Hilltop National Bank
September 8, 2026
•[ finance, hack ]
Hilltop National Bank, a Casper, Wyoming community bank, had IT disruptions from Sept. 8, 2026, then identified a cybersecurity incident, took internal systems offline and closed all branches Sept. 9. Online banking was out until about Sept. 22. Cause and actor undisclosed.
Undisclosed enterprise company investigated by Unit 42
September 9, 2026
•[ hack, technology ]
A human ransom attacker used multiple frontier AI agents to compromise an undisclosed enterprise network in less than 10 hours. The agents extracted credentials and cloud keys from code repositories, a secrets-management system and other enterprise applications, allowing expansion into cloud and identity infrastructure. An attempted Terraform backdoor was blocked. Unit 42 clarified that the incident was an intrusion rather than a ransomware attack. The exact intrusion date, victim industry and victim country were not disclosed; event_date therefore uses the supplied source publication date.
Brevo (formerly Sendinblue)
September 9, 2026
•[ hack, technology, finance ]
On September 9-10, 2026, an intruder abused a flaw in Brevo SAML SSO tenant scoping to access 138 customer accounts. The attacker used six of the accounts to distribute fraudulent messages from legitimate customer email channels and exported contacts from 43 accounts. Trezor was one affected Brevo customer; 347,149 newsletter email addresses were exported and misleading messages reached roughly 347,000 subscribers. Brevo shut the attack route and signed out sessions on September 10. The attack did not establish a breach of Trezor wallet infrastructure. The 138 customer accounts are effects within one compromised Brevo platform, not separate CED records.
Trezor
September 9, 2026
•[ phishing, hack, technology ]
Hackers who breached email provider Brevo on Sept 9, 2026 exported Trezor's newsletter contacts and sent ~347,000 fake security alerts from help@trezor.io urging users to enter wallet backups; ~2,500 clicked. Prague-based Trezor said its own systems were unaffected.
Undisclosed BigCommerce merchants
September 13, 2026
•[ hack, technology, retail ]
Attackers used a stolen BigCommerce API key of the Ribon app on Sept 13-17, 2026 to download shopper data page by page from BigCommerce merchant stores and inject malicious scripts into some storefronts. BigCommerce revoked the key, removed the app and notified merchants.
Fastr
September 13, 2026
•[ hack, technology, retail ]
Boston e-commerce software firm Fastr suffered a system compromise in which attackers stole BigCommerce API credentials for the Ribon apps of its unit Be A Part Of, per BigCommerce; the keys were abused Sept 13-17, 2026 against merchant stores. Fastr made no public comment.
Master of Malt
September 13, 2026
•[ hack, retail, technology ]
UK online drinks retailer Master of Malt confirmed attackers used a compromised Ribon app key to access customer data on its BigCommerce store between 13 and 17 Sep 2026. Customers were notified by email; payment details and passwords were not exposed.
Dyfed-Powys Police
September 14, 2026
•[ hack, government, technology ]
Dyfed-Powys Police identified a cyberattack on September 14, 2026 and temporarily lost some non-emergency online and email contact services. Emergency response and 999 and 101 services remained available. A review of whether employee data was accessed was ongoing; no compromise of public personal data was established.
CenterPoint Energy
September 14, 2026
•[ leak, hack, energy ]
Houston-based utility CenterPoint Energy said in a Sep 14, 2026 SEC filing that an unauthorized party took customer personal data via an external-facing system, after a hacker leaked a 2.5 GB archive claimed to hold 7.5M records. Power and gas service were unaffected.
Fédération francophone de Gymnastique
September 14, 2026
•[ leak, hack ]
Belgium's French-speaking Gymnastics Federation (FfG) found on Sept. 14, 2026 that unauthorized persons accessed part of its IT systems and extracted member and club data; records of about 200,000 people were reportedly leaked. The Data Protection Authority was notified.
