Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF)
August 26, 2026
•[ ransomware, government, leak ]
ATF publicly confirmed on August 26, 2026 that an unauthorized actor had compromised a standalone system containing information about targets of ATF investigations. The system was quickly disconnected and was separate from ATF's enterprise network, eForms, laboratory, and case-management systems. Qilin claimed responsibility the same day and later published approximately 6.3 GB of purported data from the CALEA environment. ATF has not publicly authenticated the full leak or confirmed Qilin's attribution, and mission operations were unaffected.
City of Circleville
August 27, 2026
•[ ransomware, government ]
The City of Circleville confirmed ransomware activity affecting portions of its municipal technology environment. Affected systems were isolated and rebuilt from clean environments or recovered through established procedures, and the city did not pay a ransom. Circleville has not disclosed the incident or detection date; an August 14 date circulated in secondary reporting but could not be independently corroborated. Officials reported no evidence establishing that sensitive information was exfiltrated, and no ransomware or extortion group has publicly claimed responsibility.
Nigerian Army (Headquarters)
August 29, 2026
•[ social, government, technology ]
On August 29, 2026, unauthorized memecoin-promotional posts appeared on the Nigerian Army official X account (@NigeriaArmyInfo), reportedly beginning around 3:50 p.m. The Army acknowledged attempted unauthorized account access around 5 p.m., activated security measures to regain exclusive control and told users to disregard unverified posts. The account-access mechanism and the operator were not identified, and no theft of information or intrusion into other Army systems was established. This was a separate social-media account and incident from the August 15 Defence Headquarters hijacking.
Avelogic
August 30, 2026
•[ ransomware, technology, government ]
Ransomware hit Singapore vendor Avelogic's SmartHRMS HR and payroll system on 30-31 Aug 2026, used by MUIS-overseen mosques and madrasahs, forcing manual payroll. Avelogic found no evidence of bulk data theft, paid no ransom, filed a police report and notified the PDPC.
Undisclosed organization investigated by Sygnia
August 31, 2026
•[ espionage, technology, government ]
Fire Ant compromised Cisco IOS XR routers, TACACS authentication systems, and Linux management hosts at an undisclosed organization, using the infrastructure to capture network traffic and administrative credentials, maintain covert access, and suppress security telemetry. The incident was part of a broader China-nexus espionage campaign with strong behavioral and tooling overlap with UNC3886. Fire Ant used the compromised environment to probe connected high-value and critical-infrastructure networks, but Sygnia observed only scanning and connection attempts against those downstream environments rather than confirmed compromise.
Taipei City Police Department
August 31, 2026
•[ insider, government, financial ]
Taipei prosecutors on Aug 31, 2026 indicted a retired Taipei police detective (Cheng) and a suspended officer (Liu) for pulling hundreds of individuals' call records without authorization since 2018 and selling them to syndicate-linked money lenders for about NT$7.2 million.
City of Vienna (Stadt Wien)
September 3, 2026
•[ leak, government ]
From September 3 to 11 2026 an intruder used a web access vulnerability to copy documents from a municipal internal-documentation platform; city systems and accounts were not controlled. Vienna confirmed about 26000 pages or documents totaling 9 GB were acquired, affecting 2083 employees, 2885 residents, and 856 contractors. No publication or extortion was established.
Florida Department of Highway Safety and Motor Vehicles
September 4, 2026
•[ hack, leak, government ]
FLHSMV discovered unauthorized access to its DAVID database on September 4, 2026, through compromised credentials belonging to one Plant City police employee. September 4 is a discovery proxy; ShinyHunters' claimed September 3 collection start was not independently confirmed. The group claimed responsibility and later released an archive inspected by Straight Arrow News. The agency did not publicly verify the named operator or its advertised victim count. No encryption or operational disruption was established.
Undisclosed Philippine nuclear research agency
September 8, 2026
•[ espionage, leak, government ]
A suspected Chinese-speaking operator exploited an ownCloud authentication weakness and stole 176 files totaling about 372 MB from a Philippine nuclear research agency. The stolen material was already present on attacker-controlled infrastructure when researchers discovered it on 13 August 2026; the exact theft date is not established, so event_date uses the supplied source publication date.
National Directorate of Cyber Security (DNSC)
September 8, 2026
•[ ddos, government, technology ]
Attackers launched approximately 2.8 million access requests against dnsc.ro at around 17:00 on 8 September 2026. About 50,000 requests passed DNSC's technical filters and overloaded the website, causing an interruption lasting less than 30 minutes. DNSC director Dan Cmpean said the attackers sought reputational impact by demonstrating vulnerability and undermining public and partner confidence. The specific group and its country of origin were not attributed.
