At least one Ukrainian government organization
March 1, 2026
•[ spear-phishing, malware, cyber espionage ]
Ghostwriter, also tracked as FrostyNeighbor, UNC1151, UAC-0057, TA445, PUSHCHA, Storm-0257, and related names, conducted a March 2026 spear-phishing campaign against Ukrainian government organizations. The campaign used malicious PDF lures impersonating Ukrtelecom, geofenced delivery to Ukrainian IP addresses, JavaScript PicassoLoader, host fingerprinting, and selective delivery of Cobalt Strike Beacon. Although no specific Ukrainian government agency was publicly named, reporting described successful compromise activity against Ukrainian government targets; no stolen data volume was reported.
Standard-Examiner
May 2, 2026
•[ ransomware, data leak, cyberattack ]
Qilin listed Standard-Examiner on its leak site on May 2, 2026 and claimed responsibility for a cyberattack, threatening to release sensitive data. Separate reporting noted earlier April production difficulties at the newspaper, but the Standard-Examiner had not publicly confirmed ransomware, data theft, or a connection between the printing disruption and Qilin's claim.
West Pharmaceutical Services
May 4, 2026
•[ ransomware, data exfiltration, encryption ]
West Pharmaceutical Services detected a ransomware intrusion on May 4, 2026. The company reported that attackers exfiltrated data and encrypted systems, prompting containment actions and disrupting manufacturing, shipping, and receiving operations across multiple global facilities. Public reporting did not identify the threat actor or specify the volume or type of exfiltrated data.
Foxconn North American operations
May 11, 2026
•[ cyberattack, data theft, operational disruption ]
Nitrogen claimed responsibility for a cyberattack against Foxconn and alleged theft of roughly 8TB of data spanning more than 11 million files. Foxconn confirmed that some North American factories suffered a cyberattack and said affected factories were resuming normal production. Public reporting supports operational disruption and alleged large-scale data theft, but does not confirm file encryption, data destruction, or the specific disruption mechanism.
Trellix
May 5, 2026
•[ source code leakage, unauthorized access, cyberattack ]
Trellix disclosed unauthorized access to a portion of its source code repository in May 2026. RansomHouse later claimed responsibility and published screenshots as proof of access. Trellix said it had found no evidence that its source-code release or distribution process was affected or that its source code had been exploited. Public reporting did not confirm encryption, data destruction, operational disruption, or customer data exposure.
Fidelity Brokerage Services LLC
August 17, 2024
•[ unauthorized access, fraudulent requests, internal database ]
An unauthorized third party accessed and obtained information from Fidelity's computer network between August 17 and August 19, 2024, using two recently established customer accounts to submit fraudulent requests to an internal database that housed document images. Massachusetts regulators later fined Fidelity Brokerage Services LLC $1.25 million over cybersecurity-control and notification failures tied to the breach.
Pine Bluff School District
December 17, 2025
•[ business email compromise, phishing, fraud ]
A compromised Pine Bluff School District email account was used in a business email compromise scheme to insert fraudulent wiring instructions into legitimate vendor correspondence, causing the district to transfer approximately $3.2 million to scammers in December 2025.
Asian Football Confederation
April 27, 2026
•[ data leak, Personally Identifiable Information (PII), passport scans ]
A threat actor published an alleged Asian Football Confederation and Al Nassr FC player and coach database on a cybercrime forum on April 27, 2026, exposing more than 150,000 records including passport scans, contracts, email addresses, AFC registration files, and personal details. The actor credited ShinyHunters, but public reporting did not confirm ShinyHunters carried out the breach.
Kentwood Public Schools
April 30, 2026
•[ malware, insider threat, network disruption ]
A student deployed malicious software that interfered with Kentwood Public Schools network, causing districtwide WiFi connectivity loss, which was later isolated and restored with help from external experts.
Instructure
May 7, 2026
•[ vulnerability, page-alteration, threat actor ]
On May 7, 2026, ShinyHunters gained additional access through a second Canvas vulnerability and altered pages shown to some logged-in students and teachers. Instructure detected and disabled the page-alteration activity after approximately 10 minutes, took Canvas offline into maintenance mode to contain the incident, and later took Free-for-Teacher offline.
Instructure
April 29, 2026
•[ unauthorized access, data leak, PII ]
Instructure detected unauthorized access to part of its Canvas environment on April 29, 2026. The incident exposed user identifying information and messages from affected institutions; Instructure stated that core learning data, course content, submissions, credentials, passwords, dates of birth, government identifiers, and financial information were not compromised.
4VPS
May 2, 2026
•[ ransomware, infrastructure compromise, billing systems ]
4VPS disclosed on May 2, 2026 that an attack affected its website and billing systems. DataBreaches.net reported that The Gentlemen ransomware group later acknowledged that part of its own backend infrastructure had been compromised because some of it was hosted with 4VPS. Public reporting did not identify the attacker, the exact intrusion method, the total data volume, or the duration of service disruption.
Extant Aerospace
August 23, 2025
•[ ransomware, data breach, PII ]
Extant Aerospace detected ransomware activity on its network in August 2025, later confirming that personal data of over 3,000 U.S. individuals was exposed, including names, addresses, dates of birth and Social Security Numbers.
RXNT
March 1, 2026
•[ data breach, healthcare, PII ]
RXNT, the SaaS provider for the Office of the Attending Physician, experienced a breach on March132026 where attackers accessed the platform and copied patient prescription records, including names, addresses, dates of birth, and medication details.
Various small Brazilian ISPs
January 11, 2026
•[ DDoS attacks, SSH keys, security breach ]
Huge Networks' infrastructure and private SSH keys were used by an unknown adversary to launch DDoS attacks against multiple small Brazilian internet service providers. The company denied involvement, attributing the activity to a security breach discovered in January 2026.
Adams County, Mississippi
April 17, 2026
•[ ransomware, government services, outdated systems ]
Adams County, Mississippi suffered a ransomware attack on April 17, 2026, after an outdated computer in the sanitation department allowed hackers to spread through the county network. The attack locked employees out of key services including court records, car tag payments, and public records processing; about 70% of systems were back online by the time of reporting, but full recovery was still underway.
Mitchell County
October 16, 2025
•[ ransomware, unauthorized access, theft of personal information ]
Mitchell County detected ransomware on its computer network on October 20, 2025, after unauthorized access between October 16 and October 20. The incident encrypted files, disrupted email and phone systems for several days, and involved the theft of personal information and protected health information from Department of Social Services records.
webhostingnz.com
May 1, 2026
•[ API token compromise, authentication bypass, unauthorized access ]
A fullaccess API token was added to a cPanel account for webhostingnz.com server rosie.whsl206.com, giving an attacker control of the account for several hours. The client area and server login were unavailable for ~6hours, and the provider did not shut down the server. The incident is linked to the cPanel authentication bypass vulnerability (CVE202641940).
Canonical
April 30, 2026
•[ DDoS, hacktivism, service outage ]
A hacktivist group claimed responsibility for a distributed denialofservice attack that flooded Canonicals publicfacing infrastructure on 1May2026, causing Ubuntu website, package repositories and security API to become unavailable for over 24hours.
CargoTrack
September 1, 2025
•[ DDoS attack, fleet management, system availability ]
CargoTracks fleet-management platform was targeted by a DDoS attack in fall 2025, temporarily restricting client access; Orange Business and SCUT stabilized the systems within two hours.
