🏛️ Government & Public Sector

Federal/state/local government, law enforcement, NGOs and nonprofits · a shareable slice of the daily brief for stakeholders who only care about this industry · RSS feed

Victims L30D3▼ −7

Prior 30D10

Active actor L90DUnknown · 4

Active actor L90DShinyHunters · 4

Active actor L90DQilin · 3

Today — 03 Nov 2026

No industry-tagged items in today's briefing — see recent activity below.

Last 14 days

DHS employee/contractor data on 40,000+ staff published by leak site DDoSecrets — sourcing claim disputed by Okta.HighGovernment & Public SectorReported Oct 28 (Reuters, CyberScoop): names, phone numbers, emails, job titles and internal distribution-list membership (including special-ops/surveillance/forensics/undercover group names) for DHS staff across ICE, CBP, HSI and CISA. Headcount estimates range 40,000–42,000 depending on outlet. A group calling itself "Department of Peace" claims it sourced the data by compromising DHS's Okta single sign-on service; Okta denies any compromise of its own systems or data. Reuters independently matched six named employees' details to credit-bureau/breach records and confirmed phone numbers for three more by calling them directly, but could not verify the Okta-sourcing claim itself. DHS has not commented. CyberScoop

City of Columbia, South Carolina confirms ransomware attack; core public-safety services unaffected.HighGovernment & Public SectorThe city manager confirmed ransomware Oct 20 after IT staff flagged suspicious activity; the SC Law Enforcement Division is investigating. Affected: the MyColaSC app, GIS/mapping tools, parks & rec reservations, and Animal Services online payments. Police, fire, 911 dispatch, Columbia Water and general bill-pay are unaffected. No data-exposure scope confirmed yet; no group has claimed responsibility. WACH Fox57 · WIS-TV

A forensic review widens the UK Legal Aid Agency's April 2025 breach to records dating back to 1978, with roughly 250,000 predating 2007 — a catch-up update to an already-tracked incident, not a new attack.MediumGovernment & Public SectorNames, addresses, dates of birth, National Insurance numbers and financial/legal-proceedings details are affected; the Ministry of Justice says it has no evidence the data has been published or sold and won't negotiate with the extortionists. The group calling itself ShinyHunters claimed the original attack, a claim the MoJ has not verified. SecurityWeek · SC World

Recent victim claims

Newest first, mapped to this industry from the victim database. Most are leak-site claims — verify before acting.

October 2026

Oct 20 City of Columbia, South Carolina Unknown Ransomware · municipal government · USA Confirmed ransomware attack; IT staff flagged suspicious activity Oct 20, city manager confirmed ransomware, SC Law Enforcement Division (SLED) investigating. Affected: MyColaSC app, GIS/mapping tools, parks & rec reservations, Animal Services online payments. Unaffected: police, fire, 911 dispatch, Columbia Water, general bill-pay. No data-exposure scope confirmed; no group has claimed responsibility. · Sources: WACH Fox57 · WIS-TV

Oct 19 Legal Aid Agency (UK) ShinyHunters Extortion · government · GBR A forensic-review update on the agency's April 2025 breach (first disclosed May 2025) finds compromised records date back to 1978, with roughly 250,000 of them predating 2007; most of the exposed material covers legal-aid applications, claims and payments from 2007-2025. Names, addresses, dates of birth, National Insurance numbers and financial/legal-proceedings details are affected. The Ministry of Justice says it has no evidence the data has been published or sold and will not negotiate with the extortionists; the group calling itself ShinyHunters publicly claimed the original attack, a claim the MoJ has not verified. · Sources: SecurityWeek · SC World

Oct 05 Denmark Central Person Register (CPR) Unknown Ransomware · Government · Denmark Unidentified parties misused a private Danish company's legitimate API access to the national CPR population register, running large-scale automated searches through September to enumerate valid CPR numbers and pull linked names/addresses; ~8.8M people affected (current/former residents plus deceased). People under name/address protection were excluded. Irregular activity first noticed Oct 2; company's CPR access revoked, Datatilsynet notified, police investigating, Digitalization Minister ordered a full security review. Government-confirmed, no attacker identified. · Sources: BleepingComputer · Cybernews · The Record

