Undisclosed United Arab Emirates company
September 15, 2026
•[ ransomware, government, hack ]
An unnamed UAE company supporting a government sector was compromised through an unpatched software vulnerability and received a ransom demand exceeding US$5 million. Reporting of the cybersecurity chief's September 15, 2026 account states that the attacker obtained company information and published some on the dark web, although other coverage says publication was prevented. Official WAM reporting describes attempted data destruction that was prevented, conflicting with reporting of completed destruction; a disruptive effect is not established. The stolen data categories, volume and source systems were not identified. The intrusion date is unknown; September 15, 2026 is the earliest-report publication fallback, not a verified occurrence date.
St James' Anglican School
September 15, 2026
•[ ransomware, hack, education ]
Hackers accessed systems at St James' Anglican School in Perth, Western Australia, copying current and former students' and families' personal data, incl. bank details, medical records and photos. The school said it contained the incident; ThreeAM ransomware claimed it.
Undisclosed organization investigated by CyberMaxx (Event A)
September 15, 2026
•[ ransomware, technology, financial ]
CyberMaxx incident responders observed exploitation of N-able N-central in an unnamed customer environment. The intruder used Net.exe to issue an administrator password-change command, established a Cloudflare tunnel, installed SimpleHelp for persistence and reached a file server over remote access. File enumeration and communication with Filemail-associated infrastructure were observed, but completed data theft and ransomware encryption were not verified. CyberMaxx attributed the activity to Storm-1175 with high confidence; Criminal and Financial reflect the ransomware-preparation context. September 15 is the publication-date fallback, not a verified intrusion date.
Undisclosed organization investigated by CyberMaxx (Event B)
September 15, 2026
•[ ransomware, financial, technology ]
In a second distinct incident-response case, CyberMaxx observed attackers abuse N-able N-central to execute commands on a domain controller, change an administrator password and establish an interactive session using the altered credentials. They installed SimpleHelp, moved to another server through RDP and staged additional tools. No completed exfiltration or ransomware encryption was confirmed. CyberMaxx linked the operation to Storm-1175 with high confidence; Criminal and Financial are supported by the ransomware-preparation context. September 15 is a report-date fallback, not the known attack date.
Undisclosed Singapore company
September 17, 2026
•[ ransomware, financial ]
Singapore Police described a ransomware attack on an unnamed business whose systems were reportedly breached and years of data became unavailable. The attacker demanded a million-dollar ransom to restore the data; the currency was not specified. The owner sent staff away, disconnected servers and contacted police. The business sector, intrusion method, disruption duration and recovery outcome were not disclosed. Complete system encryption, permanent data destruction and data exfiltration were not confirmed. The incident date and year are unknown; September 17, 2026 is the publication-date fallback, not a verified occurrence date.
Ellis County, Kansas
September 17, 2026
•[ ransomware, government ]
Ellis County, Kansas, said a ransomware incident detected Sept 17, 2026 disrupted parts of its IT systems, leaving some county services unavailable or delayed; 911 stayed up. The KBI and Highway Patrol are investigating; the county saw no evidence of data access.
Kendall Hunt Publishing Company
September 18, 2026
•[ ransomware, education ]
INC Ransom listed Kendall Hunt Publishing, a Dubuque, Iowa educational publisher, on its leak site on Sept 18, 2026, claiming stolen data and threatening to publish it unless the company negotiated. About 441,000 records were later indexed; the company has not confirmed.
United Federation of Teachers
September 18, 2026
•[ ransomware, education ]
The United Federation of Teachers, New York City's teachers' union, was listed by extortion group N0n on Sept. 18, 2026, claiming theft of ~181,420 legal case documents and demanding negotiation before publication. UFT has not confirmed the breach.
Burnaby School District 41
September 21, 2026
•[ ransomware, education, financial ]
The district discovered ransomware on September 21, 2026 and later confirmed theft of personal-information files. Network and phone services were affected. September 21 is a discovery proxy; initial access and extraction dates are unknown. The official page was first published September 23 and updated October 14. Neither encryption nor the stolen-data source host was specified, so technical subtypes remain undetermined. Financial motive is inferred from ransomware.
City of Stevens Point
September 23, 2026
•[ ransomware, government, technology ]
An unknown party gained unauthorized access to the Stevens Point municipal network on September 23. Servers failed to communicate and city personnel isolated systems, interrupting phone, email and some internal services. Staff prevented the suspected ransomware from executing. Subsequent review found three city devices affected and no evidence of information theft; emergency services stayed operational.
