-
Fédération francophone de Gymnastique
September 14, 2026
•
[ leak, hack ]
Belgium's French-speaking Gymnastics Federation (FfG) found on Sept. 14, 2026 that unauthorized persons accessed part of its IT systems and extracted member and club data; records of about 200,000 people were reportedly leaked. The Data Protection Authority was notified.
-
MEO
September 14, 2026
•
[ ddos, technology ]
Portuguese telecom operator MEO's international network was congested and degraded by a DDoS attack on Sept 14-15, 2026, leaving some customers unable to reach websites. MEO said no systems were breached nor data accessed and reported it to Portugal's CNCS.
-
Undisclosed Russian companies
September 14, 2026
•
[ ransomware, hack, leak ]
Kaspersky research reported in Sept 2026 says pro-Ukrainian hacktivist group Hacking Cat breached unnamed Russian companies via Exchange flaws, stole data and deployed Monkey ransomware and Nemo wiper; some victims paid, others had data leaked. The group denied using the lockers.
-
Undisclosed Spanish organization
September 14, 2026
•
[ hack, technology, government ]
An attacker used an AI agent built on a known language model to log into an undisclosed Spanish organization's system, find application flaws, modify personal data and access invoices. Spain's data protection agency AEPD disclosed the breach notification on Sept 14, 2026.
-
DOLYA & CO. LTD (Dolya Communication System)
September 15, 2026
•
[ hack, ddos, technology ]
Pro-Russian hacktivist PalachPro claimed a large DDoS attack and other disruptive actions against Ukrainian systems integrator DOLYA & CO. LTD, a supplier of professional communications systems to Ukrainian defense and security agencies. The claimed effects included blocked servers and file management, loss of access to the website and internal document workflow, inability to add new orders, and temporary loss of email, file exchange and Sonata messenger access. The attack had been publicly claimed by 15 September 2026, but its exact onset, duration and effects have not been independently confirmed.
-
Undisclosed United Arab Emirates company
September 15, 2026
•
[ ransomware, government, hack ]
An unnamed UAE company supporting a government sector was compromised through an unpatched software vulnerability and received a ransom demand exceeding US$5 million. Reporting of the cybersecurity chief's September 15, 2026 account states that the attacker obtained company information and published some on the dark web, although other coverage says publication was prevented. Official WAM reporting describes attempted data destruction that was prevented, conflicting with reporting of completed destruction; a disruptive effect is not established. The stolen data categories, volume and source systems were not identified. The intrusion date is unknown; September 15, 2026 is the earliest-report publication fallback, not a verified occurrence date.
-
International Meteor Organization
September 15, 2026
•
[ hack, technology ]
The Belgium-based International Meteor Organization said in Sept. 2026 that a cyberattack dealt a "critical blow" to its aging infrastructure, taking much of its website offline. Fireball reporting was restored first; it is moving to new infrastructure.
-
St James' Anglican School
September 15, 2026
•
[ ransomware, hack, education ]
Hackers accessed systems at St James' Anglican School in Perth, Western Australia, copying current and former students' and families' personal data, incl. bank details, medical records and photos. The school said it contained the incident; ThreeAM ransomware claimed it.
-
Undisclosed organization investigated by CyberMaxx (Event A)
September 15, 2026
•
[ ransomware, technology, financial ]
CyberMaxx incident responders observed exploitation of N-able N-central in an unnamed customer environment. The intruder used Net.exe to issue an administrator password-change command, established a Cloudflare tunnel, installed SimpleHelp for persistence and reached a file server over remote access. File enumeration and communication with Filemail-associated infrastructure were observed, but completed data theft and ransomware encryption were not verified. CyberMaxx attributed the activity to Storm-1175 with high confidence; Criminal and Financial reflect the ransomware-preparation context. September 15 is the publication-date fallback, not a verified intrusion date.
-
Undisclosed organization investigated by CyberMaxx (Event B)
September 15, 2026
•
[ ransomware, financial, technology ]
In a second distinct incident-response case, CyberMaxx observed attackers abuse N-able N-central to execute commands on a domain controller, change an administrator password and establish an interactive session using the altered credentials. They installed SimpleHelp, moved to another server through RDP and staged additional tools. No completed exfiltration or ransomware encryption was confirmed. CyberMaxx linked the operation to Storm-1175 with high confidence; Criminal and Financial are supported by the ransomware-preparation context. September 15 is a report-date fallback, not the known attack date.