Oct 02 Step By Step Storm Ransomware · nonprofit · USA Pennsylvania-based nonprofit; claim listed, no scope disclosed, no confirmation. · Sources: GalaxyWarden

September 2026

Sep 30 Arizona Judicial Branch Unknown Ransomware · Government · USA Phishing-delivered intrusion into Supreme Court IT hit FARE (fines/restitution payment system, ~1.3M SSNs/debt records back ~30yrs), the Foster Care Review Board (150,000+ reports since 2010) and protective-order records. Detected and contained within ~2 hours; court says no evidence yet data was viewed, shared or altered. FBI investigating. · Sources: AP via KJZZ · Malwarebytes

Sep 28 Manno (Ticino municipality, manno.ch) Safepay Ransomware · Government · Switzerland Official website of the municipality of Manno, Ticino, listed on Safepay's leak site -- an unusual target class (municipal government site, not a company). Unverified claim, no confirmation from the municipality. · Sources: Ransomware.live

Sep 28 Arnold Center Qilin Ransomware · Nonprofit · USA Michigan-based community rehabilitation nonprofit (disability employment, ABA/autism, residential/vocational services) listed on Qilin's leak site claiming encryption plus data theft -- notable target class (social-services nonprofit handling sensitive client data), not this group's typical profile. Unverified claim, no company confirmation. · Sources: Ransomware.live · DeXpose

Sep 24 Defense Manpower Data Center (DMDC) Unattributed Breach · government · USA Unauthorized access to the Pentagon's core personnel-records system from roughly October 2025 to July 16, 2026, discovery date; exposed unencrypted Social Security numbers plus at least one other identifier (name, DOB, contact info, sex, race or military occupational specialty) for current/former DoD personnel. Individual notification letters sent Sep 18, 2026; DoD says it has no indication of data misuse so far. Military Times reports approximately 4 million DoD personnel affected (DMDC holds 60M+ total records); no attacker named -- this reads as a security-lapse disclosure, not a claimed extortion incident. · Sources: Military Times · CNN

Sep 22 FBI ShinyHunters Extortion · Government · USA ShinyHunters claims 2-3TB of current/former-employee and applicant data exfiltrated via a claimed Oracle PeopleSoft zero-day (no CVE assigned), in stated retaliation for a May 2026 FBI bulletin detailing the group's tactics; demand is retraction of the bulletin, not payment. FBI says only that it is investigating claims affecting FBIjobs.gov; not confirmed. · Sources: BleepingComputer · Nextgov/FCW

Sep 18 Ministry of Education (Argentina) N0n Ransomware · Government · Argentina N0n claims network-security configuration plus 1.08M connection records tied to national library, school-book selection, scholarship and credential-validation systems, and evidence of a Monero miner inside the network; unverified DLS claim · Sources: https://www.redpacketsecurity.com/n0n-ransomware-victim-ministry-of-education-argentina/

Sep 16 Florida Department of Highway Safety and Motor Vehicles ShinyHunters Extortion · Government / Motor Vehicles · USA ShinyHunters listed the Florida DMV's DAVID database on its leak site Sep 7 with an extortion demand, claiming access via a password-reset flaw that compromised multiple accounts including ones reportedly belonging to DMV employees and an FBI agent. After Florida did not pay, ShinyHunters published files online Sep 16 claiming over 200,000 driver records including Social Security numbers, including a screenshot of Jeffrey Epstein's DMV record as proof. FLHSMV confirmed it is investigating a data breach; the leaked-data claims themselves remain unconfirmed by the agency. · Sources: BleepingComputer · TechCrunch

Sep 11 Agencia Estatal de Meteorología (AEMET) Panzer Ransomware · government · Spain Panzer, a newly observed RaaS operation running since Aug 5 2026 with 16-21 claimed victims across 11 countries in its first month, lists Spain's national meteorological agency, claiming roughly 5GB exfiltrated with a 20-21 day publication deadline. No agency confirmation yet; verify before treating as a breach. · Sources: EscudoDigital · Ransomware.live

