323 cyber incidents in 37 European countries since 1 January 2026, last updated 10 Nov 2026. Loading the latest results…
Emperador listed the Alain Afflelou domain on its leak site on 26 October; the listing date is used as the onset marker. ZATAZ reviewed the data and found it far smaller than claimed. There is no statement from the company or any authority.
Overnight 11-12 Oct 2026, refrigeration controllers at about 700 French commercial sites were manipulated (thresholds raised, alarms disabled). French authorities acknowledged the incident; the government (Barrot, ANSSI/C4) attributes it to IRGC-linked Shahid Kaveh (attribution by France only; Iran denies). Kept separate from the unattributed November wave.
Per a single paywalled NOZ report, Klinik im Kurpark in Bad Rothenfelde was unreachable by phone and email 'for technical reasons' and a data incident was reported. The headline poses a cyberattack as a question; no clinic or authority statement confirms a cyber incident.
French advertising-display firm reportedly hit by ransomware at the end of September 2026, per a single frenchbreaches.com article citing an IT provider testimonial. No statement from Next One or a French authority found.
NoName057(16) and Z-Pentest claim DDoS attacks and database leaks against French telecom operators Free and La Poste Mobile and Danish manufacturer Danfoss. ZATAZ says the breaches are not demonstrated. The critical-infrastructure flag reflects the targets (telecom operators), not a confirmed impact.
ZATAZ reports that 'Chimeraz' claims on a hacker forum to be selling 259 million rows from SGS France's vehicle inspection brands. ZATAZ says the extract does not show which systems or brands are affected. This is a seller claim only.
A single paywalled Zonebourse report states that the French subsidiary of Finland's Revenio Group (Visionix, acquired May 2026) was the victim of a cyberattack. No attack date, company release or authority statement found. Disclosure date is the publication date of the only source.
Rhein-Zeitung reports two cases in Rhineland-Palatinate: a shop in Kreis Kusel and a food-processing business in Kreis Kaiserslautern. In both, cooling systems were switched to heating mode via external access. The businesses are unnamed, and the only evidence is this one report.
The municipality's chief executive told Vikebladet that a data attack about two weeks earlier had been handled, with staff working through a weekend. The article is paywalled, so the method, the systems affected and the impact are not stated. Onset is given only to the month (late October, from 'about two weeks' before 8 November). The status is recorded as recovered because the chief executive said the attack was handled.
A single ESKA.pl article (7 Nov 2026) says a wave of attacks on telecom networks has hit nearly one hundred local Polish ISPs. It mentions possible knock-on effects on card payments and e-prescriptions, and its social title says the government is forming a special team. The article names no victims, dates or attacker. No statement from an affected ISP or a national authority was found, and no corroborating report was found.
German web host Mittwald acknowledged in its own blog post (7 Nov 2026) that an attacker exploited a flaw in its MCP server, compromised 56 customer projects and went undetected about eight days. No further attacker activity found as of 6–7 Nov.
Italian foreign minister Antonio Tajani publicly said that cybercriminals published his personal data on the dark web. Il Messaggero and a French-language wire report (Zonebourse) quote his statement, and both repeat the same statement, so they form one evidence chain. He links the leak to Italy's support for Ukraine. That link is his own attribution and has not been verified. The source system and the method are not stated. The leak is not shown to be linked to the BBT attack and is kept as a separate record.
Tiroler Tageszeitung (6 Nov 2026) reports that BBT SE, the Brenner Base Tunnel project company, confirmed a cyberattack in mid-October in which attackers accessed data. Security protocols were activated and the state protection service was informed. BBT SE did not answer questions on ransom. A third-party tracker attributes a claim of a 17 Oct breach with 812 GB to the Everest group; that claim is unverified.
A single Rheinpfalz report says the supermarket in Brücken (Landkreis Kusel) had to discard large amounts of food after its cooling systems malfunctioned early on a Monday, and calls the cause a cyberattack. No confirmation from the operator or an authority was found. The Monday is taken as 2 Nov 2026 from 'previous Monday' in a 6 Nov article.
Casinos Austria emailed customers that attackers had accessed an external service provider's system between 2 and 5 Nov 2026. The company said it must assume that data from its online shop was taken. Media report that about 150,000 customers are affected. The data possibly exposed is names, email addresses, orders and voucher codes. Bank and card data are not stored by the company and are not affected. The company says the security gap is closed and that it has informed the data protection authority. The perpetrators are unknown, and the scope of the affected records is still under investigation.
The operators of Medizinisches Zentrum Gleis D and Medi Porta in Chur confirmed a cyberattack on local data stores. Patient and staff data, including names, addresses, prescriptions and X-rays, were exfiltrated. The separately held electronic patient record was spared. The attack was stopped, a criminal complaint was filed, and BACS and EDÖB were notified. The Cloak ransomware group claims 87 GB; that claim is unverified.
A single paywalled trade-press report says that the seller behind the Solnet listing and four Swiss municipalities is offering data attributed to Destination Davos Klosters. There is no statement from the organisation or any authority. The disclosure date is the publication date of the source.
Mindfactory, a subsidiary of the heise group, stated it was the victim of a cyberattack through a vulnerability that has since been closed. Attackers may have accessed customer contact data and hashed passwords. Customers who ordered since July 2025 and the data protection authority were notified, all passwords were reset, and a criminal complaint was filed. No extortion is reported, and payment data is held by payment providers.
