June 2026: Biggest Cyber Attacks, Data Breaches, Ransomware Attacks

From critical infrastructure to entertainment, the month’s most disruptive incidents targeted major global entities, including:

Pharmaceuticals & Electronics Manufacturing: Novo Nordisk and Tata Electronics
Higher Education & Public Institutions: The University of Nottingham and the Council of Europe
Gaming & Media Giants: Nintendo and Eastman Kodak
Government Systems & Public Utilities: Texas state government infrastructure and London Hydro
Healthcare Administration & Tech: Healthcare benefits administrator DentaQuest and market intelligence platform Klue

Inside This Month’s Cybersecurity Report

Ransomware Attacks in June 2026
Data Breaches in June 2026
Major Cyber Attacks in June 2026
Newly Discovered Malware & Ransomware
Critical Vulnerabilities and Security Patches Released
Cybersecurity Advisories, Threat Intelligence Reports & Industry Analysis

As organizations become increasingly dependent on cloud platforms, SaaS applications, hybrid infrastructure, and interconnected digital ecosystems, the business impact of cyber incidents continues to grow. The organizations that recover fastest are not necessarily those that avoid attacks altogether—they are the ones that have invested in preparation before an incident occurs.

Key Trends Defining the Current Threat Landscape

The data breaches, ransomware attacks, and newly discovered vulnerabilities of June 2026 underscore the systemic risks businesses face today:

The Weaponization of the Supply Chain: Attackers are increasingly bypassing front-line defenses by targeting interconnected third-party ecosystems and SaaS providers, creating massive downstream ripple effects.
Critical Infrastructure Exploitation: Public utilities and government frameworks remain high-value targets, where the primary objective is operational paralysis.
Exploitation of Zero-Day Vulnerabilities: The discovery of new malware strains and delayed security patches continues to give threat actors a window of opportunity to extract sensitive citizen, corporate, and patient data.

Ultimately, whether the target was intellectual property, manufacturing uptime, or consumer health records, the results remained identical: severe operational disruption and the rapid erosion of stakeholder trust.

Resilience Is Built Long Before the Attack

As organizations rely more heavily on cloud environments and distributed digital networks, the fallout from a single security breach escalates exponentially. The businesses that survive these incidents are rarely those that avoided being targeted—they are the ones that were systematically prepared.

True cyber resilience cannot be outsourced or automated at the last minute. It requires a deliberate, proactive foundation built on four core pillars:

A Robust Cyber Incident Response Plan: Eliminating guesswork so your technical teams can act instantly when every second counts.
Scenario-Specific Playbooks: Turning generic security theories into actionable, step-by-step technical procedures tailored to your highest-risk threats.
Cyber Tabletop Exercises: Pressure-testing your personnel in simulated, real-world conditions to build the necessary muscle memory for a real crisis.
Executive Crisis Training: Empowering the C-suite and board members to make decisive, legally sound, and strategic choices in the critical first hours of an active breach.

Cyber resilience begins with a comprehensive incident response strategy that enables teams to act quickly and confidently during a crisis. It is strengthened by detailed, scenario-specific response playbooks that provide clear guidance for different attack scenarios. Regular cyber tabletop exercises help security teams, business leaders, and executives practice coordinated decision-making in realistic situations, while executive crisis management training ensures leadership can make informed decisions when every minute matters. Together, these capabilities significantly improve an organization’s ability to prevent, detect, contain, respond to, and recover from cyberattacks. Start building cyber resilience today.

