Seoul Facilities Corporation
June 28, 2024
•[ hack, leak, ddos ]
Two teenagers hacked servers supporting Seoul Facilities Corporation's Ttareungyi public bike-sharing service between June 28 and June 29, 2024 after identifying a web vulnerability that permitted access to member information without normal authentication. Approximately 4.62 million member records were stolen. During the June 28-30 incident, a DDoS attack also caused Ttareungyi-related pages to be unavailable for about 80 minutes. One suspect later told police that curiosity and a desire to show off motivated his actions; police also investigated whether the data may have been intended for sale but found no evidence that it was distributed to third parties.
Intesa Sanpaolo
February 17, 2025
•[ hack, ddos, finance ]
Pro-Russian hacktivist group NoName057(16) claimed a coordinated DDoS campaign against Italian institutions and banks, causing temporary service disruptions but no data compromise; politically motivated, with activity spanning several days.
Bharat Sanchar Nigam Limited (BSNL)
April 23, 2025
•[ hack, ddos, technology ]
NSFOCUS identified DDoS traffic against Bharat Sanchar Nigam Limited websites on April 23, 25 and 26, 2025 using CLDAP, NetBIOS and NTP reflection. Its May 7 observations reported the corporate site and related online services still inaccessible. The duration of each traffic wave is documented, but continuous downtime and any effect on the wider telecom network are not established. The attacker is unidentified; Hacktivist and Protest are limited inferences from the India-Pakistan conflict-related campaign.
Power Grid Corporation of India Limited (POWERGRID)
May 2, 2025
•[ hack, ddos, energy ]
On May 2, 2025 NSFOCUS observed an NTP-reflection DDoS attack against POWERGRID public website lasting 31 minutes 26 seconds. Secondary cybersecurity reporting describes temporary website and online-service disruption, while NSFOCUS distinguishes possible online billing or fault-reporting effects from confirmed measurements. No disruption to the physical power grid was reported. No operator was identified; Hacktivist and Protest are inferred from the wider India-Pakistan cyber confrontation.
Office of the President of India
May 7, 2025
•[ ddos, government ]
NSFOCUS observed two consecutive DNS-reflection DDoS waves targeting presidentofindia.gov.in on May 7-8, 2025 during the India-Pakistan military escalation. The first lasted about 2 hours 16 minutes and the second about 19 hours 46 minutes using NSFOCUS GMT+8 reporting times. Media described Indian government portals becoming unavailable during the campaign, but did not independently quantify a continuous outage of this particular website. The operator remains unknown; Hacktivist and Protest are inferred from timing and target selection.
Oschadbank
March 9, 2026
•[ ddos, finance, government ]
Ukraines state-owned Oschadbank reported that around 10:00 on March 9, 2026, its security protocols triggered due to suspected DDoS activity. To protect systems, the bank temporarily disabled servers, causing electronic services to become unavailable. The bank stated technical inspection was ongoing and expected full restoration within about an hour; no data theft was reported in the notice.
Rostelecom
April 6, 2026
•[ ddos, technology ]
Rostelecom said a large-scale DDoS attack targeted its network on April 6, 2026, affecting availability of some internet resources and disrupting access to online services across Russia before the attack was filtered and neutralized.
Spotify
May 12, 2026
•[ hack, ddos, technology ]
Islamic Cyber Resistance in Iraq (313 Team), a pro-Iran hacktivist group, claimed it launched a DDoS attack against Spotify's main servers on May 12, 2026, causing disruption to the application, web player, and support site. Spotify publicly acknowledged service issues and later said they were resolved, but public reporting did not show that Spotify confirmed the claimed DDoS attribution. No data theft, account compromise, or operational data exposure was reported.
Orion Telecom
May 24, 2026
•[ ddos, technology ]
Orion Telecom experienced a series of DDoS attack waves from 2026-05-24 through 2026-06-07. The company confirmed that the attacks caused service disruptions and affected service quality for some subscribers, with home-internet outages reported from 2026-05-26. Peak attack traffic reached 1.8 Tbps. Orion said layered traffic filtering prevented substantial prolonged service problems. The company declined to identify the attackers. Although it had prepared for possible hacktivist activity around Russia Day, no group claimed the 2026 attacks and the actor type and motive remain undetermined.
Baikal Teleport CJSC
May 26, 2026
•[ ddos, technology ]
From 2026-05-26 through 2026-05-28, Baikal Teleport experienced network disruptions caused by a large DDoS attack. The provider confirmed intermittent network outages during the three-day period. The number of affected subscribers, attack volume, perpetrator, and motive were not reported.
PrivatBank
June 1, 2026
•[ hack, ddos, finance ]
PrivatBank, Ukraine's largest state-owned bank, said an 'unusual' DDoS attack using infected devices of Ukrainian users caused a June 2026 failure of its services, blocking some legitimate customers during filtering. The bank blamed Russia; August outages were a supplier fault.
