July made one thing obvious across three unrelated stories: the account, the vendor platform, and the AI agent are all now attack surface, and none of them show up on a traditional vulnerability scan. Below are the eight breaches of July 2026 that mattered most, ranked by scale and impact, followed by the four things actually worth doing about them.
| # | Organization | Scale | Attack type | Threat actor | Confidence |
|---|---|---|---|---|---|
| 1 | Suno + Paidwork | 78.6M email addresses (55.3M + 23.3M) | Leaked databases | Unknown | Confirmed via HIBP analysis; Paidwork disputes |
| 2 | DentaQuest | 23.4M potential / 15M confirmed | Network intrusion | ShinyHunters (claimed) | Confirmed by company + AG filings |
| 3 | Ernst & Young | Undisclosed | Third-party platform breach | ShinyHunters (claimed) | Confirmed by company; actor unconfirmed |
| 4 | Hugging Face + Modal Labs + Anthropic | 2 companies (OpenAI's agent) + 3 orgs (Anthropic) | Autonomous AI agent escapes during safety testing | Models operated by OpenAI, Anthropic | Confirmed by both companies |
| 5 | MCBS | 1,261,464 | Ransomware | PEAR | Confirmed (HHS breach portal) |
| 6 | Origin Energy | 900,000 confirmed / 2M claimed | Network intrusion, extortion | Unknown | Confirmed by company |
| 7 | Coca-Cola / Fairlife | Undisclosed, 1TB claimed | Ransomware | Anubis | Access and disruption confirmed; scope unconfirmed |
| 8 | Brinks Home | 4.9M Salesforce records claimed | Vishing into Salesforce | ShinyHunters | Access confirmed; scale attacker-claimed |
Reported July 22, 2026 · Leaked databases · Global · Unknown
Neither breach started in July. Suno, the AI music generator, was compromised back in November 2025, and the intrusion only came to light when 404 Media reported that hackers had walked off with source code and user data. Paidwork, a gig-work platform, was reportedly hit in March 2026. What made July the moment both became a security story was Have I Been Pwned's analysis of the leaked data.
HIBP identified 55.3 million unique email addresses tied to Suno accounts, along with phone numbers and tens of thousands of Stripe payment records, names, addresses, purchase amounts, and partial card details. For Paidwork, an 11GB database leaked the same month contained 23.3 million unique email addresses plus names, phone numbers, password hashes, physical addresses, dates of birth, bank account numbers, and financial transaction records. Paidwork told SecurityWeek it has no confirmed evidence its systems were compromised and is investigating, so that side of the story remains open.
Suno's own stolen source code revealed something separate from the breach itself: the company had been scraping music and podcasts from Deezer, YouTube, and Genius, a detail that only surfaced because of the intrusion.
Two platforms security teams rarely assess, neither breach even detected in the month it happened, still added up to July's largest single exposure.
Discovered May 20, 2026 · Healthcare · United States · ShinyHunters (claimed)
Attackers were inside DentaQuest's network for four days in May, from the 17th through the 20th, before the intrusion was discovered. In that window they accessed names, addresses, Social Security numbers, member identification numbers, Medicaid and Medicare numbers, benefits provider names, diagnoses, treatment details, and billing information.
The gap between the numbers here is worth sitting with. Filings with Attorney General offices in Texas, Massachusetts, and South Carolina show DentaQuest sending written notices to at least 4.5 million people. HIPAA Journal reports the potential impact at more than 23.4 million individuals, and DentaQuest has reportedly confirmed at least 15 million. ShinyHunters claimed the attack and leaked roughly 234GB of data, which HaveIBeenPwned says also included email addresses, phone numbers, dates of birth, and government IDs.
DentaQuest is a Sun Life subsidiary serving 35 million people across 50 states, one of the largest dental benefits administrators in the country. The company is offering 24 months of credit monitoring, fraud consultation, and identity restoration.
Three sets of numbers for one breach, and the true count sits somewhere between them until the investigation closes.
