Welcome to the June 2026 edition of our monthly cybersecurity newsletter. This month has been characterized by high-stakes supply chain attacks, critical vulnerabilities in enterprise software, and a disturbing trend of targeting essential civilian infrastructure.
Cybercrime Breaking News
Tata Power / Apple Supply Chain Ransomware Attack
A major ransomware attack on Tata, a key supplier in Apple’s production network, has raised alarms across the tech industry. Verified reports indicate that sensitive data related to upcoming projects, including the iPhone 18 Pro, may have been compromised. This incident underscores the persistent vulnerability of global supply chains.
Novo Nordisk Major Hack and Extortion Attempt
Between June 11 and 16, pharmaceutical giant Novo Nordisk experienced a major hack by the Hunters International group, who attempted a $25 million extortion. The attack resulted in the copying of non-public and clinical trial related patient data, prompting an investigation and temporary shutdown of some internal IT systems.
University of Nottingham Data Breach
The University of Nottingham confirmed a data breach after hackers leaked stolen information online. This incident raised concerns about the security of sensitive records belonging to the institution and affected individuals.
Council of Europe Hack Claimed by ShinyHunters
On June 15, ShinyHunters claimed to have hacked the Council of Europe, potentially exposing sensitive organizational information and prompting an investigation into the alleged breach.
DentaQuest Data Breach Exposes 2.6 Million Accounts
DentaQuest, a dental benefits administrator, experienced a data breach that exposed information from 2.6 million accounts. This included sensitive personal and health-related information, increasing the risk of identity theft and fraud for affected members.
Meta AI Support Data Breach Affects Instagram Accounts
A data breach linked to Meta AI support services affected approximately 20,000 Instagram accounts. The breach potentially revealed personal details and private communications submitted to Meta AI support teams.
Nintendo Data Stolen in WebMD Subsidiary Cyber Attack
Nintendo confirmed that personal information belonging to its job applicants was stolen after attackers breached a WebMD subsidiary’s recruitment platform. This exposed applicant data that had been shared with Nintendo during the hiring process.
SoFi Hong Kong Third-Party Data Breach
SoFi Hong Kong confirmed a third-party data breach that exposed personal information belonging to its customers and applicants. This incident highlights the risks associated with third-party service providers.
French Government Messaging App Tchap Security Breach
Tchap, the French government messaging app, suffered a security breach where hundreds of thousands of private messages were allegedly stolen. This raise concerns over the security of official communications and sensitive information.
Cybersecurity and AI
AI-Built Ransomware Toolkit Automates EDR Evasion
On June 2, an AI-built ransomware toolkit was discovered that automates EDR (Endpoint Detection and Response) evasion and Active Directory discovery. This AI-generated toolkit streamlines key attack stages, potentially enabling attackers to compromise enterprise environments more quickly and efficiently.
Apple Addresses AI-Related Cybersecurity Risks
In June, Apple reportedly began releasing early software updates to address AI-related cybersecurity risks. This proactive measure indicates a growing awareness among tech giants of the security implications of integrating AI into their products and services.
Cybersecurity Justice & Regulation
US Sanctions Nobitex Crypto Exchange Used by Ransomware
The US sanctioned the Nobitex crypto exchange for allegedly facilitating financial transactions linked to ransomware operations and other cybercrime activities. This action aims to disrupt the financial infrastructure supporting ransomware groups.
Oracle Mitigates PeopleSoft Zero-Day Vulnerability
Oracle mitigated a PeopleSoft zero-day vulnerability that was being exploited in data theft attacks. This highlights the continuous efforts by software vendors to address critical vulnerabilities and protect their users.
Best Practices for July
Audit Third-Party Access
Review and restrict the permissions granted to third-party vendors, especially those handling sensitive biometric or financial data.
Verify Identity Requests
Implement strict protocols for verifying IT support requests to counter the rising success of voice phishing (vishing).
Infrastructure Hardening
For those in critical sectors, ensure that OT (Operational Technology) systems are air-gapped or protected by multi-factor authentication.
Want to find out more about:
- Red Team Testing Explained | Benefits, Methodology & Examples
- The Security Risks Hiding Inside Modern CCTV Systems
AMATAS will continue to monitor this space and deliver salient information regularly.
Stay tuned for our next report and if you are interested in any of our privacy and cybersecurity services, please do reach out through our website www.amatas.com or by e-mailing office@amatas.com.
As always – be vigilant, stay alert, and think twice.
