Recent cyber attacks and data breaches

Monmouth University notified the California Attorney General of a data breach on June 30, 2026, with the breach dated February 5, 2026. The notice covers more than 500 California residents; California does not publish the exact number.

Glucobit, Inc. dba Reframe notified the Washington State Attorney General on June 30, 2026 of a data breach, affecting 3,181 Washington residents. Information involved: Name, Medical Information.

Washington Department of Social Health Services notified the Washington State Attorney General on June 30, 2026 of a data breach that occurred on September 23, 2023, affecting 8,600 Washington residents. Information involved: Name, Social Security Number, Full Date of Birth, Protected Health Information owned or licensed by a HIPAA covered entity.

Virta Health, a business associate in CO, reported a breach of health information affecting 602 people to the US Department of Health and Human Services on June 30, 2026. HHS records the breach type as hacking/it incident, involving network server.

Kubota Tractor Corporation Employee Welfare Benefit Plan, a health plan in TX, reported a breach of health information affecting 5,891 people to the US Department of Health and Human Services on June 30, 2026. HHS records the breach type as hacking/it incident, involving network server.

Sierra Management Group notified the California Attorney General of a data breach on June 29, 2026. The notice covers more than 500 California residents; California does not publish the exact number.

Medtronic Inc. notified the Washington State Attorney General on June 29, 2026 of a data breach that occurred on April 13, 2026, affecting 64,035 Washington residents. Information involved: Name, Social Security Number, Full Date of Birth, Medical Information, Other.

Optalis Management Solutions, a healthcare provider in MI, reported a breach of health information affecting 13,723 people to the US Department of Health and Human Services on June 29, 2026. HHS records the breach type as hacking/it incident, involving network server.

In June 2026, the food distribution company Sysco was targeted by a ShinyHunters "pay or leak" extortion campaign . Data was subsequently published containing 2.7M unique email addresses belonging to staff and customers. The data also contained largely corporate contact information including names, phone numbers, physical addresses, internal job titles, and customer feedback.

In June 2026, telecommunications tower infrastructure company American Tower was the target of a ShinyHunters "pay or leak" extortion campaign . The group subsequently published data allegedly taken from the company containing more than 200k unique email addresses belonging to employees, contractors, customers, and leads. Exposed data also included names, addresses, and phone numbers.