Dyfed-Powys Police
September 14, 2026
•[ hack, government, technology ]
Dyfed-Powys Police identified a cyberattack on September 14, 2026 and temporarily lost some non-emergency online and email contact services. Emergency response and 999 and 101 services remained available. A review of whether employee data was accessed was ongoing; no compromise of public personal data was established.
Undisclosed Spanish organization
September 14, 2026
•[ hack, technology, government ]
An attacker used an AI agent built on a known language model to log into an undisclosed Spanish organization's system, find application flaws, modify personal data and access invoices. Spain's data protection agency AEPD disclosed the breach notification on Sept 14, 2026.
DOLYA & CO. LTD (Dolya Communication System)
September 15, 2026
•[ hack, ddos, technology ]
Pro-Russian hacktivist PalachPro claimed a large DDoS attack and other disruptive actions against Ukrainian systems integrator DOLYA & CO. LTD, a supplier of professional communications systems to Ukrainian defense and security agencies. The claimed effects included blocked servers and file management, loss of access to the website and internal document workflow, inability to add new orders, and temporary loss of email, file exchange and Sonata messenger access. The attack had been publicly claimed by 15 September 2026, but its exact onset, duration and effects have not been independently confirmed.
Undisclosed United Arab Emirates company
September 15, 2026
•[ ransomware, government, hack ]
An unnamed UAE company supporting a government sector was compromised through an unpatched software vulnerability and received a ransom demand exceeding US$5 million. Reporting of the cybersecurity chief's September 15, 2026 account states that the attacker obtained company information and published some on the dark web, although other coverage says publication was prevented. Official WAM reporting describes attempted data destruction that was prevented, conflicting with reporting of completed destruction; a disruptive effect is not established. The stolen data categories, volume and source systems were not identified. The intrusion date is unknown; September 15, 2026 is the earliest-report publication fallback, not a verified occurrence date.
HM Courts and Tribunals Service (HMCTS), Ministry of Justice
September 16, 2026
•[ insider, government ]
Court staff accessed confidential files relating to victims, survivors and families of the 2024 Southport attack without authorization. An internal review uncovered the access and the Ministry of Justice notified affected parties. Some files contained sensitive personal information; no disclosure to outside parties was found.
Flock Safety
September 16, 2026
•[ hack, technology, government ]
Hacker collective Stegan0gram pulled a Flock Safety license plate camera off a roadside pole, copied its storage and used an on-device key to decrypt about 21 days of vehicle images and video, sharing it with 404 Media and DDoSecrets. Flock said tampering is illegal.
Direct Communications Cedar Valley
September 17, 2026
•[ hack, ddos, technology ]
A DDoS attack that began Sept 17, 2026 on Direct Communications Cedar Valley, an Eagle Mountain, Utah ISP, caused slow speeds and full internet outages; its phone and billing systems were still down Sept 21. Eagle Mountain closed City Hall and the library. No actor named.
Ellis County, Kansas
September 17, 2026
•[ ransomware, government ]
Ellis County, Kansas, said a ransomware incident detected Sept 17, 2026 disrupted parts of its IT systems, leaving some county services unavailable or delayed; 911 stayed up. The KBI and Highway Patrol are investigating; the county saw no evidence of data access.
Moscow City Election Commission
September 18, 2026
•[ hack, government, technology ]
During Russia's September 18-20, 2026 elections, attacks disrupted Moscow's separate electronic voting infrastructure. Officials reported a September 18 terminal failure restored within about 20 minutes, slower remote-voting access on September 19 and an electronic voter-register failure delaying paper-ballot issuance on September 20. September 18 is the earliest reported disruption date; the precise campaign start is unknown. Initial attribution of the terminal failure was qualified, while subsequent official accounts linked voting-service delays to cyberattacks. The responsible operator, actor type and country were not established. No vote alteration, data theft or nationwide outage was established for this event.
Federal Bureau of Investigation
September 22, 2026
•[ hack, government, technology ]
ShinyHunters defaced FBIJobs.gov on September 22, 2026 and supplied journalists with a sample of about 5,000 purported FBI personnel records, portions of which were authenticated. The group demanded correction or withdrawal of a May FBI advisory criticizing its methods and denied seeking a ransom in this case. The FBI subsequently confirmed that an unpatched contractor-managed platform enabled the breach; Reuters identified the platform as Oracle PeopleSoft and reported the responsible contractor was removed. The scope of exfiltration and the claimed 2-3 TB remain unverified. The group is coded Criminal by its identity, while Reputation reflects its stated objective for this particular incident.
