North Carolina State Ports Authority
August 4, 2026
•[ hack, technology, government ]
North Carolina Ports detected a cyberattack late on August 4, 2026. Affected IT systems forced manual processing and delayed gate openings at three facilities. Normal gate schedules resumed August 6 while manual processing continued. August 4 is the reported disruption and detection date; initial access is unknown. The authority did not disclose the technical mechanism, attacker, ransom demand, encryption or data theft.
Department of Land Transport (DLT), Thailand
August 4, 2026
•[ financial, leak, insider ]
Thailand's Department of Land Transport and cybersecurity authorities investigated unauthorized vehicle-registry searches through accounts associated with three government agencies. The DLT confirmed that displayed data were genuine and that access had occurred, while officials said the core registry was not directly hacked. Other reporting describes illegal paid lookup services and sale of government data, supporting a limited Criminal/Financial inference despite the political prominence of some exposed people. Initial access date is unknown; August 4 is the public-discovery proxy.
City of Coweta
August 5, 2026
•[ ransomware, government ]
The City of Coweta experienced a system-wide ransomware attack on August 5, 2026. Local reporting identified the ransomware as Anubis. City computers and files became inoperable, while the website, third-party billing portal, and separately hosted police, fire, and 911 systems remained available. The City restored systems from off-site backups, and most systems and normal day-to-day operations had returned by August 18. The City said it had no evidence at that time that personal information was accessed or acquired.
City of Mitchell
August 6, 2026
•[ ransomware, government, financial ]
Mitchell discovered unauthorized activity in part of its municipal network on August 6, 2026, and isolated the affected environment through August 12. Administrative online services were interrupted, while officials said email and emergency services were unaffected. The city subsequently confirmed that information relating to a small number of employees was affected. The Storm extortion group listed Mitchell on its leak site on August 23 with an August 28 deadline and image thumbnails; independent reporting documents that claim, but the city has not verified Storm attribution. Successful encryption, theft of specific files and a ransom demand to the city are not confirmed. Criminal and Financial are supported by the claimed extortion-group context.
City of Lancaster, Ohio
August 6, 2026
•[ ransomware, government ]
Lancaster, Ohio, took city computers offline after ransomware notes appeared on multiple employee machines on Aug 6, 2026, delaying card payments. By Aug 28 about 90% of data and programs were recovered and some may not be restored. No actor or ransom demand disclosed.
City of Suisun City
August 7, 2026
•[ ransomware, malware, government ]
Malicious software infected and compromised Suisun City's IT systems at approximately 5:45 a.m. on August 7, 2026, disrupting 911 routing, police and fire dispatch, records, online services, and municipal operations. The City shut down its entire IT network to contain the incident and rerouted emergency dispatch through Solano County. Unidentified perpetrators subsequently made demands to the City, and network restoration remained underway on September 8.
Pozirk (Позірк)
August 8, 2026
•[ ddos, technology, government ]
Pozirk reported a DDoS attack against its online news platform on the morning of August 8, 2026, alongside attacks against Nasha Niva, Zerkalo and Reform.news. The assault coincided with the New Belarus conference in Warsaw. The responsible operator and precise outage duration were not established; no information theft was reported.
Reform.news
August 8, 2026
•[ ddos, government, technology ]
Reform.news reported a DDoS attack against its website on August 8, 2026 as part of concurrent attacks against independent Belarusian news outlets. Reports linked the timing to the New Belarus conference and the anniversary of the 2020 election, without identifying a perpetrator. Reform.news operates from Warsaw under a Polish registered supporting foundation. No data theft was reported.
Zakład Ubezpieczeń Społecznych (ZUS)
August 10, 2026
•[ hack, ddos, government ]
On August 10, 2026, a volumetric DDoS attack overwhelmed Poland's Social Insurance Institution web services, disrupting the website, mobile app and PUE/eZUS portal. Polish reporting places service problems shortly after 09:00, with restoration around 13:00. ZUS confirmed customers' personal information remained safe. No actor claimed the attack and no financial demand was reported. Sabotage is inferred from the targeting of public benefits-service availability, not from verified political sponsorship.
Douglas County Sheriff's Office
August 11, 2026
•[ ransomware, government, technology ]
Douglas County Sheriff's Office (Lawrence, Kansas) found suspicious network activity around Aug. 11, 2026; its website and booking log went offline and Lawrence police lost shared dispatch/records access for weeks. Eudora's ex-IT admin blamed foreign ransomware spread via VPN.