Sep 08 Florida DAVID (Highway Safety and Motor Vehicles) ShinyHunters Extortion · Government · USA ShinyHunters claims access to Florida's DAVID driver/vehicle lookup database via a password-reset flaw compromising DMV-employee and FBI-agent accounts; ~200,000 driver records allegedly pulled by iterating IDs starting around Sep 3. Proof includes a screenshot of Jeffrey Epstein's DMV record. Verify before treating as a confirmed breach — FLHSMV has not confirmed the claim; leak-site deadline set for Sep 11. · Sources: https://www.bleepingcomputer.com/news/security/shinyhunters-hackers-claim-breach-of-florida-david-dmv-database/

Sep 04 Berlin Senate (urban development, transport, environment departments) Rhysida Ransomware · government · DE 5.79 TB / 1.44M files published to dark web after Berlin refused 30 BTC ransom. Data includes critical infrastructure blueprints for Berlin water/power grids, police/LKA files, Bundeswehr documents, federal defense communication plans, CBRN threat assessments, 12,000+ personnel records. Exfiltration Aug 7-12; detection Aug 14; auction countdown ended Sep 4; data dumped Sep 4-5. 13 days before Sep 20 state election. · Sources: https://cybernews.com/news/stolen-berlin-government-files-dumped-on-dark-web-rhysida/ https://www.bankinfosecurity.com/berlin-rejects-rhysida-ransomware-blackmail-a-32731

August 2026

Aug 30 AFSARD Qilin Ransomware · Government · GBR Qilin ransomware DLS claim posted August 30 2026. Organization based in Milton Keynes UK. Attack date not confirmed. · Sources: https://www.hookphish.com/blog/ransomware-group-qilin-hits-afsard/

Aug 28 Berlin State Government (Senate Department for Mobility and Environment) Rhysida Ransomware · Government · DEU Rhysida DLS claim Aug 28, 2026: 5.79TB exfiltrated Aug 7-12 from Berlin's Senate Department for Mobility, Transport, Climate Protection and Environment; 80K administrative offence proceedings and 46.5K contracts claimed; 30 BTC ransom demand (approx EUR 2M); Berlin refuses to pay; auction countdown started Aug 28; September 20 Abgeordnetenhaus election context; Interior Senator says election data not affected · Sources: https://thehackernews.com/2026/08/berlin-refuses-to-pay-hackers-who-stole.html

Aug 26 Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) Qilin Ransomware · Government & Defense · USA Qilin posted ATF (atf.gov) to DLS Aug 26. ATF confirmed 'major cybersecurity incident' on a standalone system isolated from enterprise network. DOJ designated it a major incident under federal guidelines. No data samples published by Qilin. Standalone system; eForms and enterprise network unaffected. · Sources: https://cybernews.com/news/qilin-ransomware-bureau-alcohol-tobacco-firearms-atf-cyberattack/

Aug 14 Direction Generale des Finances Publiques (DGFiP) ZeroBytes (individual threat actor) Ransomware · Government / Tax Administration · FRA Hacker using alias ZeroBytes gained access via stolen internal VPN credentials in late June 2026; exfiltrated records of 678,000 individuals and businesses (names, reference income data, tax rates) in first breach (June); second theft (July) took 200,000 land-registry account details. DGFiP confirmed breach Aug 12 after ZeroBytes posted claim publicly. Data exposure creates targeted physical-robbery risk for high-income crypto holders in France given 30 violent wrench attacks in H1 2026. · Sources: https://therecord.media/french-tax-authority-dgfip-confirms-data-breach

Aug 11 Pennsylvania Attorney General's Office Unknown Ransomware · Government · US Ransomware attack struck communications systems; 1,200 staff affected; courts granted case extensions; recovery ongoing August 11 · Sources: https://therecord.media/pennsylvania-attorney-general-office-ransomware-attack-recovery

Aug 11 Otter Tail County INC Ransom Ransomware · Government · USA INC Ransom DLS claim posted August 17, 2026; attack estimated August 11. County government (population ~60,000, west-central Minnesota). Scope unconfirmed. · Sources: https://www.ransomware.live/id/T3R0ZXIgVGFpbCBDb3VudHksIE1pbm5lc290YUBpbmNyYW5zb20=