Ransomware Attacks in June 2026

Date	Victim	Summary	Threat Actor	Business Impact	Source Link
June 2, 2026	Potential enterprise and organisational networks using Active Directory environments	AI-Built Ransomware Toolkit Automates EDR Evasion, AD Discovery	Unknown	The AI-generated ransomware toolkit streamlined key attack stages by automating security evasion and network discovery tasks, potentially enabling attackers to compromise enterprise environments more quickly and efficiently.	Source: Bleeping Computer
June 3, 2026	Nobitex	The US Sanctions Nobitex Crypto Exchange Used by Ransomware	Multiple ransomware groups and cybercriminal actors (as cited by U.S. authorities)	The exchange allegedly facilitated financial transactions linked to ransomware operations and other cybercrime activities, helping threat actors move and launder proceeds obtained from attacks.	Nobitex Crypto Exchange Used by Ransomware
June 7, 2026	Law firms and legal organisations	Silent Ransom Group Targets Law Firms With Fake IT Support Calls	Silent Ransom Group (SRG)	The attackers used social engineering and fake IT support calls to gain access to law firm networks, steal sensitive legal data, and extort victims by threatening to leak the stolen information.	Source: Bleeping Computer
June 8, 2026	Organisations using vulnerable VPN appliances	Check Point links VPN zero-day attacks to Qilin Ransomware gang	Qilin Ransomware Gang	The attackers exploited a VPN zero-day vulnerability to gain unauthorised access to corporate networks, enabling them to deploy ransomware, disrupt operations, and increase the risk of data theft and extortion.	Source: Bleeping Computer
June 12, 2026	Multiple organisations targeted by the Conti ransomware operation	Ukrainian national pleads guilty to role in Conti Ransomware operation	Conti Ransomware Group	The Conti ransomware operation encrypted victims’ systems, disrupted business operations, and caused significant financial losses through extortion demands and recovery efforts.	Source: Bleeping Computer
June 16, 2026	Organisations targeted by the ransomware campaign	Ransomware gang abuses Microsoft Teams relays to hide malicious traffic	Storm-1175	The ransomware group concealed malicious communications through Microsoft Teams relays, helping attackers evade detection while gaining access to victim networks and increasing the risk of ransomware deployment and operational disruption.	Source: Bleeping Computer
June 18, 2026	Organisations targeted by the Gentlemen ransomware operation	Gentlemen Ransomware uses multiple EDR killers to disable defenses	Gentlemen Ransomware Group	The ransomware operators disabled endpoint security tools using multiple EDR-killing utilities before encrypting systems, increasing the likelihood of successful attacks, operational disruption, and financial losses for victims.	Source: Bleeping Computer
June 22, 2026	Multiple organisations and individuals (potential targets of the Prinz Eugen ransomware campaign)	New Prinz Eugen ransomware prioritises recent files for encryption	Prinz Eugen Ransomware Operators	The Prinz Eugen ransomware encrypted victims’ most recently modified files first, increasing operational disruption and pressure on organisations by immediately targeting the data most likely to be actively used and business-critical.	Source: Bleeping Computer
June 23, 2026	Bajaj Auto	Bajaj Auto says ransomware attack hits systems	Unknown	A ransomware attack disrupted parts of Bajaj Auto’s IT infrastructure, affecting certain business operations and prompting the company to implement containment measures while assessing the full impact of the incident.	Bajaj Auto Ransomware Attack

