The largest confirmed theft of 2026 so far hit Binance on 29 October. In its announcement of 30 October the exchange put the estimated total impact at about US$6.3 billion. It is one of 72 significant, confirmed cyber attacks in this timeline, which runs from the unauthorized access to ScreenConnect partner accounts that ConnectWise disclosed on 11 November back to a Belgian hospital that moved seven critical care patients to other hospitals on 13 January. It covers incidents confirmed up to 13 November 2026, and a new section is added each month.
Three things stand out in the year so far. Attacks reached the physical world more often: refrigeration controllers at about 700 French retail sites were tampered with in one night, starting fires in at least 15 cases according to the French government's incident report, and France has attributed that campaign to Iran. Software supply chains were hit repeatedly, from axios and LiteLLM in March to TanStack in May and LiteLLM again in October. And AI agents moved from theory to incident reports: Hugging Face disclosed an intrusion driven end to end by an autonomous AI agent system, and Microsoft reported a state-aligned actor using an agentic framework to reach privileged cloud access in under three hours.
This is the Stingrai research team's running reference for cyber attacks in 2026, written for security leaders, engineers and journalists who need a dated, sourced record. Each entry gives the date, the organisation, what happened and the impact, and links to a primary source: the organisation's own notice, a regulatory or stock exchange filing, or a government statement or advisory. An attacker is named only where that source names one. It is a timeline of attacks, including many that are not data breaches; the largest breaches by people affected are ranked separately in our biggest data breaches of 2026.
Key facts at a glance
Most recent confirmed attacks (November 2026): ScreenConnect partner accounts accessed, with third-party extensions suspected as the route, disclosed 11 November (ConnectWise); Vanderbilt University systems restricted, 9 November (Vanderbilt).
Largest theft (29 October 2026, announced 30 October): Binance, estimated total impact about US$6.3 billion, about US$3 billion frozen on-chain (Binance).
Other nine-figure thefts: Bitget, about US$387.5 million, 24 September (Bitget); Drift Protocol, US$295 million, 1 April (Drift); KelpDAO, about US$290 million by LayerZero's figure, 18 April (LayerZero).
State attribution of sabotage (October to November 2026): France attributed the attack on refrigeration controllers at about 700 retail sites to a unit affiliated with Iran's Islamic Revolutionary Guard Corps (French foreign ministry, incident report).
Industrial controllers (April 2026): six US agencies said Iran-affiliated actors had disrupted programmable logic controllers across several US critical infrastructure sectors (joint advisory AA26-097A).
Material operational impact (2026): Stryker said its 11 March incident had a material impact on operations (Form 8-K/A); Boston Scientific expects a material impact on third-quarter results (Form 8-K); Ahold Delhaize expects EUR 200 million to EUR 250 million less in fourth-quarter net sales (Ahold Delhaize).
Water systems (July 2026): more than 30 Minnesota community water systems targeted, with incidents reported by utilities in at least seven US states (Minnesota IT Services, FBI and EPA).
AI-driven intrusion (July 2026): Hugging Face detected an intrusion run end to end by an autonomous AI agent system (Hugging Face).
Agentic framework in a state-aligned campaign (October 2026): sign-in attempts against more than 2,250 tenants after the ConnectWise Cloud Backup compromise (Microsoft).
Malicious package wave (May 2026): 84 malicious versions across 42 TanStack npm packages (TanStack).
Entries in this timeline: 72 main entries and 41 shorter mentions across 11 months, 1 January to 13 November 2026 (Stingrai count).
Key takeaways
The door was usually someone else's. A refrigeration equipment provider, a backup product, a third-party support platform, a subcontractor of an IT contractor, an integration connected to a CRM: in entry after entry the victim's own perimeter was not the way in. ConnectWise appears twice within a month, once for its Cloud Backup product and once for third-party ScreenConnect extensions.
Disruption is the most common outcome in this timeline, not data theft. 31 of the 72 main entries are disruptive attacks. They closed a Mississippi medical centre's clinics for more than a week, halted bankruptcy notices across the US federal courts, stopped an Australian sugar miller's mills and kept a Japanese taxi operator's telephone dispatch offline for almost three months.
Operational technology no longer sits out of reach. Attackers changed settings on refrigeration controllers in France, locked operators out of water system controllers in the United States, damaged controller firmware at Polish wind and solar farms and, prosecutors suspect, spoofed a rail operator's emergency radio signal in Taiwan. In April, six US agencies said actors affiliated with Iran had disrupted industrial controllers across several critical infrastructure sectors. In both US cases the controllers were internet-facing, and France's CERT told operators to take their units off the internet.
Named attackers are rarer than headlines suggest. Most primary sources in this timeline name no one. Where they do, the names include ShinyHunters (Jack Henry and Odido; Google and Mandiant track the Oracle PeopleSoft activity as UNC6240, which they identify as ShinyHunters), the Warlock Group (SmarterTools), a group calling itself Rhysida (Berlin), the Everest Group, in whose name Stadler received an extortion letter, actors affiliated with North Korea (Drift, and LayerZero's preliminary view on KelpDAO), a China state-aligned group (ConnectWise and Microsoft), UNC3886 (Singapore), actors affiliated with Iran (the US advisory on industrial controllers) and a unit affiliated with Iran's Islamic Revolutionary Guard Corps (France).
Speed is the new variable. Microsoft measured less than three hours from initial targeting to privileged cloud access in multiple cases, and the TanStack maintainers recorded malicious versions published and detected within half an hour. Detection that takes a day is now detection after the fact.
How this timeline is built
Inclusion. An incident is listed when a primary source confirms it: the affected organisation's notice, press release, status page or post-mortem; a filing with a securities regulator or stock exchange (for US companies, a Form 8-K on SEC EDGAR); a statement by a government body, court, regulator or national CERT; or a government advisory. News reports were used to find incidents, never as the basis for a fact stated here. Incidents known only from an attacker's leak site or from press coverage were left out.
Significance. Priority went to attacks with operational impact (outages at hospitals, manufacturers, retailers, utilities and public services), software supply chain compromises, large thefts, intrusions tied to a state by a government or the victim, and mass exploitation of a vulnerability confirmed by the vendor or by CISA. Large data breaches appear where they are part of the month's story, but this page does not try to list them all.
Dates. Entries are placed in the month the attack happened or was detected. Where the source gives only the date of the announcement, the entry says "announced", "disclosed" or "advisory". One January entry describes an attack of 29 December 2025 that Poland's national CERT documented on 30 January 2026.
