Springfield Public Schools
September 1, 2026
•[ ransomware, education ]
Springfield Public Schools (Massachusetts) detected malicious traffic Sept. 1, 2026; its network crashed and schools closed for about a week. The FBI said student and staff data was made public; Interlock claimed the attack. District offered staff credit monitoring.
Blanco & Etcheverry
September 4, 2026
•[ ransomware, leak ]
Gunra ransomware added Montevideo law firm Blanco & Etcheverry to its leak site on Sept. 4, 2026, claiming to have leaked 300 GB of data. The firm has not confirmed the attack or commented.
Air Canada
September 9, 2026
•[ ransomware, leak, technology ]
The Gentlemen ransomware group listed Montreal-based Air Canada on its leak site on Sept 9, 2026, claiming to have stolen 51,409 'critical files'. A dataset of about 489,000 mostly email records was later indexed; Air Canada has not confirmed it; no disruption was reported.
Undisclosed organizations
September 9, 2026
•[ ransomware, espionage, technology ]
Cisco Talos disclosed on 9 Sep 2026 that three clusters exploited Cisco Secure FMC flaws at unnamed organizations: a Qilin-linked affiliate stole data and deployed Qilin ransomware, Sandworm-linked UAT-11823 harvested firewall configurations, and UAT-12197 stole credentials.
Wilke
September 9, 2026
•[ ransomware, technology ]
Wilke, an Odense, Denmark market research and polling firm, was hit by a ransomware attack that took its systems down; CEO Stine Halberg said returning to full capacity took longer and was bumpier than the few weeks she had hoped. Attack date and attacker not disclosed.
Undisclosed Russian companies
September 14, 2026
•[ ransomware, hack, leak ]
Kaspersky research reported in Sept 2026 says pro-Ukrainian hacktivist group Hacking Cat breached unnamed Russian companies via Exchange flaws, stole data and deployed Monkey ransomware and Nemo wiper; some victims paid, others had data leaked. The group denied using the lockers.
Undisclosed United Arab Emirates company
September 15, 2026
•[ ransomware, government, hack ]
An unnamed UAE company supporting a government sector was compromised through an unpatched software vulnerability and received a ransom demand exceeding US$5 million. Reporting of the cybersecurity chief's September 15, 2026 account states that the attacker obtained company information and published some on the dark web, although other coverage says publication was prevented. Official WAM reporting describes attempted data destruction that was prevented, conflicting with reporting of completed destruction; a disruptive effect is not established. The stolen data categories, volume and source systems were not identified. The intrusion date is unknown; September 15, 2026 is the earliest-report publication fallback, not a verified occurrence date.
St James' Anglican School
September 15, 2026
•[ ransomware, hack, education ]
Hackers accessed systems at St James' Anglican School in Perth, Western Australia, copying current and former students' and families' personal data, incl. bank details, medical records and photos. The school said it contained the incident; ThreeAM ransomware claimed it.
Undisclosed organization investigated by CyberMaxx (Event A)
September 15, 2026
•[ ransomware, technology, financial ]
CyberMaxx incident responders observed exploitation of N-able N-central in an unnamed customer environment. The intruder used Net.exe to issue an administrator password-change command, established a Cloudflare tunnel, installed SimpleHelp for persistence and reached a file server over remote access. File enumeration and communication with Filemail-associated infrastructure were observed, but completed data theft and ransomware encryption were not verified. CyberMaxx attributed the activity to Storm-1175 with high confidence; Criminal and Financial reflect the ransomware-preparation context. September 15 is the publication-date fallback, not a verified intrusion date.
Undisclosed organization investigated by CyberMaxx (Event B)
September 15, 2026
•[ ransomware, financial, technology ]
In a second distinct incident-response case, CyberMaxx observed attackers abuse N-able N-central to execute commands on a domain controller, change an administrator password and establish an interactive session using the altered credentials. They installed SimpleHelp, moved to another server through RDP and staged additional tools. No completed exfiltration or ransomware encryption was confirmed. CyberMaxx linked the operation to Storm-1175 with high confidence; Criminal and Financial are supported by the ransomware-preparation context. September 15 is a report-date fallback, not the known attack date.
