Undisclosed United States LightSpy victim
August 6, 2026
•[ espionage, malware, technology ]
Arctic Wolf researchers identified LightSpy victims in at least 13 countries, including the United States, and documented a wider campaign in which the spyware infected multiple device types and network routers. This conservative record represents at least one unidentified United States victim; the victim's device type, organization or individual status, and exact data acquired were not disclosed. Researchers linked the latest LightSpy activity to a Chinese contractor after identifying one of the spyware operators through the platform's administrative infrastructure.
VL Prosperity
August 7, 2026
•[ hack, espionage, manufacturing ]
Sources told ABC News that VL Prosperity was hacked while transiting the Strait of Gibraltar and lost communications for more than 30 hours. The Coast Guard and FBI later said foreign cyber actors had compromised the vessel's network and boarded the ship on 21 August to investigate and mitigate the threat. Subsequent reporting citing unnamed U.S. officials said investigators found temporary access to a propulsion-linked digital system, but the vessel manager later said Coast Guard, classification-society and internal IT reviews found no evidence the propulsion system was compromised. The initial access vector and perpetrator remain unknown; the 7 August date comes from contemporaneous reporting and has not been publicly confirmed by U.S. authorities.
Undisclosed Middle Eastern government organization
August 14, 2026
•[ espionage, government, malware ]
Jewelbug compromised government users through malicious code inserted into a shared Middle Eastern government webmail platform. When employees logged in, the script exfiltrated webmail cookies and institutional email addresses; selected users were then presented with a fake Adobe update that delivered the Antino backdoor and malicious PDF Viewer browser extension. At least one confirmed victim showed authenticated access to internal virtualization-management infrastructure. This conservative record represents at least one government organization within a broader campaign that successfully watering-holed more than 15 government webmail tenants.
Quinn Emanuel Urquhart & Sullivan LLP
August 14, 2026
•[ social, espionage, leak ]
On August 14, 2026 an unauthorized third party used social engineering to obtain access through one temporarily compromised Quinn Emanuel user account to stored files in a single software application. The intruder accessed a limited number of client documents including material concerning Muddy Waters from litigation in Florida. The law firm notified affected parties and law enforcement, and said unauthorized access was no longer ongoing. A separate 2023 Quinn Emanuel client-data exposure involved a third-party data center and is not this incident.
Undisclosed Philippine marine engineering and shipbuilding company
August 26, 2026
•[ espionage, manufacturing, technology ]
Website data was stolen following administrator compromise, by 13 August 2026. Espionage motive is inferred from the broader targeted collection. Intrusion date is unknown; event_date uses the publication-date fallback.
Undisclosed organization investigated by Sygnia
August 31, 2026
•[ espionage, technology, government ]
Fire Ant compromised Cisco IOS XR routers, TACACS authentication systems, and Linux management hosts at an undisclosed organization, using the infrastructure to capture network traffic and administrative credentials, maintain covert access, and suppress security telemetry. The incident was part of a broader China-nexus espionage campaign with strong behavioral and tooling overlap with UNC3886. Fire Ant used the compromised environment to probe connected high-value and critical-infrastructure networks, but Sygnia observed only scanning and connection attempts against those downstream environments rather than confirmed compromise.
Undisclosed Philippine nuclear research agency
September 8, 2026
•[ espionage, leak, government ]
A suspected Chinese-speaking operator exploited an ownCloud authentication weakness and stole 176 files totaling about 372 MB from a Philippine nuclear research agency. The stolen material was already present on attacker-controlled infrastructure when researchers discovered it on 13 August 2026; the exact theft date is not established, so event_date uses the supplied source publication date.
Undisclosed organizations
September 9, 2026
•[ ransomware, espionage, technology ]
Cisco Talos disclosed on 9 Sep 2026 that three clusters exploited Cisco Secure FMC flaws at unnamed organizations: a Qilin-linked affiliate stole data and deployed Qilin ransomware, Sandworm-linked UAT-11823 harvested firewall configurations, and UAT-12197 stole credentials.