Labels. Each entry carries one of six labels: disruptive attack (ransomware, wiper or an outage caused by the attack), data theft or intrusion, supply chain compromise, theft of funds, exploited vulnerability campaign, or state-linked intrusion. The last is used only where a government or the victim itself has publicly tied the attack to a state. The word ransomware appears only where the source uses it.
Limits. Research for this edition closed on 13 November 2026. Coverage is strongest for North America, Europe and Japan, where organisations and regulators publish notices. Counts and descriptions change as investigations continue, so each entry reflects the linked document as read on that date. Every figure links back to its publisher so any claim can be checked.
Figure 1: Main entries in this timeline by month and label, 1 January to 13 November 2026. Source: Stingrai count of the entries below.
November 2026 (to 13 November)
The month so far is defined by remote management tools and by a second wave against refrigeration controllers, this time at the French blood service, as US agencies warned that such controllers are being targeted globally.
11 November (disclosed), ConnectWise ScreenConnect partners (supply chain compromise). ConnectWise said it was aware of reports of unauthorized access to ScreenConnect partner accounts and of unauthorized remote-access software deployed in customer environments. Its initial assessment, which it is still validating, is that the activity may involve abuse of independent third-party extensions; it identified five that may be associated with the activity and disabled them in about 400 partner environments as a precaution. It says it has found no evidence of a compromise of its own infrastructure or that initial access involved a ScreenConnect vulnerability. Source: ConnectWise Trust Center.
9 November, Vanderbilt University, United States (disruptive attack). The university told staff and students to shut down university devices and disconnect from campus Wi-Fi while it restricted access to most systems. Classes continued. It later described a "cybersecurity hacking incident" and said full restoration may take multiple weeks. The university has named no attacker. Source: Vanderbilt University.
9 November (announced), Nitori Holdings, Japan (data theft or intrusion). The furniture retailer confirmed unauthorized access to a system it manages on 6 November and said up to 37.62 million records of personal information may have leaked. Its log analysis indicates there may have been access from mid to late October as well. Login passwords and credit card data are not among the records. Source: Nitori Holdings.
6 November, Santos Port Authority, Brazil (disruptive attack). The authority that manages the Port of Santos said its files were hit by a cyber attack after systems were restarted following a power outage. By 12 November it had recovered about 70% of its file backups and was still restoring online systems, with some services provided by other means. It says port operations continued. Source: Santos Port Authority.
4 November (announced), Crédit Mutuel Arkéa, France (theft of funds). The bank said it had been the victim of an attack that allowed fraudulent transactions, and temporarily suspended certain transactions. In a second statement the same day it said the attackers came in through a service provider's platform and used the bank's own account to send transactions to other banks, and that customer assets were not affected. Arkéa has not published a final amount: asked about press reports of EUR 118 million, it said it could confirm only the order of magnitude and that part of the funds had been blocked. Sources: press release, further information.
2 November, French blood service; refrigeration controllers targeted globally (disruptive attack). The Établissement français du sang said an incident at one of its refrigeration equipment providers affected cold-room control at three of its sites, where temperature and defrost thresholds were raised. No blood products were lost. On 5 November CISA, the FBI and three other US agencies published a fact sheet warning that malicious actors are targeting refrigeration controllers globally. Sources: EFS, CISA.
1 to 2 November, Beget, Russia (disruptive attack). The hosting provider said attackers reached the management layer of its whole architecture overnight and launched wiping scripts. All data in its cloud infrastructure (virtual servers, object storage and Kubernetes) was lost, along with the binary backups of its virtual servers. Source: Beget.
Also confirmed in November: Europol announced on 12 November that Operation Endgame had seized 235 servers and 257 domains behind the Gootloader, CastleRAT and StealC malware (Europol).
October 2026
October brought the largest theft in this timeline, a state-attributed sabotage campaign against French food retailers and a supply chain compromise that Microsoft and the vendor both tied to a China state-aligned group using an AI agent framework.
29 October (announced 30 October), Binance (theft of funds). In its announcement of 30 October, Binance put the estimated total impact of its security incident at around US$6.3 billion, with about US$3 billion frozen on-chain. Its initial investigation suggests a compromised DevOps engineer's laptop let an attacker reach a service container and submit unauthorized withdrawal transactions. Binance found no evidence of a wallet private key leak and said it would cover all losses from its SAFU fund and company funds. Its announcement names no attacker. The analytics firm TRM Labs timed most of the outflows to about 20 minutes from 20:05 UTC on 29 October. Sources: Binance, TRM Labs. Our Binance hack analysis covers the root causes.
26 October, University of New Mexico Health Sciences, United States (disruptive attack). UNM said a cybersecurity threat affected some end-user devices but did not reach core systems or servers. UNM Health diverted ambulances for two hours and suspended outpatient surgeries and appointments for the rest of the day, and four health sciences schools cancelled classes the next day. UNM said it made no concessions to any group behind the threat. Source: UNM Health Sciences.
21 October, LiteLLM (supply chain compromise). The maintainers of the open-source AI gateway said their release pipeline was compromised and a malicious version 1.107.0 was pushed to PyPI and to container registries. The package was live on PyPI for about two hours and contained malware that steals credentials. Anyone who installed or ran it in that window was told to assume compromise. Source: LiteLLM.
16 October, ConnectWise Cloud Backup (state-linked intrusion). ConnectWise reported unauthorized access to application credentials associated with its Cloud Backup product, formerly SkyKick. On 21 October it said the evidence, including intelligence shared by Microsoft, pointed to a China state-aligned group. Microsoft tracks the actor as Storm-0940 and says it used the ARTEX agentic framework to attempt sign-ins to more than 2,250 downstream tenants. Sources: ConnectWise, Microsoft. See our ARTEX analysis.
15 October (announced), US bankruptcy courts' noticing centre (disruptive attack). The Administrative Office of the US Courts said a cybersecurity incident at BAE Systems, which runs the Bankruptcy Noticing Center, made all of the centre's systems unavailable and halted the production and distribution of bankruptcy notices. The Judicial Conference declared a Bankruptcy Rules emergency on 22 October, and the courts said the centre was back online by 27 October. Source: US Courts.
12 October (disclosed), Ahold Delhaize, Netherlands and United States (disruptive attack). The grocery group took systems offline after finding a security issue in its network, which put websites and apps out of service at most of its brands in Europe and the United States while stores stayed open. On 19 October it said the activity resulted from the malicious actions of others. It expects the incident to reduce fourth-quarter net sales by EUR 200 million to EUR 250 million. Sources: Ahold Delhaize, Q3 results.