Town of Andover
August 13, 2026
•[ ransomware, government, education ]
A cyberattack detected August 13 caused a four-day outage across the shared Town of Andover and Andover Public Schools network, disrupting internet connectivity, external email, online bill payments, and access to school teacher assignments while public safety agencies and utilities remained operational. Wallstreet subsequently listed Andover on its leak site and claimed possession of documents, databases, email, personal data, and media. The town has not confirmed Wallstreet's responsibility or any data theft, so the claimed exfiltration is not coded as an exploitive primary effect.
Town of Lincoln
August 13, 2026
•[ ransomware, government ]
The Town of Lincoln determined that files on portions of its computer network had been encrypted, with preliminary evidence indicating activity may have begun as early as August 13. The main file server and other network infrastructure were affected, causing the town office to close August 17 and reopen the following day with limited services while restoration continued. By the end of August the town again advertised normal hours, card payments, and online forms. On September 15, police said investigators determined that some data may have been obtained from town systems and that potentially affected individuals would be notified, but officials have not confirmed specific data acquisition, a ransom demand, ransomware attribution, or a responsible actor.
Maritime Industry Authority (MARINA)
August 13, 2026
•[ ransomware, financial, government ]
MARINA detected suspicious cyber activity on August 13, 2026 and took its nationwide seafarer document-processing environment offline to contain the incident. The Philippine Department of Information and Communications Technology described the incident as ransomware, but MARINA subsequently reported no confirmed data theft and did not establish successful encryption. Routine issuance of seafarer identity documents and record books was suspended nationwide. MARINA issued temporary certificates, launched an interim processing system on September 1 and progressively restored normal issuance in September. Criminal and financial motivation are inferred from the reported ransomware activity; no perpetrator or ransom demand was publicly verified.
Santé publique France
August 13, 2026
•[ hack, leak, government ]
French public health agency Sant publique France said a cyberattack on its brochure-ordering site moncoupon.santepubliquefrance.fr, run by an outside provider, exposed contact data of about 80,000 users. The site went into maintenance, passwords were deleted and CNIL notified.
Undisclosed Middle Eastern government organization
August 14, 2026
•[ espionage, government, malware ]
Jewelbug compromised government users through malicious code inserted into a shared Middle Eastern government webmail platform. When employees logged in, the script exfiltrated webmail cookies and institutional email addresses; selected users were then presented with a fake Adobe update that delivered the Antino backdoor and malicious PDF Viewer browser extension. At least one confirmed victim showed authenticated access to internal virtualization-management infrastructure. This conservative record represents at least one government organization within a broader campaign that successfully watering-holed more than 15 government webmail tenants.
Undisclosed organizations running self-hosted JFrog Artifactory
August 15, 2026
•[ hack, technology, government ]
Multiple unnamed actors exploited three JFrog Artifactory flaws against self-hosted instances from Aug 15 to Sep 8, 2026, creating admin accounts, planting backdoor plugins and exfiltrating configurations and cluster keys, Wiz reported. CISA added the flaws to KEV.
City of Fort Scott
August 18, 2026
•[ ransomware, government, technology ]
A ransomware attack detected on 18 Aug 2026 closed Fort Scott, Kansas, City Hall and forced the city network offline; IT staff restored systems within six days, with about a week of data lost on two machines. The attackers were not identified.
Samagra Portal (Samagra Samajik Suraksha Mission, Government of Madhya Pradesh)
August 19, 2026
•[ hack, government, insider ]
Cyber police opened an investigation after officials discovered that a person's Samagra record had been updated even though authorized district-level officers had not made the change. Officials tightened portal security and referred the matter for investigation.
Undisclosed U.S. individual
August 21, 2026
•[ social, finance, government ]
Scammers initially impersonated an American Express representative and then NYPD and FBI personnel, using transfers, real officer names and badge numbers, and a video call to build credibility. The victim ultimately provided personal identification information.
Norwegian Digitalisation Agency (Digdir)
August 24, 2026
•[ ddos, government, technology ]
DDoS waves targeted Digdir's ID-porten from August 24 to August 26, 2026, intermittently disrupting shared digital services. Digdir says services were mostly available during the campaign; the attack window is not continuous downtime. Server Killers claimed responsibility, without public official attribution. No personal-data loss was indicated. Some restrictions on foreign logins persisted after the attack ended.