Aug 10 Canopy Support Services The Gentlemen Ransomware · Nonprofit · CA TheGentlemen DLS posting August 10, 2026; Canadian nonprofit; data scope unconfirmed · Sources: https://www.ransomware.live/

July 2026

Jul 30 Malaysian Nuclear Agency The Gentlemen Ransomware · government / nuclear research · Malaysia TheGentlemen DLS claim July 30, 2026; Malaysian government nuclear research and technology organisation; data scope and impact unconfirmed; 🟥 unverified · Sources: https://www.breachsense.com/breaches/ · https://www.ransomware.live/

Jul 29 Administratia Nationala a Penitenciarelor (ANP) Unknown Ransomware · Government · RO Romanian National Prison Administration posted to DLS July 29; group unconfirmed; data scope unknown · Sources: https://www.ransomware.live/

Jul 28 Swiss Federal IT Office (FOITT/BIT) Unknown Ransomware · Government · CHE SharePoint exploitation chain (CVE-2026-55040 JWT bypass + CVE-2026-56164 EoP); ~200 user and technical accounts compromised; attack detected July 28, external access blocked, passwords reset, servers being rebuilt; no confirmed data exfiltration beyond compromised credentials; attackers described as previously unknown · Sources: https://www.bleepingcomputer.com/news/security/swiss-government-sharepoint-breach-compromised-200-accounts/

Jul 26 UK Police National Legal Database (PNLD) ExfilSquad Ransomware · Law Enforcement / Government · UK Attack detected July 26 2026; PNLD confirmed breach; ExfilSquad claims 135,000 contact records of UK police officers, criminal justice staff, and government partners (names, organisations, email addresses); 14 total ExfilSquad victims across 5 countries in this wave; exposure of officers in sensitive investigations is primary concern · Sources: https://www.bleepingcomputer.com/news/security/exfilsquad-hackers-leak-info-of-over-100-000-uk-police-officers-staff/amp/ https://thehackernews.com/2026/08/pnld-breach-exposes-uk-police-and.html

Jul 25 Traffic Control and Road Safety Services Qilin Ransomware · Government/Transportation · Unknown DLS posting July 25 2026 by Qilin. Sector and country unconfirmed from snippets. · Sources: https://www.ransomware.live/

Jul 25 Plitvicka Jezera Nacionalni Park Qilin Ransomware · Tourism/Government · HR Plitvice Lakes National Park (Croatia), UNESCO World Heritage Site. DLS posting July 25 2026 by Qilin. Data scope unconfirmed. · Sources: https://www.ransomware.live/

Jul 22 South Korean National Diplomatic Academy Unattributed (suspected DPRK) Ransomware · government · KR South Korean Ministry of Foreign Affairs diplomatic training academy compromised; ~10,000 current and former diplomat records exfiltrated (names, IDs, email, encrypted passwords, job titles, affiliations); dwell time ~9-10 months (Apr/May 2025 – Feb 2026); zero-day + misconfigured security settings; South Korean officials describe exfiltration scope as 'unprecedented'; North Korean link under investigation; 🟨 attribution unverified · Sources: https://therecord.media/south-korea-cyberattack-foreign-ministry

Jul 19 Dephub Nova Ransomware · government (transportation/ports authority) · Indonesia Nova DLS posting July 19; Indonesian government transportation and ports authority entity; data claimed exfiltrated; unverified — no public statement from Dephub · Sources: https://www.ransomware.live

Jul 15 BRAC The Gentlemen Ransomware · Humanitarian/NGO · Bangladesh World's largest NGO listed on The Gentlemen DLS July 15; no public statement from BRAC. Unverified claim. · Sources: https://www.ransomware.live/group/the-gentlemen

Jul 10 Commune de Castries Payload Ransomware · municipal government · France French municipality (Castries, Hérault); Payload DLS claim July 10, 2026; data scope and impact unconfirmed; 🟥 unverified · https://www.ransomware.live/group/payload · Sources: [ransomware.live]

Jul 10 Envision Unlimited MoneyMessage Ransomware · nonprofit · human services/US Chicago-based nonprofit providing residential, day, and community-based services for adults with intellectual and developmental disabilities; MoneyMessage DLS claim July 10, 2026; data scope and impact unconfirmed; 🟥 unverified · https://www.ransomware.live/group/moneymessage · Sources: [ransomware.live]