Undisclosed company described at the 2026 IFDA Solutions Conference
September 18, 2026
•[ leak, espionage ]
A cybersecurity executive at the September 2026 IFDA Solutions Conference described a separate unnamed organization that detected a malicious intruder in its network but did not contain the access. According to the panel discussion, the intruder remained in the network for approximately 16 months and ultimately exfiltrated about 12 TB of data. The victim company, industry, country, access vector, incident year and exact intrusion/exfiltration dates were not disclosed. September 18, 2026 is the publication-date fallback and should not be treated as the confirmed compromise month.
H&L Manufacturing
October 5, 2026
•[ ransomware, manufacturing, espionage ]
H&L Manufacturing was listed as a victim on the leak site of the interlock ransomware group; the attack is estimated to have taken place on 2026-10-05. Sector: Manufacturing. Website: https:hlmanufacturing.com. H&L Manufacturing is a contract manufacturer serving various industries, including automotive, consumer goods, and transportation. However, due to negligence, H&L filesnon-disclosure agreements, CAD models, material specifications, quotes, prototypes, 3D printing data, process specifications, quality control records, supplier and employee datawere compromised and are now publicly available. These files represent commercially valuable assets and confidential intellectual property. This leak, which the company is unwilling to address, allows competitors to copy its work, undercut tender prices, lure customers, provoke lawsuits and fines, and damage its reputation, draining the company's resources.
Ability Enterprise
October 6, 2026
•[ ransomware, technology, manufacturing ]
Ability Enterprise was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-10-06. Country: Taiwan. Website: abilitytw.com. abilitytw.com zoominfo.com/c/ability-enterprise-co-ltd/1340859360 Ability Enterprise is a Taiwan-based ODM/OEM manufacturer founded in 1965, headquartered in New Taipei City, and one of the world's leading producers of digital imaging and optical camera products. The company designs and manufactures camera modules, action cameras, Edge AI webcams, automotive cameras, and security/surveillance systems for global brands, with factories in Taiwan, China (Dongguan), and Vietnam. Roughly half of its workforce is in R&D, and the company holds 42 patents from the last three years, focusing on AI vision, 3D ToF, and robotics. Financially, it's on a strong growth run: FY2025 revenue hit NT$9.91 billion (+60% YoY), and 2026 revenue is tracking above NT$10 billion with an ambitious NT$30 billion target by 2028. Its strategic pivot "Transformation 3.0" positions it as the "eyes for AI robots," supplying vision modules for humanoid robots (Agility Robotics, Mantis Robotics) and drones
Ernesto Malvestiti S.p.A.
October 26, 2026
•[ ransomware, manufacturing, espionage ]
Ernesto Malvestiti S.p.A. was listed as a victim on the leak site of the aurora ransomware group; the attack is estimated to have taken place on 2026-10-26. Sector: Manufacturing. Country: Italy. Website: Ernesto Malvestiti S.p.A.. [manufacturer] Ernesto Malvestiti S.p.A. a privately-held Italian manufacturer of precision aluminium die-cast and fine-blanked components, supplying BMW, Valeo, BorgWarner, Schneider Electric, Fiat/Stellantis, and 150+ other automotive OEM.
The exposed material spans the company's entire operations:
PAGHENET payroll database (1.1 GB SQL Server backup 7 copies) every employee's salary, IBAN bank account, codice fiscale (Italian tax ID), home address, and tax withholdings. Plus the INAZMST employee master database (181 MB 5).
GDPR Article 9 special-category data medical fitness records, disability status, union membership lists, workplace injuries, occupational diseases, and stress assessments for the entire workforce.
50+ plaintext OEM portal credentials stored in a single file called accesso web.txt BMW B2B, Brose SWP, Valeo, BorgWarner SAP, Schneider VFAST, Eaton, Fiat, Peugeot/PSA, and 40+ more.
SQL Server administrator password for the payroll database server, stored in a plaintext ODBC registry export.
ADP payroll SFTP credentials stored in WinSCP.ini the channel used to transmit employee salary data to the external payroll processor.