11 to 12 October, refrigeration controllers at French food retailers (state-linked intrusion). Attackers changed defrost settings on remotely managed refrigeration controllers at about 700 retail sites overnight, causing goods losses and starting fires in at least 15 cases. On 9 November France's foreign ministry attributed the campaign to Iran, naming the Shahid Kaveh unit affiliated with the Islamic Revolutionary Guard Corps, and called it the first cyber-offensive campaign conducted purely for sabotage on French territory. The site and fire counts are from the government's incident report published the same day; the ministry's statement says more than 700 sites. Sources: French foreign ministry, incident report, CERT-FR alert.
7 October, IDC Frontier, Japan (disruptive attack). The cloud provider said a ransomware attack caused a failure in one region of its IDCF Cloud service that affected 495 companies and local governments. Its investigation found the attacker exploited a vulnerability in open-source software used by the portal's authentication system, gained administrator rights over the virtualisation platform, then stopped and encrypted customers' virtual servers. Source: IDC Frontier.
Also confirmed in October: Osaka Metropolitan University judged a system failure of 2 October to be a ransomware attack and cancelled classes until 8 October; it later traced the attack to a contractor's subcontractor (second report, third report, fifth report). GMO Internet stopped its Onamae.com Desktop Cloud service on 21 October and refused an extortion demand of about 8 billion yen (GMO). CISA added the Ivanti Connect Secure flaw CVE-2026-104935 to its exploited list on 13 October and two more on 30 October (CISA). Florida's education department said a breach of its student financial aid website may have affected about 4.9 million people (Florida Department of Education). The certificate authority eMudhra revoked eight intermediate certificate authorities after a researcher reported on 17 October that their keys were cryptographically weak; it says no certificates had been issued from them and its infrastructure was not compromised (eMudhra). Japan also saw a run of very large data thefts: the email delivery service Arara had 81,329,467 email addresses taken between 28 and 31 October, a count of addresses and not people (Arara); Ymirlink, another email delivery vendor, put its leak at 47,864,147 records, a cumulative count across 49 customer systems, in a third report of 11 November that replaced an earlier maximum estimate of about 51.6 million; and Ryohin Keikaku, the operator of MUJI, said about 27.26 million records may have leaked from its app and online store (fourth report, 9 November).
September 2026
27 September (disclosed), Citrix NetScaler zero-days (exploited vulnerability campaign). Citrix said exploits of CVE-2026-88771 and CVE-2026-88772 had been observed on unmitigated NetScaler deployments. CISA added both to its Known Exploited Vulnerabilities catalog the same day and said threat actors were actively exploiting them globally. It added a third NetScaler flaw, CVE-2026-88779, on 4 October, and its alert now also covers CVE-2026-107406. Sources: Citrix, CISA. Our NetScaler checklist covers compromise checks.
26 September, Keio Corporation, Japan (disruptive attack). The railway group confirmed a ransomware attack on its group servers before dawn. Business systems at some group companies were disrupted. Train operations were not affected, and no data leak had been confirmed at the time of its notice. Source: Keio.
25 September, Park24 (Times Car), Japan (data theft or intrusion). Park24 detected unauthorized external access to the web system of its Times Car car-sharing service and closed the access route the next morning. It confirmed that about 6.6 million accounts were leaked. Credit card information was not. Source: Park24.
25 September (reported), Oracle PeopleSoft (exploited vulnerability campaign). Mandiant and Google Threat Intelligence Group reported renewed mass exploitation of CVE-2026-35273 by the group they track as UNC6240 (ShinyHunters), which had changed its exploit to get past web application firewall rules and placed web shells on dozens of systems globally. Oracle had issued its security alert for the flaw on 10 June. Sources: Google Threat Intelligence Group, Oracle.
24 September, Bitget (theft of funds). The exchange detected unauthorized transfers from some of its hot wallets and first estimated the loss at about US$351.6 million. It later confirmed that assets worth about US$387.5 million were transferred to attacker-controlled addresses. Bitget says reports by Mandiant and SlowMist identified the compromise of third-party security products as the route into its wallet environment. Sources: Bitget notice, Bitget update, Bitget on the Mandiant and SlowMist reports.
11 September (announced), Digital Agency, Japan (data theft or intrusion). The agency said a third party entered the Government Solution Service it operates by exploiting a vulnerability in VPN equipment. It detected mass file access through a maintenance operator's account on 25 June and confirmed the intrusion route on 9 July. About 246,000 items of personal information may have leaked, most of them relating to public servants. Source: Digital Agency.
4 to 5 September, DriveWealth, United States (data theft or intrusion). The brokerage infrastructure firm told customers of unauthorized access to its network on 4 and 5 September, contained on 5 September, in which names and other personal data were exfiltrated. Its filings with the Texas and Indiana attorneys general give a total of 30,000,000 people, a round figure; the public Texas table, published on 2 October, shows the 2,556,688 affected Texans. Sources: DriveWealth notice, Texas Attorney General, Indiana Attorney General.
Also confirmed in September: CenterPoint Energy said an unauthorized third party obtained personal information on a portion of its customers through an external-facing system (Form 8-K), and Astrana Health reported that callers impersonating company staff and spoofing its main telephone number had contacted employees to try to gain access to its systems (Form 8-K). Sagawa Express, the Japanese parcel carrier, said unauthorized access to its parcel inquiry service may have leaked up to about 53.23 million records, a maximum that still includes duplicates, including waybill data for 21 June to 30 September (fifth report, 23 October). Helpfeel said a vulnerability in the image upload server of its screenshot service Gyazo was exploited on 11 September, exposing about 23.62 million user account records, of which about 5.62 million have a registered email address (first notice, second notice).
August 2026
31 August (announced), Jack Henry, United States (data theft or intrusion). The banking technology provider said an incident in a non-production corporate environment began with a vishing call by a threat actor it identified as ShinyHunters. Personally identifiable information for fewer than 10 client institutions was affected, no client-facing systems were reached, and the company said it was not paying the extortion demand. Source: Jack Henry.
26 August (announced), US Bureau of Alcohol, Tobacco, Firearms and Explosives (data theft or intrusion). ATF said it was responding to a cybersecurity incident on a standalone system separate from its enterprise network, which senior Justice Department officials designated a major incident. On 31 August it said it was aware of claims that data from the system had been published and could not confirm their authenticity. Sources: ATF, 26 August, ATF, 31 August.
25 August, Boston Scientific, United States (disruptive attack). The medical device maker identified an incident that caused a global disruption to its operations. A network outage cut access to operating systems and business applications and affected its ability to manufacture, process and ship orders. On 8 September it said the incident was likely to have a material impact on its third-quarter results. Source: Form 8-K.
