-
Master of Malt
September 13, 2026
•
[ hack, retail, technology ]
UK online drinks retailer Master of Malt confirmed attackers used a compromised Ribon app key to access customer data on its BigCommerce store between 13 and 17 Sep 2026. Customers were notified by email; payment details and passwords were not exposed.
-
Bulkhead
September 13, 2026
•
[ ddos, technology ]
Bulkhead, a Derby, UK game studio, saw its tactical shooter WARDOGS hit by a DDoS attack just before its Sept 10, 2026 Steam Early Access launch, one of several issues that plagued the game. Attacker, duration and specific impact were not reported.
-
Norwegian Parliament (Stortinget)
September 14, 2026
The pro-Russian hacktivist group Server Killers claimed a DDoS attack against the Norwegian Parliament on 14 September 2026. Stortinget confirmed website instability beginning around 15:00, with outside Norwegian incident tracking reporting normal operation restored by 16:23. Server Killers had previously declared a cyberwar against Norway and explicitly cited Norwegian military, security and financial support for Ukraine as its reason for attacks. Norwegian authorities confirmed the disruption but did not independently attribute this specific incident to the group, and the group's physical country of origin remains unverified.
-
Dyfed-Powys Police
September 14, 2026
•
[ hack, government, technology ]
Dyfed-Powys Police identified a cyberattack on September 14, 2026 and temporarily lost some non-emergency online and email contact services. Emergency response and 999 and 101 services remained available. A review of whether employee data was accessed was ongoing; no compromise of public personal data was established.
-
CenterPoint Energy
September 14, 2026
•
[ leak, hack, energy ]
Houston-based utility CenterPoint Energy said in a Sep 14, 2026 SEC filing that an unauthorized party took customer personal data via an external-facing system, after a hacker leaked a 2.5 GB archive claimed to hold 7.5M records. Power and gas service were unaffected.
-
Fédération francophone de Gymnastique
September 14, 2026
•
[ leak, hack ]
Belgium's French-speaking Gymnastics Federation (FfG) found on Sept. 14, 2026 that unauthorized persons accessed part of its IT systems and extracted member and club data; records of about 200,000 people were reportedly leaked. The Data Protection Authority was notified.
-
MEO
September 14, 2026
•
[ ddos, technology ]
Portuguese telecom operator MEO's international network was congested and degraded by a DDoS attack on Sept 14-15, 2026, leaving some customers unable to reach websites. MEO said no systems were breached nor data accessed and reported it to Portugal's CNCS.
-
Undisclosed Russian companies
September 14, 2026
•
[ ransomware, hack, leak ]
Kaspersky research reported in Sept 2026 says pro-Ukrainian hacktivist group Hacking Cat breached unnamed Russian companies via Exchange flaws, stole data and deployed Monkey ransomware and Nemo wiper; some victims paid, others had data leaked. The group denied using the lockers.
-
Undisclosed Spanish organization
September 14, 2026
•
[ hack, technology, government ]
An attacker used an AI agent built on a known language model to log into an undisclosed Spanish organization's system, find application flaws, modify personal data and access invoices. Spain's data protection agency AEPD disclosed the breach notification on Sept 14, 2026.
-
DOLYA & CO. LTD (Dolya Communication System)
September 15, 2026
•
[ hack, ddos, technology ]
Pro-Russian hacktivist PalachPro claimed a large DDoS attack and other disruptive actions against Ukrainian systems integrator DOLYA & CO. LTD, a supplier of professional communications systems to Ukrainian defense and security agencies. The claimed effects included blocked servers and file management, loss of access to the website and internal document workflow, inability to add new orders, and temporary loss of email, file exchange and Sonata messenger access. The attack had been publicly claimed by 15 September 2026, but its exact onset, duration and effects have not been independently confirmed.
-
Undisclosed United Arab Emirates company
September 15, 2026
•
[ ransomware, government, hack ]
An unnamed UAE company supporting a government sector was compromised through an unpatched software vulnerability and received a ransom demand exceeding US$5 million. Reporting of the cybersecurity chief's September 15, 2026 account states that the attacker obtained company information and published some on the dark web, although other coverage says publication was prevented. Official WAM reporting describes attempted data destruction that was prevented, conflicting with reporting of completed destruction; a disruptive effect is not established. The stolen data categories, volume and source systems were not identified. The intrusion date is unknown; September 15, 2026 is the earliest-report publication fallback, not a verified occurrence date.
