-
DOLYA & CO. LTD (Dolya Communication System)
September 15, 2026
•
[ hack, ddos, technology ]
Pro-Russian hacktivist PalachPro claimed a large DDoS attack and other disruptive actions against Ukrainian systems integrator DOLYA & CO. LTD, a supplier of professional communications systems to Ukrainian defense and security agencies. The claimed effects included blocked servers and file management, loss of access to the website and internal document workflow, inability to add new orders, and temporary loss of email, file exchange and Sonata messenger access. The attack had been publicly claimed by 15 September 2026, but its exact onset, duration and effects have not been independently confirmed.
-
Undisclosed United Arab Emirates company
September 15, 2026
•
[ ransomware, government, hack ]
An unnamed UAE company supporting a government sector was compromised through an unpatched software vulnerability and received a ransom demand exceeding US$5 million. Reporting of the cybersecurity chief's September 15, 2026 account states that the attacker obtained company information and published some on the dark web, although other coverage says publication was prevented. Official WAM reporting describes attempted data destruction that was prevented, conflicting with reporting of completed destruction; a disruptive effect is not established. The stolen data categories, volume and source systems were not identified. The intrusion date is unknown; September 15, 2026 is the earliest-report publication fallback, not a verified occurrence date.
-
International Meteor Organization
September 15, 2026
•
[ hack, technology ]
The Belgium-based International Meteor Organization said in Sept. 2026 that a cyberattack dealt a "critical blow" to its aging infrastructure, taking much of its website offline. Fireball reporting was restored first; it is moving to new infrastructure.
-
St James' Anglican School
September 15, 2026
•
[ ransomware, hack, education ]
Hackers accessed systems at St James' Anglican School in Perth, Western Australia, copying current and former students' and families' personal data, incl. bank details, medical records and photos. The school said it contained the incident; ThreeAM ransomware claimed it.
-
Undisclosed organization investigated by CyberMaxx (Event A)
September 15, 2026
•
[ ransomware, technology, financial ]
CyberMaxx incident responders observed exploitation of N-able N-central in an unnamed customer environment. The intruder used Net.exe to issue an administrator password-change command, established a Cloudflare tunnel, installed SimpleHelp for persistence and reached a file server over remote access. File enumeration and communication with Filemail-associated infrastructure were observed, but completed data theft and ransomware encryption were not verified. CyberMaxx attributed the activity to Storm-1175 with high confidence; Criminal and Financial reflect the ransomware-preparation context. September 15 is the publication-date fallback, not a verified intrusion date.
-
Undisclosed organization investigated by CyberMaxx (Event B)
September 15, 2026
•
[ ransomware, financial, technology ]
In a second distinct incident-response case, CyberMaxx observed attackers abuse N-able N-central to execute commands on a domain controller, change an administrator password and establish an interactive session using the altered credentials. They installed SimpleHelp, moved to another server through RDP and staged additional tools. No completed exfiltration or ransomware encryption was confirmed. CyberMaxx linked the operation to Storm-1175 with high confidence; Criminal and Financial are supported by the ransomware-preparation context. September 15 is a report-date fallback, not the known attack date.
-
Tsifrotekh (Rostelecom subsidiary)
September 16, 2026
iStories authenticated leaked internal material from Tsifrotekh, developer of GAS Vybory 2.0, supplied by anonymous claimants associated with CikLeak. The claimants said they sought to expose alleged electoral manipulation; their identity, country and sponsorship remain unverified. Follow-up reporting identified source code, communications and voter records. Voter-file metadata indicated a July 2026 database export, not an intrusion date. An internal support ticket dated August 31 indicates acquisition of that item on or after that date and by its September 17 publication, assuming the timestamp is accurate; this does not date initial access or the entire theft. September 16, 2026 remains the earliest-disclosure fallback. The acquisition system and any attacker-caused disruption were not established. Solar denied a direct Central Election Commission breach.
-
HM Courts and Tribunals Service (HMCTS), Ministry of Justice
September 16, 2026
•
[ insider, government ]
Court staff accessed confidential files relating to victims, survivors and families of the 2024 Southport attack without authorization. An internal review uncovered the access and the Ministry of Justice notified affected parties. Some files contained sensitive personal information; no disclosure to outside parties was found.
-
Flock Safety
September 16, 2026
•
[ hack, technology, government ]
Hacker collective Stegan0gram pulled a Flock Safety license plate camera off a roadside pole, copied its storage and used an on-device key to decrypt about 21 days of vehicle images and video, sharing it with 404 Media and DDoSecrets. Flock said tampering is illegal.
-
Ministero dell'Interno
September 16, 2026
Group iamnotavillain, behind the Revolut extortion, claimed 147 GB of Italian Interior Ministry and police data ('Italian Files') from the same PEC email intrusion and by Sept. 24, 2026 posted a first batch on the dark web to press for ransom. No ministry confirmation.