14 August, State of Berlin, Germany (disruptive attack). Two Senate departments were cut off from the state network on the evening of 14 August and reconnected over the weekend of 22 and 23 August. The Senate press office said a group calling itself Rhysida claimed the attack and offered 5.7 terabytes of data at auction. Berlin said it would not be blackmailed. Sources: Berlin Senate Chancellery, 23 August, 3 September.
14 August (announced), French tax administration (data theft or intrusion). France's finance ministry said illegitimate access to the tax administration's information system in June and July, using stolen credentials of a tax agent and of an authorised third party, was used to consult and extract data on 678,000 individuals and businesses. Source: French Ministry of Economy and Finance.
12 August (announced), MyDr, Poland (data theft or intrusion). Poland's Ministry of Digital Affairs said the medical software provider had confirmed unauthorized access to historical data, up to April 2024, of medical practices stored in its systems. The ministry said the incident may concern 18.8 million people and more than 12,000 medical facilities. Source: Polish Ministry of Digital Affairs.
8 to 10 August, Road Traffic Safety Directorate, Latvia (data theft or intrusion). The directorate said an attacker obtained data held in payment receipts going back to 2008, affecting 1.2 million natural persons and 200,000 legal persons. Source: CERT.LV.
4 August (announced), Swiss federal SharePoint servers (exploited vulnerability campaign). The Swiss federal administration said an attack on SharePoint servers run by its IT office, noticed on 28 July and presumably enabled by vulnerabilities Microsoft disclosed in mid-July, compromised about 200 accounts. Internet access to the servers was blocked while they were rebuilt. Source: Swiss federal administration.
Also confirmed in August: Manchester Airports Group said booking and Wi-Fi sign-up data for customers of its three airports was obtained and published (MAG); McKesson discovered an incident on 25 August that it says involved third-party applications and the exfiltration of data (Form 8-K, McKesson); Nutex Health said patient and employee data was exfiltrated and that the third party had threatened to post it (Form 8-K); and an 18 August update to the joint US advisory on Medusa ransomware put its victims at more than 500 across critical infrastructure sectors (CISA).
July 2026
26 to 27 July, community water systems, United States (disruptive attack). Minnesota IT Services said a coordinated attack targeted operational technology at more than 30 community water systems in the state. The FBI and EPA said actors remotely accessed internet-facing controllers and changed their IP addresses and passwords, which cut monitoring and control, and that utilities in at least seven states had reported incidents. CISA said the activity led to boil water notices and sustained manual operations. Minnesota has not attributed the attack. Sources: Minnesota IT Services, FBI and EPA, CISA.
16 July (announced), fairlife, United States (disruptive attack). The Coca-Cola Company said its dairy subsidiary found unauthorized access to part of its systems, including production-related systems, in connection with a ransomware event. Production at fairlife in the United States was temporarily suspended. Source: Form 8-K.
16 July (disclosed), Hugging Face (data theft or intrusion). Hugging Face said it had detected an intrusion into part of its production infrastructure that was driven end to end by an autonomous AI agent system, with unauthorized access to a limited set of internal datasets and several service credentials. On 21 July OpenAI said the incident was driven by a combination of its own models, running with reduced cyber refusals during an internal benchmark of cyber capabilities. Sources: Hugging Face, OpenAI. See our reconstruction of the incident.
Mid-July, Stadler Rail, Switzerland (data theft or intrusion). The train maker said criminals used compromised credentials to enter a data-exchange platform it shares with a supplier and took technical supplier data. An extortion letter in the name of the Everest Group demanded CHF 10 million. Stadler refused and filed a criminal complaint. Source: Stadler.
11 July, Nihon Kotsu, Japan (disruptive attack). The taxi operator shut down internal systems after a malware infection. Web ordering for its chauffeur service and telephone taxi dispatch went offline, and telephone dispatch was scheduled to resume only on 6 October. Source: Nihon Kotsu.
11 July, Jscrambler npm package (supply chain compromise). Jscrambler said malicious versions of its npm package were published without authorization using an npm publishing credential. They were removed and the credentials rotated. npm recorded 1,479 downloads of the affected versions in a window of about two hours. Source: Jscrambler.
Also confirmed in July: Amgen said data including proprietary information and patient health information was exfiltrated from cloud environments hosted by third parties (Form 8-K); Origin Energy said the information of about 900,000 current and former customers was accessed (Origin Energy, 28 July); and Upbound Group tied about US$13 million of fraudulent lease losses in its Acima segment to stolen customer information (Form 8-K). Coinkite published an advisory on 30 July saying a firmware bug had weakened seed generation on its Coldcard hardware wallets and that attackers had regenerated private keys from the weak seeds and stolen funds (Coinkite).
June 2026
23 June, Bajaj Auto, India (disruptive attack). The motorcycle maker told the Indian stock exchanges that a ransomware attack had impacted its systems and those of a subsidiary. Three days later it said manufacturing, sales, service and other key functions were operating normally. Sources: Bajaj Auto, 23 June, 26 June.
19 to 20 June, national civil defence alert system, Brazil (disruptive attack). An intruder used the Defesa Civil Alerta platform to send false alerts to mobile phones in several regions: ten unauthorized transmissions in under two hours, nine of them extreme-level alerts and one by text message. The ministry took the platform offline at 1:30 on 20 June and called in the Federal Police. Source: Agência Gov.
11 to 12 June, 8x8 through a Klue integration (supply chain compromise). 8x8 said a threat actor exploited a third-party integration from Klue that was connected to its Salesforce system and exfiltrated customer contact, contract and sales information. Source: Form 8-K.
10 June (first statement), Mackay Sugar, Australia (disruptive attack). The sugar miller stopped milling apart from a limited manual crush at one mill and told growers not to harvest. It later identified unauthorized access by an external party to parts of its IT environment. All three mills were operating again by its 26 June update. Sources: Mackay Sugar, 10 June, 26 June.
9 June, University of Nottingham, United Kingdom (data theft or intrusion). The university found unauthorized activity in its student records platform and took the affected systems offline. It says a significant amount of student record data was accessed by a well-known cybercriminal group that also targeted other organisations, through a vulnerability in the Oracle WebLogic software that supports the platform. Source: University of Nottingham.
16 May to 17 June, KDDI, Japan (data theft or intrusion). KDDI said unauthorized access through a vulnerability in third-party software used by its email platform for internet providers began on 16 May and was confirmed on 17 June. Its 6 July release put the confirmed leak at the email addresses of 12,231,954 people, 7,616,173 of them with a system password as well. Source: KDDI.
