-
Undisclosed organization investigated by CyberMaxx (Event A)
September 15, 2026
•
[ ransomware, technology, financial ]
CyberMaxx incident responders observed exploitation of N-able N-central in an unnamed customer environment. The intruder used Net.exe to issue an administrator password-change command, established a Cloudflare tunnel, installed SimpleHelp for persistence and reached a file server over remote access. File enumeration and communication with Filemail-associated infrastructure were observed, but completed data theft and ransomware encryption were not verified. CyberMaxx attributed the activity to Storm-1175 with high confidence; Criminal and Financial reflect the ransomware-preparation context. September 15 is the publication-date fallback, not a verified intrusion date.
-
Undisclosed organization investigated by CyberMaxx (Event B)
September 15, 2026
•
[ ransomware, financial, technology ]
In a second distinct incident-response case, CyberMaxx observed attackers abuse N-able N-central to execute commands on a domain controller, change an administrator password and establish an interactive session using the altered credentials. They installed SimpleHelp, moved to another server through RDP and staged additional tools. No completed exfiltration or ransomware encryption was confirmed. CyberMaxx linked the operation to Storm-1175 with high confidence; Criminal and Financial are supported by the ransomware-preparation context. September 15 is a report-date fallback, not the known attack date.
-
Tsifrotekh (Rostelecom subsidiary)
September 16, 2026
iStories authenticated leaked internal material from Tsifrotekh, developer of GAS Vybory 2.0, supplied by anonymous claimants associated with CikLeak. The claimants said they sought to expose alleged electoral manipulation; their identity, country and sponsorship remain unverified. Follow-up reporting identified source code, communications and voter records. Voter-file metadata indicated a July 2026 database export, not an intrusion date. An internal support ticket dated August 31 indicates acquisition of that item on or after that date and by its September 17 publication, assuming the timestamp is accurate; this does not date initial access or the entire theft. September 16, 2026 remains the earliest-disclosure fallback. The acquisition system and any attacker-caused disruption were not established. Solar denied a direct Central Election Commission breach.
-
HM Courts and Tribunals Service (HMCTS), Ministry of Justice
September 16, 2026
•
[ insider, government ]
Court staff accessed confidential files relating to victims, survivors and families of the 2024 Southport attack without authorization. An internal review uncovered the access and the Ministry of Justice notified affected parties. Some files contained sensitive personal information; no disclosure to outside parties was found.
-
Flock Safety
September 16, 2026
•
[ hack, technology, government ]
Hacker collective Stegan0gram pulled a Flock Safety license plate camera off a roadside pole, copied its storage and used an on-device key to decrypt about 21 days of vehicle images and video, sharing it with 404 Media and DDoSecrets. Flock said tampering is illegal.
-
Ministero dell'Interno
September 16, 2026
Group iamnotavillain, behind the Revolut extortion, claimed 147 GB of Italian Interior Ministry and police data ('Italian Files') from the same PEC email intrusion and by Sept. 24, 2026 posted a first batch on the dark web to press for ransom. No ministry confirmation.
-
Nipigon District Memorial Hospital
September 16, 2026
Ransomware hit Nipigon District Memorial Hospital in Nipigon, Ontario, in Sept 2026, encrypting some files that may hold personal health data and affecting IT systems and some patient services. The Storm ransomware group later claimed the attack and threatened to leak data.
-
Undisclosed Singapore company
September 17, 2026
•
[ ransomware, financial ]
Singapore Police described a ransomware attack on an unnamed business whose systems were reportedly breached and years of data became unavailable. The attacker demanded a million-dollar ransom to restore the data; the currency was not specified. The owner sent staff away, disconnected servers and contacted police. The business sector, intrusion method, disruption duration and recovery outcome were not disclosed. Complete system encryption, permanent data destruction and data exfiltration were not confirmed. The incident date and year are unknown; September 17, 2026 is the publication-date fallback, not a verified occurrence date.
-
Piskarevsky Dairy Plant
September 17, 2026
A reported DDoS attack on September 17, 2026 disrupted Piskarevsky Dairy Plant's computer network and electronic documentation, preventing product registration in the Chestny Znak labeling system. The company confirmed the disruption and suspended retail shipments on September 18. Shipments subsequently resumed under temporary regulatory arrangements, but infrastructure restoration and reduced production continued on September 21. These recovery effects do not establish a continuous multi-day outage. September 17 is the reported attack date, not a publication-date fallback; any preceding intrusion remains unestablished. No encryption or data theft was confirmed. The attacker, actor type and motive remain unverified.