-
Nipigon District Memorial Hospital
September 16, 2026
Ransomware hit Nipigon District Memorial Hospital in Nipigon, Ontario, in Sept 2026, encrypting some files that may hold personal health data and affecting IT systems and some patient services. The Storm ransomware group later claimed the attack and threatened to leak data.
-
Undisclosed Singapore company
September 17, 2026
•
[ ransomware, financial ]
Singapore Police described a ransomware attack on an unnamed business whose systems were reportedly breached and years of data became unavailable. The attacker demanded a million-dollar ransom to restore the data; the currency was not specified. The owner sent staff away, disconnected servers and contacted police. The business sector, intrusion method, disruption duration and recovery outcome were not disclosed. Complete system encryption, permanent data destruction and data exfiltration were not confirmed. The incident date and year are unknown; September 17, 2026 is the publication-date fallback, not a verified occurrence date.
-
Piskarevsky Dairy Plant
September 17, 2026
A reported DDoS attack on September 17, 2026 disrupted Piskarevsky Dairy Plant's computer network and electronic documentation, preventing product registration in the Chestny Znak labeling system. The company confirmed the disruption and suspended retail shipments on September 18. Shipments subsequently resumed under temporary regulatory arrangements, but infrastructure restoration and reduced production continued on September 21. These recovery effects do not establish a continuous multi-day outage. September 17 is the reported attack date, not a publication-date fallback; any preceding intrusion remains unestablished. No encryption or data theft was confirmed. The attacker, actor type and motive remain unverified.
-
Direct Communications Cedar Valley
September 17, 2026
•
[ hack, ddos, technology ]
A DDoS attack that began Sept 17, 2026 on Direct Communications Cedar Valley, an Eagle Mountain, Utah ISP, caused slow speeds and full internet outages; its phone and billing systems were still down Sept 21. Eagle Mountain closed City Hall and the library. No actor named.
-
Ellis County, Kansas
September 17, 2026
•
[ ransomware, government ]
Ellis County, Kansas, said a ransomware incident detected Sept 17, 2026 disrupted parts of its IT systems, leaving some county services unavailable or delayed; 911 stayed up. The KBI and Highway Patrol are investigating; the county saw no evidence of data access.
-
Moscow City Election Commission
September 18, 2026
•
[ hack, government, technology ]
During Russia's September 18-20, 2026 elections, attacks disrupted Moscow's separate electronic voting infrastructure. Officials reported a September 18 terminal failure restored within about 20 minutes, slower remote-voting access on September 19 and an electronic voter-register failure delaying paper-ballot issuance on September 20. September 18 is the earliest reported disruption date; the precise campaign start is unknown. Initial attribution of the terminal failure was qualified, while subsequent official accounts linked voting-service delays to cyberattacks. The responsible operator, actor type and country were not established. No vote alteration, data theft or nationwide outage was established for this event.
-
Clop ransomware operation (data-leak website)
September 18, 2026
ShinyHunters began compromising Clop's leak website on September 18, 2026, uploading a file and subsequently replacing the site's content. BleepingComputer independently verified the upload and defacement. Clop later acknowledged the compromise, and Grav's developers confirmed the exploited vulnerability. ShinyHunters demanded an eight-figure payment and threatened publication of alleged stolen material; Financial reflects that explicit demand despite additional retaliatory statements. Theft of source code, logs and private keys was not independently verified. The affected server's country, disruption duration and any payment remain undetermined.
-
Undisclosed freight carrier
September 18, 2026
•
[ social, phishing, retail ]
An unnamed third-party freight carrier experienced an email-system compromise. Attackers obtained shipment-related information through the carrier, used it to arrange a fraudulent pickup supported by apparently correct paperwork, and diverted a load of blueberries from a cold-storage facility. The carrier itself was the compromised IT victim; the food theft was a downstream consequence. Victim country, compromise date, technique, actor identity and quantity of accessed correspondence were not disclosed. September 18, 2026 is a publication-date fallback, not the date of the intrusion.
-
Undisclosed company described at the 2026 IFDA Solutions Conference
September 18, 2026
•
[ leak, espionage ]
A cybersecurity executive at the September 2026 IFDA Solutions Conference described a separate unnamed organization that detected a malicious intruder in its network but did not contain the access. According to the panel discussion, the intruder remained in the network for approximately 16 months and ultimately exfiltrated about 12 TB of data. The victim company, industry, country, access vector, incident year and exact intrusion/exfiltration dates were not disclosed. September 18, 2026 is the publication-date fallback and should not be treated as the confirmed compromise month.
-
Kendall Hunt Publishing Company
September 18, 2026
•
[ ransomware, education ]
INC Ransom listed Kendall Hunt Publishing, a Dubuque, Iowa educational publisher, on its leak site on Sept 18, 2026, claiming stolen data and threatening to publish it unless the company negotiated. About 441,000 records were later indexed; the company has not confirmed.