Data Breaches in June 2026

Date	Victim	Summary	Threat Actor	Business Impact	Source Link
June 4, 2026	World Food Programme (WFP)	UN Food Agency investigates Gaza Aid breach	Unknown	The breach exposed sensitive information linked to people receiving humanitarian assistance in Gaza, prompting an investigation into unauthorized access of WFP systems.	Gaza Aid Breach
June 4, 2026	DentaQuest customers and members	DentaQuest data breach exposed information of 2.6 million accounts	Unknown	Sensitive personal and health-related information of ~2.6 million individuals was exposed, increasing risks of identity theft and fraud.	Source: Bleeping Computer
June 8, 2026	Instagram users who contacted Meta AI support services	Meta AI Support data breach affects 20,000 Instagram accounts	Unknown	Support case data linked to ~20,000 Instagram users was exposed, potentially revealing private communications and personal details.	Source: Bleeping Computer
June 8, 2026	SoFi Hong Kong customers and applicants	SoFi confirms third-party data breach at Hong Kong subsidiary	Unknown	Personal data was exposed via a compromised third-party provider, increasing identity theft and fraud risk.	Source: Bleeping Computer
June 9, 2026	ServiceNow customers	ServiceNow discloses security incident exposing customer data	Unknown	Customer data stored in affected environments was exposed to unauthorized access.	Source: Bleeping Computer
June 11, 2026	Tchap users (French government employees)	French government messaging app Tchap suffers breach	Unknown	Hundreds of thousands of messages were allegedly stolen, raising concerns over government communication security.	French Government Messaging App Breach
June 11, 2026	Organisations using Oracle PeopleSoft	Oracle mitigates PeopleSoft zero-day exploited in data theft attacks	Unknown	Attackers exploited a zero-day vulnerability to steal sensitive enterprise data.	Source: Bleeping Computer
June 11, 2026	Novo Nordisk	Major hack and $25M extortion attempt claimed	Hunters International	Clinical trial and patient-related data was allegedly stolen, disrupting internal IT systems.	Source: Reuters
June 14, 2026	Four Iranian banks	Cyberattack disrupts banking services	Unknown	Temporary disruption of financial services across multiple banks.	Source: Reuters
June 15, 2026	REDCap servers (medical/research institutions)	Chinese hackers steal medical research data	Chinese state-backed hackers	Sensitive medical research data was exfiltrated from vulnerable systems.	Source: Bleeping Computer
June 15, 2026	Council of Europe	ShinyHunters claims data leak	ShinyHunters	Sensitive organisational data allegedly exposed and leaked.	Source: securityweek.com
June 16, 2026	iRhythm Technologies	Patient information stolen in cyberattack	Unknown	Unauthorized access led to exposure of sensitive patient healthcare data.	Source: Bleeping Computer
June 17, 2026	Online service users	24 billion credentials exposed in massive leak	Unknown	Billions of login credentials exposed, increasing risk of account takeover and identity theft.	24 Billion Credentials Leak
June 18, 2026	Texas Parks and Wildlife Department	Millions of IDs and passport numbers exposed	Unknown	Sensitive government-issued identification data was exposed in a breach.	Texas Parks & Wildlife Breach
June 18, 2026	Amazon One Medical	Patient data exposed	Unknown	Healthcare data exposure affecting patient privacy.	Source: cybernews.com
June 19, 2026	GrayRobinson	Cyberattack compromised personal data of 65,000+ people	Unknown	Sensitive personal and health data stolen from law firm systems.	GrayRobinson Breach
June 22, 2026	Optimum First Mortgage	Data breach exposes personal information	Unknown	Personal financial data exposed, increasing fraud risk.	Optimum First Mortgage Breach
June 22, 2026	Tata Electronics	Data breach and leak confirmed	Hunters International	Internal company data and documents were stolen and leaked.	Source: TechCrunch
June 22, 2026	London Hydro	Customer data potentially compromised	Unknown	Possible exposure of customer personal data following a security incident.	London Hydro Breach
June 22, 2026	Belgian State Security Service	Ivanti vulnerability exploited	Suspected Chinese state-backed hackers	Sensitive intelligence communications and personal data exposed.	Source: techzine.eu
June 22, 2026	Alcott HR	Data breach exposes employee information	Unknown	Employee and dependent data exposed, raising identity theft risks.	Source: globenewswire.com
June 22, 2026	XSOLIS, Inc.	Data breach investigation launched	Unknown	Sensitive personal data exposed from healthcare tech systems.	Source: prnewswire.com
June 23, 2026	Meta Employees	Internal monitoring data exposed	Unknown	Employee monitoring data and private communications were exposed internally.	Source: Reuters
June 23, 2026	LastPass	Supply chain attack via Klue	UNC6040	Limited customer and business data exposed via third-party compromise.	Source: Bleeping Computer
June 25, 2026	Alera Group	Data breach settlement announced	Unknown	Personal data exposed, leading to class-action settlement and fraud risk concerns.	Source: economictimes.indiatimes.com

