Gyrovague.com blog
February 10, 2026
•[ DDoS, Denial of Service, malicious script ]
Cybernews reported that Archive.today (archive.ph / archive.is mirrors) embedded a hidden script that turns visitors into participants in a DDoS attack against the Finnish travel blogger site Gyrovague.com. The script is triggered while visitors solve a CAPTCHA and repeatedly hits Gyrovagues search function with randomized requests to defeat caching and increase resource load. The article frames the attack as a personal vendetta tied to a prior OSINT/doxxing blog post about Archive.todays operator, and notes the operator acknowledged the DDoS and issued additional threats. This is coded as a confirmed disruptive denial-of-service action targeting the bloggers site availability/performance.
Air Cote d'Ivoire
February 8, 2026
•[ cyberattack, data leak, sensitive files ]
Air Cte d'Ivoire confirmed that a cyberattack on February 8, 2026 affected parts of its information system and involved the illegal extraction of sensitive files, prompting business continuity measures and technical support for flights and other operations.
University of La Sapienza
February 5, 2026
•[ cyberattack, operational disruption, network shutdown ]
La Sapienza University in Rome reported that its IT infrastructure was targeted by a cyberattack that caused widespread operational disruption. The university announced it ordered an immediate shutdown of network systems as a precaution to protect data integrity and security, and formed a technical task force while notifying authorities. As of the report, the universitys website remained offline and ongoing status updates indicated continued recovery work. Public reporting did not confirm data theft; the primary documented effect is the deliberate shutdown and resulting loss of availability for key university network services.
Spain's Ministry of Science (Ministerio de Ciencia)
February 5, 2026
•[ cyberattack, data leak, IDOR vulnerability ]
Spains Ministry of Science partially shut down IT systems and suspended ongoing administrative procedures following what it called a technical incident, later reported by Spanish media as related to a cyberattack. A threat actor using the alias GordonFreeman claimed responsibility, posted samples, and offered allegedly stolen ministry data for sale. The attacker claimed an IDOR vulnerability enabled credential access and full admin-level access, but BleepingComputer noted it could not independently confirm all claims. The confirmed impact is significant service disruption for citizen/company-facing procedures, with credible indications of data compromise based on posted samples.
Conpet
February 4, 2026
•[ cyberattack, ransomware, data breach ]
Romanias national oil pipeline operator Conpet said a cyberattack disrupted parts of its technology infrastructure and knocked its website offline earlier in the week, while operational technology systems (including SCADA and telecoms) remained functional and oil transport operations were not affected. Conpet did not confirm a data breach or name the attacker, but the Qilin ransomware group listed Conpet on its leak site and claimed to have stolen nearly one terabyte of data, publishing images of alleged internal documents, financial records, and passport scans. Conpet said it took immediate mitigation steps, worked with national cybersecurity authorities, and filed a criminal complaint.
Senegal's Directorate of File Automation (DAF)
February 3, 2026
•[ ransomware, cyberattack, operational disruption ]
The Record reported that Senegal confirmed a cybersecurity incident affecting its Directorate of File Automation (DAF), an office managing sensitive identity information such as national ID cards, passports, and other biometric data. DAF issued a public notice warning residents that the cyberattack forced the temporary suspension of the offices operations. The article noted the breach became public after ransomware claims, but it did not confirm in the government notice that biometric or identity records were exfiltrated; the confirmed primary effect in the report is operational disruption via suspension/closure of the offices services.
Family Health Centers of Southern Indiana
February 2, 2026
•[ cyberattack, data leak, PII ]
Termite claimed responsibility for a cyberattack against Family Health Centers of Southern Indiana, identified by the domain fhcenters.org, on February 2, 2026. DataBreach later indexed 60,425 rows tied to the breach, with exposed fields including dates of birth, phone numbers, names, street addresses, and bank account information. Public sources did not confirm the intrusion vector, encryption, operational disruption, or exact data-theft mechanism.
Uffizi Galleries
February 1, 2026
•[ cyberattack, backup restoration, operational disruption ]
Uffizi Galleries confirmed a cyberattack but said nothing was stolen and disruption was limited to restoring backups.
Olympique de Marseille
February 1, 2026
•[ cyberattack, data leak, data breach ]
Olympique de Marseille confirmed a cyberattack after a threat actor claimed to have breached club systems earlier in February and leaked samples of staff and supporter data online.
European Commission
January 30, 2026
•[ cyberattack, data leak, vulnerability exploitation ]
The European Commission disclosed it detected traces of a cyberattack on January 30, 2026 targeting its central infrastructure used to manage staff mobile devices. The Commission said the incident may have resulted in access to staff names and mobile phone numbers for some employees, but it had not found evidence that managed mobile devices themselves were compromised. The Commission stated its response contained and cleaned the system within nine hours. The article notes the Commission did not disclose the initial access method, but the incident appeared linked to attacks exploiting vulnerabilities in Ivanti Endpoint Manager Mobile (EPMM).