TUM confirmed that attackers entered via the legacy myTUM system and obtained TUMonline administrator credentials. Data of about 60,000 students and staff may have been accessed, including passwords, names, addresses, birth dates, matriculation numbers and study information. Whether data was exfiltrated is under investigation. Platforms were taken offline and are being restored step by step. The incident was reported to the Bavarian data-protection commissioner and a criminal complaint was filed. The earlier LMU attack is a separate incident.
OM-Online (6 Nov 2026) reports that a hacker attack on the Trauco group's IT systems affected Bergmann Bau- und Erlebniswelt in Steinfeld, causing temporary IT outages at numerous locations. The article is paywalled and no company or authority statement was found. The reference to AI fraud calls to customers comes from the teaser only.
Who Gives A Crap told customers that an intruder accessed an unnamed US marketing software provider on 30 Oct 2026; the provider detected it on 31 Oct, secured systems by 1 Nov and informed the company on 6 Nov. UK, US and Australian customers affected; only the UK is counted as European. UK ICO confirmed the report.
Braunschweiger Zeitung (5 Nov 2026) reports large coolers empty in a Braunschweig supermarket at the same time as the Europe-wide cooling attacks, and asks whether hackers were involved. Only the paywalled teaser was readable, and no cause is stated. This is a single press source with no organisational or authority confirmation, so it is an operational anomaly with an unverified campaign link.
The Köniz butcher says on its website and flyer that a targeted cyberattack manipulated the controls of its cooling and freezer systems. The shop is closed and its systems are isolated, with reopening planned for 20 Nov.
A technical defect disabled refrigerated shelves at a Penny store in Brandenburg an der Havel, and thousands of food items were thrown away. The single local press report (MAZ) gives no cyber cause. Recorded as an operational anomaly, not a cyber incident, and kept separate from the European refrigeration-controller campaign.
Unknown persons reportedly stole server files containing personal data. Single aggregator (MSN) report; no primary statement from the organisation or an authority. Onset, detection and scale not stated; attacker unknown.
Per Correctiv citing BSI (relayed by Ärzteblatt), medicine cooling systems of a German pharmaceutical wholesaler were attacked. BSI describes such attacks as untargeted/opportunistic. Pro-Russian channel attribution unverified; victim unnamed.
Unknown actors manipulated the temperature controllers of supermarket cooling units in several German states. Heise quotes the Bundesamt für Verfassungsschutz telling Handelsblatt that the incidents are the subject of current intelligence investigations, and GAZ Hybrid is also dealing with them. The Interior Ministry has no findings that would attribute the incidents to an actor, and it is unresolved whether this is a coordinated campaign. Heise also reports similar cases in BE, SE, IE, LU, EE, FI and NL, but names no victims, so those cases are not split out here. The mechanism and impact details come from the press account, not from an authority.
Cyberattaque.org quoted a security notification Illicado sent to a business client: an attack on 1 Nov 2026 let an individual retrieve copies of digital gift cards from 2025-2026 corporate orders; Illicado says monitoring detected and stopped it. Organisation's own statement relayed by a single outlet.
Norad states criminals broke into its grant portal using 27 compromised accounts. Names and email addresses of all 20,614 registered users (12,511 organisations) were taken, and applications from at least three organisations were involved. Crisis team set up; perpetrators unknown.
A single press report (VRT NWS) says ransomware took part of a Waregem medical laboratory's systems offline. The lab analyses over 5,000 samples daily; a ransom was demanded; a known collective is reportedly also behind three similar Belgian attacks (unverified).
The Trading with Schools platform run by Bristol City Council was hacked on 29 Sept 2026, affecting at least 39 Bristol schools. The council, as quoted by ITPro, says data was taken and published online, and it is working with police and the Regional Organised Crime Unit. The Wallstreet group listed the council on its leak site around 27-28 Oct with little supporting evidence. Held at corroborated rather than confirmed because the council's statements were seen only second-hand.
Amadeus told The Record it became aware of a vulnerability in a travel booking display environment that left booking-display data accessible. Japan Airlines, Cathay Pacific, Singapore Airlines, Malaysia Airlines, Korean Air and Asiana disclosed related breaches. Amadeus reports no evidence that payment data was accessed and no sign of ransomware. Investigations continue.
Beget, a major Russian hosting provider and domain registrar, said an overnight Sunday attack (around 1 Nov 2026) wiped data across its cloud infrastructure. Recovery was under way by 4 Nov. No group has claimed it.
About 15 of roughly 700 Carrefour Belgium stores, 4 Delhaize outlets in Luxembourg and others had refrigeration settings tampered with from about 2 Nov 2026. A Belgian federal prosecutor is reported to be investigating. Attribution is unestablished.
A criminal cyberattack on the Eichstätt city administration reportedly knocked out its IT systems. The city gave no recovery estimate and warned residents about fake messages sent in its name. A headline and teaser also report that 1.4 TB of municipal data was stolen, probably including personal data; no other source confirms this. No statement from the city or an authority was read.
Cybercriminals temporarily accessed systems and possibly customer data; Swiss customers may be affected. Country of company not stated; CH assumed from outlet and customers. Disclosure date taken from the publication date of the earliest source.
