-
City of Mitchell
August 6, 2026
•
[ ransomware, government, financial ]
Mitchell discovered unauthorized activity in part of its municipal network on August 6, 2026, and isolated the affected environment through August 12. Administrative online services were interrupted, while officials said email and emergency services were unaffected. The city subsequently confirmed that information relating to a small number of employees was affected. The Storm extortion group listed Mitchell on its leak site on August 23 with an August 28 deadline and image thumbnails; independent reporting documents that claim, but the city has not verified Storm attribution. Successful encryption, theft of specific files and a ransom demand to the city are not confirmed. Criminal and Financial are supported by the claimed extortion-group context.
-
City of Lancaster, Ohio
August 6, 2026
•
[ ransomware, government ]
Lancaster, Ohio, took city computers offline after ransomware notes appeared on multiple employee machines on Aug 6, 2026, delaying card payments. By Aug 28 about 90% of data and programs were recovered and some may not be restored. No actor or ransom demand disclosed.
-
National Insurance Information System (NSIS; National Insurance Information System JSC)
August 6, 2026
NSIS reported a high-volume DDoS campaign targeting its nationwide insurance information system for almost ten days, peaking at roughly one thousand times ordinary traffic. CEO Nikolai Galushin said access for writing insurance contracts was interrupted for one hour and 50 minutes on the first day and that the purpose appeared to be obstructing contract issuance. No database intrusion was confirmed. The disclosed report did not establish the first attack date, so August 6 is a report-date fallback. Sabotage is inferred from interference with a system serving the national insurance market; actor identity and sponsorship remain unknown.
-
Westland Insurance Group Ltd.
August 7, 2026
•
[ ransomware, leak, finance ]
Helix listed Westland Insurance Group on its extortion site on August 7, 2026 and said negotiations had stalled after Westland received a ransom demand. Helix subsequently claimed the data had been published. DataBreach.com indexed 1,520,799 records containing personal, contact, and vehicle information. Westland has not publicly confirmed the incident, and no operational disruption has been independently established.
-
State of Berlin
August 7, 2026
Attackers copied data from Berlin state administration networks, mainly during August 7-12, 2026, and published it on September 4 after an extortion demand. Rhysida claimed responsibility. Berlin's October 16 update identifies shared and personal employee directories as the principal source. Authorities disconnected affected systems on August 14; that containment action does not establish attacker-generated denial of service. The precise exploitive locus remains undetermined.
-
Troutman Pepper Locke LLP
August 7, 2026
•
[ social, phishing, ransomware ]
A Troutman Pepper Locke employee was deceived by communications that appeared legitimate and sent documents to an unauthorized party on August 7, 2026. The firm said the unauthorized party never accessed its environment and operations were not affected. Silent Ransom Group subsequently claimed responsibility and published data.
-
City of Suisun City
August 7, 2026
•
[ ransomware, malware, government ]
Malicious software infected and compromised Suisun City's IT systems at approximately 5:45 a.m. on August 7, 2026, disrupting 911 routing, police and fire dispatch, records, online services, and municipal operations. The City shut down its entire IT network to contain the incident and rerouted emergency dispatch through Solano County. Unidentified perpetrators subsequently made demands to the City, and network restoration remained underway on September 8.
-
VL Prosperity
August 7, 2026
•
[ hack, espionage, manufacturing ]
Sources told ABC News that VL Prosperity was hacked while transiting the Strait of Gibraltar and lost communications for more than 30 hours. The Coast Guard and FBI later said foreign cyber actors had compromised the vessel's network and boarded the ship on 21 August to investigate and mitigate the threat. Subsequent reporting citing unnamed U.S. officials said investigators found temporary access to a propulsion-linked digital system, but the vessel manager later said Coast Guard, classification-society and internal IT reviews found no evidence the propulsion system was compromised. The initial access vector and perpetrator remain unknown; the 7 August date comes from contemporaneous reporting and has not been publicly confirmed by U.S. authorities.
-
Norsk Tipping AS
August 7, 2026
•
[ ddos, hack, technology ]
Norsk Tipping confirmed a new DDoS attack between 20:53 and 21:08 on August 7 that made its services inaccessible to some customers. The company said operations had returned to normal and that it did not know who was responsible. The attack followed restored service after August 4, so it is a distinct disruptive event. No data theft or ransom demand was reported; Sabotage is a contextual inference based on the targeted service interference.
-
Road Traffic Safety Directorate (CSDD)
August 8, 2026
Attackers exploited multiple vulnerabilities in CSDD's internet-facing Medical platform, moved into inadequately segmented internal systems, and accessed a database containing historical payment-receipt information. CERT.LV assessed that the same attacker likely attempted to penetrate other Latvian government systems around the same period. CSDD services were not disrupted and records were not altered or destroyed.