Cyber Attacks in June 2026

Date	Victim	Summary	Threat Actor	Business Impact	Source Link
June 1, 2026	Multiple organisations across the United States, Israel, Turkey, and the Middle East	Iran-linked hackers allegedly destroy IT, backups, and recovery systems in cyber attack targeting Middle East	Ababil of Minab (Iran-linked, associated with Black Shadow)	The attack disrupted business operations after hackers wiped critical IT systems, backups, and recovery environments, significantly hindering victims’ ability to restore affected services and data.	Iran-linked hackers destroy IT, backups, and recovery systems
June 1, 2026	Thousands of legitimate websites and their visitors worldwide	Hackers hijack thousands of sites for ClickFix and FakeUpdate attacks	Unknown	The attackers hijacked thousands of websites and injected malicious code that redirected visitors to fake update and ClickFix pages, exposing them to malware infections and potential system compromise.	Source: Bleeping Computer
June 2, 2026	Minecraft players and server operators who downloaded infected game modifications and tools	Over 116,000 Minecraft systems infected in WeedHack malware campaign	Unknown	The malware campaign infected more than 116,000 Minecraft-related systems, allowing attackers to steal credentials, cryptocurrency wallets, authentication tokens, and other sensitive data from affected users.	Source: Bleeping Computer
June 2, 2026	WordPress websites using vulnerable themes and plugins that relied on the Kirki Customizer Framework	Critical Kirki Flaw Exploited to Hijack WordPress Admin Accounts	Unknown	Attackers exploited the critical Kirki vulnerability to create rogue administrator accounts on vulnerable WordPress sites, giving them unauthorised control over website management and content.	Source: Bleeping Computer
June 2, 2026	Russian government officials and employees of defense, telecommunications, law enforcement, and other public sector organisations	Russia claims foreign spy agencies hacked government officials	Alleged Foreign Intelligence Agencies (attribution claimed by Russian authorities)	The espionage campaign reportedly compromised the mobile devices of Russian government and public-sector officials, enabling attackers to monitor communications and gather sensitive information.	Source: The Record Media
June 3, 2026	Web servers and online services using vulnerable HTTP/2 implementations	New HTTP/2 Bomb DoS Attack Crashes Web Servers in Under a Minute	Unknown	The HTTP/2 Bomb attack overwhelmed vulnerable web servers with a small number of malicious requests, causing rapid service disruptions and making affected websites unavailable in under a minute.	Source: Bleeping Computer
June 3, 2026	Organisations across Europe, particularly in the technology, telecommunications, and government sectors	Chinese hackers use New Atlas RAT malware in European cyber attacks	Silver Fox (China-linked threat actor)	The attackers deployed the Atlas RAT malware to gain persistent remote access to targeted systems, enabling espionage activities, data collection, and continued monitoring of compromised networks.	Source: Bleeping Computer
June 4, 2026	Developers and organisations that downloaded the compromised npm packages	New IronWorm Malware Hits 36 Packages in npm supply chain attack	Unknown	The supply chain attack compromised 36 npm packages with IronWorm malware, exposing developers and organisations to credential theft, system compromise, and unauthorised access through infected software dependencies.	Source: Bleeping Computer
June 5, 2026	U.S. gas stations operating internet-exposed automatic tank gauge (ATG) systems	Over 900 US gas station tank gauge systems exposed to attacks	Unknown	More than 900 internet-accessible fuel tank monitoring systems were left vulnerable to unauthorised access, creating a risk of fuel management disruption, operational interference, and potential manipulation of critical infrastructure.	Source: Bleeping Computer
June 5, 2026	Organisations targeted by long-term cyber espionage campaigns, including government and enterprise networks	Chinese APT deploys new malware to keep access to hacked networks	Salt Typhoon (China-linked APT group)	The threat actors deployed new persistence malware to maintain covert access to compromised networks, enabling prolonged espionage activities and continued access to sensitive systems and data.	Source: Bleeping Computer
June 7, 2026	Internet-exposed routers running vulnerable DD-WRT firmware	c0xM0 Botnet Spreads via DD-WRT Router Flaw, Kills Rival Malware	c0xM0 Botnet Operators	The botnet infected vulnerable DD WRT routers to expand its malicious network, allowing attackers to control compromised devices and strengthen their infrastructure for future attacks.	Source: Bleeping Computer
June 8, 2026	Android users who downloaded fake banking application updates from GitHub	NFCShare Android malware spreads via fake banking app updates on GitHub	Unknown	The malware campaign infected Android devices through fake banking app updates, allowing attackers to steal banking credentials, intercept sensitive information, and conduct financial fraud against affected users.	Source: Bleeping Computer
June 10, 2026	Potentially any organisations and users that could be targeted using the leaked Miasma worm code	The Miasma Worm Source Code briefly leaked on GitHub	Unknown	The brief exposure of the Miasma worm source code increased the risk that other threat actors could reuse or modify the malware to launch new attacks, potentially expanding its impact across additional networks and systems.	Source: Bleeping Computer