Jul 09 Greene County Government (GA) Incrandom Ransomware · Government · US Greene County Georgia government; county servers taken offline after incident detected July 9 2026; Incrandom DLS posting July 28 2026; data scope unconfirmed; 🟥 unverified DLS claim · Sources: https://hoodline.com/2026/07/cyber-scare-knocks-greene-county-computers-offline/

Jul 09 Canadian Armed Forces (forces.gc.ca) Bavaqai Ransomware · Government / Defense · CAN Bavaqai (MedusaLocker/BAVACAI variant) listed the Canadian Armed Forces domain forces.gc.ca on its 'File Manager' DLS on approximately July 9 2026. Some tracker feeds index this under the medusalocker group slug. DLS claim — scope and exfiltrated data not confirmed. · Sources: https://socradar.io/data-breach/forces-medusalocker-ransomware-2026/

Jul 07 YMCA of Western North Carolina Interlock Ransomware · non-profit · community services/US Interlock DLS claim July 7, 2026; data scope and impact unconfirmed; 🟥 unverified · https://www.ransomware.live/group/interlock · Sources: [ransomware.live]

Jul 04 Goodwill Manasota Qilin Ransomware · nonprofit · thrift retail/US Qilin DLS claim July 4, 2026; data scope and impact unconfirmed; 🟥 unverified · https://www.ransomware.live/group/qilin · Sources: [ransomware.live]

Jul 04 US government entity Kairos Ransomware · government · US 2TB of sensitive records exfiltrated including SSNs, fingerprints, financial data, and passport scans; ~$1M (~9.44 BTC) ransom paid July 4, 2026 to prevent publication; victim identity not publicly disclosed; pure data-extortion model — no encryption, no operational disruption; 🟨 payment confirmed, victim identity unconfirmed · https://thehackernews.com/2026/07/us-government-entity-paid-kairos-group.html · https://securityaffairs.com/194750/security/u-s-government-agency-paid-1m-to-data-extortion-group-kairos.html · Sources: [The Hacker News] · [Security Affairs]

Jul 04 Edgewood Police Department Wallstreet Ransomware · government · law enforcement/US Edgewood Police Department, Pierce County, Washington; Wallstreet DLS claim July 4, 2026; law enforcement targeting during holiday window; data scope and impact unconfirmed; 🟥 unverified · https://www.ransomware.live/ · Sources: [ransomware.live]

Jul 03 Prince George County RansomHouse Ransomware · government · US Virginia county systems encrypted June 10 2026; phone, internet, and online payment systems disrupted; 911 unaffected; PII possibly exposed (names, addresses, DOBs, driver's licence numbers, SSNs); credit monitoring offered; FBI Cyber Crimes Division and CISA notified; RansomHouse claims encryption and posted evidence pack; county has not officially confirmed ransomware attribution or data theft; 🟥 unverified · https://www.wric.com/news/local-news/prince-george/county-government-cybersecurity-incident/ · https://www.govtech.com/security/prince-george-county-va-discloses-recent-cyber-attack · https://ransomware.live/id/UHJpbmNlIEdlb3JnZSBDb3VudHlAcmFuc29taG91c2U= · https://www.redpacketsecurity.com/ransomhouse-ransomware-victim-prince-george-county/ · Sources: [WRIC ABC 8News] · [GovTech] · [ransomware.live] · [RedPacket Security]

Jul 03 Oak Park INC Ransom Ransomware · local government · city/US Metro Detroit suburb in Oakland County; INC Ransom DLS claim July 3, 2026; attack estimated July 2, 2026; data scope and impact unconfirmed; 🟥 unverified · https://www.ransomware.live/group/incransom · Sources: [ransomware.live]

Jul 03 City of Acworth, Georgia INC Ransom Ransomware · local government · US suburban Atlanta city northwest of the city; INC Ransom DLS claim July 3, 2026; data scope and impact unconfirmed; 🟥 unverified · https://www.ransomware.live/group/incransom · Sources: [ransomware.live]