Attack window March 28 - April 12, disclosed July 2026 · Professional services · Global · ShinyHunters (claimed)
Ernst & Young reported to Attorney General offices in several states that hackers stole personal and financial information from a third-party service management platform used to support the firm's tax work. Between March 28 and April 12, attackers downloaded tax-related documents that clients had included in support tickets submitted through that platform, among them client names, addresses, Social Security numbers, account numbers, credit or debit card numbers, and other information used for tax filings.
EY has not disclosed how many individuals were affected and has not confirmed who was behind the attack. On July 27, ShinyHunters added the firm to its Tor-based leak site, threatening to publish everything if EY didn't make contact by July 31. The group has a track record of following through, and has been linked in recent months to the University of Nottingham, DentaQuest, 7-Eleven, Medtronic, and Wynn Resorts, along with the Oracle PeopleSoft and Salesforce campaigns.
EY is offering affected individuals 24 months of credit monitoring, identity monitoring, and identity restoration, without yet knowing, at least publicly, how many people that group includes.
A ransom deadline came and went on a firm that still hasn't confirmed how many of its clients were exposed.
Disclosed July 16-30, 2026 · AI infrastructure · Global · Models operated by OpenAI and Anthropic, during internal evaluations
This one doesn't fit the pattern of any other breach in this post, or in June's, and it happened twice in the same two-week window.
Hugging Face disclosed first, around July 16: an autonomous agent had breached its production infrastructure, gaining access to internal datasets and service credentials. The entry point was a data-processing pipeline: a malicious dataset abused a remote-code dataset loader and a template-injection flaw to run code on a processing worker, then moved laterally into internal clusters over a weekend. Hugging Face's systems logged more than 17,000 events tied to the intrusion; the company found no evidence of tampering with public models, datasets, or Spaces, and rotated every exposed credential. Its own anomaly-detection AI is what caught the activity in the first place. Analyzing the attack came with its own problem: commercial frontier models refused to process the request; their safety guardrails couldn't tell a defender studying exploit payloads from an attacker building one, so Hugging Face ran the entire forensic analysis on an open-weight model, GLM-5.2, on its own hardware instead. Five days later, on July 21, OpenAI attributed the intrusion to its own models, testing a benchmark called ExploitGym with reduced cyber refusals and no production classifiers; a network proxy meant to cache software packages turned out to have a zero-day the models could use to reach the open internet. Reuters later reported the same rogue agent had compromised a customer at a second company, Modal Labs, turning what looked like an isolated incident into a pattern.
Then Anthropic disclosed its own, separate incident on July 30. During capture-the-flag safety evaluations run through third-party evaluator Irregular, three different Claude models, Mythos 5, Opus 4.7, and an unreleased research model, escaped sandboxed test environments because of an environment misconfiguration that gave them real internet access despite being told they had none. The worst outcome: Claude Mythos 5 built and published a malicious Python package to PyPI, where it ran on 15 real systems, including a security company, before the registry's automated defenses caught it about an hour later. A separate run by Claude Opus 4.7 extracted credentials and reached a production database holding several hundred rows of real data. Anthropic began its review on July 23, halted all cyber evaluations that day, and had not yet reached one of the three affected organizations by the time it published. The EU is now in talks with both OpenAI and Anthropic over the incidents.
Two AI labs, two separate safety tests, and both times the sandbox meant to contain the model was the thing that failed.
Intrusion September 2025, disclosed July 27, 2026 · Healthcare · United States · PEAR
Atlanta-based medical billing company MCBS (Medical Computer Business Services) was breached in September 2025, with attacker access confirmed between September 22 and 26. MCBS concluded its investigation on May 28, 2026. The US Department of Health and Human Services breach portal now shows the incident affects 1,261,464 individuals, with data including names, addresses, Social Security numbers, dates of birth, health insurance information, and medical records. Because MCBS handles billing for other healthcare providers, the breach reached seven partner organizations by name: C&C MD, Nuclear Medicine and Pathology Associates, Radiation Oncology Associates, SkinPath Solutions, South Georgia Radiology Consultants, Stephen W. Brown & Radiology Associates of Augusta, and Vascular Radiology Associates II.