June 13, 2026	A high-value organisation operating an isolated network	Chinese hackers hijack Auth Flow to spy on isolated network for a decade	Chinese state-backed hackers	The attackers maintained covert access to an isolated network for nearly a decade by hijacking authentication processes, enabling long-term espionage and the monitoring of sensitive communications and activities without detection.	Source: Bleeping Computer
June 15, 2026	Maine Attorney General’s data breach notification portal	Maine takes data breach notification portal offline after fake reports	Unknown	Attackers abused Maine’s data breach notification portal to submit fraudulent breach reports, forcing the state to take the system offline and disrupting its public breach disclosure process.	Source: cyberpress.org
June 16, 2026	Multiple cardiac monitoring device manufacturers and their patients	Cardiac Monitor makers’ security skips a beat as data thieves go for the jugular	Unknown	Data breaches at several cardiac monitoring device providers exposed sensitive patient and healthcare information, increasing the risk of privacy violations and misuse of personal medical data.	Data breaches at several cardiac monitoring device providers
June 16, 2026	Steam users and Wallpaper Engine users	Steam workshop abused to spread malware via wallpaper engine app	Unknown	Attackers used malicious Wallpaper Engine content distributed through Steam Workshop to infect users with malware, exposing affected systems to data theft and further compromise.	Source: Bleeping Computer
June 16, 2026	Organisations and Windows users targeted by the GhostTree campaign	GhostTree attack abused recursive Windows junctions to hide malware	Unknown	Attackers used recursive Windows junctions to conceal malware from security tools, allowing them to maintain stealthy access to compromised systems and increasing the risk of data theft and prolonged network intrusion.	Source: Bleeping Computer
June 16, 2026	Government organisations and critical sector entities targeted by the campaign	Windows Version of SprySOCKS Linux Malware Used to Attack Govt Orgs	Chinese state-backed hackers	The attackers deployed a Windows version of the SprySOCKS malware to maintain covert access to government networks, enabling long-term espionage activities and the theft of sensitive information from targeted organisations.	Source: Bleeping Computer
June 18, 2026	Windows users infected through compromised USB drives	USB Worm spreads crypto-stealing malware via Windows shortcut files	Unknown	The malware spread through infected USB devices and stole cryptocurrency wallet data and other sensitive information, putting affected users at risk of financial loss and account compromise.	Source: Bleeping Computer
June 18, 2026	WordPress websites using compromised ShapedPlugin products	ShapedPlugin Update Flow Hacked to Infect WordPress Sites	Unknown	Attackers compromised the plugin update mechanism and pushed malicious code to WordPress sites, potentially giving them unauthorised access to affected websites and exposing visitors and administrators to further attacks.	Source: Bleeping Computer
June 19, 2026	Mount Royal University	Mount Royal University site down due to cyber attack	Unknown	The cyber attack disrupted Mount Royal University’s website, telephone services, and other key IT systems, forcing the institution to activate incident response measures while cybersecurity experts investigated the extent of the compromise.	Mount Royal University Website Cyber Attack
June 21, 2026	D-Link Router Users Worldwide	Arystinger botnet infected thousands of D-Link routers worldwide	Arystinger Botnet Operators	The Arystinger botnet compromised thousands of vulnerable D-Link routers worldwide, allowing attackers to hijack the devices and use them as part of a malicious network for further cyber operations and abuse.	Source: Bleeping Computer
June 22, 2026	Brazil’s Defesa Civil Alerta (Civil Defense Alert System) / National Protection and Civil Defense Secretariat (SEDEC)	Brazil probes possible cyber attack on alert system	Unknown (suspected hacker(s) under investigation)	A suspected cyber attack hijacked Brazil’s emergency alert platform, triggering false “extreme” warnings on thousands of mobile phones across multiple states and forcing authorities to temporarily take the system offline while an investigation was launched.	Source: www.thestar.com.
June 23, 2026, June 25, 2026	Iran’s Banking Infrastructure (including multiple Iranian banks)	Islamic Republic confirms banking infrastructure cyber incident	Predatory Sparrow (Gonjeshke Darandeh)	The cyber attack disrupted card-based banking services at three Iranian lenders, causing payment processing problems and limiting customers’ access to banking transactions and financial services.	Iran’s Banking Infrastructure Under Attack
June 23, 2026	Jaredfromsubway MEV Bot Operator	Jaredfromsubway MEV bot hacked in $1.5 million crypto theft	Unknown	Hackers compromised the Jaredfromsubway MEV bot and stole approximately $1.5 million in cryptocurrency, resulting in significant financial losses through unauthorised transfers of digital assets.	Source: Bleeping Computer
June 24, 2026	Cybercriminal infrastructure behind Amadey and StealC malware operations	Amadey, StealC malware operations disrupted in Operation Endgame action	Amadey and StealC Malware Operators	An international law enforcement operation disrupted the infrastructure used by the Amadey and StealC malware groups, hindering their ability to infect victims, steal sensitive data, and conduct further cybercriminal activities.	Source: Bleeping Computer