-
International Meteor Organization
September 15, 2026
•
[ hack, technology ]
The Belgium-based International Meteor Organization said in Sept. 2026 that a cyberattack dealt a "critical blow" to its aging infrastructure, taking much of its website offline. Fireball reporting was restored first; it is moving to new infrastructure.
-
St James' Anglican School
September 15, 2026
•
[ ransomware, hack, education ]
Hackers accessed systems at St James' Anglican School in Perth, Western Australia, copying current and former students' and families' personal data, incl. bank details, medical records and photos. The school said it contained the incident; ThreeAM ransomware claimed it.
-
Undisclosed organization investigated by CyberMaxx (Event A)
September 15, 2026
•
[ ransomware, technology, financial ]
CyberMaxx incident responders observed exploitation of N-able N-central in an unnamed customer environment. The intruder used Net.exe to issue an administrator password-change command, established a Cloudflare tunnel, installed SimpleHelp for persistence and reached a file server over remote access. File enumeration and communication with Filemail-associated infrastructure were observed, but completed data theft and ransomware encryption were not verified. CyberMaxx attributed the activity to Storm-1175 with high confidence; Criminal and Financial reflect the ransomware-preparation context. September 15 is the publication-date fallback, not a verified intrusion date.
-
Undisclosed organization investigated by CyberMaxx (Event B)
September 15, 2026
•
[ ransomware, financial, technology ]
In a second distinct incident-response case, CyberMaxx observed attackers abuse N-able N-central to execute commands on a domain controller, change an administrator password and establish an interactive session using the altered credentials. They installed SimpleHelp, moved to another server through RDP and staged additional tools. No completed exfiltration or ransomware encryption was confirmed. CyberMaxx linked the operation to Storm-1175 with high confidence; Criminal and Financial are supported by the ransomware-preparation context. September 15 is a report-date fallback, not the known attack date.
-
Tsifrotekh (Rostelecom subsidiary)
September 16, 2026
iStories authenticated leaked internal material from Tsifrotekh, developer of GAS Vybory 2.0, supplied by anonymous claimants associated with CikLeak. The claimants said they sought to expose alleged electoral manipulation; their identity, country and sponsorship remain unverified. Follow-up reporting identified source code, communications and voter records. Voter-file metadata indicated a July 2026 database export, not an intrusion date. An internal support ticket dated August 31 indicates acquisition of that item on or after that date and by its September 17 publication, assuming the timestamp is accurate; this does not date initial access or the entire theft. September 16, 2026 remains the earliest-disclosure fallback. The acquisition system and any attacker-caused disruption were not established. Solar denied a direct Central Election Commission breach.
-
HM Courts and Tribunals Service (HMCTS), Ministry of Justice
September 16, 2026
•
[ insider, government ]
Court staff accessed confidential files relating to victims, survivors and families of the 2024 Southport attack without authorization. An internal review uncovered the access and the Ministry of Justice notified affected parties. Some files contained sensitive personal information; no disclosure to outside parties was found.
-
Flock Safety
September 16, 2026
•
[ hack, technology, government ]
Hacker collective Stegan0gram pulled a Flock Safety license plate camera off a roadside pole, copied its storage and used an on-device key to decrypt about 21 days of vehicle images and video, sharing it with 404 Media and DDoSecrets. Flock said tampering is illegal.
-
Ministero dell'Interno
September 16, 2026
Group iamnotavillain, behind the Revolut extortion, claimed 147 GB of Italian Interior Ministry and police data ('Italian Files') from the same PEC email intrusion and by Sept. 24, 2026 posted a first batch on the dark web to press for ransom. No ministry confirmation.
-
Nipigon District Memorial Hospital
September 16, 2026
Ransomware hit Nipigon District Memorial Hospital in Nipigon, Ontario, in Sept 2026, encrypting some files that may hold personal health data and affecting IT systems and some patient services. The Storm ransomware group later claimed the attack and threatened to leak data.
