Trezor
September 9, 2026
•[ phishing, hack, technology ]
Hackers who breached email provider Brevo on Sept 9, 2026 exported Trezor's newsletter contacts and sent ~347,000 fake security alerts from help@trezor.io urging users to enter wallet backups; ~2,500 clicked. Prague-based Trezor said its own systems were unaffected.
Undisclosed Costa Rican credit bureau
September 12, 2026
•[ leak, finance, technology ]
Costa Rican officials linked jarol1488 to theft of a credit bureau database containing personal and financial information. Authorities detected the public posting on September 12, 2026; this date is used as a discovery proxy, not a verified intrusion or extraction date. Cero Riesgo was named in attacker material but had not confirmed that the published information originated from its systems. Officials authenticated only part of a public sample, not the claimed 400 million-plus records. The database was advertised for US$2,500. The exact extraction system was not forensically confirmed. The minister described the attacker as South American without identifying a country.
Undisclosed BigCommerce merchants
September 13, 2026
•[ hack, technology, retail ]
Attackers used a stolen BigCommerce API key of the Ribon app on Sept 13-17, 2026 to download shopper data page by page from BigCommerce merchant stores and inject malicious scripts into some storefronts. BigCommerce revoked the key, removed the app and notified merchants.
Fastr
September 13, 2026
•[ hack, technology, retail ]
Boston e-commerce software firm Fastr suffered a system compromise in which attackers stole BigCommerce API credentials for the Ribon apps of its unit Be A Part Of, per BigCommerce; the keys were abused Sept 13-17, 2026 against merchant stores. Fastr made no public comment.
Master of Malt
September 13, 2026
•[ hack, retail, technology ]
UK online drinks retailer Master of Malt confirmed attackers used a compromised Ribon app key to access customer data on its BigCommerce store between 13 and 17 Sep 2026. Customers were notified by email; payment details and passwords were not exposed.
Bulkhead
September 13, 2026
•[ ddos, technology ]
Bulkhead, a Derby, UK game studio, saw its tactical shooter WARDOGS hit by a DDoS attack just before its Sept 10, 2026 Steam Early Access launch, one of several issues that plagued the game. Attacker, duration and specific impact were not reported.
Dyfed-Powys Police
September 14, 2026
•[ hack, government, technology ]
Dyfed-Powys Police identified a cyberattack on September 14, 2026 and temporarily lost some non-emergency online and email contact services. Emergency response and 999 and 101 services remained available. A review of whether employee data was accessed was ongoing; no compromise of public personal data was established.
MEO
September 14, 2026
•[ ddos, technology ]
Portuguese telecom operator MEO's international network was congested and degraded by a DDoS attack on Sept 14-15, 2026, leaving some customers unable to reach websites. MEO said no systems were breached nor data accessed and reported it to Portugal's CNCS.
Undisclosed Russian companies
September 14, 2026
•[ ransomware, hack, leak ]
Kaspersky research reported in Sept 2026 says pro-Ukrainian hacktivist group Hacking Cat breached unnamed Russian companies via Exchange flaws, stole data and deployed Monkey ransomware and Nemo wiper; some victims paid, others had data leaked. The group denied using the lockers.
Undisclosed Spanish organization
September 14, 2026
•[ hack, technology, government ]
An attacker used an AI agent built on a known language model to log into an undisclosed Spanish organization's system, find application flaws, modify personal data and access invoices. Spain's data protection agency AEPD disclosed the breach notification on Sept 14, 2026.
DOLYA & CO. LTD (Dolya Communication System)
September 15, 2026
•[ hack, ddos, technology ]
Pro-Russian hacktivist PalachPro claimed a large DDoS attack and other disruptive actions against Ukrainian systems integrator DOLYA & CO. LTD, a supplier of professional communications systems to Ukrainian defense and security agencies. The claimed effects included blocked servers and file management, loss of access to the website and internal document workflow, inability to add new orders, and temporary loss of email, file exchange and Sonata messenger access. The attack had been publicly claimed by 15 September 2026, but its exact onset, duration and effects have not been independently confirmed.
International Meteor Organization
September 15, 2026
•[ hack, technology ]
The Belgium-based International Meteor Organization said in Sept. 2026 that a cyberattack dealt a "critical blow" to its aging infrastructure, taking much of its website offline. Fireball reporting was restored first; it is moving to new infrastructure.