New Ransomware/Malware Discovered in June 2026

New Ransomware	Summary
MLTBackdoor	A newly discovered modular backdoor that leverages Beacon Object Files (BOFs) to dynamically extend its functionality after infection. Distributed through ClickFix social-engineering campaigns, it enables remote command execution, file transfers, and payload deployment, providing attackers with a flexible post-exploitation framework.
AryStinger	A newly identified botnet malware targeting vulnerable routers and NAS devices, including D-Link, Linksys, and QNAP systems. It converts compromised devices into a malicious proxy network, enabling traffic tunneling, reconnaissance, and anonymous attacker operations while abusing edge infrastructure for stealth.
Crypto Clipper	A newly uncovered cryptocurrency-stealing malware that spreads through infected USB drives using malicious shortcut (.LNK) files. It targets cryptocurrency wallets, seed phrases, and private keys while incorporating clipboard hijacking, credential theft, screenshot capture, and Tor-based command-and-control capabilities.
Rocket Banking Trojan	A newly observed Android banking malware family targeting banking and cryptocurrency applications. It abuses Android Accessibility Services, deploys credential-stealing overlays, records screens, captures keystrokes, intercepts notifications, and conducts extensive surveillance to facilitate financial fraud and account takeover attacks.
Lalia Ransomware	A newly emerged ransomware family identified in June 2026 that targets Windows environments. The malware is believed to employ modern ransomware tradecraft and may support double-extortion tactics involving both file encryption and data theft. Its emergence highlights the continued growth of the ransomware ecosystem as new threat actors enter the cybercrime landscape despite increased law enforcement pressure on established groups.

Vulnerabilities/Patches Discovered in June 2026

Date	New Flaws/Fixes	Summary
June 1, 2026	CVE-2026-41089	Attackers actively exploited a critical Windows Netlogon vulnerability allowing unauthenticated RCE on domain controllers, enabling potential full system compromise and urgent patching.
June 2, 2026	CVE-2025-30762	CISA ordered urgent patching of an Oracle WebLogic flaw actively exploited to gain unauthorized server access and compromise systems.
June 5, 2026	CVE-2025-48799	SolarWinds Serv-U vulnerability actively exploited to crash servers, causing potential service disruption and requiring immediate updates.
June 6, 2026	CVE-2025-1128	Everest Forms Pro WordPress plugin flaw allowed attackers to create admin accounts and fully take over websites.
June 8, 2026	CVE-2024-39930	Gogs zero-day vulnerability patched after discovery of potential remote code execution risk on servers.
June 9, 2026	CVE-2024-24919	Check Point vulnerability actively exploited by ransomware groups to gain unauthorized network access.
June 9, 2026	CVE-2025-23121	Veeam backup server vulnerability could allow remote code execution and full system compromise.
June 9, 2026	CVE-2026-44748, CVE-2026-27671, CVE-2026-22732, CVE-2026-40128	SAP released patches for multiple critical vulnerabilities in NetWeaver and Commerce Cloud enabling authentication bypass and system compromise risks.
June 10, 2026	CVE-2025-53786	Microsoft patched an actively exploited Exchange Server zero-day preventing email system compromise.
June 11, 2026	CVE-2025-5777, CVE-2025-6543, CVE-2025-6544	CISA mandated rapid patching of multiple actively exploited vulnerabilities within three days due to high compromise risk.
June 12, 2026	CVE-2025-22457	Ivanti vulnerability actively exploited allowing attackers to compromise enterprise systems.
June 16, 2026	CVE-2025-32756, CVE-2025-32755, CVE-2025-25257	Fortinet FortiSandbox vulnerabilities actively exploited enabling potential code execution and appliance compromise.
June 17, 2026	CVE-2025-25257	Joomla extension vulnerability actively exploited leading to website compromise.
June 18, 2026	CVE-2025-53859, CVE-2025-23419, CVE-2025-23418, CVE-2025-23417, CVE-2025-23416	F5 released emergency NGINX patches addressing critical vulnerabilities affecting server stability and security.
June 23, 2026	CVE-2026-20230	Cisco Unified CM vulnerability actively exploited allowing unauthenticated remote access and command execution.