City of New Britain
January 28, 2026
•[ ransomware, cyberattack, infrastructure disruption ]
City of New Britain municipal systems were taken offline following a ransomware attack that disrupted internal networks and communications, prompting coordination with federal and state authorities to restore services.
Euroxx Securities S.A.
January 27, 2026
•[ cyberattack, defensive shutdown, system shutdown ]
Cyberattack on Euroxx prompted a defensive system shutdown; no disruption or data loss confirmed.
Concello de Sanxenxo (Spanish Municipality)
January 26, 2026
•[ ransomware, data encryption, bitcoin ]
A ransomware attack encrypted thousands of administrative documents at the Concello de Sanxenxo, prompting a $5,000 Bitcoin ransom demand. The city refused to pay and is restoring systems from backups; the incident disrupted internal municipal operations and required a formal complaint to the Guardia Civil.
Vladimir Bread Factory
January 26, 2026
•[ cyberattack, operational disruption, delivery disruption ]
A cyberattack knocked offline internal digital systems at a Russian bread factory, disrupting order processing and deliveries while production lines continued operating.
Delta (Russian Security and Alarm Services Company)
January 26, 2026
•[ cyberattack, service disruption, state-sponsored attack ]
A cyberattack attributed to a hostile foreign state disrupted Deltas alarm and vehicle services for thousands of users. No customer data compromise confirmed.
Local Government Services Portal (KOVTP)
January 22, 2026
•[ cyberattack, denial-of-service, service disruption ]
A Russian-language summary report stated that the portal for local government services (KOVTP) was subjected to a large-scale cyberattack that disrupted availability. The incident was presented as a service disruption affecting public access, consistent with an external denial-of-service scenario. The available summary did not provide exact downtime, traffic characteristics, or evidence of data theft, so the record is coded as disruptive with undetermined duration and scope details.
Czech Public Procurement Portal
January 19, 2026
•[ DDoS attack, service disruption, cyberattack ]
Czech authorities reported that the countrys public procurement portal was taken out of service by hackers on Monday, January 19, 2026, in an incident described as a DDoS attack. The Ministry for Regional Development stated the portal was brought back online later that same day and the situation continued to be assessed. Officials emphasized that actual public procurement submissions are handled in a separate system that remained functional, limiting downstream operational disruption primarily to portal availability and access to related information services rather than halting procurement processes entirely.
Town of La Hague
January 13, 2026
•[ intrusion, email compromise, unauthorized access ]
The municipality of La Hague (France) announced it was the victim of an intrusion into its information system that impacted internal email accounts. Upon learning of the incident, the commune reported immediate actions including changing passwords for affected and administrator accounts, temporarily suspending email sending for impacted users, notifying relevant authorities (including ANSSI, CERT-FR, DINUM, CNIL, and local digital authorities), informing partners, and filing a formal complaint with the gendarmerie. Specialized law enforcement units began investigating the incident and its consequences while technical teams and service providers conducted parallel analysis. The announcement emphasized heightened vigilance against suspicious links/attachments and stated the municipality was working to restore system security.
AZ Monica
January 13, 2026
•[ cyberattack, operational disruption, healthcare ]
AZ Monica hospital in Antwerp reported a cyberattack discovered around 6:30 a.m. after staff observed a serious IT failure. As a precaution, the hospital shut down all servers across both campuses (Deurne and Antwerp/Harmonie), and law enforcement opened an investigation with the cyber crime unit on site. Because clinicians could not access electronic patient records, the hospital postponed non-urgent care and maintained emergency care at a reduced level. Reporting stated at least 70 planned operations were cancelled, roughly 70 patients were sent home, and seven patients were transferred to other hospitals as a precaution. Public reporting did not confirm encryption, ransom demands, or data theft, focusing primarily on operational disruption and patient-care impact.
ICE List site
January 13, 2026
•[ denial-of-service attack, data leak, personal information ]
A website known as ICE List, operated by Netherlands-based immigration activist Dominick Skinner and described as dedicated to leaking personal information about U.S. immigration and border personnel, went offline following a denial-of-service attack on the evening of January 13, 2026. Reporting said the outage occurred shortly after media coverage that Skinner planned to publish additional personal data allegedly obtained from a whistleblower. Skinner stated it was only possible to speculate on who directed the attack but claimed a large amount of traffic appeared to come from Russia, consistent with bot traffic intended to overwhelm the site and disrupt access.