-
Direct Communications Cedar Valley
September 17, 2026
•
[ hack, ddos, technology ]
A DDoS attack that began Sept 17, 2026 on Direct Communications Cedar Valley, an Eagle Mountain, Utah ISP, caused slow speeds and full internet outages; its phone and billing systems were still down Sept 21. Eagle Mountain closed City Hall and the library. No actor named.
-
Ellis County, Kansas
September 17, 2026
•
[ ransomware, government ]
Ellis County, Kansas, said a ransomware incident detected Sept 17, 2026 disrupted parts of its IT systems, leaving some county services unavailable or delayed; 911 stayed up. The KBI and Highway Patrol are investigating; the county saw no evidence of data access.
-
Moscow City Election Commission
September 18, 2026
•
[ hack, government, technology ]
During Russia's September 18-20, 2026 elections, attacks disrupted Moscow's separate electronic voting infrastructure. Officials reported a September 18 terminal failure restored within about 20 minutes, slower remote-voting access on September 19 and an electronic voter-register failure delaying paper-ballot issuance on September 20. September 18 is the earliest reported disruption date; the precise campaign start is unknown. Initial attribution of the terminal failure was qualified, while subsequent official accounts linked voting-service delays to cyberattacks. The responsible operator, actor type and country were not established. No vote alteration, data theft or nationwide outage was established for this event.
-
Clop ransomware operation (data-leak website)
September 18, 2026
ShinyHunters began compromising Clop's leak website on September 18, 2026, uploading a file and subsequently replacing the site's content. BleepingComputer independently verified the upload and defacement. Clop later acknowledged the compromise, and Grav's developers confirmed the exploited vulnerability. ShinyHunters demanded an eight-figure payment and threatened publication of alleged stolen material; Financial reflects that explicit demand despite additional retaliatory statements. Theft of source code, logs and private keys was not independently verified. The affected server's country, disruption duration and any payment remain undetermined.
-
Undisclosed freight carrier
September 18, 2026
•
[ social, phishing, retail ]
An unnamed third-party freight carrier experienced an email-system compromise. Attackers obtained shipment-related information through the carrier, used it to arrange a fraudulent pickup supported by apparently correct paperwork, and diverted a load of blueberries from a cold-storage facility. The carrier itself was the compromised IT victim; the food theft was a downstream consequence. Victim country, compromise date, technique, actor identity and quantity of accessed correspondence were not disclosed. September 18, 2026 is a publication-date fallback, not the date of the intrusion.
-
Undisclosed company described at the 2026 IFDA Solutions Conference
September 18, 2026
•
[ leak, espionage ]
A cybersecurity executive at the September 2026 IFDA Solutions Conference described a separate unnamed organization that detected a malicious intruder in its network but did not contain the access. According to the panel discussion, the intruder remained in the network for approximately 16 months and ultimately exfiltrated about 12 TB of data. The victim company, industry, country, access vector, incident year and exact intrusion/exfiltration dates were not disclosed. September 18, 2026 is the publication-date fallback and should not be treated as the confirmed compromise month.
-
Kendall Hunt Publishing Company
September 18, 2026
•
[ ransomware, education ]
INC Ransom listed Kendall Hunt Publishing, a Dubuque, Iowa educational publisher, on its leak site on Sept 18, 2026, claiming stolen data and threatening to publish it unless the company negotiated. About 441,000 records were later indexed; the company has not confirmed.
-
United Federation of Teachers
September 18, 2026
•
[ ransomware, education ]
The United Federation of Teachers, New York City's teachers' union, was listed by extortion group N0n on Sept. 18, 2026, claiming theft of ~181,420 legal case documents and demanding negotiation before publication. UFT has not confirmed the breach.
-
Institute for Basic Science Heavy Ion Accelerator Research Institute
September 18, 2026
South Korea's IBS Heavy Ion Accelerator Research Institute confirmed on Aug 11, 2026 that 1,894 items of Raon accelerator administrative and research data had been transferred outside, allegedly by a former team leader around 2022; the leak went undetected for four years.
-
Ludwig-Maximilians-Universität München
September 19, 2026
•
[ hack, leak, education ]
LMU Munich, Germany, disclosed in Sept 2026 that an unauthorized actor accessed student-registration master data in a university IT system and that the data must be assumed to have been retrieved. Modification was prevented; the Bavarian State Criminal Police is investigating.
-
Blok Radio
September 21, 2026
•
[ ddos, hack, technology ]
Blok Radio experienced a traffic-flooding attack on September 21, 2026. SHARE's subsequent monitoring report describes the radio being taken offline twice within eight days, distinguishing this incident from the September 28 disruption. Outage duration and restoration timing were not disclosed. Sabotage is inferred from deliberate obstruction of the radio's online service; the operator, actor type and political affiliation remain unverified.
