Leak-site monitors closed out May 2026 with another cluster of ransomware marketing entries—many still awaiting company confirmation. BreachHistory added canonical rows for the highest-signal names surfacing on ransomware.live and security blogs between May 29 and May 31.
Lake Washington School District (May 31)
Lake Washington School District (LWSD) in Washington state appeared in a cmdorganization listing on May 31. The district serves Kirkland, Redmond, and Sammamish with dozens of schools—making any confirmed student-data exposure a high-priority notification event for families and state regulators.
ShinyHunters travel-sector claim
BCD Travel, a major corporate travel management company, was marketed by ShinyHunters on May 29 alongside the broader spring extortion wave documented in our ShinyHunters overview.
Healthcare and research targets
- Capital Family Physicians — cmdorganization, May 29
- AcademyHealth — BravoX, May 29
- Lab Express — INC_RANSOM, May 30
Business services
Plexsupply, a U.S. wholesaler, was listed by the Pear ransomware brand on May 30 with estimated attack timing around May 26.
How to read these rows
Unless a company publishes a substitute notice or regulator filing, treat counts as zero verified victims in our headline field while the technical write-up explains actor claims. Enable monitoring for updates when forensic statements arrive.
Canonical examples: LWSD timeline, breach blog, platform tools.