City of Suisun City
August 7, 2026
•[ ransomware, malware, government ]
Malicious software infected and compromised Suisun City's IT systems at approximately 5:45 a.m. on August 7, 2026, disrupting 911 routing, police and fire dispatch, records, online services, and municipal operations. The City shut down its entire IT network to contain the incident and rerouted emergency dispatch through Solano County. Unidentified perpetrators subsequently made demands to the City, and network restoration remained underway on September 8.
Undisclosed Middle Eastern government organization
August 14, 2026
•[ espionage, government, malware ]
Jewelbug compromised government users through malicious code inserted into a shared Middle Eastern government webmail platform. When employees logged in, the script exfiltrated webmail cookies and institutional email addresses; selected users were then presented with a fake Adobe update that delivered the Antino backdoor and malicious PDF Viewer browser extension. At least one confirmed victim showed authenticated access to internal virtualization-management infrastructure. This conservative record represents at least one government organization within a broader campaign that successfully watering-holed more than 15 government webmail tenants.
iTorrents.org
August 15, 2026
•[ hack, malware, technology ]
An unauthorized party compromised the iTorrents.org public torrent repository and manipulated torrent-file responses so users seeking movie downloads received links to MovieReaper Windows malware. Kaspersky identified several hundred infected individuals and organizations in multiple countries; those unnamed downstream victims are not counted as a single additional event.
Cambrian High School & College
August 19, 2026
•[ phishing, malware, education ]
Check Point Research confirmed by August 19 that the legitimate website of Cambrian High School & College in Bangladesh had been compromised and was hosting a malicious page at cambrianschoolbd.com/mail/. The page had displayed a fake Spotify-branded security-verification CAPTCHA and was flagged by multiple threat-intelligence sources as an information-stealer and malware-distribution site. The precise intrusion date, responsible actor, and duration of the compromise are unknown. The activity occurred in the context of broader financially motivated cybercriminal phishing and malware campaigns targeting the education sector, but no downstream visitor infection or credential theft was publicly confirmed.
Undisclosed crates.io maintainer
August 20, 2026
•[ hack, leak, malware ]
On Aug 20, 2026, attackers hijacked a crates.io maintainer's account and published tampered versions of Rust crates arrayref, internment and append-only-vec carrying a credential- and wallet-stealing payload. Wiz linked it to North Korean actors; versions were removed.
Undisclosed Claude user
August 31, 2026
•[ hack, malware, technology ]
A criminal operator used commodity infostealer malware on an affected user's computer to steal an active Claude login session and replay it to access the victim's Claude account and consume paid usage. This record represents a confirmed victim within a broader campaign affecting multiple Claude users; Anthropic's own systems were not breached.
HBO Max (Warner Bros. Discovery) official Reddit account
September 6, 2026
•[ hack, malware, social ]
An unauthorized operator took over verified Reddit account u/hbomax and ran 108 deceptive paid advertisements over about 48 hours. Links impersonated HBO Max and software products and directed users to ClickFix command-pasting instructions that delivered malware. The malicious advertisements were paused after they were reported.
Undisclosed People Playground user
September 21, 2026
•[ malware, hack, technology ]
The developer confirmed malware infections involving file deletion and publication of sensitive information through malicious Workshop mods. This represents an unnamed affected user, not a Valve corporate breach. September 21 is the outbreak-onset proxy; individual infection timing is unknown. Sabotage is inferred from deliberate destruction; operator identity and actor type remain undetermined.
Ministry of Education — Argentina
September 18, 2026
•[ ransomware, government, education ]
Ministry of Education Argentina was listed as a victim on the leak site of the N0n ransomware group; the attack is estimated to have taken place on 2026-09-18. Sector: Government & Defense. Country: Argentina. Website: argentina.gob.ar. Government / education Argentina | Complete network-security configuration of the ministry network; 1.08M connection records: national library (BNM), school-book selection platform, scholarship systems (becasprogresar), titulosvalidez, certificadosinfd, sitrared; Evidence of the Monero cryptocurrency miner operating inside the ministry network | The ministry network is under a total blackout until settlement. | [ACTIVE: deadline 2026-09-21 03:01 UTC]
Operation Endgame 4.0
June 18, 2026
•[ hack, malware, technology ]
On 18 June 2026, the latest phase of Operation Endgame targeted the SocGholish malware operation, a prolific malware distribution network used to compromise systems and facilitate further cybercrime. Coordinated by international law enforcement agencies with support from Europol and Eurojust, the operation remediated almost 15,000 compromised websites and disrupted more than 100 servers and domains used to distribute malware. Authorities initially provided HIBP with 154k impacted email addresses and more than half a million previously unseen passwords. The following week, a further 4M email addresses and 9M passwords relating to the StealC malware operation also targeted by Operation Endgame were provided, followed by another 131k email addresses the following month, bringing the total to more than 4.3M unique email addresses.