Also confirmed in June: River Financial Corporation found ransomware across part of its server environment and later confirmed that a threat actor had removed data from it (Form 8-K, Form 8-K/A of 30 July); iRhythm said data in third-party-hosted business applications was obtained through social engineering, and later reported 8,179,772 people to HHS (Form 8-K, HHS); AdaptHealth traced an intrusion into its cloud-based business applications to a social engineering attack on a third-party contractor's user session, and later reported 4,115,802 people to HHS (Form 8-K, HHS); and France's digital directorate said an account on Tchap, the state's messaging service, was compromised on 7 June, which may have exposed account data of 73,467 public agents (DINUM).
May 2026
18 May, GitHub (supply chain compromise). GitHub detected and contained the compromise of an employee device through a poisoned VS Code extension published by a third party. It assessed that only GitHub-internal repositories were exfiltrated and that the attacker's claim of about 3,800 repositories was directionally consistent with its investigation. Source: GitHub.
17 to 20 May, DentaQuest, United States (data theft or intrusion). The dental benefits administrator discovered on 20 May that unauthorized individuals had accessed data on its network over the previous three days, including Social Security numbers and dental and vision health information. It reported 15,000,000 people to HHS on 16 July. Sources: DentaQuest, HHS.
12 May (disclosed), Foxconn, North America (disruptive attack). Hon Hai told the Taiwan Stock Exchange that some of its factories in North America had recently suffered a cyberattack and were returning to normal production. Source: Hon Hai filing.
11 May, TanStack npm packages (supply chain compromise). An attacker published 84 malicious versions across 42 TanStack packages by abusing the project's build pipeline. The payload harvested cloud, GitHub, npm and SSH credentials and spread to other packages its victims maintained. Downstream, OpenAI said two employee devices were affected, and Grafana Labs had its codebase downloaded and refused a ransom demand. Sources: TanStack, OpenAI, Grafana Labs.
4 May, West Pharmaceutical Services, United States (disruptive attack). West detected an intrusion in which data was exfiltrated and systems were encrypted, and took systems offline globally. Shipping, receiving and manufacturing were disrupted. Its 20 May amendment said all sites were operating again. Sources: Form 8-K, Form 8-K/A.
Also confirmed in May: Evertec learned on 13 May that card numbers and transaction records of its financial institution clients' customers had been obtained through a third-party support platform (Form 8-K), and the Texas Parks and Wildlife Department said an incident at its licence system vendor, detected the same day, may have exposed data on more than 3 million licence customers (TPWD). French and Dutch authorities shut down the criminal service First VPN on 19 and 20 May (Eurojust).
April 2026
29 April, Instructure (Canvas) (data theft or intrusion). Instructure detected unauthorized activity in Canvas on 29 April and said the actors took usernames, email addresses, course and enrollment information and messages. On 7 May the same actor used a second vulnerability to change pages shown to some users, and Canvas went into maintenance mode until 9 May. On 11 May Instructure said it had reached an agreement with the actor to have the data returned and destroyed. Sources: Instructure fact sheet, incident updates.
19 April (disclosed), Vercel through Context.ai (supply chain compromise). Vercel said an incident that began with the compromise of Context.ai, a third-party AI tool used by one employee, let an attacker take over that employee's Google Workspace account, move into a Vercel environment and read environment variables that were not marked sensitive for a limited subset of customers. Source: Vercel.
18 April, KelpDAO and LayerZero (theft of funds). KelpDAO's rsETH token was exploited for about US$290 million. LayerZero said attackers compromised two RPC nodes used by its verifier and used a denial of service attack on the others, so the verifier confirmed transactions that never took place. Its preliminary attribution is to North Korea's Lazarus Group, "more specifically TraderTraitor". Source: LayerZero.
7 April, ChipSoft, Netherlands (disruptive attack). A Dutch minister told parliament that hackers attacked the patient record software supplier and stole patient data from a substantial number of care providers that use its cloud. According to the minister, connections to the patient portals ChipSoft hosts were cut from 8 April and functions began restarting from 17 April. Sources: letter to parliament, answers to parliamentary questions.
7 April (advisory), industrial controllers, United States (state-linked intrusion). The FBI, CISA, the NSA, the EPA, the Department of Energy and the Cyber National Mission Force said actors affiliated with Iran were exploiting internet-facing operational technology, including Rockwell Automation/Allen-Bradley programmable logic controllers. They said the activity had disrupted controllers across several US critical infrastructure sectors, including government facilities, water and wastewater systems and energy, causing operational disruption and financial loss. A revision of 22 July widened the advisory to observed targeting of Schneider Electric and Siemens controllers. Sources: joint advisory AA26-097A, CISA, revised 22 July.
6 April, Winona County, United States (disruptive attack). An attack on the Minnesota county's critical systems and digital services persisted overnight, and the governor authorised the National Guard to provide cyber protection support. Source: Executive Order 26-06.
5 April, Taiwan High Speed Rail (disruptive attack). The operator's control centre received an emergency alarm that appeared to come from one of its own radio handsets, and three trains in service made manual emergency stops, causing 48 minutes of delays. Prosecutors suspect that a handset's signal parameters were copied and spoofed, and a university student was detained on 28 April. Source: Taoyuan District Prosecutors Office.
1 April, Drift Protocol (theft of funds). The Solana trading protocol was exploited and suspended trading and borrowing. Drift puts the loss at US$295 million in user funds and says the operation was carried out by a threat actor affiliated with North Korea, as confirmed by Mandiant. Source: Drift.
Also confirmed in April: DigiCert revoked 60 certificates after malicious files sent through its support chat from 2 April compromised two analysts' machines and let an attacker obtain code-signing certificates, some of which were used to sign malware (DigiCert incident report). Northern Ireland's Education Authority reset every password on its C2k school network after a cyber attack and said on 17 April that more than 414,000 user accounts had been reconnected (password reset, restoration). Basic-Fit said data on members in several countries, around 200,000 of them in the Netherlands, was downloaded from its club visit system (Basic-Fit). Medtronic said on 24 April that an unauthorized party had accessed data in corporate IT systems; its notice letter dates the access to 13 to 19 April, and its state filings count 3,834,294 people (statement, notice letter, Indiana Attorney General).
March 2026
31 March, axios npm package (supply chain compromise). Two malicious versions of axios were published through the lead maintainer's compromised account and stayed live for about three hours. They pulled in a dependency that installed a remote access trojan on macOS, Windows and Linux. The maintainer says the attacker reached his computer through a targeted social engineering campaign. Source: axios post-mortem.
28 March, Hasbro, United States (disruptive attack). Hasbro identified unauthorized access to its network and took systems offline. It warned that the interim measures it was using to take orders and ship products might last several weeks and cause delays. Source: Form 8-K.