Undisclosed Singapore company
September 17, 2026
•[ ransomware, financial ]
Singapore Police described a ransomware attack on an unnamed business whose systems were reportedly breached and years of data became unavailable. The attacker demanded a million-dollar ransom to restore the data; the currency was not specified. The owner sent staff away, disconnected servers and contacted police. The business sector, intrusion method, disruption duration and recovery outcome were not disclosed. Complete system encryption, permanent data destruction and data exfiltration were not confirmed. The incident date and year are unknown; September 17, 2026 is the publication-date fallback, not a verified occurrence date.
Ellis County, Kansas
September 17, 2026
•[ ransomware, government ]
Ellis County, Kansas, said a ransomware incident detected Sept 17, 2026 disrupted parts of its IT systems, leaving some county services unavailable or delayed; 911 stayed up. The KBI and Highway Patrol are investigating; the county saw no evidence of data access.
Kendall Hunt Publishing Company
September 18, 2026
•[ ransomware, education ]
INC Ransom listed Kendall Hunt Publishing, a Dubuque, Iowa educational publisher, on its leak site on Sept 18, 2026, claiming stolen data and threatening to publish it unless the company negotiated. About 441,000 records were later indexed; the company has not confirmed.
United Federation of Teachers
September 18, 2026
•[ ransomware, education ]
The United Federation of Teachers, New York City's teachers' union, was listed by extortion group N0n on Sept. 18, 2026, claiming theft of ~181,420 legal case documents and demanding negotiation before publication. UFT has not confirmed the breach.
Burnaby School District 41
September 21, 2026
•[ ransomware, education, financial ]
The district discovered ransomware on September 21, 2026 and later confirmed theft of personal-information files. Network and phone services were affected. September 21 is a discovery proxy; initial access and extraction dates are unknown. The official page was first published September 23 and updated October 14. Neither encryption nor the stolen-data source host was specified, so technical subtypes remain undetermined. Financial motive is inferred from ransomware.
City of Stevens Point
September 23, 2026
•[ ransomware, government, technology ]
An unknown party gained unauthorized access to the Stevens Point municipal network on September 23. Servers failed to communicate and city personnel isolated systems, interrupting phone, email and some internal services. Staff prevented the suspected ransomware from executing. Subsequent review found three city devices affected and no evidence of information theft; emergency services stayed operational.
Keio Corporation
September 26, 2026
•[ ransomware, finance, technology ]
Japanese railway group Keio confirmed a ransomware attack on group servers on Sept. 26, 2026, disrupting hotel reservations and card payments at some group firms; trains ran normally. Qilin claimed the attack in October and posted sample internal documents.
insurancehouse.com
October 8, 2026
•[ ransomware, finance ]
insurancehouse.com was listed as a victim on the leak site of the settra ransomware group; the attack is estimated to have taken place on 2026-10-08. Sector: Financial Services. Country: United Kingdom of Great Britain and Northern Ireland. Website: insurancehouse.com. Inside: quarterly and annual operational reports from the claims division (Claims Operations, QCS, SIU, Subrogation & Arbitration, Coverage Containment) covering 20232026, with full financial KPIs a cumulative coverage containment total of $4.8 million over three years; monthly reports on reserves, subrogation shortfalls, and the operational burden of the litigation unit; an executive summary of the disclaimer program (1,209 disclaimers, zero bad-faith claims); a Chubb data breach response plan form listing responsible parties; confidentiality and non-solicitation agreements with employ
kingdomtitle.net
October 8, 2026
•[ ransomware, finance, leak ]
kingdomtitle.net was listed as a victim on the leak site of the settra ransomware group; the attack is estimated to have taken place on 2026-10-08. Sector: Financial Services. Country: United Kingdom of Great Britain and Northern Ireland. Website: kingdomtitle.net. 1. 06/26/2026: an incoming book transfer of $15,319,440 and an outgoing wire on file 20260084C of $14,947,415. The same amount appears in the cleared report and in the Void & Stop Payment report. 2. 07/07/2026: Brian Moore Professional and Personal Spreadsheet.pdf contains personal auto, umbrella, and boat policies. The OCR alongside lists $766, $4,963.26, and $9,170.70 with the annotations paid from kts dev gr. 3. Three recent Trial Balances contain 2,972 positive balances totaling $1,277,500.31: American $1,077,012.58, Kingdom $143,990.33, Title Connect $56,497.40. 4. American ODI
Isapre Consalud
November 2, 2026
•[ ransomware, healthcare ]
Isapre Consalud was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-11-02. Sector: Healthcare. Country: Chile. Website: www.consalud.cl.