614 MB of financial/controlling data consolidated balance sheets (2024-2025), revenue by plant, P&L, transfer pricing documents, cash flow, competitor analysis, and banking relationships.
1.5 GB of engineering IP 300+ fine blanking die designs, technical drawings (483 MB), press parameters, PLC programs, FANUC robot code, and R&D contracts.
160+ client/supplier contracts with pricing, commercial terms, and executed NDAs.
560+ job candidate CVs with full names, addresses, phone numbers, and career histories.
Rapid Manufacturing
October 30, 2026
•[ ransomware, espionage, manufacturing ]
Rapid Manufacturing was listed as a victim on the leak site of the aurora ransomware group; the attack is estimated to have taken place on 2026-10-30. Sector: Manufacturing. Website: Rapid Manufacturing. [manufacturer] Rapid Manufacturing a 50-year-old electronics contract manufacturer in Anaheim, California with operations in Ensenada, Mexico.
Rapid Manufacturing is not a household name. But it is a critical Tier-1 supplier to SpaceX (Falcon & Starship programs), Anduril, Northrop Grumman, Rocket Lab, L3Harris, Collins Aerospace (RTX), and Millennium Space (Boeing). It builds the wire harnesses, electro-mechanical assemblies, and box builds that go inside rockets, missiles, and satellites.
The exposed material includes:
>
ITAR-controlled engineering drawings and manufacturing processes for Falcon 9/Heavy, Starship, and Draco propulsion systems RTD soldering acceptance criteria, visual inspection standards, cable thermocouple assemblies, and production master plans.
26 ITAR customer quoting accounts including SpaceX, Anduril, Northrop Grumman, Rocket Lab, L3Harris, Collins Aerospace, and Millennium Space the complete defense/space revenue architecture.
6001,200 employee records spanning US (SSN, bank accounts, payroll, I-9/immigration) and Mexico (RFC, CURP, IMSS, bank accounts, nminas) with data from 2019 through August 2026.
Attorney-client privileged materials settlement agreements, severance terms, internal investigation files, and a recorded termination meeting (audio).
Military Sealift Command
July 17, 2026
•[ ransomware, government, espionage ]
Military Sealift Command was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-07-17. Sector: Transportation. Country: United States of America. Website: sealiftcommand.com. ***.com zoominfo.com/c/military-sealift-command/149045906 We attempted to contact the managers regarding the leaked documents (ITAR documentation, personal data, cargo manifestsincluding ESSM shipmentsvessel blueprints, and both disclosed and undisclosed information)/ We managed to reach only Jennifer Miller , Todd Phillips and Dain Costlow However, these individuals dismissed the entire matter as a joke, ignoring all warnings about leaks and the importance of internal documents, and refused to provide any contact details for anyone authorized to handle such issues or to pass the information on to management, despite the availability of conclusive evidence. If you do not get in touch in the near future, the data will be published.
Aerospace & Advanced Composites GmbH
June 22, 2026
•[ ransomware, manufacturing, technology ]
Aerospace & Advanced Composites GmbH was listed as a victim on the leak site of the aurora ransomware group; the attack is estimated to have taken place on 2026-06-22. Sector: Manufacturing. Country: Germany. *** (AAC) an Austrian space-materials R&D company headquartered in Wiener Neustadt, with deep ties to the European Space Agency.
Obtained two complete NAS snapshots spanning 30+ years of operations:
aacdata (31 December 2022) 123 GB: the complete Testhouse, R&D, and engineering share, including the ESA thermal vacuum test archive, polymer composites formulations, and 22 Outlook PST email backups.
aacdata1 (14 January 2025) 86 GB: the administrative share, including managing director's full PC backup (browser credentials, passport scans), 15 years of financial statements, shareholder agreements, and the IT credentials master spreadsheet.
BMD_DATA 34 MB: the complete BMD business software accounting database with employee payroll, SEPA payments, and VAT declarations.
done/ Bitlocker recovery keys for 12 endpoints and WMI system dumps.