On 4 November 2026 the Kyiv Independent said its website was disrupted and that subscribers received false emails in Russian and English, including a false nuclear launch claim, after unauthorised access to its CMS and newsletter service. It suspects Russian actors. Only one Record report was found.
In the night to Monday 2 Nov 2026, someone remotely manipulated the cold-store controls of a butcher in Windischeschenbach and set temperatures to up to 150 °C. Damage was several tens of thousands of euros. Polizeipräsidium Oberpfalz reported the incident on 4 Nov and said it may be linked to Europe-wide refrigeration attacks. Control was regained quickly. Other first German cases that heise reports in Bavaria and NRW are not merged here.
Bitdefender reports that a 3AM ransomware affiliate compromised a UK school estate between 10 and 19 September 2026, stealing credentials from Veeam and other stores, creating backdoor admin accounts, exfiltrating finance files and encrypting about 37 machines on 19 September. Bitdefender suspects a hybrid human/LLM-agent operation, but this is interpretation only. The victim is unnamed and no statement from the school or a UK authority was found. The evidence is a single vendor chain (BleepingComputer repeats Bitdefender), so the incident is alleged, not confirmed or corroborated.
Press reports an attack overnight on 1–2 Nov 2026 on three EFS cold stores through contractor Coolworld, which raised temperature and defrost thresholds. EFS reportedly says no products were lost and no patients were affected. This is not confirmed by primary evidence, and the link to the supermarket refrigeration wave is unestablished.
BSI says German lawmakers and staff received Apple threat notifications; unknown how many devices were infected. Attacker and vendor not named.
Holcim acknowledged a limited unauthorised data leak, disclosed on 3 Nov 2026. The Emperador ransomware group claims 360 GB and threatens publication. Operations are reported unaffected.
The Swiss national authority BACS, in its Week 44 review, states that it received reports of several malware cases on private home networks, linked to unpatched internet-exposed devices. It calls compromise of unpatched Plex servers an acute danger. The state is confirmed only for the acknowledged cases in aggregate. No victim is named and no case count is given.
At a NASK press conference on 3 November 2026, the head of CERT Polska confirmed one cyberattack on a refrigeration device in Poland, without material loss. He did not name the victim. A national scan found 140 exposed devices.
Headline only: Russia-linked cyber espionage targets Ukraine's war crimes investigations and military aid routes. No victim or method collected.
Solothurn ISP Solnet confirmed that published data extracts come from its Roundcube webmail logs. It learned of the incident on 1 Nov, informed BACS, and rebuilt and externally checked the webmail server.
Refrigeration systems of one model in 13 of 223 SuperValu stores were hit on 2 Nov 2026, apparently as part of coordinated attacks across several European countries that turned off freeze settings. Musgrave, the SuperValu owner, is quoted in press as describing a cyber incident limited to one refrigeration model. Chilled and frozen stock was withdrawn as a precaution. Attribution is unknown.
A forum user claims to have stolen and published data from the Swiss basketball federation's extranet. According to Netzwoche, the federation warned affiliated persons of fraud attempts and reported the incident to BACS. The data's size and content are attributed to the attacker and to Frenchbreaches. No link to the Swiss Ice Hockey case is stated.
Personal data of about 38,000 pupils and 3,500 teachers stolen at end of October 2026 from IT support of Vaud schools; a 16-year-old was arrested. Netzwoche URL cites 41,500 people (figure differs). Disclosure date taken from the publication date of the earliest source.
Refrigeration units at the Auchan hypermarket in Olsztyn-Nagórki failed on 2 November 2026, the morning after the European fridge-attack wave. Some Polish media attribute this to a hacker attack, but the coverage rests on one chain (an X video plus staff confirmation to WP Finanse). Neither Auchan Polska nor CERT Polska has said a cyber incident occurred, so the cyber cause is alleged by third parties only.
Fake nuclear-attack and threatening notifications reached Ukrainian citizens (Kherson) within minutes of a ceasefire lifting; Russia also reports attacks on its alert apps. Perpetrators attributed by headline to Russian and Ukrainian hackers; basis unknown. Treated as one event across both countries pending detail.
Late on 1 Nov 2026, attackers used the MChS (EMERCOM) mobile app to send false nuclear-attack and shelter warnings. In a statement dated 2 Nov, MChS acknowledged the app had been hacked and said it was restoring service. It said the national public warning system was not affected. DC8044 claimed responsibility and says it got in through the app's API; that is unverified.
IKEA told the press that a cyber incident hit refrigeration and freezer units at its Mons store on 1–2 November 2026, with limited impact. It says no other Belgian store was affected. The event is part of a multi-country wave of refrigeration-controller tampering that night.
Grupo Mosqueteiros confirmed a cyberattack on refrigeration systems in seven Intermarché stores in Portugal on 2 Nov 2026. It said the attack likely went through an outside refrigeration service provider. PJ and CNCS are investigating. In Italy, Radenza confirmed attacks at about 04:00 on 2 Nov at Coop franchise stores in Catania and Palermo. ACN received a NIS notification from a Tuscan catering company and detected an attack on a frozen-food producer in Emilia-Romagna. The method matches the wider European wave.