Warnings/Advisories/Reports/Analysis

News Type	Summary
Report	A federal inspector general’s report found that management shortcomings and resource challenges at NIST led to significant delays in processing vulnerability data, creating a backlog that affected the timeliness and reliability of the National Vulnerability Database.
Warning	The Five Eyes intelligence alliance warned that Chinese intelligence operatives had used professional networking and job recruitment platforms to target and recruit insiders with access to sensitive government and corporate information.
Warning	Acer warned that multiple maximum-severity zero-day vulnerabilities in its Wave 7 Wi-Fi routers could have allowed attackers to gain remote control of affected devices, prompting users to apply security updates immediately.
Warning	CISA warned that attackers had been actively exploiting vulnerabilities in Android and Linux systems, urging organizations and users to apply available patches to reduce the risk of device compromise and unauthorized access.
Warning	CISA warned that cyber threat actors had targeted internet-exposed fuel tank monitoring systems using default credentials and poor security configurations, potentially allowing unauthorized access and operational disruption.
Warning	Cisco warned that a critical vulnerability in Unified Communications Manager could have allowed attackers to gain unauthorized access and execute malicious actions on affected systems, and urged customers to patch the flaw after proof-of-concept exploit code became publicly available.
Report	Law enforcement agencies dismantled a large online marketplace that had supplied forged identity documents to migrant smuggling networks, disrupting a criminal operation that facilitated illegal border crossings and identity fraud.
Warning	Cisco warned that attackers had exploited a zero-day vulnerability in SD-WAN devices to gain root-level access to affected systems, prompting urgent patching and mitigation efforts to prevent further compromises.
Report	Researchers reported that the China linked JDY botnet had expanded its operations to target internet exposed systems associated with US military networks, increasing concerns about espionage, network compromise, and persistent access to sensitive infrastructure.
Report	Attackers abused Maine’s online data breach reporting portal to publish fraudulent breach notifications, creating confusion and undermining trust in official breach disclosure records.
Report	A Japanese energy company disclosed that a storage device containing personal information belonging to approximately 10.9 million customers had been lost, raising concerns about potential unauthorized access to customer data.
Warning	South Korea’s privacy regulator reported that Coupang was fined approximately $400 million after a data breach affecting millions of users exposed weaknesses in the company’s handling and protection of customer information.
Warning	Oracle warned customers that attackers had exploited a PeopleSoft security flaw to breach more than 100 organisations, urging users to secure vulnerable systems against further compromise.
Report	Maine temporarily disabled its online data breach notification portal after attackers abused the system to submit and publish fake breach disclosures, disrupting the state’s public reporting process.
Report	The U.S. government reportedly asked Anthropic to restrict foreign national access to its Fable and Mythos AI models due to concerns that the technology could be misused for national security and sensitive research purposes.
Report	The FBI disrupted a large-scale AI-powered phishing service that had used more than one million malicious URLs to steal credentials and facilitate cybercrime campaigns targeting victims worldwide.
Report	The FBI revealed that it had built a realistic replica of a small town to simulate real-world cyber attacks, helping agents and cybersecurity professionals train for threats targeting critical infrastructure and connected systems.
Report	The Council of Europe launched an investigation after the ShinyHunters hacking group claimed to have breached its systems and stolen sensitive data, while officials worked to verify the authenticity and scope of the alleged compromise.
Warning	Security experts warned that a rise in account takeover attacks targeting Argos customers had been driven by password reuse, increasing the risk of unauthorised purchases and account compromise.