The exposed material includes:
4 passport scans, 1 social security number, 25 employees' complete HR files, 50100+ job applicant CVs the full identity-theft toolkit for the workforce plus third-party data subjects.
The IT credentials master spreadsheet (AAC CODES.xlsx) containing every system password, plus browser-stored logins for ESA SSO, the company's IT provider, and industrial suppliers.
12 Bitlocker recovery keys enabling full-disk decryption of 6 company laptops.
123 GB of ESA thermal vacuum test data 30+ years of space-grade materials testing that represents the company's core competitive advantage and cannot be recreated.
137 executed NDAs with partners including Airbus, RUAG, Safran, Thales, ESA, BMW, Tesla, Google, Samsung SDI, CERN, DLR, and 126 others.
15 years of annual financial statements, bank records, insurance policies, and shareholder agreements the company's entire financial anatomy laid bare.
rbh aerospace inc
May 11, 2026
•[ ransomware, manufacturing, espionage ]
rbh aerospace inc was listed as a victim on the leak site of the incransom ransomware group; the attack is estimated to have taken place on 2026-05-11. Sector: Manufacturing. Country: United States of America. Website: rbhaerospace.com. RBH Aerospace, Inc.
-is a manufacturing company located in Long Beach, California, specializing in the production of aerospace components. Established in January 2005, the company focuses on providing high-quality parts for both commercial and military aircraft. Their product offerings include aircraft frames, fuselages, wings, and various metal alloy components such as steel, aluminum, and titanium.
2708 Seaboard Lane, Long Beach, CA 90805
http://www.rbhaerospace.com/
Leaked data 240 GB:
Corporate information, including electronic correspondence with counterparties, contracts including NDAs, transactions and payments related to them, STP (STEP) files, part drawings (including those for F-15, F-22), manuals and instructions.
50 Senior Unit 9900 Officers Exposed
April 4, 2026
•[ ransomware, espionage, government ]
50 Senior Unit 9900 Officers Exposed was listed as a victim on the leak site of the handala ransomware group; the attack is estimated to have taken place on 2026-04-04. Sector: Government & Defense. Today, for the first time, the complete details of 50 senior officers from Unit 9900 of the Israeli military intelligence (Aman) have been made public. This historic exposure is the result of months of surveillance and complex cyber operations by Handala Hack, a move that has sent shockwaves through the very foundation of the Zionist
Israel Institute for National Security Studies (INSS)
March 4, 2026
•[ ransomware, government, espionage ]
Israel Institute for National Security Studies (INSS) was listed as a victim on the leak site of the handala ransomware group; the attack is estimated to have taken place on 2026-03-04. Sector: Government & Defense. Country: Israel. INSS Hacked Your national security is built on deception, media manipulation, and the brainwashing of Jews. How did your national security institution imagine it could end the war in just a few days? But this time is different, and there will be no end. This is a war between good and evil, and all the
IDF in Farsi
March 6, 2026
•[ ransomware, government, espionage ]
IDF in Farsi was listed as a victim on the leak site of the handala ransomware group; the attack is estimated to have taken place on 2026-03-06. Sector: Government & Defense. Country: Iran. Tonight, the silence of the Persian pages of the Zionist army has been broken. Handala Hack is here; this time not for a warning, but for proof. All confidential information from Israeli army accounts has fallen into our hands. Now, 26 pages of individuals connected to the Zionist army in the Axis of Resistance countries
Israeli Weather Stations Crippled
March 8, 2026
•[ ransomware, government, hack ]
Israeli Weather Stations Crippled was listed as a victim on the leak site of the handala ransomware group; the attack is estimated to have taken place on 2026-03-08. Sector: Government & Defense. Country: Israel. Greetings to all freedom-loving nations and resistance fighters. Following a series of successful cyber operations, Handala Hack has fully infiltrated the main servers of the Zionist regimes meteorological systems and has wiped out all governmental and military weather stations. As of this moment, none of these stations are operational, leaving the enemys aviation and military
