-
Undisclosed Singapore company
September 17, 2026
•
[ ransomware, financial ]
Singapore Police described a ransomware attack on an unnamed business whose systems were reportedly breached and years of data became unavailable. The attacker demanded a million-dollar ransom to restore the data; the currency was not specified. The owner sent staff away, disconnected servers and contacted police. The business sector, intrusion method, disruption duration and recovery outcome were not disclosed. Complete system encryption, permanent data destruction and data exfiltration were not confirmed. The incident date and year are unknown; September 17, 2026 is the publication-date fallback, not a verified occurrence date.
-
Piskarevsky Dairy Plant
September 17, 2026
A reported DDoS attack on September 17, 2026 disrupted Piskarevsky Dairy Plant's computer network and electronic documentation, preventing product registration in the Chestny Znak labeling system. The company confirmed the disruption and suspended retail shipments on September 18. Shipments subsequently resumed under temporary regulatory arrangements, but infrastructure restoration and reduced production continued on September 21. These recovery effects do not establish a continuous multi-day outage. September 17 is the reported attack date, not a publication-date fallback; any preceding intrusion remains unestablished. No encryption or data theft was confirmed. The attacker, actor type and motive remain unverified.
-
Direct Communications Cedar Valley
September 17, 2026
•
[ hack, ddos, technology ]
A DDoS attack that began Sept 17, 2026 on Direct Communications Cedar Valley, an Eagle Mountain, Utah ISP, caused slow speeds and full internet outages; its phone and billing systems were still down Sept 21. Eagle Mountain closed City Hall and the library. No actor named.
-
Ellis County, Kansas
September 17, 2026
•
[ ransomware, government ]
Ellis County, Kansas, said a ransomware incident detected Sept 17, 2026 disrupted parts of its IT systems, leaving some county services unavailable or delayed; 911 stayed up. The KBI and Highway Patrol are investigating; the county saw no evidence of data access.
-
Moscow City Election Commission
September 18, 2026
•
[ hack, government, technology ]
During Russia's September 18-20, 2026 elections, attacks disrupted Moscow's separate electronic voting infrastructure. Officials reported a September 18 terminal failure restored within about 20 minutes, slower remote-voting access on September 19 and an electronic voter-register failure delaying paper-ballot issuance on September 20. September 18 is the earliest reported disruption date; the precise campaign start is unknown. Initial attribution of the terminal failure was qualified, while subsequent official accounts linked voting-service delays to cyberattacks. The responsible operator, actor type and country were not established. No vote alteration, data theft or nationwide outage was established for this event.
-
Clop ransomware operation (data-leak website)
September 18, 2026
ShinyHunters began compromising Clop's leak website on September 18, 2026, uploading a file and subsequently replacing the site's content. BleepingComputer independently verified the upload and defacement. Clop later acknowledged the compromise, and Grav's developers confirmed the exploited vulnerability. ShinyHunters demanded an eight-figure payment and threatened publication of alleged stolen material; Financial reflects that explicit demand despite additional retaliatory statements. Theft of source code, logs and private keys was not independently verified. The affected server's country, disruption duration and any payment remain undetermined.
-
Undisclosed freight carrier
September 18, 2026
•
[ social, phishing, retail ]
An unnamed third-party freight carrier experienced an email-system compromise. Attackers obtained shipment-related information through the carrier, used it to arrange a fraudulent pickup supported by apparently correct paperwork, and diverted a load of blueberries from a cold-storage facility. The carrier itself was the compromised IT victim; the food theft was a downstream consequence. Victim country, compromise date, technique, actor identity and quantity of accessed correspondence were not disclosed. September 18, 2026 is a publication-date fallback, not the date of the intrusion.
-
Undisclosed company described at the 2026 IFDA Solutions Conference
September 18, 2026
•
[ leak, espionage ]
A cybersecurity executive at the September 2026 IFDA Solutions Conference described a separate unnamed organization that detected a malicious intruder in its network but did not contain the access. According to the panel discussion, the intruder remained in the network for approximately 16 months and ultimately exfiltrated about 12 TB of data. The victim company, industry, country, access vector, incident year and exact intrusion/exfiltration dates were not disclosed. September 18, 2026 is the publication-date fallback and should not be treated as the confirmed compromise month.
