-
Clop ransomware operation (data-leak website)
September 18, 2026
ShinyHunters began compromising Clop's leak website on September 18, 2026, uploading a file and subsequently replacing the site's content. BleepingComputer independently verified the upload and defacement. Clop later acknowledged the compromise, and Grav's developers confirmed the exploited vulnerability. ShinyHunters demanded an eight-figure payment and threatened publication of alleged stolen material; Financial reflects that explicit demand despite additional retaliatory statements. Theft of source code, logs and private keys was not independently verified. The affected server's country, disruption duration and any payment remain undetermined.
-
Undisclosed freight carrier
September 18, 2026
•
[ social, phishing, retail ]
An unnamed third-party freight carrier experienced an email-system compromise. Attackers obtained shipment-related information through the carrier, used it to arrange a fraudulent pickup supported by apparently correct paperwork, and diverted a load of blueberries from a cold-storage facility. The carrier itself was the compromised IT victim; the food theft was a downstream consequence. Victim country, compromise date, technique, actor identity and quantity of accessed correspondence were not disclosed. September 18, 2026 is a publication-date fallback, not the date of the intrusion.
-
Undisclosed company described at the 2026 IFDA Solutions Conference
September 18, 2026
•
[ leak, espionage ]
A cybersecurity executive at the September 2026 IFDA Solutions Conference described a separate unnamed organization that detected a malicious intruder in its network but did not contain the access. According to the panel discussion, the intruder remained in the network for approximately 16 months and ultimately exfiltrated about 12 TB of data. The victim company, industry, country, access vector, incident year and exact intrusion/exfiltration dates were not disclosed. September 18, 2026 is the publication-date fallback and should not be treated as the confirmed compromise month.
-
Kendall Hunt Publishing Company
September 18, 2026
•
[ ransomware, education ]
INC Ransom listed Kendall Hunt Publishing, a Dubuque, Iowa educational publisher, on its leak site on Sept 18, 2026, claiming stolen data and threatening to publish it unless the company negotiated. About 441,000 records were later indexed; the company has not confirmed.
-
United Federation of Teachers
September 18, 2026
•
[ ransomware, education ]
The United Federation of Teachers, New York City's teachers' union, was listed by extortion group N0n on Sept. 18, 2026, claiming theft of ~181,420 legal case documents and demanding negotiation before publication. UFT has not confirmed the breach.
-
Institute for Basic Science Heavy Ion Accelerator Research Institute
September 18, 2026
South Korea's IBS Heavy Ion Accelerator Research Institute confirmed on Aug 11, 2026 that 1,894 items of Raon accelerator administrative and research data had been transferred outside, allegedly by a former team leader around 2022; the leak went undetected for four years.
-
Ludwig-Maximilians-Universität München
September 19, 2026
•
[ hack, leak, education ]
LMU Munich, Germany, disclosed in Sept 2026 that an unauthorized actor accessed student-registration master data in a university IT system and that the data must be assumed to have been retrieved. Modification was prevented; the Bavarian State Criminal Police is investigating.
-
Blok Radio
September 21, 2026
•
[ ddos, hack, technology ]
Blok Radio experienced a traffic-flooding attack on September 21, 2026. SHARE's subsequent monitoring report describes the radio being taken offline twice within eight days, distinguishing this incident from the September 28 disruption. Outage duration and restoration timing were not disclosed. Sabotage is inferred from deliberate obstruction of the radio's online service; the operator, actor type and political affiliation remain unverified.
-
Undisclosed People Playground user
September 21, 2026
•
[ malware, hack, technology ]
The developer confirmed malware infections involving file deletion and publication of sensitive information through malicious Workshop mods. This represents an unnamed affected user, not a Valve corporate breach. September 21 is the outbreak-onset proxy; individual infection timing is unknown. Sabotage is inferred from deliberate destruction; operator identity and actor type remain undetermined.
-
Burnaby School District 41
September 21, 2026
•
[ ransomware, education, financial ]
The district discovered ransomware on September 21, 2026 and later confirmed theft of personal-information files. Network and phone services were affected. September 21 is a discovery proxy; initial access and extraction dates are unknown. The official page was first published September 23 and updated October 14. Neither encryption nor the stolen-data source host was specified, so technical subtypes remain undetermined. Financial motive is inferred from ransomware.
-
Elsevier
September 21, 2026
On Sept 21, 2026, visitors to select Elsevier platforms, including elsevier.com and Evolve, were redirected to a LAPSUS$-branded page taunting the FBI. Elsevier confirmed the redirect, restored service and said no customer data or core systems were compromised.