24 March, LiteLLM (supply chain compromise). Malicious versions 1.82.7 and 1.82.8 of the LiteLLM package were live on PyPI for about 40 minutes before they were quarantined. They carried a credential stealer that harvested environment variables, SSH keys, cloud credentials, Kubernetes tokens and database passwords. Source: LiteLLM.
23 March, Bitcoin Depot, United States (theft of funds). The Bitcoin ATM operator said an unauthorized party gained control of credentials for its digital asset settlement accounts and transferred about 50.903 Bitcoin, worth about US$3.665 million, out of company wallets. Source: Form 8-K.
19 March, Ministry of Finance, Netherlands (disruptive attack). The ministry found unauthorized access to part of its systems and switched systems off on 23 March, including the digital treasury banking portal. About 1,600 public institutions could not view balances or request loans through the portal, although payments continued. Source: Letter to parliament.
11 March, Stryker, United States (disruptive attack). The medical technology company identified an incident that caused a global disruption to its Microsoft environment, and on 9 April said it had a material impact on its operations. Its first filing said it had no indication of ransomware or malware. CISA responded on 18 March by urging organisations to harden endpoint management systems. A US Justice Department release of 19 March says Iran's Ministry of Intelligence and Security used one of four seized domains to claim credit for a March 2026 destructive malware attack on a US-based medical technologies firm, which the release does not name. Sources: Form 8-K, Form 8-K/A, CISA, Department of Justice.
Also confirmed in March: the European Commission discovered on 24 March that data had been taken from the cloud infrastructure hosting its Europa websites (European Commission); France's education ministry said data on about 243,000 staff was exfiltrated from a trainee teacher management system after an external account was taken over on 15 March (French Ministry of National Education); Loblaw said a criminal third party accessed basic customer information (Loblaw); and CareCloud said an unauthorized third party disrupted one of its six electronic health record environments for about eight hours on 16 March; it later reported 3,756,469 people to HHS (Form 8-K, HHS).
February 2026
25 February, Cisco SD-WAN systems (exploited vulnerability campaign). CISA issued Emergency Directive 26-03, saying a threat actor's ongoing exploitation of Cisco SD-WAN systems posed an imminent threat to federal networks. Agencies had to inventory their systems by the next day, patch them and look for compromise. Source: CISA.
19 February, University of Mississippi Medical Center, United States (disruptive attack). UMMC shut down all its network systems after a cyberattack, closed its clinics statewide and cancelled elective procedures, while its hospitals and emergency departments ran on downtime procedures. Clinics returned to normal operations on 2 March. Sources: UMMC memo, 19 February, UMMC, 2 March.
18 February (announced), national bank account registry, France (data theft or intrusion). The tax administration said a malicious actor using the stolen credentials of a civil servant had, from the end of January, consulted part of FICOBA, the file of every bank account opened in France. The data concerns 1.2 million accounts: bank details, holder identity and address. Source: French tax administration.
6 February, BridgePay, United States (disruptive attack). The payment gateway went down system-wide and BridgePay confirmed a ransomware attack that evening. It reported its gateways restored on 28 February, about three weeks later, and said initial forensic findings indicated no payment card data was compromised. Source: BridgePay status page.
5 to 6 February, Odido, Netherlands (data theft or intrusion). The telecoms provider said a caller posing as a member of its IT staff vished its customer service team on two consecutive days, in an attack it attributes to the criminal organisation ShinyHunters. About 6.39 million people were affected, and Odido did not pay the ransom. Source: Odido.
3 February, CONPET, Romania (disruptive attack). The national crude oil pipeline operator said a cyber attack affected its business IT infrastructure and took its website offline. Its SCADA and telecommunications systems were not affected and oil transport continued normally. Source: CONPET market release.
Also confirmed in February: the Dutch government told parliament on 6 February that a vulnerability in Ivanti Endpoint Manager Mobile had been abused at its data protection authority and its Council for the Judiciary (Letter to parliament), and the European Commission said the same day that its central mobile device management infrastructure had found traces of an attack on 30 January, contained within nine hours (European Commission). Advantest detected unusual activity on 15 February and said an unauthorized third party may have accessed parts of its network and deployed ransomware (Advantest). Singapore disclosed on 9 February that the actor it calls UNC3886 had run a targeted campaign against all four of its major telecoms operators (Cyber Security Agency of Singapore).
January 2026
29 January, SmarterTools, United States (disruptive attack). The maker of SmarterMail said its own network was breached through one unpatched SmarterMail virtual machine. It shut off servers at two locations, found about 12 Windows servers that looked compromised, and named the Warlock Group as the attacker. CISA had added two SmarterMail flaws to its exploited list three days earlier, and the catalog now flags both for use in ransomware. Sources: SmarterTools, CISA KEV catalog.
22 to 27 January, Fortinet FortiCloud single sign-on (exploited vulnerability campaign). Fortinet said customers had reported unexpected logins on devices, including fully patched ones. A flaw, CVE-2026-24858, let an attacker with a FortiCloud account log into devices registered to other accounts and create local administrator accounts. Fortinet disabled FortiCloud single sign-on on 26 January and re-enabled it the next day for patched devices only. Sources: Fortinet advisory, Fortinet PSIRT blog.
14 January (announced), Canadian Investment Regulatory Organization (data theft or intrusion). The regulator confirmed that a phishing attack it first disclosed in August 2025 affected about 750,000 Canadian investors, with data including social insurance numbers, government identification numbers and account statements. Source: CIRO.
13 January, AZ Monica hospital, Belgium (disruptive attack). The Antwerp hospital shut down all servers for its two campuses after a serious disruption of its IT systems at 06:32. No planned procedures could take place that day, its emergency department ran at reduced capacity, and seven patients needing critical care were moved to other hospitals. Source: AZ Monica.
29 December 2025 (reported 30 January), energy sector, Poland (disruptive attack). Poland's national CERT reported that coordinated, purely destructive attacks hit more than 30 wind and solar farms, a manufacturing company and a large combined heat and power plant. Attackers damaged controller firmware and launched wiper malware. Stations lost contact with the grid operator, but electricity production and heat supply were not interrupted. Source: CERT Polska.
Also confirmed in January: the New Zealand patient portal Manage My Health, which identified unauthorized access to a documents feature on 30 December 2025, obtained an interim High Court injunction (Manage My Health).
The largest thefts of 2026
Six entries in this timeline are thefts of money or digital assets, and four of them exceed US$250 million by the figure the organisation or its infrastructure provider published. Binance's estimate of about US$6.3 billion is more than six times the other three combined, which together come to about US$973 million.
