City of Maple Plain Water Utility
July 27, 2026
•[ espionage, hack, government ]
On July 27, 2026, the City of Maple Plain identified a cybersecurity incident affecting certain automated control functions supporting portions of its water utility system. Employees immediately used contingency procedures and maintained water and wastewater services without interruption. The city declared a local emergency on July 27 and terminated it on July 29 after conditions stabilized. No affected product, access method, data theft, ransom demand, or specific actor was disclosed. U.S. intelligence agencies preliminarily assessed that Iran was likely responsible for the coordinated Minnesota campaign, but attribution was not final.
City of South St. Paul Water Utility
July 27, 2026
•[ espionage, hack, government ]
Early on July 27, 2026, the City of South St. Paul identified a cybersecurity incident affecting some automated controls supporting portions of its water utility system. Public Works employees immediately transitioned to manual operations and maintained uninterrupted water and wastewater service. The city reported no impact on drinking-water treatment, quality, pressure, or delivery and no indication that resident or customer data was accessed. No affected product, access method, ransom demand, or specific actor was disclosed. U.S. intelligence agencies preliminarily assessed that Iran was likely responsible for the coordinated Minnesota campaign, but attribution was not final.
City of Braham Water Utility
July 27, 2026
•[ hack, espionage, government ]
On July 27, 2026, a malicious cyberattack shut down computerized operating controls at Braham's municipal well and water treatment plant. Public Works isolated the affected system, restored a backup, and restarted the plant in approximately 90 minutes. The city temporarily asked residents to minimize water use because it was relying on stored tower water, but customers did not lose service. Officials reported no physical plant damage, change to chemical feed rates, or impact on water quality or safety. No ransom demand or specific actor was disclosed. U.S. intelligence agencies preliminarily assessed that Iran was likely responsible for the coordinated Minnesota campaign, but attribution was not final.
Direction générale des Finances publiques (DGFiP)
July 27, 2026
•[ leak, government ]
ZeroBytes used a compromised authorized partner account, apparently from a surveyor firm, to access the DGFiP professional cadastral database between July 27 and August 8, 2026. The intruder extracted cadastral information. DGFiP disabled the implicated partner access and restricted the APEX cadastral portal during containment; this is distinct from the E-Contact tax-correspondence intrusion.
Borough of Woodbine Water Department
July 27, 2026
•[ hack, government ]
Attackers hit the Borough of Woodbine, NJ water department on July 27, 2026, interrupting phone communication to the water system for a few hours until staff restored it manually. Officials said water supply and customer data were unaffected; actor unconfirmed.
Undisclosed U.S. water utilities
July 27, 2026
•[ hack, espionage, government ]
Hackers hijacked internet-exposed PLCs at more than 30 Minnesota public water systems from about July 27, 2026, and at utilities in other states, locking out operators, forcing manual operations and shutting off a well in Braham. No contamination; FBI/EPA warned, Iran suspected.
Federal Office of Information Technology and Telecommunication (FOITT)
July 28, 2026
•[ hack, government, technology ]
Swiss federal security specialists detected anomalous activity on SharePoint servers operated by the Federal Office of Information Technology and Telecommunication on July 28, 2026. Unknown attackers likely exploited recently disclosed SharePoint vulnerabilities. Subsequent investigation found that access credentials for approximately 200 user and technical accounts had been compromised. FOITT reset the affected passwords and rebuilt the SharePoint servers; investigators found no indication that additional data had been exfiltrated.
United Kingdom Department for Education
July 29, 2026
•[ leak, government, education ]
ExfilSquad claimed that it obtained approximately 607,000 records from the United Kingdom Department for Educations Customer Help Portal and Turing Scheme portal and published samples on the dark web. DfE became aware after the claims appeared over the weekend of July 2526. It said the figure represented records rather than unique individuals and that the affected information was limited to contact details. As a precaution, DfE took both portals offline for investigation and remediation. The Customer Help Portal was operating normally again by August 5, but the Turing Scheme portal remained unavailable as of August 11. Contemporaneous leak-site screenshots showed a payment demand for withholding the remaining data, although a group representative later denied demanding ransom and characterized the broader campaign as publicity-driven.
Romanian National Administration of Penitentiaries
July 29, 2026
•[ ransomware, government, technology ]
A ransomware attack affected multiple Romanian National Administration of Penitentiaries workstations and servers on July 29, 2026. ANP physically isolated affected equipment and operated in emergency mode while IMS Web, Infokiosk, inmate telephones, the visit-scheduling portal, inter-facility VPN connections, and the ANP website were unavailable. Routine inmate transfers and approved temporary-leave rewards were suspended, and Vaslui Penitentiary used limited calls, manual visit scheduling, and paper requests. Romania's DNSC director assessed Babuk as the most likely actor, although the investigation remained open.
Office of Justice - Register of Beneficial Owners (VwbP)
July 29, 2026
•[ leak, misconfiguration, government ]
Unknown perpetrators gained unauthorized access to Liechtenstein's Register of Beneficial Owners during the night of July 29-30, 2026 and exfiltrated copies of data concerning approximately 31,000 legal entities. Government analysis later determined that faulty authorization-checking logic allowed repeated requests to exploit the register's API. Authorities took the compromised register offline and defensively disconnected additional sensitive government systems for security reviews. No data alteration or deletion was identified, no perpetrator has been attributed, and no motive has been established.