Operation Endgame 4.0
June 18, 2026
•[ hack, malware, technology ]
On 18 June 2026, the latest phase of Operation Endgame targeted the SocGholish malware operation, a prolific malware distribution network used to compromise systems and facilitate further cybercrime. Coordinated by international law enforcement agencies with support from Europol and Eurojust, the operation remediated almost 15,000 compromised websites and disrupted more than 100 servers and domains used to distribute malware. Authorities initially provided HIBP with 154k impacted email addresses and more than half a million previously unseen passwords recovered during the operation. The following week, a further 4M email addresses and 9M passwords relating to the StealC malware operation targeted by Operation Endgame were provided to HIBP, bringing the total to almost 4.2M unique email addresses.
Operation Endgame 4.0
June 18, 2026
•[ malware, hack, technology ]
On 18 June 2026, the latest phase of Operation Endgame targeted the SocGholish malware operation, a prolific malware distribution network used to compromise systems and facilitate further cybercrime. Coordinated by international law enforcement agencies with support from Europol and Eurojust, the operation remediated almost 15,000 compromised websites and disrupted more than 100 servers and domains used to distribute malware. Authorities also provided HIBP with 154k impacted email addresses and more than half a million previously unseen passwords.
June 2026 Stealer Logs
June 15, 2026
•[ malware, hack ]
In June 2026, a collection of accumulated stealer logs from various sources was added to HIBP. The corpus comprised 56M unique email addresses across hundreds of millions of stealer log records. The data also contained 124M unique passwords, which have been added to Pwned Passwords and are now searchable. Individuals can view any records captured against their email address in the stealer logs section of their dashboard. Organisations can see logs affecting their domain via the stealer logs API.
Afghanistan Ministry of Finance
May 29, 2026
•[ spear-phishing, malware, XenoRAT ]
SideCopy, a suspected Pakistan-linked threat group, targeted Afghanistan's Ministry of Finance and provincial revenue and finance directorates with spear-phishing emails containing a malicious ZIP/LNK file in Pashto. When executed, the malware chain installed XenoRAT, enabling long-term remote access, spying on infected computers, and additional malicious activity.
Chelan County Government
May 24, 2026
•[ malware, cyberattack, network shutdown ]
Chelan County, Washington reported that malware was detected on county government systems around 10 a.m. on May 24, 2026, affecting all county departments. As a precaution, the county voluntarily shut down network access, computers, and telephone systems across departments while IT staff worked with security partners to restore systems; 911 and emergency services remained available. Public reporting did not identify the threat actor, confirm ransomware, report data theft, or confirm whether any personal data was compromised.
Based Apparel
May 21, 2026
•[ malware, infostealer, social engineering ]
Based Apparel's merchandise website was compromised and used to present visitors with a fake Cloudflare-style verification prompt that attempted to trick macOS users into running commands that installed infostealer malware. Reporting described the malware as commodity infostealer/Trojan activity intended to steal credentials and passwords. The website was taken offline after the compromise was reported; no confirmed theft of Based Apparel data or visitor data was publicly reported.
sqgame.net
October 1, 2024
•[ supply chain attack, malware, backdoor ]
ScarCruft/INKY SQUID compromised Windows and Android components of the sqgame.net gaming platform serving ethnic Koreans in China's Yanbian region, trojanizing game files and update components with RokRAT and BirdCall backdoors. ESET estimated the compromise began in late 2024, with Android malware development beginning around October 2024 and Windows update components malicious since at least November 2024.
Belgrade School District
April 1, 2026
•[ malware, system restoration, data breach investigation ]
Belgrade School District confirmed that malware infected certain network systems, causing technology problems and requiring isolation, removal, security work, and restoration of affected systems. The district said known malware had been removed, but crews were still working to bring affected systems back online and restoration was expected to continue into June. The incident appears distinct from the separate Canvas/Instructure breach because public reporting describes malware in Belgrade School District's own network systems, not unauthorized access to Instructure's Canvas LMS. The district was investigating whether personal information belonging to students or staff was affected, but no confirmed data exposure, encryption, ransomware group, or named perpetrator was reported.
At least one Russian government agency or aviation company
September 1, 2025
•[ phishing, malicious advertising, malware ]
HeartlessSoul has targeted Russian government agencies, aerospace firms, aviation companies, and drone operators since at least September 2025 using phishing emails with infected attachments, malicious advertising, fake aviation-software download sites, fake SourceForge projects, and malware disguised as legitimate software. Public reporting indicates the campaign was successful against one or more victims and resulted in the exfiltration of GIS, satellite, GPS, terrain, digital geographic relief, and other proprietary geospatial data.
At least one DAEMON Tools user in government, scientific, manufacturing, retail, or education sectors
April 8, 2026
•[ supply chain attack, malware, trojanized installers ]
Threat actors compromised official DAEMON Tools installers distributed from the vendor website beginning April 8, 2026. The trojanized installers executed malware on infected Windows hosts, collected system information, and in selected cases deployed additional backdoor payloads. Reporting identified second-stage payloads on roughly a dozen machines in government, scientific, manufacturing, and retail organizations in Russia, Belarus, and Thailand, and QUIC RAT on one Russian educational institution. The specific perpetrator was not publicly identified.