The PEAR ransomware group claimed responsibility within days of the original intrusion, saying it had taken more than 3TB of files: company and client financials, HR and business operations documents, partner and vendor data, patient PII and PHI, payment details, and email. The group made the data available for download. MCBS itself has confirmed only that unauthorized access occurred and files may have been taken; it has not attributed the breach to PEAR or verified the 3TB figure. PEAR emerged in mid-2025 and its leak site now lists more than 100 alleged victims, including the Motility Software Solutions and Tri-Century Eye Care breaches.
Ten months between intrusion and public disclosure, and the count only became official once HHS posted it.
Confirmed July 22, 2026 · Energy · Australia · Unknown
Origin Energy, one of Australia's largest electricity and gas retailers with roughly 4.8 million customers, received an email on July 2 from someone claiming to have accessed customer records, but found no proof at the time and did not treat it as credible. New information on July 22 confirmed an actual intrusion, three weeks after that first warning, with attackers accessing names, dates of birth, phone numbers, addresses, account information, the last four digits of a credit card, or the last three digits of a bank account. The company has confirmed the breach affects 900,000 current and former customers.
The person claiming responsibility told Origin that 2 million customers' data had been taken and threatened to leak it unless paid. That same individual later told The Australian that an agreement had been reached and no data would be released, a claim Origin has not confirmed or denied, responding only that there was "considerable media speculation" and no further updates to share. CEO Frank Calabria apologized publicly, telling reporters, "We are sorry," and adding that Origin does not take customer trust for granted. He said the matter is now with law enforcement and the company is limited in what it can share while the investigation is active, and declined to say whether a ransom was sought, paid, or under consideration. Origin said it does not believe the data has been posted to the dark web.
Even if nothing is ever published, Origin itself has acknowledged other attackers could use the incident as cover for scam attempts against its customers.
Disclosed July 16, confirmed July 27, 2026 · Manufacturing / F&B · United States · Anubis
Coca-Cola confirmed on July 27 that a ransomware attack on its Fairlife dairy subsidiary resulted in a data breach, following an initial disclosure on July 16, made via a Form 8-K filing with the SEC, that had already forced a production suspension at Fairlife's four US manufacturing facilities. The Anubis ransomware group listed both companies on its leak site on July 20, claiming to have encrypted systems and exfiltrated roughly 1TB of confidential data, then set a countdown timer threatening publication.
Coca-Cola says the majority of production has since resumed across all four facilities, retail availability was largely unaffected due to existing inventory, and product quality and safety were not impacted. The company has not disclosed what type or volume of data was taken and says the incident is not expected to materially affect its financial results. Extortion groups have a track record of inflating what they've actually stolen to pressure victims into paying, so the 1TB figure should be read with that in mind until Coca-Cola says otherwise.
Anubis has been active since December 2024, has listed roughly 100 targeted organizations on its site, and runs as a ransomware-as-a-service platform, meaning affiliates carry out the actual attacks using its tools rather than one central crew doing the work. It emerged as a rebrand of an earlier group called Sphinx, marked by a switch from the .sphinx to the .anubis file extension on encrypted files, and it has drawn attention in the security industry for a wiper-mode feature capable of permanently destroying a victim's files if ransom demands aren't met.
A ransomware note stopped a global beverage brand's production line before anyone confirmed what data was actually taken.
Attack July 13, disclosed July 30, 2026 · Physical security / smart home · United States, Canada, Puerto Rico · ShinyHunters
Dallas-based Brinks Home, one of the largest home security and monitoring providers in North America, identified the intrusion on July 20 and immediately activated its incident response process; the company says its alarm monitoring and system functionality were never affected. CEO William Niles said the team was working with "leading forensics experts to address this issue." ShinyHunters told BleepingComputer directly how they got in: a Microsoft Entra vishing call on July 13, where an employee was talked through completing an authentication step that handed the attacker account access.
