City of Mitchell
August 6, 2026
•[ ransomware, government, financial ]
Mitchell discovered unauthorized activity in part of its municipal network on August 6, 2026, and isolated the affected environment through August 12. Administrative online services were interrupted, while officials said email and emergency services were unaffected. The city subsequently confirmed that information relating to a small number of employees was affected. The Storm extortion group listed Mitchell on its leak site on August 23 with an August 28 deadline and image thumbnails; independent reporting documents that claim, but the city has not verified Storm attribution. Successful encryption, theft of specific files and a ransom demand to the city are not confirmed. Criminal and Financial are supported by the claimed extortion-group context.
Wildberries (RWB)
August 10, 2026
•[ ddos, retail, financial ]
Cyber Corps conducted a DDoS campaign against Wildberries on 10-11 August 2026 that disrupted the marketplace's main remote customer-service channel and partially destabilized payment infrastructure, with users reporting inability to complete financial transactions. Ukraine's Defence Intelligence said the operation was intended to reinforce the effects of Ukrainian strikes against Wildberries logistics facilities. Wildberries later confirmed DDoS attacks against its Seller Balance systems; some subsequent seller-withdrawal delays resulted from defensive controls activated in response to the attacks.
Maritime Industry Authority (MARINA)
August 13, 2026
•[ ransomware, financial, government ]
MARINA detected suspicious cyber activity on August 13, 2026 and took its nationwide seafarer document-processing environment offline to contain the incident. The Philippine Department of Information and Communications Technology described the incident as ransomware, but MARINA subsequently reported no confirmed data theft and did not establish successful encryption. Routine issuance of seafarer identity documents and record books was suspended nationwide. MARINA issued temporary certificates, launched an interim processing system on September 1 and progressively restored normal issuance in September. Criminal and financial motivation are inferred from the reported ransomware activity; no perpetrator or ransom demand was publicly verified.
Oz Hair and Beauty
August 15, 2026
•[ leak, retail, financial ]
An unauthorized third party accessed Oz Hair and Beauty's online purchase and order platform and obtained customer information. Public breach records attribute the incident to xpl0itrs extortion activity and document 1,988,331 affected accounts; the company reported that payment-card information, banking details, and home addresses were not exposed.
Mutuelle générale de prévoyance
August 18, 2026
•[ financial, leak, healthcare ]
French mutual insurer Mutuelle gnrale de prvoyance (MGP) confirmed an intrusion via a third-party provider in August 2026; a hacker claim cited about 200,000 people and 133,000 IBANs. MGP could not confirm the scope, began notifying members Aug 17 and filed a complaint.
Cambrian High School & College
August 19, 2026
•[ phishing, malware, education ]
Check Point Research confirmed by August 19 that the legitimate website of Cambrian High School & College in Bangladesh had been compromised and was hosting a malicious page at cambrianschoolbd.com/mail/. The page had displayed a fake Spotify-branded security-verification CAPTCHA and was flagged by multiple threat-intelligence sources as an information-stealer and malware-distribution site. The precise intrusion date, responsible actor, and duration of the compromise are unknown. The activity occurred in the context of broader financially motivated cybercriminal phishing and malware campaigns targeting the education sector, but no downstream visitor infection or credential theft was publicly confirmed.
Interim HealthCare, Inc.
August 21, 2026
•[ ransomware, healthcare, financial ]
Anubis listed Interim HealthCare, Inc., the Sunrise, Florida-based corporate franchisor, on its extortion site in August 2026 and claimed theft of approximately 530 GB of corporate and franchise-related data. The group described the material as including franchisee financial information, internal and external audit records, operational discussions, and day-to-day business memoranda. Samples and stolen material were subsequently published, supporting that data acquisition occurred, although Interim HealthCare has not publicly confirmed the intrusion, its exact date, or the claimed 530 GB total. This appears separate from Genesis's claim involving Oklahoma and Tulsa franchise operations.
Nutex Health Inc.
August 26, 2026
•[ leak, healthcare, financial ]
Nutex Health disclosed that an unauthorized third party accessed and exfiltrated information from company servers. The company publicly disclosed the incident on August 24 but has not published the intrusion date; under the coding guide the SecurityWeek publication date is used because the compromise date remains undetermined. Nutex later confirmed that patient, employee, credentialed-provider, business, and financial information was involved. The Gentlemen claimed the incident on August 31, and Nutex said on September 10 that data purportedly obtained in the event had been published. Nutex reported no material operational impact.
Undisclosed Philippine marine engineering and shipbuilding company
August 26, 2026
•[ financial, hack, manufacturing ]
Injected code displayed fake verification content using Amatera-linked delivery infrastructure. Financial intent is inferred; visitor infections and linkage to the separate data theft are unconfirmed. Onset is unknown; event_date uses the publication-date fallback.
