-
Undisclosed healthcare organization
September 8, 2026
•
[ hack, healthcare, technology ]
Google's Mandiant reported that a data extortion group breached an unnamed healthcare organization and stole drug research, corporate data and a proprietary AI model, then threatened to publish it unless paid. Disclosed in GTIG's Q2 2026 AI Threat Tracker.
-
Undisclosed AI media generation company
September 8, 2026
Google's Mandiant reported that attackers compromised an unnamed AI media generation company, stole its source code, prompts, skills, model scripts and secrets, and demanded payment under threat of publishing them. Disclosed in GTIG's Q2 2026 AI Threat Tracker.
-
Hilltop National Bank
September 8, 2026
•
[ finance, hack ]
Hilltop National Bank, a Casper, Wyoming community bank, had IT disruptions from Sept. 8, 2026, then identified a cybersecurity incident, took internal systems offline and closed all branches Sept. 9. Online banking was out until about Sept. 22. Cause and actor undisclosed.
-
Undisclosed enterprise company investigated by Unit 42
September 9, 2026
•
[ hack, technology ]
A human ransom attacker used multiple frontier AI agents to compromise an undisclosed enterprise network in less than 10 hours. The agents extracted credentials and cloud keys from code repositories, a secrets-management system and other enterprise applications, allowing expansion into cloud and identity infrastructure. An attempted Terraform backdoor was blocked. Unit 42 clarified that the incident was an intrusion rather than a ransomware attack. The exact intrusion date, victim industry and victim country were not disclosed; event_date therefore uses the supplied source publication date.
-
Brevo (formerly Sendinblue)
September 9, 2026
•
[ hack, technology, finance ]
On September 9-10, 2026, an intruder abused a flaw in Brevo SAML SSO tenant scoping to access 138 customer accounts. The attacker used six of the accounts to distribute fraudulent messages from legitimate customer email channels and exported contacts from 43 accounts. Trezor was one affected Brevo customer; 347,149 newsletter email addresses were exported and misleading messages reached roughly 347,000 subscribers. Brevo shut the attack route and signed out sessions on September 10. The attack did not establish a breach of Trezor wallet infrastructure. The 138 customer accounts are effects within one compromised Brevo platform, not separate CED records.
-
Air Canada
September 9, 2026
•
[ ransomware, leak, technology ]
The Gentlemen ransomware group listed Montreal-based Air Canada on its leak site on Sept 9, 2026, claiming to have stolen 51,409 'critical files'. A dataset of about 489,000 mostly email records was later indexed; Air Canada has not confirmed it; no disruption was reported.
-
Surfshark
September 9, 2026
•
[ misconfiguration, technology, leak ]
VPN provider Surfshark (Netherlands) disclosed on Sep 9, 2026 that a threat actor accessed a misconfigured, internet-exposed internal test server holding engineering material and an isolated proxy server. Detected Aug 31; Surfshark says no user data or VPN services were affected.
-
Undisclosed organizations
September 9, 2026
•
[ ransomware, espionage, technology ]
Cisco Talos disclosed on 9 Sep 2026 that three clusters exploited Cisco Secure FMC flaws at unnamed organizations: a Qilin-linked affiliate stole data and deployed Qilin ransomware, Sandworm-linked UAT-11823 harvested firewall configurations, and UAT-12197 stole credentials.
-
Wilke
September 9, 2026
•
[ ransomware, technology ]
Wilke, an Odense, Denmark market research and polling firm, was hit by a ransomware attack that took its systems down; CEO Stine Halberg said returning to full capacity took longer and was bumpier than the few weeks she had hoped. Attack date and attacker not disclosed.
-
Trezor
September 9, 2026
•
[ phishing, hack, technology ]
Hackers who breached email provider Brevo on Sept 9, 2026 exported Trezor's newsletter contacts and sent ~347,000 fake security alerts from help@trezor.io urging users to enter wallet backups; ~2,500 clicked. Prague-based Trezor said its own systems were unaffected.
-
Helpfeel
September 11, 2026
Kyoto-based Helpfeel said a hacker exploited a flaw in the upload server of its Gyazo image-sharing service on Sept 11, 2026 and accessed about 23.62M user records and 490M image metadata records before being cut off Sept 12. Users told to reset passwords; image access curbed.
-
Undisclosed Costa Rican credit bureau
September 12, 2026
•
[ leak, finance, technology ]
Costa Rican officials linked jarol1488 to theft of a credit bureau database containing personal and financial information. Authorities detected the public posting on September 12, 2026; this date is used as a discovery proxy, not a verified intrusion or extraction date. Cero Riesgo was named in attacker material but had not confirmed that the published information originated from its systems. Officials authenticated only part of a public sample, not the claimed 400 million-plus records. The database was advertised for US$2,500. The exact extraction system was not forensically confirmed. The minister described the attacker as South American without identifying a country.
-
Kimberly-Clark
September 13, 2026
Extortion group ShinyHunters listed Irving, Texas consumer-products maker Kimberly-Clark on its leak site on Sept 13, 2026, claiming stolen data and setting a Sept 16 deadline. A dataset of about 650,000 records was later indexed; the company had not confirmed the claim.
-
Undisclosed BigCommerce merchants
September 13, 2026
•
[ hack, technology, retail ]
Attackers used a stolen BigCommerce API key of the Ribon app on Sept 13-17, 2026 to download shopper data page by page from BigCommerce merchant stores and inject malicious scripts into some storefronts. BigCommerce revoked the key, removed the app and notified merchants.
-
Fastr
September 13, 2026
•
[ hack, technology, retail ]
Boston e-commerce software firm Fastr suffered a system compromise in which attackers stole BigCommerce API credentials for the Ribon apps of its unit Be A Part Of, per BigCommerce; the keys were abused Sept 13-17, 2026 against merchant stores. Fastr made no public comment.
-
Master of Malt
September 13, 2026
•
[ hack, retail, technology ]
UK online drinks retailer Master of Malt confirmed attackers used a compromised Ribon app key to access customer data on its BigCommerce store between 13 and 17 Sep 2026. Customers were notified by email; payment details and passwords were not exposed.
-
Bulkhead
September 13, 2026
•
[ ddos, technology ]
Bulkhead, a Derby, UK game studio, saw its tactical shooter WARDOGS hit by a DDoS attack just before its Sept 10, 2026 Steam Early Access launch, one of several issues that plagued the game. Attacker, duration and specific impact were not reported.
-
Norwegian Parliament (Stortinget)
September 14, 2026
The pro-Russian hacktivist group Server Killers claimed a DDoS attack against the Norwegian Parliament on 14 September 2026. Stortinget confirmed website instability beginning around 15:00, with outside Norwegian incident tracking reporting normal operation restored by 16:23. Server Killers had previously declared a cyberwar against Norway and explicitly cited Norwegian military, security and financial support for Ukraine as its reason for attacks. Norwegian authorities confirmed the disruption but did not independently attribute this specific incident to the group, and the group's physical country of origin remains unverified.
-
Dyfed-Powys Police
September 14, 2026
•
[ hack, government, technology ]
Dyfed-Powys Police identified a cyberattack on September 14, 2026 and temporarily lost some non-emergency online and email contact services. Emergency response and 999 and 101 services remained available. A review of whether employee data was accessed was ongoing; no compromise of public personal data was established.
-
CenterPoint Energy
September 14, 2026
•
[ leak, hack, energy ]
Houston-based utility CenterPoint Energy said in a Sep 14, 2026 SEC filing that an unauthorized party took customer personal data via an external-facing system, after a hacker leaked a 2.5 GB archive claimed to hold 7.5M records. Power and gas service were unaffected.