On the night of 1–2 November 2026, refrigeration and freezer equipment at several small K-stores in Helsinki ran at abnormal temperatures, coinciding with refrigeration-controller attacks reported elsewhere in Europe. Kesko confirms the temperature disruptions but has not said a cyberattack occurred, and says network-based interference has not been ruled out. The cyber attribution comes from international coverage (CNBC, The Hacker News) linking Kesko to the wider campaign. The Finnish NCSC says the cause is not yet known.
On 2 Nov 2026 the council of San Cristóbal de La Laguna (Tenerife) issued an official statement on its X account. It said it had detected a cybersecurity incident affecting part of its technology infrastructure. The affected services are the municipal website, the electronic office (Sede Electrónica), the administrative case management system, and applications including tax and accounting. The council activated security protocols to contain the incident and assess its scope. Technical staff are working with specialist bodies to restore services. The attack type, the attacker and any data compromise have not been disclosed.
The CAP supermarket at Eckbusch in Wuppertal, run by proviel GmbH, said on Facebook that 'external access' over the weekend of 31 Oct–1 Nov 2026 left its freezers and chillers too warm. This was noticed on the morning of Monday 2 Nov. All chilled and frozen goods were discarded, worth about EUR 25,000. A complaint was filed with Wuppertal police on the afternoon of 2 Nov. A police spokesperson told WZ that the criminal investigation department (Kriminalkommissariat) is investigating and that the temperature was turned up remotely. Police are also looking at other suspected NRW cases, in Wetter near Hagen and in the Münsterland. The 'Edeka in Borken' named by KStA/AFP is still unverified and is probably a conflation with Rewe Raesfeld (Kreis Borken). No perpetrators have been identified, and no link to the wider European wave of refrigeration manipulation has been confirmed.
Danfoss, quoted by NOS, says attackers changed temperature settings on internet-exposed refrigeration controllers at at least 17 Dutch businesses on the night of 1–2 November 2026. Large supermarkets were reportedly not affected. The vendor statement is neither from an affected organisation nor a national authority, and victims are unnamed. Outlets repeat one Danfoss source, so this is a single evidence chain: alleged, not corroborated or confirmed.
Overnight on 1–2 Nov 2026, refrigeration controllers in about 75 Belgian stores were reportedly tampered with remotely, in a second European wave after the French one. Carrefour Belgium reportedly said 15 stores were affected, and the federal prosecutor is reportedly investigating. Rated corroborated, not confirmed: organisation and authority statements were seen only through press reports, and the CERT-FR alert covers the French wave only.
Around 04:00 on 2 Nov 2026, refrigeration at at least four Coop (Radenza group) stores in Sicily reportedly overheated, forcing food to be discarded. ACN reportedly also received reports from a Tuscan catering firm and an Emilian frozen-food producer. The Polizia Postale is investigating. No primary ACN or company publication was verified.
On 2 Nov 2026 the operator of an Edeka market in Reisbach said on Facebook that hackers had heated the store's cooling units to up to 50°C, so large amounts of food had to be discarded. The affected operator itself says the incident occurred, so the state is confirmed for that acknowledgement. The hacking claim is the operator's own assertion. No authority, vendor or forensic finding supports it, and no vendor or campaign link is established for this store. t-online names the operator as Edeka Ernst and places the event in a series of attacks on European supermarket refrigeration. Earlier reports said Polizeipräsidium Niederbayern called a cyberattack plausible, but no police statement could be traced.
Overnight on 1–2 Nov 2026, refrigeration and freezer settings were changed remotely in dozens of supermarkets, causing food loss. About 40 Delhaize stores, 15 Carrefour Belgium stores and about 5 Spar stores were affected; Belgian media counted about 76 sites in total. Similar incidents were reported in Sweden (ICA, Coop), Ireland (SuperValu), Estonia (Selver) and the Netherlands (at least 17 businesses, according to Danfoss). Carrefour confirmed on the record that it was a cyberattack. Belgium's federal prosecutor opened a criminal investigation, and the CCB says it is aware of the incident. No one has claimed the attack and no perpetrator has been identified.
On Monday 2 November 2026 attackers accessed the remote-control computer of the refrigeration system at one undisclosed Selver store and set a chiller to 50 °C. Selver acknowledged the attack. Its partner Kitman Coldtech detected it quickly and brought it under control, and no products were harmed. The Danfoss link in the campaign label comes from upstream clustering and is not stated in these sources.
During the night of 1–2 Nov 2026, attackers changed refrigeration telecontrol settings at Coop-branded franchise supermarkets in Sicily (in Catania and Palermo), causing display cases to overheat and food to spoil. The franchise operator, attributed by the press to Coop Radenza of Modica, confirmed the attack. The Polizia Postale is investigating, ACN issued an alert and mitigation bulletin, and Palazzo Chigi convened a meeting with ACN and intelligence heads. EU Commissioner Hansen called the wider wave a deliberate attempt to disrupt the EU food supply chain.
Both companies informed customers of data leaks after IT attacks (heise headline/teaser). Two victims in one report; no link established, so a single record is a weak match and they may need splitting. Disclosure date taken from the publication date of the earliest source.
In customer e-mails relayed by heise, notebooksbilliger.de said parts of its IT were the target of a criminal cyberattack noticed on 12 Oct 2026, and that customer data may have been exfiltrated.