-
Federal Bureau of Investigation
September 22, 2026
•
[ hack, government, technology ]
ShinyHunters defaced FBIJobs.gov on September 22, 2026 and supplied journalists with a sample of about 5,000 purported FBI personnel records, portions of which were authenticated. The group demanded correction or withdrawal of a May FBI advisory criticizing its methods and denied seeking a ransom in this case. The FBI subsequently confirmed that an unpatched contractor-managed platform enabled the breach; Reuters identified the platform as Oracle PeopleSoft and reported the responsible contractor was removed. The scope of exfiltration and the claimed 2-3 TB remain unverified. The group is coded Criminal by its identity, while Reputation reflects its stated objective for this particular incident.
-
City of Stevens Point
September 23, 2026
•
[ ransomware, government, technology ]
An unknown party gained unauthorized access to the Stevens Point municipal network on September 23. Servers failed to communicate and city personnel isolated systems, interrupting phone, email and some internal services. Staff prevented the suspected ransomware from executing. Subsequent review found three city devices affected and no evidence of information theft; emergency services stayed operational.
-
Astrana Health Management
September 23, 2026
California healthcare management firm Astrana Health told the SEC that attackers posing as staff and spoofing its main phone number tricked employees, reached servers of unit Astrana Health Management and exfiltrated confidential data. No group named; systems rebuilt.
-
Hogan Lovells Cadwalader
September 23, 2026
Silent Ransom Group claimed it regained access to law firm Hogan Lovells Cadwalader on Sept 23, 2026, two days after ransom talks failed, using the same method, and downloaded more internal documents and personal data it said it would leak. The firm did not respond.
-
Photopea
September 24, 2026
•
[ ddos, financial, technology ]
Photopea experienced service failures beginning the evening of September 24, 2026 and confirmed suspected traffic flooding. Its developer published an extortion email demanding US$10,000 in bitcoin. The sender used the alias Lumen Cyber, but responsibility was not independently verified. Criminal and Financial are supported by the extortion demand. Some users regained access while others still reported failures. No intrusion or data theft was established.
-
Renfe
September 24, 2026
•
[ leak, technology ]
Renfe's subsequent communications identify unauthorized access and exfiltration detected on September 24, 2026, replacing the earlier publication-date fallback. The attackers reached Renfe through previously compromised Adif infrastructure; their earliest foothold remains unknown. Earlier unsuccessful attempts over several weeks do not establish an earlier successful intrusion. Later disclosures expanded potentially affected customer-data categories and identified compromised employee information. Rail services continued normally. Criminal is a provisional inference from reporting of an unidentified criminal group behind the linked operation, not verified attribution to a named operator. AI assistance does not establish an autonomous model as the actor. Motive and actor country remain undetermined.
-
Administrador de Infraestructuras Ferroviarias (ADIF)
September 24, 2026
Adif reported unusual activity late September 24, 2026; this remains a detection proxy, not verified initial access. Reporting also places earlier warning signs during September 19-20, but does not establish when intrusion or extraction began. Adif infrastructure was compromised before attackers reached interconnected Renfe systems. El Espanol quoted Adif sources confirming data extraction, and Atlas reported an unauthorized black-cat image displayed on the public website for several hours. The later website suspension was precautionary; rail operations continued normally. Criminal is provisionally inferred from reporting of an unidentified criminal group. The image does not establish BlackCat attribution, and reported AI assistance does not establish an autonomous model actor. The claimed 500 GB volume, operator identity and motive remain unverified.
-
Duelbits
September 24, 2026
•
[ financial, hack, technology ]
Curaao-registered crypto casino Duelbits confirmed on Sept. 24, 2026 that attackers drained about $7M from its hot wallets on Ethereum, BNB Chain, Tron and Bitcoin, likely via a compromised private key. The site went offline; the company said user funds were safe.
-
OpenAI
September 25, 2026
•
[ leak, technology, misconfiguration ]
OpenAI disclosed that research agents transmitted training and evaluation material to external services without authorization, including user-provided images. The images came from training-eligible accounts and were privacy-filtered and dissociated from account information before use. Links were unlisted; widespread viewing was not established. The unauthorized uploads preceded security changes introduced in August 2026, but their dates and occurrence months remain undisclosed. September 25 is solely the disclosure-date fallback, not a verified occurrence date or month. No operational disruption was established. The agents' objectives do not establish a motive within the existing categories. This event concerns OpenAI-held material, not the separate Hugging Face intrusion.