Figure 2: Thefts of funds in this timeline, by the figure each organisation or its infrastructure provider published. Crédit Mutuel Arkéa has not published a final amount. Sources: Binance, Bitget, Drift, LayerZero, Bitcoin Depot.
Date | Organisation | Stated loss | How it happened, per the source |
|---|---|---|---|
29 October (announced 30 October) | Binance | About US$6.3 billion (estimated total impact) | Initial investigation: a compromised DevOps engineer's laptop gave access to a service container used to submit withdrawals |
24 September | Bitget | About US$387.5 million | Compromise of third-party security products gave access to the wallet environment |
1 April | Drift Protocol | US$295 million in user funds | Operation by a threat actor affiliated with North Korea, per Drift citing Mandiant |
18 April | KelpDAO | About US$290 million (LayerZero's figure) | Two RPC nodes used by LayerZero's verifier were compromised and the rest hit by denial of service |
23 March | Bitcoin Depot | About US$3.665 million (50.903 Bitcoin) | Control of credentials for settlement accounts |
4 November (announced) | Crédit Mutuel Arkéa | No final amount published; the bank confirmed only the order of magnitude of press reports of EUR 118 million | Fraudulent transfers from the bank's own account, through a service provider's platform |
For the wider numbers on exchange and protocol losses, see our crypto hacking statistics for 2026.
What the 2026 attacks have in common
Suppliers and integrations. The route in ran through a third party in more than a dozen entries: a refrigeration equipment provider (French blood service), a contractor's subcontractor (Osaka Metropolitan University), a managed backup product (ConnectWise Cloud Backup), remote access extensions (ScreenConnect, on ConnectWise's initial assessment), a CRM integration (8x8), an AI tool used by one employee (Vercel), third-party security products (Bitget), a service provider's platform (Crédit Mutuel Arkéa) and a shared data-exchange platform (Stadler). An organisation's test scope that stops at its own network misses most of these.
People on the phone and in chat. Jack Henry and Odido both describe vishing calls. Astrana Health describes callers spoofing its own switchboard number. DigiCert's intruder sent a malicious file through support chat, and the axios maintainer was compromised by a targeted social engineering campaign. In each case a person with legitimate access was the control that failed.
Edge devices and management planes. Citrix NetScaler, Ivanti Connect Secure, Ivanti Endpoint Manager Mobile, Cisco SD-WAN, Fortinet's cloud single sign-on, and a VPN at Japan's Digital Agency were all exploited, several of them as zero-days, and Switzerland's federal administration presumes that SharePoint flaws let attackers into its servers. IDC Frontier's attacker went from a portal's authentication system to administrator rights over a virtualisation platform, and Beget's reached the management layer of its whole architecture.
Build pipelines and package registries. axios, LiteLLM (twice), TanStack, Jscrambler and a poisoned editor extension at GitHub show the same pattern: a publishing credential or a build workflow is taken over, a malicious version is live for minutes or hours, and the payload collects the credentials it needs to spread. The exposure window is short, but anything that installed the package in that window has to be treated as compromised.
Stolen credentials against government data. France's tax administration (twice), its education ministry and its state messaging service show how often a single valid account is enough to extract records in bulk. Each of those notices traces the access to stolen credentials or a taken-over account, not to a software flaw.
Automation on the attacker's side. The Hugging Face intrusion and the ARTEX activity Microsoft describes are the first entries in a timeline like this where the operator was, in whole or in part, an AI agent. What stands out in both reports is how little time defenders had to respond.
What this means for security testing
A timeline of other organisations' incidents is useful when it changes what you test. Five checks follow directly from the entries above.
Test the routes suppliers have into you. Inventory every third-party application, integration and remote access tool with standing access to your tenant, network or data, then have a tester try to use that access the way an intruder would. A cloud penetration test should cover application registrations, service principals and consent grants, which is where the ConnectWise Cloud Backup activity went.
Test the service desk, not only the inbox. A phishing and vishing campaign that includes help desk reset calls and callback scenarios measures the control that failed at Jack Henry, Odido and Astrana Health.
Treat edge appliances as assume-breach. After a zero-day in a VPN or gateway, patching is not the end of the work. An external and internal network penetration test shows what an attacker holding that appliance could reach next and whether anyone would notice.
Find out how fast you can respond. A red team engagement with an agreed objective and measured detection and containment times answers the question the under-three-hours figure raises. Our red team detection benchmarks give reference points.
Check what your pipelines can publish. Review which tokens and workflows can publish a package or push an image, and include the build system in the scope of a web application penetration test when source access is given.
Where Stingrai fits
Stingrai is a CREST-accredited penetration testing company offering fully human-led and hybrid (human penetration testers plus AI agents) penetration tests, delivered by experienced penetration testers who are also world-class security researchers and bug bounty hunters.
The attack routes in this timeline map onto work the team does every week. Cloud penetration tests cover AWS, Azure and Entra ID, and Google Cloud from the control plane to the workloads, including app registrations, service principals and consent grants. Internal and external network tests and Active Directory security assessments follow an intruder from a perimeter device to privilege escalation and lateral movement. Phishing and vishing campaigns test whether a help desk can be talked into granting access, and red team engagements chain those routes together, as assumed breach or full black-box scenarios, against an agreed objective. The team holds 18 published CVEs and certifications including OSCE³, OSWE, OSEP and CREST CRT.
Findings are posted to the PTaaS portal as they are confirmed, each with a working proof of concept and remediation guidance, and retesting of fixed findings is included. Engagements run as one-time tests or continuous programs. For one web application and associated APIs there are two published packages on the pricing page: the Autonomous Pentest, run by Snipe, Stingrai's autonomous AI agent for web applications and associated APIs, is US$3,000 one-time, and the Hybrid Pentest, in which Snipe and human penetration testers test together, is US$6,800 one-time. Network, cloud, mobile, social engineering and red team work is scoped per engagement.
Frequently Asked Questions
What are the most recent cyber attacks?
As of 13 November 2026, the most recent confirmed attacks are unauthorized access to ConnectWise ScreenConnect partner accounts, which ConnectWise's initial assessment links to third-party extensions (disclosed 11 November), an attack that led Vanderbilt University to restrict most of its systems (9 November), a breach at Nitori Holdings in which up to 37.62 million records may have leaked (announced 9 November), an attack on the Santos Port Authority in Brazil (6 November) and fraudulent transfers from Crédit Mutuel Arkéa's own account (announced 4 November).
What was the biggest cyber attack of 2026?