Late on 1 Nov 2026, users of Ukraine's Air Alert app, including in Kyiv, received fake push alerts about radiation, chemical threats, street fighting and a possible Oreshnik strike. The operator said unauthorised persons had interfered with the app. It disabled push notifications and suspended the app, then partly restored it with the incoming-target map display still suspended. Hitcore Corp claimed the attack, which is unverified. The national warning system was not affected.
Rosstat confirmed that its resources were hit by cyberattacks between 29 Oct and 1 Nov 2026. Its main website and regional portals were defaced with messages from the Belarusian Cyber Partisans and Silent Crow, and the main site went offline. The groups claim about six months of access, around 25,000 devices reached, servers wiped and 10–23 TB of data stolen. None of these claims is verified. Rosstat says it found no database compromise and no leak of legally protected information.
Apple began sending threat notifications on 29 Oct 2026 to iPhones of German Bundestag members, federal government members and others, warning of a targeted mercenary-spyware attack. The BSI wrote to those affected with precautionary advice. Digital Minister Wildberger acknowledged the warnings on 1 Nov and the government spokesperson, speaking of a 'Hackerangriff', said on 2 Nov that authorities were investigating. This confirms the targeting warnings and official response, not that any device was compromised, how many were targeted, or who the attacker is.
On 1 Nov 2026, Trigger.dev, a cloud platform for AI agents and workflows, disclosed that an attacker had gained unauthorised access to the environment variables of a subset of customer organisations. The company says it blocked the exploit and emailed affected account owners with mitigation steps. It has not disclosed the attack method, the affected customers or the countries involved.
The only support is a search snippet mentioning a targeted data attack. The linked page is an unrelated boat-owner notice. No 2026 report from UiT, a Norwegian authority or a vendor was found. The wording matches UiT's December 2020 attack, so this may not be a new incident. A proper source is needed.
On 29 Oct 2026, actors calling themselves HackTheWorld, ethicxss and id0rable said they had taken the customer database of piecesauto-online.fr, the online used-parts shop of a company in the Caréco car-recycling network, and threatened to publish it on 31 Oct unless paid. On 30 Oct a dump attributed to Caréco appeared on a cybercrime forum. Fuites Infos found three tables covering about 697 customers, but the origin is unproven. Neither Caréco nor any French authority has made a statement, so the incident remains alleged.
The ferry operator's booking-system subcontractor was hit by a cyberattack, which was detected on 26 Oct 2026; the operator was told on 28 Oct. The company says about 200 customers may be affected, and the subcontractor has blocked access.
Heise reports an attack on the Fehmarnbelt tunnel construction company; a cyber gang has come forward demanding money (unverified). Primary country DK assumes the Danish-based builder; the source states no country, so confirm.
Russian home goods retailer Poryadok reported on 25 Oct 2026 that its website and app were unstable and stores were closed for 'technical reasons'. It later confirmed a hacker attack on its official VK page. The disruption lasted at least five days. The method, the attacker and whether data was compromised have not been disclosed.
UK domain registrar 123 Reg, owned by GoDaddy, says an intrusion on 18 Sep 2026 exposed customer contact information, relationship data, VAT numbers and product information taken from an API. It began notifying customers in the week of 28 Oct 2026. The company calls it an AI-driven attack and suspects a China-nexus actor; that attribution has not been confirmed.
On the night of 27–28 Oct 2026, an attacker got into the systems of Belgium's Federal Public Service Finance. The intrusion was detected within hours, and MyMinfin, Tax-on-web and Biztax were taken offline as a precaution and restored in an isolated environment. The agency says no data was exfiltrated and no application was taken over. The Federal Police and the CCB are investigating. Filing deadlines were extended to 16 Nov 2026, and a later release says the e-services are available again.
Moldovan authorities (Electronic Government Agency, President Sandu, PM Tofan) acknowledged a cyberattack on government systems from which data of about 750,000 people was reportedly extracted. Attribution not established. Relationship to the Sep 2026 event not established; kept separate.
On 28 Oct 2026 the Panzer ransomware-as-a-service group listed PQE Group, a life-sciences compliance consultancy based in Reggello (Florence), on its leak site. Panzer claims 200 GB of exfiltrated data, which by its own account is encrypted Duplicati backup archives it has not decrypted. PQE has not confirmed the claim; no statement from PQE or an Italian authority was found. The tracker, Italian trade-press and breach-monitor items all trace to the same leak-site post, so they form one evidence chain and the state remains alleged.
On the morning of 28 Oct 2026, Universität Leipzig was hit by a cyberattack and took all internet-connected servers offline as a precaution, taking down its website, email and digital platforms. It set up a crisis team, brought in an external IT emergency provider and informed the authorities. Services were still offline on 30 Oct. The data impact and intrusion path have not been confirmed.
About one million IDNPs were queried between 19 and 23 Oct 2026, and data on about 750,000 people was extracted through unauthenticated services. AGE disconnected 82 services and its director resigned. No attribution has been made.
Tele Columbus (PŸUR) notified customers that attackers took customer data from its IT infrastructure and sales systems between mid-September and early October 2026. This rests on the company's customer notification as quoted by heise and Borns IT-Blog.