Undisclosed Russian companies
September 14, 2026
•[ ransomware, hack, leak ]
Kaspersky research reported in Sept 2026 says pro-Ukrainian hacktivist group Hacking Cat breached unnamed Russian companies via Exchange flaws, stole data and deployed Monkey ransomware and Nemo wiper; some victims paid, others had data leaked. The group denied using the lockers.
Undisclosed Spanish organization
September 14, 2026
•[ hack, technology, government ]
An attacker used an AI agent built on a known language model to log into an undisclosed Spanish organization's system, find application flaws, modify personal data and access invoices. Spain's data protection agency AEPD disclosed the breach notification on Sept 14, 2026.
DOLYA & CO. LTD (Dolya Communication System)
September 15, 2026
•[ hack, ddos, technology ]
Pro-Russian hacktivist PalachPro claimed a large DDoS attack and other disruptive actions against Ukrainian systems integrator DOLYA & CO. LTD, a supplier of professional communications systems to Ukrainian defense and security agencies. The claimed effects included blocked servers and file management, loss of access to the website and internal document workflow, inability to add new orders, and temporary loss of email, file exchange and Sonata messenger access. The attack had been publicly claimed by 15 September 2026, but its exact onset, duration and effects have not been independently confirmed.
Undisclosed United Arab Emirates company
September 15, 2026
•[ ransomware, government, hack ]
An unnamed UAE company supporting a government sector was compromised through an unpatched software vulnerability and received a ransom demand exceeding US$5 million. Reporting of the cybersecurity chief's September 15, 2026 account states that the attacker obtained company information and published some on the dark web, although other coverage says publication was prevented. Official WAM reporting describes attempted data destruction that was prevented, conflicting with reporting of completed destruction; a disruptive effect is not established. The stolen data categories, volume and source systems were not identified. The intrusion date is unknown; September 15, 2026 is the earliest-report publication fallback, not a verified occurrence date.
International Meteor Organization
September 15, 2026
•[ hack, technology ]
The Belgium-based International Meteor Organization said in Sept. 2026 that a cyberattack dealt a "critical blow" to its aging infrastructure, taking much of its website offline. Fireball reporting was restored first; it is moving to new infrastructure.
St James' Anglican School
September 15, 2026
•[ ransomware, hack, education ]
Hackers accessed systems at St James' Anglican School in Perth, Western Australia, copying current and former students' and families' personal data, incl. bank details, medical records and photos. The school said it contained the incident; ThreeAM ransomware claimed it.
Flock Safety
September 16, 2026
•[ hack, technology, government ]
Hacker collective Stegan0gram pulled a Flock Safety license plate camera off a roadside pole, copied its storage and used an on-device key to decrypt about 21 days of vehicle images and video, sharing it with 404 Media and DDoSecrets. Flock said tampering is illegal.
Direct Communications Cedar Valley
September 17, 2026
•[ hack, ddos, technology ]
A DDoS attack that began Sept 17, 2026 on Direct Communications Cedar Valley, an Eagle Mountain, Utah ISP, caused slow speeds and full internet outages; its phone and billing systems were still down Sept 21. Eagle Mountain closed City Hall and the library. No actor named.
Moscow City Election Commission
September 18, 2026
•[ hack, government, technology ]
During Russia's September 18-20, 2026 elections, attacks disrupted Moscow's separate electronic voting infrastructure. Officials reported a September 18 terminal failure restored within about 20 minutes, slower remote-voting access on September 19 and an electronic voter-register failure delaying paper-ballot issuance on September 20. September 18 is the earliest reported disruption date; the precise campaign start is unknown. Initial attribution of the terminal failure was qualified, while subsequent official accounts linked voting-service delays to cyberattacks. The responsible operator, actor type and country were not established. No vote alteration, data theft or nationwide outage was established for this event.
Ludwig-Maximilians-Universität München
September 19, 2026
•[ hack, leak, education ]
LMU Munich, Germany, disclosed in Sept 2026 that an unauthorized actor accessed student-registration master data in a university IT system and that the data must be assumed to have been retrieved. Modification was prevented; the Bavarian State Criminal Police is investigating.
