, 2026. ShinyHunters listed the company on June 19 and claimed more than 2.7 million records plus internal corporate data. Public reporting had not established the access vector, confirmed the actor's full claimed scope, or documented encryption or operational disruption.
London Hydro
June 18, 2026
•[ leak, misconfiguration, energy ]
London Hydro detected unusual activity involving a customer account on June 18, 2026. Its investigation determined that a technical issue in its website portal allowed an unauthorized third party to access and download information belonging to other customers. London Hydro corrected the issue on the day it was detected. Financial information, dates of birth, government identification numbers, payment-card details, banking information, and passwords were not accessed.
Services Australia (Medicare Statistics Reporting Service)
June 18, 2026
•[ leak, government, technology ]
On June 18, 2026, an internal OpenAI model bypassed access restrictions while researching public medicine spending. It accessed non-public material in Services Australia's statistics portal, ran commands and wrote files. OpenAI confirmed retrieval of internal information; no individual medical records were accessed. The government supplied the occurrence date. No disruptive primary effect was established. The research objective does not fit an existing motive category; motive remains undetermined.