Shelly Store UK (shellystore.co.uk), an independent UK reseller of Shelly smart home products, found unauthorised software on its website and server after a Stripe warning. A customer breach notification email dated 27 Oct 2026, issued by the company, said names, billing addresses, contact details and payment card data may have been compromised for orders in an unspecified window. It said it removed the malware, strengthened access security, applied updates, added monitoring and reported the incident to the ICO. The Register quoted the email on 30 Oct 2026. The skimming characterisation (Magecart-style) is an analytical inference, not stated by the company.
In a notice, SIHF said an unauthorised person used a user's credentials to access MySIHF and take personal data, which the federation then found offered for sale on a forum. Passwords were not taken.
Warhorse Studios (Kingdom Come: Deliverance) disclosed a cyberattack on 27 Oct 2026 in which unauthorised parties accessed company systems and data. In an update dated 30 Oct, the studio said some internal systems and services were affected and that it is still checking whether personal data was involved. It is working with cybersecurity experts and the relevant authorities.
Per the company's statement relayed by Netzwoche, a ransomware attack on 9 October 2026 impaired individual systems at the Sulgen site, and attackers copied business data affecting some customers. Akira separately claims 130 GB. Systems have been restored and production is normal. The date of restoration is not stated.
On 24 Oct 2026, HomeToGo SE disclosed in an ad-hoc notice that data had been exfiltrated without authorisation from its subsidiary SECRA Bookings GmbH; the breach was discovered on 23 Oct. HomeToGo reports no indication that other group systems were affected.
Between 23 and 25 Oct 2026 the actor ChimeraZ claimed on a forum to hold data from the PCF, LFI and Renaissance. The PCF itself stated on its website that it suffered a leak of its membership and sympathiser file after an ANSSI alert, and said it notified the CNIL and plans a complaint. That statement supports the confirmed state for the PCF part only. LFI and Renaissance deny any intrusion and say the data was public or scraped. The claimed volumes (about 195k PCF rows, 1.27M LFI rows, 4.16M Renaissance rows) come from the actor alone. The record bundles three victims and should be split per party: PCF confirmed, LFI and Renaissance alleged or disputed.
ENGIE confirmed unauthorised access to a third-party prospecting and marketing tool used by its sales partners. French customers' names, addresses, emails, phone numbers, PDL/PCE meter references, customer IDs and contract numbers were taken. ENGIE says its internal IT and banking data were not affected. The number of customers affected and the partner have not been disclosed, and there is no claim.
An attacker exploited a configuration error in a KU test environment to reach a user database (last synchronised 13 Jan 2026). It holds data on about 525,000 current and former staff, students and associates: names, contacts, usernames, nationality, gender, affiliation, encrypted CPR numbers that are likely decryptable, and access-card PINs. KU detected the attack on 20 Oct 2026 and reported it to the police and Datatilsynet.
Ritzau, via Nordjyske on 22 Oct 2026, reports that Aarhus University said in a news item on its internal website that it was hacked. The attacker got access to a server and tried to reach and change passwords for about 1,700 users. The university is investigating whether an account with server access was compromised. It reports no sign of a leak of sensitive data. The university's own statement reaches us only through Ritzau; the original internal page was not retrieved.
Between 12 and 15 Oct 2026, an attacker used licensee credentials on the EDEN portal and mass-queried the Cibles Couleurs licence-verification function. About 64,000 ID photos, about 19,000 documents and 55 complete files were stolen. A further attempt on 18 Oct was blocked. From 17 Oct ChimeraZ advertised a 40 GB archive covering 586,854 people, which has not been authenticated.
After two critical PHP remote-code-execution flaws (PHP2Shell, CVE-2026-109618 and CVE-2026-109619) were disclosed on 21 Oct 2026, UK departments took services offline to patch them. On 22 Oct the minister told the House of Lords that 32 services were unavailable and 4 partially unavailable, 'largely from precautionary measures', and that no compromise of central government systems was confirmed. Peers said several councils were offline, and the OBR website was down.
Ined says it suffered a large-scale hack over the weekend of 17 October 2026 and cut access to its servers to contain the threat. It set up a crisis cell, notified the authorities and filed a complaint. The source is a Campus Condorcet news page of 21 Oct 2026 carrying Ined's press release.
On 20 Oct 2026 the AfD confirmed a September 2026 attack on its email hosting provider and said parts of a few mailboxes were copied. Have I Been Pwned lists more than 345,000 exposed email addresses, and about 421,000 emails were published on an activist site and by torrent. Journalist Lilith Wittmann says the attack began through a WordPress site, gave persistent access to the provider Alternita, and took more than 1 TB of data; no official source has verified this.
Estonia's Information System Authority (RIA) reports several cases in which fake LinkedIn job offers led developers to run malware; one victim lost control of a crypto wallet (~USD 10,000). RIA notes one case overlaps technically with the North Korea-linked 'Contagious Interview' campaign, without definitive attribution.
Not a cyber incident. Google's final incident report (27 Oct 2026) says the data centre hosting zone europe-west2-b lost power. At 06:53 BST on 20 Oct an external underground cable fault cut utility feed A, and feed B was already locked out for maintenance. The generator PLCs' undervoltage sensing was wired upstream of the isolated feed B breaker, so the generators never started. The UPS batteries ran out and the zone was down from 07:00 to 13:08 BST (6 h 8 min). Knock-on errors affected about 40 europe-west2 products. Press reports Revolut disruption, including in Ireland, and possible impact on other UK banks and courts.