Undisclosed Czech healthcare organization
August 27, 2026
•[ leak, healthcare, financial ]
ComSource detected a data leak from an unnamed Czech healthcare organization on 27 August 2026. DataBastard offered the stolen database for sale for $1,400. The exact initial-access and exfiltration dates were not reported, so event_date uses the first documented detection of the leak.
Hungry Lion
August 27, 2026
•[ ransomware, retail, financial ]
MedusaLocker listed South African fast-food chain Hungry Lion on its leak site on 27 Aug 2026, claiming POS data covering 111 locations in seven countries and threatening a full leak. The claim is unverified; the company did not comment.
Taipei City Police Department
August 31, 2026
•[ insider, government, financial ]
Taipei prosecutors on Aug 31, 2026 indicted a retired Taipei police detective (Cheng) and a suspended officer (Liu) for pulling hundreds of individuals' call records without authorization since 2018 and selling them to syndicate-linked money lenders for about NT$7.2 million.
Liquid Network
September 6, 2026
•[ hack, financial, technology ]
Hackers exploited a bug in Liquid Network, the Blockstream-developed Bitcoin sidechain, on Sept. 6, 2026 to mint unbacked L-BTC and withdraw ~4,000 BTC ($320M) from its federation wallet. Liquid halted the network; self-described white hats returned 3,400 BTC.
Undisclosed organization investigated by CyberMaxx (Event A)
September 15, 2026
•[ ransomware, technology, financial ]
CyberMaxx incident responders observed exploitation of N-able N-central in an unnamed customer environment. The intruder used Net.exe to issue an administrator password-change command, established a Cloudflare tunnel, installed SimpleHelp for persistence and reached a file server over remote access. File enumeration and communication with Filemail-associated infrastructure were observed, but completed data theft and ransomware encryption were not verified. CyberMaxx attributed the activity to Storm-1175 with high confidence; Criminal and Financial reflect the ransomware-preparation context. September 15 is the publication-date fallback, not a verified intrusion date.
Undisclosed organization investigated by CyberMaxx (Event B)
September 15, 2026
•[ ransomware, financial, technology ]
In a second distinct incident-response case, CyberMaxx observed attackers abuse N-able N-central to execute commands on a domain controller, change an administrator password and establish an interactive session using the altered credentials. They installed SimpleHelp, moved to another server through RDP and staged additional tools. No completed exfiltration or ransomware encryption was confirmed. CyberMaxx linked the operation to Storm-1175 with high confidence; Criminal and Financial are supported by the ransomware-preparation context. September 15 is a report-date fallback, not the known attack date.
Undisclosed Singapore company
September 17, 2026
•[ ransomware, financial ]
Singapore Police described a ransomware attack on an unnamed business whose systems were reportedly breached and years of data became unavailable. The attacker demanded a million-dollar ransom to restore the data; the currency was not specified. The owner sent staff away, disconnected servers and contacted police. The business sector, intrusion method, disruption duration and recovery outcome were not disclosed. Complete system encryption, permanent data destruction and data exfiltration were not confirmed. The incident date and year are unknown; September 17, 2026 is the publication-date fallback, not a verified occurrence date.
Burnaby School District 41
September 21, 2026
•[ ransomware, education, financial ]
The district discovered ransomware on September 21, 2026 and later confirmed theft of personal-information files. Network and phone services were affected. September 21 is a discovery proxy; initial access and extraction dates are unknown. The official page was first published September 23 and updated October 14. Neither encryption nor the stolen-data source host was specified, so technical subtypes remain undetermined. Financial motive is inferred from ransomware.
Photopea
September 24, 2026
•[ ddos, financial, technology ]
Photopea experienced service failures beginning the evening of September 24, 2026 and confirmed suspected traffic flooding. Its developer published an extortion email demanding US$10,000 in bitcoin. The sender used the alias Lumen Cyber, but responsibility was not independently verified. Criminal and Financial are supported by the extortion demand. Some users regained access while others still reported failures. No intrusion or data theft was established.
Duelbits
September 24, 2026
•[ financial, hack, technology ]
Curaao-registered crypto casino Duelbits confirmed on Sept. 24, 2026 that attackers drained about $7M from its hot wallets on Ethereum, BNB Chain, Tron and Bitcoin, likely via a compromised private key. The site went offline; the company said user funds were safe.
The Official College of Architects of León (COAL)
October 2, 2026
•[ ransomware, financial, leak ]
The Official College of Architects of Len (COAL) was listed as a victim on the leak site of the akira ransomware group; the attack is estimated to have taken place on 2026-10-02. Sector: Professional Services. Country: Mexico. The Official College of Architects of Len (COAL) was established on July 12, 1931, encompassin
g the regions of Len, Asturias, and Galicia. The College of Galicia was legally separated in 1
973 and the College of Asturias in 1981.
We will upload 77gb of corporate data soon. Detailed personal information (passports), financia
ls, students and clients information and so on.