Undisclosed South Korean healthcare website owner or operator
July 30, 2026
•[ espionage, healthcare, government ]
An unnamed state-sponsored group compromised at least one South Korean healthcare website and used it as a watering hole against selected visitors. Fifteen legitimate South Korean websites across several sectors were used as watering holes, but the exact number in the healthcare sector, individual compromise dates, and specific server-access method were not disclosed. No operational disruption or data theft from the website owner was reported.
Undisclosed South Korean small website owner or operator
July 30, 2026
•[ espionage, hack, government ]
An unnamed state-sponsored group compromised at least one smaller, poorly secured South Korean website and used it as a watering hole against selected visitors. Fifteen legitimate South Korean websites across several sectors were used as watering holes, but the exact number in this residual category, individual compromise dates, and specific server-access method were not disclosed. No operational disruption or data theft from the website owner was reported.
Undisclosed South Korean organization infected through an AnySign4PC watering hole
July 30, 2026
•[ espionage, technology, government ]
An unnamed state-sponsored group infected at least one target organization's Windows endpoints when a user visited a compromised website while running a vulnerable AnySign4PC version. The malicious page exploited a buffer overflow without a download prompt, installed a backdoor, established command-and-control, escalated privileges, harvested credentials, and enabled lateral movement. Researchers reported evidence of related attacks at 72 organizations, but cautioned that this was not a count of 72 equally confirmed full compromises. The broader campaign was not formally attributed to Lazarus or another named group.
Office of Justice – Register of Beneficial Owners (VwbP)
July 30, 2026
•[ hack, leak, government ]
Unknown attackers gained unauthorized access to Liechtenstein's Register of Beneficial Owners during the night of July 29-30 and exfiltrated copies of data relating to approximately 31,000 legal entities. Authorities found no indication that data was modified or deleted; the register was taken offline by the government as a defensive response rather than as an attacker-caused disruption.
Undisclosed United States water or wastewater utility
July 30, 2026
•[ hack, energy, government ]
An FBI/EPA advisory identifies at least one utility that found modified PLC project files and ladder-logic discrepancies across several sites. This row represents that specific anonymized victim, not all utilities in the campaign reported since July 27, 2026. Its occurrence date is undisclosed; July 30 is the advisory-publication fallback. Campaign-wide reports of flooding, pressure loss and loss of control are not assigned to this utility without victim-specific evidence. No actor or data theft was identified.
Direction générale des Finances publiques (DGFiP)
August 1, 2026
•[ leak, misconfiguration, government ]
A third, distinct incident affected the DGFiP portal for unclaimed/vacant estates. DGFiP identified a technical vulnerability in this portal on August 17, 2026 and confirmed that an unauthorized party had extracted data; the intrusion may have predated discovery. The exact access date, identity of this intruder, and number of records obtained were not established; the government described the affected information as publicly available.
Uttarakhand Information Technology Development Agency (ITDA) / State Data Centre
August 1, 2026
•[ hack, malware, misconfiguration ]
On August 1, 2026, the Uttarakhand Information Technology Development Agency detected malware on government web servers and temporarily disconnected multiple state department websites to contain the suspected attack. Initial reports identified approximately 10 affected departmental portals, including the Chief Minister Relief Fund website; services returned over the following hours. The agency subsequently said no unauthorized data access or theft was found, and attributed some application failures to configuration errors rather than malware. No ransomware encryption, extortion demand or perpetrator was confirmed. This incident is distinct from the October 2024 Uttarakhand State Data Centre attack.
Ministry of Ecological Transition
August 1, 2026
•[ hack, leak, government ]
France's Ministry of Ecological Transition confirmed a sophisticated late-Aug 2026 attack on its messaging tools; email services and regional sites were disrupted. An actor called 'mondial' claimed theft of 22,000+ records. A complaint was filed and ANSSI is investigating.
Ministerio de Justicia y del Derecho (Colombian Ministry of Justice)
August 2, 2026
•[ ransomware, government, technology ]
On August 2, 2026 a ransomware infection struck the Colombian Ministry of Justice, disrupting administrative IT and digital services. The ministry isolated affected systems and switched document submission and citizen assistance to in-person, telephone and temporary email channels. By August 15 the cannabis-control licensing platform (MICC) remained unavailable and SICOQ operated only partially; the electronic archive document system (SGDEA) remained out of service on August 20, restricting access to registered petitions. No verified file theft, attacker identity or completed encryption extent was disclosed.
Norsk Tipping AS
August 2, 2026
•[ ddos, hack, government ]
A DDoS attack against Norsk Tipping on August 2 produced public website and mobile-app errors and caused the operator to suspend Oddsen betting around 13:40. The company reported the traffic attack lasted about two hours and betting access had resumed by its afternoon update. No successful intrusion or data theft was found. The attacker and motive were not verified; Sabotage is inferred from the deliberate denial of a state-owned nationwide service.