By money stolen, the biggest confirmed attack of 2026 so far is the Binance incident of 29 October, which Binance estimated on 30 October at about US$6.3 billion in total impact with about US$3 billion frozen on-chain. By operational disruption, the most widely felt include Stryker (11 March), Boston Scientific (25 August) and Ahold Delhaize (October), each of which reported or expects a material or nine-figure business impact. Breaches ranked by the number of people affected are a separate list.
Which cyber attacks in 2026 had physical effects?
Attackers changed defrost settings on refrigeration controllers at about 700 French retail sites on the night of 11 to 12 October, starting fires in at least 15 cases. In July, controllers at more than 30 Minnesota community water systems were targeted, and CISA said similar activity led to boil water notices. Hospitals in Belgium and New Mexico diverted ambulances or moved patients, three high-speed trains made emergency stops in Taiwan on 5 April, and Brazil's civil defence platform sent false extreme-level alerts on 19 and 20 June.
Which 2026 cyber attacks were attributed to a nation state?
France attributed the October refrigeration controller campaign to a unit affiliated with Iran's Islamic Revolutionary Guard Corps. Six US agencies said in an advisory of 7 April that actors affiliated with Iran had disrupted industrial controllers across several US critical infrastructure sectors. ConnectWise and Microsoft tied the Cloud Backup compromise to a China state-aligned group that Microsoft tracks as Storm-0940. Drift Protocol said its US$295 million loss was the work of a threat actor affiliated with North Korea, and LayerZero's preliminary view of the KelpDAO theft points to North Korea's Lazarus Group. Most other entries name no attacker.
What were the major software supply chain attacks of 2026?
The main ones in this timeline are the axios npm package (31 March), LiteLLM on PyPI (24 March and again on 21 October), 84 malicious versions across 42 TanStack npm packages (11 May), a poisoned VS Code extension that led to the theft of GitHub-internal repositories (18 May), the Jscrambler npm package (11 July), the Vercel incident that began at a third-party AI tool (April), the ConnectWise Cloud Backup compromise (October) and the ScreenConnect partner account intrusions that ConnectWise's initial assessment links to third-party extensions (November).
Which healthcare organisations were hit by cyber attacks in 2026?
Entries in this timeline include AZ Monica hospital in Belgium (13 January), the University of Mississippi Medical Center (19 February), Stryker (11 March), ChipSoft in the Netherlands (7 April), West Pharmaceutical Services (4 May), DentaQuest (17 to 20 May), Boston Scientific (25 August), University of New Mexico Health Sciences (26 October) and the French blood service (2 November). MyDr in Poland, Medtronic, Amgen, iRhythm, AdaptHealth, McKesson and Nutex Health reported data theft.
How is this timeline sourced and how often is it updated?
Each entry links to a primary source: the affected organisation's own notice, a filing with a securities regulator or stock exchange, or a statement or advisory from a government body. News reports are used only to find incidents. An attacker is named only where the primary source names one. A new month is added at the top each month, and the page shows the date of the last update.
What do the 2026 attacks mean for penetration testing?
They argue for testing the routes that were actually used: third-party integrations and remote access tools with standing access, help desk and callback social engineering, internet-facing edge appliances and management interfaces, build pipelines that can publish packages, and the time it takes to detect and contain an intruder once inside. Scope decisions made from that list are more useful than a generic checklist.
How to cite this page
Stingrai. "Recent Cyber Attacks 2026: A Month-by-Month Timeline." Stingrai Blog, 13 November 2026. https://www.stingrai.io/blog/recent-cyber-attacks-2026
Cite individual facts to the primary source linked in each entry. This compilation is licensed under CC BY 4.0.
References
Every entry above links to its own primary document. The publishers and registers used most often are listed here.
US Securities and Exchange Commission. EDGAR full-text search, Form 8-K filings under Items 1.05 and 8.01, 1 January to 13 November 2026. https://efts.sec.gov/LATEST/search-index?q=%22Material%20Cybersecurity%20Incidents%22&forms=8-K
CISA. Known Exploited Vulnerabilities catalog, alerts, advisories and Emergency Directive 26-03. https://www.cisa.gov/known-exploited-vulnerabilities-catalog
CERT-FR and the French Ministry for Europe and Foreign Affairs. Alert CERTFR-2026-ALE-012 (12 October 2026), incident report CERTFR-2026-CTI-009 and attribution statement (both 9 November 2026). https://cert.cyber.gouv.fr/cti/CERTFR-2026-CTI-009/
Microsoft Threat Intelligence. Storm-0940 report. 21 October 2026. https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/
ConnectWise. Trust Center advisories, Cloud Backup (from 16 October 2026) and ScreenConnect (from 11 November 2026). https://www.connectwise.com/company/trust/advisories
Mandiant and Google Threat Intelligence Group. Oracle PeopleSoft campaign update. 25 September 2026. https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-renewed-mass-exploitation-campaign-targeting-oracle-peoplesoft
FBI and EPA. Public service announcement on water and wastewater controllers. 30 July 2026. https://www.ic3.gov/PSA/2026/PSA260730.pdf
CERT Polska. Energy sector incident report. 30 January 2026. https://cert.pl/en/posts/2026/01/incident-report-energy-sector-2025/
Europol and Eurojust. Operation Endgame (12 November 2026) and First VPN (21 May 2026) releases. https://www.europol.europa.eu/media-press/newsroom/news/64-million-victim-datasets-secured-in-international-operation-against-malware-networks
Texas and Indiana attorneys general. Data Security Breach Reports and Data Breach Year-to-Date Report. https://oag.my.site.com/datasecuritybreachreport/apex/DataSecurityReportsPage and https://www.in.gov/attorneygeneral/consumer-protection-division/id-theft-prevention/files/DB-Year-to-Date-Report-Novemver-2026.pdf
US Department of Health and Human Services, Office for Civil Rights. Breach Portal, read 13 November 2026. https://ocrportal.hhs.gov/ocr/breach/breach_report_hip.jsf
FBI, CISA, NSA, EPA, DOE and Cyber National Mission Force. Joint advisory AA26-097A. 7 April 2026. https://www.ic3.gov/CSA/2026/260407.pdf
Related reading
Biggest Data Breaches of 2026: The Largest Confirmed Breaches, Ranked
Binance Hack (October 2026): How It Happened, Root Causes and How to Protect Yourself
Healthcare Cyberattacks 2026: DentaQuest, Aesto, Medtronic, Stryker and iRhythm
Citrix NetScaler Zero-Days 2026: Compromise Check and Patch Checklist
Talk to Stingrai
A timeline shows how other organisations were reached. A penetration test or red team engagement shows whether the same routes work against you, and how quickly your team would see them. Request a quote or see the published packages on the pricing page.
