#databreach

The INC_RANSOM ransomware group has listed Golden Glasko Haddy and Associates, a Miami-based law firm, as a victim on its dark web leak site. The posting, which appeared on July 14, 2026, is part of a double-extortion campaign where the attackers claim to have stolen internal files and threaten to release them to pressure the firm into paying a ransom. The firm, which specializes in estate and probate law, has not yet commented on the attack or the potential exposure of sensitive client data.

Deutsche Bank has acknowledged a cybersecurity incident at a third-party service provider following claims from the 'Unsafe' ransomware group. The group posted data on its leak site allegedly stolen from the bank, including employee records. Deutsche Bank asserts that its own internal systems were not compromised and that the incident was contained to an external marketing vendor in Germany. The event highlights the significant supply chain risks facing large financial institutions.

The Chaos ransomware group has claimed an attack on Aphena Pharma Solutions, a U.S.-based pharmaceutical contract manufacturer. The group listed the company on its dark web leak site on July 14, 2026, alleging the theft of 142 GB of 'critical corporate data,' including sensitive financial documents. The attackers claim to have gained full access to the company's infrastructure, employing a double-extortion strategy by threatening to leak the stolen information.

Insurance provider AssuranceAmerica has disclosed a data breach that exposed the personal information of approximately 6.9 million people. The incident, which occurred in March 2026, resulted from an attack targeting an employee. An unauthorized party gained access to the company's IT systems and copied files containing names, driver's license numbers, and, for some, Social Security numbers. The company is now notifying affected individuals and offering credit monitoring services.

The Akira ransomware group has claimed responsibility for a cyberattack on Ironmark, a U.S.-based marketing and communications provider. On July 13, 2026, the group added Ironmark to its dark web leak site, threatening to release 190GB of stolen data. The compromised information allegedly includes sensitive employee PII such as passports, as well as corporate financial records, client contracts, and NDAs. This attack is consistent with Akira's typical double-extortion strategy of encrypting data while also exfiltrating it to pressure victims into paying a ransom.

Dutch law enforcement suspects local criminals were behind a recent data breach at Odido, a major telecommunications provider in the Netherlands. The attack exposed the personal data of approximately six million customers. The breach was initiated through a phishing attack, where a Dutch-speaking individual impersonated an IT employee over the phone to gain initial access to a customer contact system. While Odido states that sensitive data like passwords, financial details, and call logs were not compromised, the exposed information could still be used for further phishing and fraud. The Dutch High Tech Crime Team is investigating and has urged the impersonator to come forward.

Global professional services firm Ernst & Young (EY) has disclosed a data breach that occurred via a compromised third-party IT service management platform. Between March and April 2026, an unauthorized actor gained access to the system and downloaded documents containing sensitive personal and financial data from client tax support tickets. EY has secured the platform and notified authorities, but the full number of affected clients has not been disclosed.

Genetic testing company 23andMe has agreed to an $18 million bankruptcy settlement with 43 U.S. states, including Pennsylvania, over a massive data breach discovered in October 2023. The breach, which impacted nearly 7 million customers, was attributed to credential stuffing attacks that succeeded due to poor security practices, such as a lack of mandatory multi-factor authentication (MFA). The settlement holds the company accountable for its security failures.

Following a significant data exfiltration incident in June 2026 claimed by the 'World Leaks' ransomware group, Tata Electronics has implemented most of the cybersecurity controls recommended by incident response firm Mandiant. The attack resulted in the theft of over 200,000 files, including sensitive materials related to major clients like Apple and Tesla, highlighting the supply chain risks in the global electronics manufacturing ecosystem.

The 'World Leaks' ransomware group has leaked 14.3 GB of files allegedly stolen from Reliance Group, a contractor for India's Kudankulam Nuclear Power Plant (KKNPP). The data, posted on the dark web, includes purported blueprints, supplier lists, and equipment reviews. Reliance Group confirmed a 'partial breach' on a server hosted by a third-party data center. While there is no evidence the plant's operational networks were breached, the incident exposes sensitive engineering data that could be used to plan future attacks against the critical infrastructure facility.

A new study from Comparitech reveals a troubling trend: government organizations were successfully attacked by ransomware at an average rate of one per day in the first half of 2026. The 187 documented attacks mark a 13% increase from the latter half of 2025. The United States was the most frequent target, accounting for 31% of incidents. The report highlights the significant disruption to public services and data breaches resulting from these attacks, with groups like The Gentlemen, Qilin, and LockBit being the most active.

The Nightspire ransomware group has added Cedar Crest College, a private liberal arts college in Pennsylvania, to its dark web data leak site. The listing appeared on July 14, 2026, with the attack estimated to have occurred a day prior. The group has not yet released any details about the type or volume of data allegedly stolen in the attack. The incident highlights the persistent threat of ransomware targeting the education sector.