Keio Corporation
September 26, 2026
•[ ransomware, finance, technology ]
Japanese railway group Keio confirmed a ransomware attack on group servers on Sept. 26, 2026, disrupting hotel reservations and card payments at some group firms; trains ran normally. Qilin claimed the attack in October and posted sample internal documents.
insurancehouse.com
October 8, 2026
•[ ransomware, finance ]
insurancehouse.com was listed as a victim on the leak site of the settra ransomware group; the attack is estimated to have taken place on 2026-10-08. Sector: Financial Services. Country: United Kingdom of Great Britain and Northern Ireland. Website: insurancehouse.com. Inside: quarterly and annual operational reports from the claims division (Claims Operations, QCS, SIU, Subrogation & Arbitration, Coverage Containment) covering 20232026, with full financial KPIs a cumulative coverage containment total of $4.8 million over three years; monthly reports on reserves, subrogation shortfalls, and the operational burden of the litigation unit; an executive summary of the disclaimer program (1,209 disclaimers, zero bad-faith claims); a Chubb data breach response plan form listing responsible parties; confidentiality and non-solicitation agreements with employ
kingdomtitle.net
October 8, 2026
•[ ransomware, finance, leak ]
kingdomtitle.net was listed as a victim on the leak site of the settra ransomware group; the attack is estimated to have taken place on 2026-10-08. Sector: Financial Services. Country: United Kingdom of Great Britain and Northern Ireland. Website: kingdomtitle.net. 1. 06/26/2026: an incoming book transfer of $15,319,440 and an outgoing wire on file 20260084C of $14,947,415. The same amount appears in the cleared report and in the Void & Stop Payment report. 2. 07/07/2026: Brian Moore Professional and Personal Spreadsheet.pdf contains personal auto, umbrella, and boat policies. The OCR alongside lists $766, $4,963.26, and $9,170.70 with the annotations paid from kts dev gr. 3. Three recent Trial Balances contain 2,972 positive balances totaling $1,277,500.31: American $1,077,012.58, Kingdom $143,990.33, Title Connect $56,497.40. 4. American ODI
Isapre Consalud
November 2, 2026
•[ ransomware, healthcare ]
Isapre Consalud was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-11-02. Sector: Healthcare. Country: Chile. Website: www.consalud.cl.
Harry's International
November 2, 2026
•[ ransomware, retail ]
Harry's International was listed as a victim on the leak site of the Orova ransomware group; the attack is estimated to have taken place on 2026-11-02. Sector: Retail & E-Commerce. Country: Singapore. Website: www.harrys.com.sg. Harrys is Singapores largest collection of everyday bars and kitchens - a homegrown destination where people from all walks of life come together to connect, unwind, and celebrate life over great food and drinks.
EVINOKS
November 1, 2026
•[ ransomware, technology, manufacturing ]
EVINOKS was listed as a victim on the leak site of the Barracuda ransomware group; the attack is estimated to have taken place on 2026-11-01. Sector: Technology. Country: Turkey. Website: evinoks.com. Evinoks is a Turkish company that produces and sells various products for hotel and restaurant service, such as trolleys, chairs, tables, buffet units, furniture and hygiene equipment. It has a wide range of customers and partners around the world and aims to provide innovative, aesthetic and quality.
We are beginning to release unsold data for free; it will remain available for one month, so be sure to download all the files to your own storage.
Our storage: http://qr6uopkqxmq254osyct3oibil32xp3qsimkkbqdscsrsb4zqbagnifad.onion/ | Status: free | FREE
qc-consult
November 1, 2026
•[ ransomware, technology ]
qc-consult was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-11-01. Sector: Professional Services. Country: Germany. Website: www.qc-consult.de.
CMD Naturkosmetik
November 1, 2026
•[ ransomware, retail ]
CMD Naturkosmetik was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-11-01. Sector: Retail & E-Commerce. Country: Germany. Website: www.cmd-natur.de.
BKV Vasúti Jármjavító Kft
November 1, 2026
•[ ransomware, leak ]
BKV Vasti Jrmjavt Kft was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-11-01. Sector: Transportation. Country: Hungary. Website: www.vjsz.hu.
Meshbesher & Spence
November 1, 2026
•[ ransomware, leak ]
Meshbesher & Spence was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-11-01. Sector: Professional Services. Country: United States of America. Website: www.meshbesher.com.