Norsk Tipping AS
June 2, 2026
•[ ddos, hack, technology ]
A DDoS attack against Norsk Tipping began shortly before 20:30 June 2 and intensified about 21:00, overloading gaming services, especially KongKasino. Telenor mitigated the traffic and the company said traffic normalized about 23:00. No customer-data breach was reported. The operator remains unidentified. Sabotage is inferred from deliberate service interference against a government-owned national gambling operator, not from a proven political or financial demand.
Norsk Tipping AS
June 3, 2026
•[ ddos, hack, technology ]
On June 3, after the previous evening's DDoS had been contained and service restored, Norsk Tipping experienced another traffic-flooding attack. Customers reported delays and failed access to some online games. The company confirmed restoration around 23:00, with no data compromise. The attacker was not identified. Sabotage is inferred from repeated efforts to obstruct this state-owned public gambling service.
PT Tempo Inti Media Tbk
June 5, 2026
•[ hack, ddos, technology ]
Beginning on 2026-06-05, unidentified attackers used bot-generated traffic in an intermittent DDoS attack against Tempo's news website, making it difficult for the public to access. Tempo recorded 24.9 million malicious requests through 2026-06-08, including 12.97 million during one reported two-hour surge. Tempo suspected the attack was intended to interfere with its journalism and may have followed a separate late-May compromise that temporarily unpublished corruption-related articles, but neither the connection nor the perpetrator was confirmed.
VTB Bank (PJSC)
June 8, 2026
•[ ddos, finance, hack ]
On June 8, 2026, a DDoS attack disrupted VTB Banks online services, preventing some customers from logging into mobile and web banking or completing payments and transfers. Complaints increased around 11:00 Moscow time, and VTB reported that service availability had been fully restored after 17:00.
tinyBuild LLC
June 22, 2026
•[ ddos, technology ]
Beginning with the 2026-06-22 early-access launch of SAND: Raiders of Sophie, unidentified attackers conducted large DDoS attacks against the game's online service. tinyBuild's chief executive reported 12 hours after launch that the team was still responding to the attacks, which hampered gameplay and service stability and contributed to negative user reviews. The exact attack volume, number of affected players, end time, perpetrator, and motive were not reported.
elTOQUE (Mas Voces Foundation, Inc.)
July 2, 2026
•[ ddos, government, technology ]
From July 2 through July 8, 2026, elTOQUE received approximately 1.09 billion malicious automated requests intended to overwhelm eltoque.com and prevent access to its reporting. The campaign focused principally on the homepage, which hosts the outlet's widely used informal Cuban exchange-rate tracker. Protective systems stopped approximately 96% of the traffic before it reached the origin server, and the website remained online, although emergency mitigation rules temporarily delayed or impeded access for some legitimate users, particularly in Cuba. About 2,400 accompanying attempts to exploit website vulnerabilities were unsuccessful. Traffic came through rented data-center and cloud infrastructure in several countries and does not establish attribution. Given the sustained Cuban government pressure against elTOQUE, the politically sensitive target, and the pattern of earlier attacks, the actor country is coded Cuba as a low-confidence contextual assessment; the perpetrator and actor type remain undetermined.
Tidewater Telecom, Inc.
July 19, 2026
•[ ddos, ransomware, technology ]
On the evening of July 19, 2026, unidentified attackers used bots to flood Tidewater Telecom and affiliated Lincolnville Communications internet-service systems with malicious traffic. The providers worked with upstream carriers to block the traffic. Internet service for residential, business, and government customers across 23 towns became unreliable or unavailable, limiting municipal services and closing the Camden Town Office. Internet operations were near normal by the morning of July 21, although traditional voice service remained in major-outage status. A Tidewater representative said the attackers made demands, but the company did not disclose the demands, any requested amount, or whether payment occurred. The companies found no indication that customer data was compromised.
KazTAG
July 19, 2026
•[ ddos, hack ]
DDoS attacks against KazTAG began July 19 and continued July 20, causing access problems and temporarily preventing the newsroom from publishing. Its hosting provider observed an anomalous surge in inbound traffic and blocked foreign traffic until the attacks ended while leaving access from Kazakhstan unrestricted; no attacker or motive was identified.
Norsk Tipping AS
August 2, 2026
•[ ddos, hack, government ]
A DDoS attack against Norsk Tipping on August 2 produced public website and mobile-app errors and caused the operator to suspend Oddsen betting around 13:40. The company reported the traffic attack lasted about two hours and betting access had resumed by its afternoon update. No successful intrusion or data theft was found. The attacker and motive were not verified; Sabotage is inferred from the deliberate denial of a state-owned nationwide service.