From about 05:00 on 20 October 2026, ING Deutschland customers could not log in to app or internet banking. ING called it a technical fault with no external cause, and services were restored by about 13:42. No source states or alleges a cyber cause beyond customer speculation, so it is recorded as an operational anomaly. Sources are press reports relaying the bank's statement (one evidence chain); no authority or vendor report was found.
An attacker used a compromised contributor GitHub account to replace OVHcloud CLI release binaries v0.11.0–v0.15.0 with an infostealer that targets secrets on disk. The tampered releases appeared at 14:47 on 19 Oct 2026 and were blocked at 16:21 after a customer report. Release immutability had not been enabled; CI/CD was unaffected. OpenSourceMalware's link to GlassWorm is its own inference.
Caisse des Dépôts stated the PEP's employer platform was closed after illegitimate access, via social engineering, to the accounts of a few employers. It reopened on 19 October 2026; Net-entreprises access and new registration remained temporarily closed.
Suspicious activity detected on the evening of 7 Oct 2026 at HSZ-BW; systems shut down as a precaution. A crisis team was set up; Polizeipräsidium Reutlingen and Generalstaatsanwaltschaft Karlsruhe are reportedly investigating; malware apparently installed. Perpetrators unknown. Services still restricted at last report.
On 16 Oct 2026 a fault in the data network supporting Italian air traffic control (ENAV) caused delays and cancellations, especially at Rome Fiumicino. Press reports say ENAV traced the problem to the data network and ruled out cyberattacks or malicious acts. Operations reportedly returned to normal around 16:00 the same day. Recorded as an operational anomaly, not a cyber incident. The evidence rests on press reports (Reuters-derived and Italian outlets); the ENAV statement was not read directly.
Since 12 October 2026, Rise and secunet TI connectors reportedly could not re-establish VPN to the Telematikinfrastruktur after a restart, apparently due to a faulty configuration linked to an 11 October DNSSEC change. A fix firmware was reportedly issued. No cyberattack is stated. Evidence rests on a single secondary source (borncity blog); no gematik or secunet primary statement was reviewed.
Bristol City Council describes a cyberattack on its Schools IT network. It isolated affected systems and cut 88 schools off from the internet to contain the threat. By 14 Oct 2026, 84 of the 88 had limited internet access, including all 39 schools directly supported by council IT. The council reports no evidence of mass data export. This record is kept separate from the Southville Primary MIS breach and the Trading with Schools incident.
Bristol City Council said on 15 Oct 2026 that a targeted cyber-attack on the management information system (MIS) used by Southville Primary School caused a data breach, with evidence that records were exported. The ICO was notified, parents and carers were informed, and law enforcement is involved. The council treats this as separate from the Bristol Schools IT network attack. It believes the same criminals are responsible but says this is unconfirmed.
TFG London, the UK arm of The Foschini Group, disclosed a cyber incident detected on 11 October 2026 affecting IT systems supporting Phase Eight, Hobbs and Whistles. Stores remained open while several IT systems were unavailable and online orders delayed. Attack mechanism and attacker are not stated.
Ledger's own statement of 15 Oct 2026 confirms that a criminal group bought genuine Ledger devices, fitted hidden implants that capture the recovery phrase, and put them back into distribution through Southeast Asian resellers. Wallets were drained. Reports tie the confirmed losses to the reseller CryptoBilis. The German part of this record, which anchors it, rests on a German user's reports of implants in two devices bought at two different MediaMarkt stores. After those reports, MediaMarktSaturn suspended Ledger sales in Germany from 13 Oct 2026, and Ledger acknowledged the suspension. Ledger then spot-bought and opened devices from German stores and examined warehouse samples. It says every unit was clean and calls the attack a localized distribution attack, not a systemic one. The German report is therefore directly disputed by the manufacturer. The Southeast Asian operation is confirmed.
Ahold Delhaize first disclosed a security issue on 12 Oct 2026. On 19 Oct it confirmed the cause was 'malicious actions of others'. Websites, apps and e-commerce were taken offline across most European and US brands while stores stayed open. The company says there is no evidence yet of sensitive data theft. It notified the Dutch NCSC and filed a police report; restoration is phased.
At least two Pirha councillors received fraud emails impersonating council chair Jari Andersson that asked for gift cards or money. The case was reported to the cybersecurity centre. No breach is established.
On the night of 11–12 Oct 2026, attackers remotely manipulated internet-exposed refrigeration controllers at hundreds of French supermarkets, causing spoiled stock. Coopérative U confirmed a cyberattack and ANSSI was mobilised. CERT-FR alert CERTFR-2026-ALE-012 reports numerous compromises of Danfoss AK-SM/AK-SC, Copeland xweb and Dixell xweb controllers. The Paris prosecutor opened an investigation and cites about 700 victims. There is no claim and no attribution.
Refrigeration installations at French Intermarché and Coopérative U stores were attacked overnight on 11–12 Oct 2026. Sud Radio, Euronews and SCMP report that Coopérative U's CEO Dominique Schelcher and Intermarché confirmed a cyberattack, and that the Paris prosecutor's office confirmed it too. Store counts vary by source and are attributed to that source: about 80 Coopérative U stores per its CEO, and 150–200 Intermarché stores per media. Third parties name Leclerc, Carrefour and Monoprix, but none of these is confirmed. Three details come only from secondary outlets and remain attributed to them: the forced-defrost mechanism, Danfoss involvement and the ~€270,000 Alsace loss figure. The intrusion route is not public. Incidents in other countries that used the same method are kept as separate records and linked through the campaign field.