-
Pozirk (Позірк)
August 8, 2026
•
[ ddos, technology, government ]
Pozirk reported a DDoS attack against its online news platform on the morning of August 8, 2026, alongside attacks against Nasha Niva, Zerkalo and Reform.news. The assault coincided with the New Belarus conference in Warsaw. The responsible operator and precise outage duration were not established; no information theft was reported.
-
Reform.news
August 8, 2026
•
[ ddos, government, technology ]
Reform.news reported a DDoS attack against its website on August 8, 2026 as part of concurrent attacks against independent Belarusian news outlets. Reports linked the timing to the New Belarus conference and the anniversary of the 2020 election, without identifying a perpetrator. Reform.news operates from Warsaw under a Polish registered supporting foundation. No data theft was reported.
-
Nasha Niva (Наша Ніва)
August 8, 2026
•
[ ddos, hack, technology ]
On August 8, 2026, Nasha Niva reported that a DDoS attack against its website began at approximately 10:00 a.m. and was still in progress at its 11:24 a.m. report. The incident coincided with the New Belarus conference in Warsaw and the anniversary of Belarus's disputed 2020 election. Other exiled Belarusian outlets also reported DDoS activity. A hacktivist operator is inferred from the political timing and targeting, but neither the attacker nor a government connection was verified.
-
Zerkalo (Зеркало / Zerkalo.io)
August 8, 2026
•
[ ddos, hack, technology ]
Zerkalo reported that its website worked intermittently on the morning of August 8, 2026, during DDoS attacks also reported by Nasha Niva, Pozirk and Reform.news. Zerkalo published its account at 12:05 p.m., but did not give a precise start or restoration time. The campaign coincided with the opening of the New Belarus conference in Warsaw; no operator or government sponsor was identified. Hacktivist is an inference from political timing and target selection.
-
Primorske novice
August 8, 2026
•
[ ddos, hack ]
Primorske novice reported coordinated, multiwave traffic-flooding attacks against its news website beginning on August 8. Some readers could not load pages and online editorial production was affected. The publisher said traffic filtering restored normal service by August 10 and found no intrusion or theft of newsroom or subscriber data. A concurrent attack also affected Necenzurirano. Sabotage is inferred from the effect on news distribution and the outlets' public-information role; the operator and political motive remain unverified.
-
Necenzurirano.si
August 8, 2026
•
[ hack, ddos, technology ]
Necenzurirano.si documented a DDoS campaign beginning August 8 at about 18:30, with successive waves through August 12. Its readers encountered blocked access and HTTP 503 errors. The publisher identified malicious traffic from compromised devices in approximately 40 countries and concluded that the apparent objective was to interfere with publication and readership; it could not identify the person who ordered the attack. Sabotage is a target-and-effect inference, not proof of the sponsor's identity, and no data theft was established.
-
Coggins Insurance Agency, Inc.
August 10, 2026
•
[ leak, finance, ransomware ]
Global Secret Group listed Coggins Insurance Agency on its leak site on August 10, 2026. DataBreach.com later indexed 21,657 records containing names, email addresses, and phone numbers. Coggins is an independent insurance agency in Pensacola, Florida. No independently verified operational disruption has been established.
-
Levi Strauss & Co.
August 10, 2026
•
[ social, ransomware, retail ]
Levi Strauss disclosed that an unauthorized third party used social engineering to gain access to three employees' company-issued computers and exfiltrate corporate information. The company contained and terminated the unauthorized access and reported no consumer-data exposure or business interruption. Reuters-linked infrastructure showed Levi Strauss was among companies targeted by a broader ransom-seeking social-engineering campaign associated with activity tracked as UNC6671, but neither Levi Strauss nor Google has confirmed that attribution and no group has publicly claimed the breach.
-
Shared Health Manitoba (Health Sciences Centre Winnipeg and CancerCare Manitoba)
August 10, 2026
•
[ ransomware, healthcare ]
On August 10, 2026, Shared Health identified a ransomware incident affecting a facility-maintenance network serving Health Sciences Centre Winnipeg and CancerCare Manitoba. Shared Health isolated the affected network; central HVAC monitoring and the system for issuing or changing staff access cards were interrupted, and the HSC security office temporarily closed. HVAC equipment remained operational under local monitoring, existing access cards continued functioning and clinical services continued. Recovery was ongoing August 17. Investigators had not established that personal health or financial information had been accessed; no attacker, encryption of particular files or ransom demand was publicly confirmed. The two affected institutions were reported as part of one network incident.
-
Wildberries (RWB)
August 10, 2026
•
[ ddos, retail, financial ]
Cyber Corps conducted a DDoS campaign against Wildberries on 10-11 August 2026 that disrupted the marketplace's main remote customer-service channel and partially destabilized payment infrastructure, with users reporting inability to complete financial transactions. Ukraine's Defence Intelligence said the operation was intended to reinforce the effects of Ukrainian strikes against Wildberries logistics facilities. Wildberries later confirmed DDoS attacks against its Seller Balance systems; some subsequent seller-withdrawal delays resulted from defensive controls activated in response to the attacks.