-
Tsifrotekh (Rostelecom subsidiary)
September 16, 2026
iStories authenticated leaked internal material from Tsifrotekh, developer of GAS Vybory 2.0, supplied by anonymous claimants associated with CikLeak. The claimants said they sought to expose alleged electoral manipulation; their identity, country and sponsorship remain unverified. Follow-up reporting identified source code, communications and voter records. Voter-file metadata indicated a July 2026 database export, not an intrusion date. An internal support ticket dated August 31 indicates acquisition of that item on or after that date and by its September 17 publication, assuming the timestamp is accurate; this does not date initial access or the entire theft. September 16, 2026 remains the earliest-disclosure fallback. The acquisition system and any attacker-caused disruption were not established. Solar denied a direct Central Election Commission breach.
-
HM Courts and Tribunals Service (HMCTS), Ministry of Justice
September 16, 2026
•
[ insider, government ]
Court staff accessed confidential files relating to victims, survivors and families of the 2024 Southport attack without authorization. An internal review uncovered the access and the Ministry of Justice notified affected parties. Some files contained sensitive personal information; no disclosure to outside parties was found.
-
Flock Safety
September 16, 2026
•
[ hack, technology, government ]
Hacker collective Stegan0gram pulled a Flock Safety license plate camera off a roadside pole, copied its storage and used an on-device key to decrypt about 21 days of vehicle images and video, sharing it with 404 Media and DDoSecrets. Flock said tampering is illegal.
-
Ministero dell'Interno
September 16, 2026
Group iamnotavillain, behind the Revolut extortion, claimed 147 GB of Italian Interior Ministry and police data ('Italian Files') from the same PEC email intrusion and by Sept. 24, 2026 posted a first batch on the dark web to press for ransom. No ministry confirmation.
-
Nipigon District Memorial Hospital
September 16, 2026
Ransomware hit Nipigon District Memorial Hospital in Nipigon, Ontario, in Sept 2026, encrypting some files that may hold personal health data and affecting IT systems and some patient services. The Storm ransomware group later claimed the attack and threatened to leak data.
-
Undisclosed Singapore company
September 17, 2026
•
[ ransomware, financial ]
Singapore Police described a ransomware attack on an unnamed business whose systems were reportedly breached and years of data became unavailable. The attacker demanded a million-dollar ransom to restore the data; the currency was not specified. The owner sent staff away, disconnected servers and contacted police. The business sector, intrusion method, disruption duration and recovery outcome were not disclosed. Complete system encryption, permanent data destruction and data exfiltration were not confirmed. The incident date and year are unknown; September 17, 2026 is the publication-date fallback, not a verified occurrence date.
-
Piskarevsky Dairy Plant
September 17, 2026
A reported DDoS attack on September 17, 2026 disrupted Piskarevsky Dairy Plant's computer network and electronic documentation, preventing product registration in the Chestny Znak labeling system. The company confirmed the disruption and suspended retail shipments on September 18. Shipments subsequently resumed under temporary regulatory arrangements, but infrastructure restoration and reduced production continued on September 21. These recovery effects do not establish a continuous multi-day outage. September 17 is the reported attack date, not a publication-date fallback; any preceding intrusion remains unestablished. No encryption or data theft was confirmed. The attacker, actor type and motive remain unverified.
-
Direct Communications Cedar Valley
September 17, 2026
•
[ hack, ddos, technology ]
A DDoS attack that began Sept 17, 2026 on Direct Communications Cedar Valley, an Eagle Mountain, Utah ISP, caused slow speeds and full internet outages; its phone and billing systems were still down Sept 21. Eagle Mountain closed City Hall and the library. No actor named.
-
Ellis County, Kansas
September 17, 2026
•
[ ransomware, government ]
Ellis County, Kansas, said a ransomware incident detected Sept 17, 2026 disrupted parts of its IT systems, leaving some county services unavailable or delayed; 911 stayed up. The KBI and Highway Patrol are investigating; the county saw no evidence of data access.
-
Moscow City Election Commission
September 18, 2026
•
[ hack, government, technology ]
During Russia's September 18-20, 2026 elections, attacks disrupted Moscow's separate electronic voting infrastructure. Officials reported a September 18 terminal failure restored within about 20 minutes, slower remote-voting access on September 19 and an electronic voter-register failure delaying paper-ballot issuance on September 20. September 18 is the earliest reported disruption date; the precise campaign start is unknown. Initial attribution of the terminal failure was qualified, while subsequent official accounts linked voting-service delays to cyberattacks. The responsible operator, actor type and country were not established. No vote alteration, data theft or nationwide outage was established for this event.
