Cybersecurity incidents continued to rise throughout July 2026, affecting healthcare providers, manufacturers, AI companies, software vendors, financial institutions, and millions of consumers worldwide. Attackers increasingly leveraged phishing, ransomware, credential theft, supply chain attacks, and AI-powered techniques to compromise organizations.

Below is a roundup of some of the most significant cybersecurity incidents reported during July 2026, along with practical security recommendations that organizations and individuals can implement to reduce risk.

Hackers claim to have breached Deutsche Bank internal systems.

Hackers claim to have breached Deutsche Bank’s internal systems, posting what appear to be employee database records as proof of the ransomware leak on a ransomware leak site. The bank’s spokesperson confirms a third-party breach.

The Unsafe ransomware group has claimed to have breached Deutsche Bank, listing the German banking giant on a dark web leak site.

The alleged attackers posted database extracts as proof of their claims, including terminal output and commands that appear to show exports from multiple databases. The provided screenshots show database queries that call back sensitive employee data.

According to Cybernews researchers, the screenshots contain records associated with Deutsche Bank employees, including:

• Employee email addresses
• Password hashes
• Physical addresses
• Internal database records

Accenture Confirms Data Breach After Hacker Claims Source Code Theft

Professional services giant Accenture confirmed a data breach after a hacker claimed the theft of internal source code from the company.

The incident came to light this week, when a threat actor boasted on the hacker forum PwnForums about compromising Accenture and stealing 35 gigabytes of data.

According to the hacker, the information, including Azure access keys and tokens, configuration files, RSA and SSH keys, and source code, was exfiltrated from Accenture earlier this month.

The threat actor, who was trying to sell the allegedly stolen data, posted as proof-of-possession a screenshot depicting a private Azure DevOps repository apparently hosted on an accenture.com domain.

Responding to a SecurityWeek inquiry, Accenture confirmed the attack, but refrained from providing additional details on the matter.

“We are aware of this isolated matter, and we have remediated its source. There is no impact to Accenture operations and service delivery,” an Accenture spokesperson said.

It is unclear how the data was exfiltrated, whether any personal information was compromised, and how the hacker gained access to Accenture’s environment.

According to Corsica Technologies CISO Ross Filipek, the incident raises concerns because the allegedly stolen data could be used as a playbook for future attacks, based on code vulnerabilities, credentials, and infrastructure information that threat actors can extract.

“Accenture is a familiar target because of where it sits in the business ecosystem. Large consulting and services firms often sit close to the systems that help major companies run, from cloud environments and identity tools to codebases and transformation projects,” Filipek said.

Ernst & Young discloses data breach after support system hack

Ernst & Young is notifying customers of a data breach caused by the compromise of a third-party support ticket system used by its IT personnel.

According to the company, support tickets submitted through the platform may have included documents containing client tax information.

Ernst & Young (EY) is among the world’s four largest auditing and professional services providers, offering auditing, tax, consulting, and transaction advisory services to major organizations in more than 150 countries.

With help from external cybersecurity experts, the company determined that an unauthorized third party had accessed the said platform between March 28 and April 12 and downloaded multiple documents.

The affected information included certain personal and financial data contained in or used to prepare tax filings. Since the notification sample features a placeholder for the specific data types, the type of the information exposed remains unclear.

Also, the company has not shared exactly how many customers were affected or whether the incident impacts only its U.S. customer base or other countries as well.

Ernst & Young says it secured its systems and notified federal law enforcement authorities, while it has assured that the unauthorized access has been removed.

The company also states that it is not aware of any misuse or further exposure of the stolen files and has no indication that particular individuals were targeted by the threat actors.

To mitigate the risks arising from this exposure, EY offers affected clients 24 months of identity monitoring and restoration service through Experian and urges letter recipients to enroll by October 31, 2026.

At the time of writing, no data extortion or ransomware groups have taken responsibility for the attack on Ernst & Young.

Bank of Baroda Data Breach

Bank of Baroda has confirmed a cybersecurity incident in which attackers gained unauthorized access to an employee’s email account, exposing internal communications and potentially sensitive information, raising concerns about phishing attacks, account security, and customer data protection.

Reports indicate that the unauthorized access was detected after suspicious activity was observed in an employee’s mailbox. The attackers are believed to have compromised the account credentials, allowing them to access emails, attachments, and internal correspondence associated with that user.

Once inside, they can impersonate employees, search for sensitive documents, identify business partners, and launch further attacks against internal networks.

In banking environments, a compromised email account poses serious risks. Internal mailboxes may contain customer communications, loan-related documents, transaction references, employee records, operational details, and vendor information.

Even if attackers do not directly access core banking systems, this information can facilitate fraud, social engineering attacks, or targeted phishing campaigns.

According to a Times of India report, Bank of Baroda has not publicly disclosed the specific method used to compromise the employee’s email account, and it remains unclear whether customer data, financial records, or banking systems were affected.

The scope of the incident will depend on the level of access held by the compromised employee and the amount of information stored in the mailbox.

This incident underscores the importance of implementing multi-factor authentication for all employee accounts, particularly for staff handling sensitive customer, financial, and administrative information.

Multi-factor authentication can significantly reduce the risk of account takeover, even if a password is stolen through phishing or exposed in a previous data breach.

Organizations should also monitor email login activity for unusual locations, unfamiliar devices, impossible travel patterns, and abnormal forwarding rules.

Attackers often create hidden mailbox rules to silently forward emails to external addresses, allowing them to maintain access and collect information without immediate detection.

Financial institutions are high-value targets for cybercriminals due to the volume of personal, transaction, and financial data they manage. A single compromised employee account can provide attackers with valuable intelligence that helps them expand their access or deceive customers and staff.

Bank of Baroda’s investigation is expected to clarify the full impact of the breach, including whether data was accessed or removed.

Customers are advised to remain vigilant for suspicious emails, fake banking messages, and unsolicited requests for credentials, one-time passwords (OTPs), or account details that may attempt to exploit this incident.

Revolut Alleged Data Breach

Revolut is currently under scrutiny after hackers claimed to be selling a database containing records of more than 75 million users. However, the company asserts that it has found no evidence of a new breach at this time.

A threat actor has advertised what they describe as a Revolut customer database on a cybercrime forum, allegedly containing 75 million records linked to the popular fintech platform.

Samples shared with researchers include partial card data, email addresses, full names, phone numbers, physical addresses, account identifiers, device information, and hashed user credentials.

The seller is reportedly offering the dataset for around $500, which appears to be a suspiciously low price given the claimed scale of the data.

Security researchers who examined the samples noted the presence of payment card details, such as the last four digits, card type, expiration dates, and card status, as well as personally identifiable information such as email addresses, names, countries, and registration IPs.

The dataset appears to contain bcrypt or argon2id password hashes, as well as metadata on device models and operating systems. This information could enable detailed profiling of targeted users.

Even without full verification, the presence of detailed contact information and partial card data in criminal marketplaces can facilitate highly convincing phishing and social engineering campaigns targeting Revolut customers.

Users are advised to treat unsolicited messages referencing Revolut with caution, avoid clicking on embedded links, and authenticate communications only through official channels and in-app notifications.

Enabling multi-factor authentication, regularly changing credentials, and closely monitoring account activity for suspicious transactions are essential steps. At the same time, investigators work to confirm or debunk the hackers’ claims.