Jul 02 AWO Kreisverband Südost e.V. SafePay Ransomware · social welfare non-profit · Germany German social welfare organization; SafePay DLS claim July 2, 2026; data scope and impact unconfirmed; 🟥 unverified · https://www.ransomware.live/group/safepay · Sources: [ransomware.live]

Jul 02 COMHAR WorldLeaks Ransomware · health and human services non-profit · Ireland Irish non-profit providing community mental health, disability, and social services; WorldLeaks DLS claim July 2, 2026; data scope and impact unconfirmed; 🟥 unverified · https://www.ransomware.live/group/worldleaks · Sources: [ransomware.live]

Jul 01 Boyne City The Gentlemen Ransomware · local government · US City of Boyne City, northern Michigan municipality; The Gentlemen DLS claim July 1, 2026; data scope and impact unconfirmed; 🟥 unverified · https://www.breachsense.com/breaches/2026/july/ · Sources: [Breachsense]

Jul 01 Penticton and District Society for Community Living MedusaLocker Ransomware · nonprofit · disability services/Canada nonprofit organisation providing residential, employment, and social services for adults with developmental disabilities in the Penticton (BC) region; MedusaLocker DLS claim July 1, 2026; data scope and impact unconfirmed; 🟥 unverified · https://www.redpacketsecurity.com/medusalocker-ransomware-victim-penticton-and-district-society-for-community-living/ · https://ransomware.live/id/UGVudGljdG9uIGFuZCBEaXN0cmljdCBTb2NpZXR5IGZvciBDb21tdW5pdHkgTGl2aW5nQG1lZHVzYWxvY2tlcg== · Sources: [RedPacket Security] · [ransomware.live]

June 2026

Jun 26 NSW Rural Fire Service Nova Ransomware · government · emergency services/Australia New South Wales Rural Fire Service; Nova DLS claim June 26, 2026; 300 GB claimed; RFS confirmed the breach June 24 but stated emergency operations were unaffected; no evidence of operational impact · https://www.cyberdaily.au/security/13817-exclusive-nova-ransomware-group-takes-responsibility-for-nsw-rfs-hack · https://www.ransomware.live/group/nova · Sources: [Cyber Daily] · [ransomware.live]

Jun 26 Life Bridges INC Ransom Ransomware · non-profit · social services/US non-profit organisation supporting individuals with intellectual and developmental disabilities; INC Ransom DLS claim June 25-26, 2026; data scope and impact unconfirmed; 🟥 unverified · https://www.dexpose.io/incransom-targets-life-bridges-non-profit-in-ransomware-attack/ · https://www.breachsense.com/breaches/ · Sources: [DeXpose] · [Breachsense]

Jun 26 Policía de Turismo KRYBIT Ransomware · government · law enforcement/Dominican Republic Dominican Republic tourist police force; KRYBIT DLS claim June 26, 2026; data scope and impact unconfirmed; 🟥 unverified · https://www.breachsense.com/breaches/2026/june/ · Sources: [Breachsense]

Jun 24 mlit.com.my Stormous Ransomware · government · public sector/Malaysia DLS claim June 24, 2026; full 10GB data dump claimed including "highly sensitive internal information and financial records"; scope unconfirmed · https://www.redpacketsecurity.com/stormous-ransomware-victim-mlit-com-my-update-full-data-dump-new-link-10gb/ · Sources: [RedPacket Security]

Jun 23 Gov.br APT73 Ransomware · government · digital infrastructure/Brazil official state digital platform and domain zone of the Brazilian Federal Government claimed on DLS; impact scope unconfirmed; APT73 previously targeted siapenet.gov.br (April 2026) · https://www.blackfog.com/cybersecurity-101/apt73-ransomware-group/ · https://www.ransomware.live/group/apt73 · https://www.redpacketsecurity.com/apt73-ransomware-victim-www-siapenet-gov-br/ · Sources: [BlackFog] · [ransomware.live] · [RedPacket Security]