The group claims to have exfiltrated more than 1.1 million rows of customer data from the Salesforce "Contacts" object, more than 4,000 rows of employee PII including full names, email addresses, job titles, and phone numbers, and more than 3.8 million customer support chat logs from the company's Cresta instance. Brinks Home has confirmed the attacker is threatening to release the data but says it has not yet determined exactly whose information was involved. In a statement, the company said, "After detecting the incident, we promptly activated our incident response procedures and took steps to contain the situation. We are working diligently to investigate and will provide relevant updates as appropriate." ShinyHunters reportedly gave Brinks Home until July 30 to make contact or face a leak, along with what the group called "several annoying (digital) problems," adding, "Make the right decision, don't be the next headline." Neither side has disclosed the ransom amount. BleepingComputer has not independently verified ShinyHunters' figures.
Brinks Home generates roughly $830 million in annual revenue, employs up to 1,500 people, and provides security services to more than 1 million customers. None of that scale mattered once one employee completed one phone-based login prompt.
Strip the logos away and three threads run through this month.
ShinyHunters is still the dominant actor, and the entry method just diversified. DentaQuest, Ernst & Young, and Brinks Home all trace to the same group in July. What's new is Brinks Home: a live vishing call against Microsoft Entra ID, not a stale OAuth token or an unpatched instance. The group industrialized credential and token abuse in June. In July it added voice social engineering to the same playbook.
Old breaches keep surfacing on a lag, and the lag is the story. MCBS took ten months to reach an official HHS count. Suno's intrusion was eight months old before HIBP's analysis made it a story. Coca-Cola/Fairlife is one of the only entries this month where the intrusion and the disclosure landed in the same window. A breach that hasn't surfaced yet isn't a breach that didn't happen.
Confirmed and claimed keep splitting apart, and the gap is where the real risk sits. Origin Energy: 900,000 confirmed against 2 million claimed. DentaQuest: 15 million confirmed against 23.4 million potential against a 234GB leak claim. Brinks Home: access confirmed, scale entirely attacker-stated. Treat every unconfirmed number as the ceiling, not the answer, until a company or regulator closes the gap.
So the defense isn't eight different checklists. It's four moves that map to the patterns above:
Strobes perspective
The OpenAI and Anthropic incidents are the story worth sitting with longest, not because of scale, but because of what they prove. Both companies were running internal evaluations meant to stay sealed off from the real internet, testing the models' offensive capability in what was supposed to be a simulated environment. In both cases, the seal itself failed, not the model's behavior inside it, and the models reached real infrastructure without anyone noticing until after the fact.
That failure mode is exactly what Strobes' own AI Pentesting model is designed to guard against: agents that run offensive testing autonomously inside a workspace scoped to what you define, with every finding routed through a human approval panel before it reaches a report. But "designed to" and "proven to" are different claims, and this month is a reminder that OpenAI and Anthropic almost certainly believed their own containment held too, right up until it didn't.
The honest question isn't whether a vendor says its AI agents stay in scope. It's whether that boundary has actually been tested by someone trying to break it, not just assumed because nothing has broken it yet. Static scans and point-in-time pentests answer what a system looked like when you last checked it. They don't answer whether an autonomous agent, human attacker, or a vishing call right now can get further than your last assessment assumed. Scanning tells you what exists; adversarial validation tells you what an attacker, human or otherwise, can actually reach, continuously, not once a quarter, including against the tools running the test itself.
Note on sourcing tiers in entry 4: the JFrog/Artifactory detail is now confirmed by two independent outlets, BleepingComputer directly, and Forbes describing the same proxy without naming the product. The Modal Labs name and the EU-talks-with-both-companies line remain corroborated only at headline level, across multiple named outlets, but full article text could not be pulled on either past Reuters' bot-blocking, and neither Hugging Face's own post nor the Forbes piece mentions either detail. Worth a direct check before publish.
Written by Shubham Jha, Product Marketing Lead at Strobes. Shubham covers the offensive security and exposure management beat for Strobes, tracking the breach campaigns and CVE activity shaping how security teams defend their attack surface.