-
Kendall Hunt Publishing Company
September 18, 2026
•
[ ransomware, education ]
INC Ransom listed Kendall Hunt Publishing, a Dubuque, Iowa educational publisher, on its leak site on Sept 18, 2026, claiming stolen data and threatening to publish it unless the company negotiated. About 441,000 records were later indexed; the company has not confirmed.
-
United Federation of Teachers
September 18, 2026
•
[ ransomware, education ]
The United Federation of Teachers, New York City's teachers' union, was listed by extortion group N0n on Sept. 18, 2026, claiming theft of ~181,420 legal case documents and demanding negotiation before publication. UFT has not confirmed the breach.
-
Institute for Basic Science Heavy Ion Accelerator Research Institute
September 18, 2026
South Korea's IBS Heavy Ion Accelerator Research Institute confirmed on Aug 11, 2026 that 1,894 items of Raon accelerator administrative and research data had been transferred outside, allegedly by a former team leader around 2022; the leak went undetected for four years.
-
Ludwig-Maximilians-Universität München
September 19, 2026
•
[ hack, leak, education ]
LMU Munich, Germany, disclosed in Sept 2026 that an unauthorized actor accessed student-registration master data in a university IT system and that the data must be assumed to have been retrieved. Modification was prevented; the Bavarian State Criminal Police is investigating.
-
Blok Radio
September 21, 2026
•
[ ddos, hack, technology ]
Blok Radio experienced a traffic-flooding attack on September 21, 2026. SHARE's subsequent monitoring report describes the radio being taken offline twice within eight days, distinguishing this incident from the September 28 disruption. Outage duration and restoration timing were not disclosed. Sabotage is inferred from deliberate obstruction of the radio's online service; the operator, actor type and political affiliation remain unverified.
-
Undisclosed People Playground user
September 21, 2026
•
[ malware, hack, technology ]
The developer confirmed malware infections involving file deletion and publication of sensitive information through malicious Workshop mods. This represents an unnamed affected user, not a Valve corporate breach. September 21 is the outbreak-onset proxy; individual infection timing is unknown. Sabotage is inferred from deliberate destruction; operator identity and actor type remain undetermined.
-
Burnaby School District 41
September 21, 2026
•
[ ransomware, education, financial ]
The district discovered ransomware on September 21, 2026 and later confirmed theft of personal-information files. Network and phone services were affected. September 21 is a discovery proxy; initial access and extraction dates are unknown. The official page was first published September 23 and updated October 14. Neither encryption nor the stolen-data source host was specified, so technical subtypes remain undetermined. Financial motive is inferred from ransomware.
-
Elsevier
September 21, 2026
On Sept 21, 2026, visitors to select Elsevier platforms, including elsevier.com and Evolve, were redirected to a LAPSUS$-branded page taunting the FBI. Elsevier confirmed the redirect, restored service and said no customer data or core systems were compromised.
-
Federal Bureau of Investigation
September 22, 2026
•
[ hack, government, technology ]
ShinyHunters defaced FBIJobs.gov on September 22, 2026 and supplied journalists with a sample of about 5,000 purported FBI personnel records, portions of which were authenticated. The group demanded correction or withdrawal of a May FBI advisory criticizing its methods and denied seeking a ransom in this case. The FBI subsequently confirmed that an unpatched contractor-managed platform enabled the breach; Reuters identified the platform as Oracle PeopleSoft and reported the responsible contractor was removed. The scope of exfiltration and the claimed 2-3 TB remain unverified. The group is coded Criminal by its identity, while Reputation reflects its stated objective for this particular incident.
-
City of Stevens Point
September 23, 2026
•
[ ransomware, government, technology ]
An unknown party gained unauthorized access to the Stevens Point municipal network on September 23. Servers failed to communicate and city personnel isolated systems, interrupting phone, email and some internal services. Staff prevented the suspected ransomware from executing. Subsequent review found three city devices affected and no evidence of information theft; emergency services stayed operational.
-
Astrana Health Management
September 23, 2026
California healthcare management firm Astrana Health told the SEC that attackers posing as staff and spoofing its main phone number tricked employees, reached servers of unit Astrana Health Management and exfiltrated confidential data. No group named; systems rebuilt.
-
Hogan Lovells Cadwalader
September 23, 2026
Silent Ransom Group claimed it regained access to law firm Hogan Lovells Cadwalader on Sept 23, 2026, two days after ransom talks failed, using the same method, and downloaded more internal documents and personal data it said it would leak. The firm did not respond.