Jun 22 Royal Thai Navy Housing Cooperative The Gentlemen Ransomware · public sector · housing cooperative/Thailand cooperative managing housing projects, financial services, and welfare programs for Royal Thai Navy personnel and their families; The Gentlemen DLS claim June 22, 2026; data scope and impact unconfirmed; 🟥 unverified · https://www.redpacketsecurity.com/thegentlemen-ransomware-victim-royal-thai-navy-housing-cooperative/ · https://www.ransomware.live/group/thegentlemen · Sources: [RedPacket Security] · [ransomware.live]

Jun 21 Texas Parks and Wildlife Dept. Unattributed Breach · government · US 3,087,721 individuals exposed: driver's license numbers, passport numbers, email, phone, residential address; no SSNs/DOB/financial data; actor unattributed · https://www.techtimes.com/articles/318790/20260621/texas-data-breach-hits-3-million-drivers-licenses-passport-numbers-stolen-hunting-vendor.htm · Sources: [TechTimes]

Jun 17 SUNASS Nova Ransomware · government · water regulator/Peru Sources: ransomware.live DLS

Jun 16 Kedah State Government Nova Ransomware · government · Malaysia official state government portal providing public services for Kedah, Malaysia; Nova DLS claim June 16, 2026; estimated attack date June 16; data scope and impact unconfirmed · https://www.dexpose.io/nova-ransomware-group-targets-kedah-state-government/ · https://www.ransomware.live/id/S2VkYWhAbm92YQ== · Sources: [DeXpose] · [ransomware.live]

Jun 14 Council of Europe ShinyHunters Extortion · intergovernmental organisation · France 297 GB published June 16, 2026, after ransom deadline not met; content: 409,000+ payslips (2011–2026), 3,700+ personnel files, 14,000+ CVs, and employee personal/financial records (names, DOB, home addresses, phone, salaries, bank account details, SSN/tax information, medical records) for 10,000+ staff; claimed access vector: Oracle PeopleSoft CVE-2026-35273; Council of Europe states investigation is ongoing; data authenticity not yet independently verified by forensics · https://www.securityweek.com/shinyhunters-claims-council-of-europe-hack/ · https://www.bleepingcomputer.com/news/security/council-of-europe-investigates-shinyhunters-data-breach-claims/ · https://cybernews.com/security/council-of-europe-data-breach-claim/ · Sources: [SecurityWeek] · [BleepingComputer] · [Cybernews]

Jun 14 Winona County NightSpire Ransomware · government · US second ransomware attack on county in 2026; attack detected April 7; county network partially taken offline; MN National Guard assisted; NightSpire leaked data June 14 2026; county confirmed data leak same day; personal info affected pending review; 🟨 county-confirmed · https://www.govtech.com/security/cyber-criminals-leak-data-from-minnesota-ransomware-incident · https://www.dexpose.io/nightspire-ransomware-attack-on-k-county/ · Sources: [GovTech] · [DeXpose]

Jun 12 Blackbaud Icarus Ransomware · nonprofit · social-good CRM software/US Salesforce CRM data accessed via Klue OAuth integration; disclosed June 30, 2026; 🟨 scope unverified · Sources: [SecurityWeek]

Jun 11 National Association of Insurance Commissioners ShinyHunters Extortion · insurance regulatory · US 3.1TB and 105,000+ files claimed; investigation confirmed (July 1): only publicly available statutory financial reports, outdated logs, and config files accessed; key systems SERFF/OPTins/UCAA/EDP/RDC confirmed intact; no consumer PII or payment data; breach via PeopleSoft CVE-2026-35273, access June 11; data published online by June 25; 🟩 breach confirmed, impact minimal (public regulatory data only) · https://www.insurancejournal.com/news/national/2026/06/24/875119.htm · https://www.bleepingcomputer.com/news/security/naic-says-public-data-stolen-in-shinyhunters-peoplesoft-breach/ · https://www.techradar.com/pro/security/naic-confirms-data-breach-with-shinyhunters-claiming-3-1tb-of-data-stolen-in-oracle-zero-day-attack · Sources: [Insurance Journal] · [BleepingComputer] · [TechRadar]

Jun 09 Cal Fresh Termite Ransomware · government benefits · US Sources: ransomware.live DLS

Jun 09 Mid-Cumberland Human Resource Agency Insomnia Ransomware · public services · US Sources: ransomware.live DLS

---

← All industries · Victim database →