Undisclosed organization investigated by CyberMaxx (Event A)
September 15, 2026
•[ ransomware, technology, financial ]
CyberMaxx incident responders observed exploitation of N-able N-central in an unnamed customer environment. The intruder used Net.exe to issue an administrator password-change command, established a Cloudflare tunnel, installed SimpleHelp for persistence and reached a file server over remote access. File enumeration and communication with Filemail-associated infrastructure were observed, but completed data theft and ransomware encryption were not verified. CyberMaxx attributed the activity to Storm-1175 with high confidence; Criminal and Financial reflect the ransomware-preparation context. September 15 is the publication-date fallback, not a verified intrusion date.
Undisclosed organization investigated by CyberMaxx (Event B)
September 15, 2026
•[ ransomware, financial, technology ]
In a second distinct incident-response case, CyberMaxx observed attackers abuse N-able N-central to execute commands on a domain controller, change an administrator password and establish an interactive session using the altered credentials. They installed SimpleHelp, moved to another server through RDP and staged additional tools. No completed exfiltration or ransomware encryption was confirmed. CyberMaxx linked the operation to Storm-1175 with high confidence; Criminal and Financial are supported by the ransomware-preparation context. September 15 is a report-date fallback, not the known attack date.
Flock Safety
September 16, 2026
•[ hack, technology, government ]
Hacker collective Stegan0gram pulled a Flock Safety license plate camera off a roadside pole, copied its storage and used an on-device key to decrypt about 21 days of vehicle images and video, sharing it with 404 Media and DDoSecrets. Flock said tampering is illegal.
Direct Communications Cedar Valley
September 17, 2026
•[ hack, ddos, technology ]
A DDoS attack that began Sept 17, 2026 on Direct Communications Cedar Valley, an Eagle Mountain, Utah ISP, caused slow speeds and full internet outages; its phone and billing systems were still down Sept 21. Eagle Mountain closed City Hall and the library. No actor named.
Moscow City Election Commission
September 18, 2026
•[ hack, government, technology ]
During Russia's September 18-20, 2026 elections, attacks disrupted Moscow's separate electronic voting infrastructure. Officials reported a September 18 terminal failure restored within about 20 minutes, slower remote-voting access on September 19 and an electronic voter-register failure delaying paper-ballot issuance on September 20. September 18 is the earliest reported disruption date; the precise campaign start is unknown. Initial attribution of the terminal failure was qualified, while subsequent official accounts linked voting-service delays to cyberattacks. The responsible operator, actor type and country were not established. No vote alteration, data theft or nationwide outage was established for this event.
Blok Radio
September 21, 2026
•[ ddos, hack, technology ]
Blok Radio experienced a traffic-flooding attack on September 21, 2026. SHARE's subsequent monitoring report describes the radio being taken offline twice within eight days, distinguishing this incident from the September 28 disruption. Outage duration and restoration timing were not disclosed. Sabotage is inferred from deliberate obstruction of the radio's online service; the operator, actor type and political affiliation remain unverified.
Undisclosed People Playground user
September 21, 2026
•[ malware, hack, technology ]
The developer confirmed malware infections involving file deletion and publication of sensitive information through malicious Workshop mods. This represents an unnamed affected user, not a Valve corporate breach. September 21 is the outbreak-onset proxy; individual infection timing is unknown. Sabotage is inferred from deliberate destruction; operator identity and actor type remain undetermined.
Federal Bureau of Investigation
September 22, 2026
•[ hack, government, technology ]
ShinyHunters defaced FBIJobs.gov on September 22, 2026 and supplied journalists with a sample of about 5,000 purported FBI personnel records, portions of which were authenticated. The group demanded correction or withdrawal of a May FBI advisory criticizing its methods and denied seeking a ransom in this case. The FBI subsequently confirmed that an unpatched contractor-managed platform enabled the breach; Reuters identified the platform as Oracle PeopleSoft and reported the responsible contractor was removed. The scope of exfiltration and the claimed 2-3 TB remain unverified. The group is coded Criminal by its identity, while Reputation reflects its stated objective for this particular incident.