Warning	The FTC warned that Americans lost a record $3.5 billion to imposter scams in 2025, as cybercriminals increasingly posed as trusted organisations and government agencies to deceive victims into sending money.
Warning	CISA warned that attackers had been actively exploiting a vulnerability in a cPanel plugin, urging organisations to patch affected systems quickly to prevent unauthorised access and potential compromise.
Report	Microsoft reported that North Korean threat actors were linked to a supply-chain attack targeting the Mastra AI development framework, after attackers compromised developer accounts and inserted malicious code designed to steal credentials and cryptocurrency assets from downstream users.
Warning	CISA warned Fortinet customers to immediately secure and review their devices after the FortiBleed vulnerability exposed sensitive information, raising concerns that attackers could have used the leaked data to gain unauthorised access to affected systems.
Warning	Researchers warned that attackers used WhatsApp messages containing fake business documents to trick users into opening malicious files, leading to malware infections and unauthorised access to compromised Windows PCs.
Report	Belgian authorities reported that hundreds of organisations were affected by a large-scale cyber attack that exploited a vulnerability in widely used software, exposing systems to unauthorised access and prompting a nationwide cybersecurity response.
Report	Germany approved new powers allowing its intelligence services to conduct offensive cyber operations against foreign hackers, marking a significant expansion of the country’s ability to actively disrupt and counter cyber threats originating abroad.
Report	Meta paused its employee-tracking program after a security review found that internal data had been exposed more broadly than intended, raising concerns about employee privacy and data protection.
Warning	Researchers warned that a malicious Microsoft Edge extension abused the browser’s Native Messaging feature to communicate with malware on infected devices, enabling attackers to execute commands and maintain access to compromised systems.
Warning	Experts warned that ransomware attacks had increasingly pushed German businesses toward financial distress and potential bankruptcy by causing prolonged operational disruptions, recovery costs, and significant revenue losses.
Warning	CISA warned that attackers had actively exploited maximum-severity vulnerabilities in Ubiquiti networking devices, potentially allowing unauthorized access and full compromise of affected systems, and urged organizations to apply security updates immediately.
Report	Researchers reported that the stealthy MISTIC backdoor was linked to the KongTuke access broker, which used compromised systems to provide network access that could later be sold to ransomware operators and other cybercriminal groups.
Warning	The UK’s Public Accounts Committee warned that many of the country’s cultural institutions had failed to adequately strengthen their cyber defenses, leaving critical national collections and services vulnerable to increasingly sophisticated cyber threats.

Build Your Competitive Advantage with Synergy IT Solutions Group

In a threat landscape where breaches are a matter of when, not if, your agility in response is your ultimate defense. At Synergy IT Solutions Group, we help organizations transform chaotic crisis management into a controlled, structured operational advantage.

Our specialized cybersecurity and managed defense infrastructure services ensure your business is engineered to endure:

Cyber Incident Planning & Response Services: Equip your internal leadership teams with the practical knowledge, technical frameworks, and confidence required to navigate a live cyber crisis.
Managed Cyber Tabletop Exercises: Put your team’s capabilities to the test using immersive, hyper-realistic attack simulations modeled after real-world threat actors.
Bespoke Incident Response Playbook Creation & Review: Move past boilerplate templates. We design, audit, and refine custom incident response playbooks that are practical, compliant, and fit for your exact operational and cloud environment.

Don’t wait for an attacker to audit your security posture. Ensure your team is ready to respond. Understand how cyber resilience protects your business operations. Start building cyber resilience today:

Source : https://www.cm-alliance.com/cybersecurity-blog/june-2026-biggest-cyber-attacks-data-breaches-ransomware-attacks

IT_Security