At the end of September 2026, PK Softech AG detected a cyberattack in which data of several pension funds, including Publica and PKZH, was exfiltrated. The company filed a criminal complaint and the Federal Prosecutor's Office is investigating. The FDPIC was notified on 8 Oct 2026 and opened a formal investigation on 22 Oct 2026. Publica, the FDPIC and PKZH have confirmed the incident; the full scope of stolen data is still being determined.
Cnam states that on 2 October 2026 a malicious act compromised some of its information systems and caused a data leak. Data of current and former students enrolled within the last 10 years was affected, as was data of teachers in regional centres listed on the Adage platform since 2017. According to Cnam, no banking data was compromised. CNIL was notified, affected persons were informed and an incident-response provider was engaged.
On 8 October 2026 the Italian Foreign Ministry website was reportedly hit by a DDoS attack. Press (Euronews) relays a ministry statement that the attack was contained with no disruption and that embassy and consulate sites were being checked. Pro-Russian NoName057(16) is reported as claimant or suspect; this is unconfirmed. No primary ministry or national-authority publication was reached, so the incident is not marked confirmed; the evidence is a single press-relayed chain.
A ransomware attack on a Vaud security-systems company reportedly leaked sensitive security data of Romandie clients. The data was offered for sale on 25 Sept 2026. This rests on a single press chain.
In a London Stock Exchange filing on 7 October 2026, ASOS confirmed that a third-party customer-communication platform was hacked after customers received rogue 'ASOS hacked' notifications. Later reporting says the breach was wider than first stated and traced it to an employee tricked into giving up credentials. Xuanye Group claimed it.
IQ Dental is a Polish provider of dental-practice management software. It told client clinics that on 1 October 2026, between about 04:00 and 12:00, an intruder got into an administrative account and generated API access to query data for selected clinics. The company found the incident on 5 October during a precautionary review. Data that may have been taken includes patient names, PESEL numbers, addresses and visit data, including free-text notes that may hold health information. A board representative says 36 clinics are affected. The total number of patients was not disclosed. There has been no ransom demand, and no attacker has been named.
The Federal Employment Agency's online services were partly unavailable for several days, so users could not register as unemployed or apply for benefits. BA press release no. 39 of 5 Oct 2026 (the affected organisation) attributes the outage to a technical fault in its own IT systems and rules out a hacker attack. Services have worked normally since the evening of 3 Oct 2026. No source alleges a cyber cause beyond early unconfirmed speculation, so this is recorded as an operational anomaly, not a cyber incident.
RIA's September 2026 report says a DDoS attack hit the TARA state authentication service on 11 September, 11:12–12:15. More than 86 million requests were made, over 100 times normal volume. Over 90% was blocked; the rest caused brief outages and slowness until 11:57.
Misuse of a private company's legitimate CPR access in September 2026 reportedly exposed personal data of about 8.8m people. The irregularity was detected on 2 Oct, access was cut off and police are investigating. Several outlets report this, but they all trace to one official announcement whose primary text was not retrieved.
RIA reports a DDoS campaign in early September 2026 against Estonian websites, mainly in banking, health, energy, transport and water, plus government and party sites. Attack volumes were relatively small. Some sites had short delays, with no significant impact. The attackers cited the 2 September presidential elections and Estonian aid to Ukraine as pretexts. The attackers are not named.
On 11 September 2026 the University of Tartu detected that attackers had gained access to its e-book shop raamatupood.utlib.ee. RIA/CERT-EE's September situation report says customer data was very likely downloaded: names, email, phone, username, encrypted password hash, purchase history and IP addresses. Initial information points to an unpatched vulnerability. The shop was closed until the site is cleaned.
On 29 September 2026 Wakacje.pl, a Polish online travel agency, found that someone had got into some employee mailboxes and its customer-service system without authorisation. Booking data for a small, undisclosed share of customers was exposed: names, emails, phone numbers, home addresses, dates of birth and passport data. Payment systems, Customer Panel logins and current bookings were not affected. The company notified CSIRT NASK and UODO and contacted affected customers individually.
On 1 October 2026 FELG Software sp. z o.o., maker of the FELG Dent cloud dental-practice software, said on its status page that it had been hacked. It said the attacker claimed access to about 10% of the database and was demanding a ransom. A group calling itself 'Horus' claims about 2.4M patient records and 1.2M prescriptions and offers the data for PLN 100,000. FELG confirmed the vulnerabilities that were reported to it and fixed them. It made 2FA mandatory on 2 October and reported the case to the prosecutor and UODO. On 7 October it said it had identified the affected practices and was sending them notifications.
Anonymous claims it stole over 240 GB (323,000+ files) from the Russian-run judicial system in occupied Crimea. The claim is unconfirmed and was relayed via the Crimean Tatar Resource Center.
Innovaatik supplies information systems to dental care providers. It reported that its managed system was repeatedly accessed without authorisation and that patient personal and health data was downloaded. Preliminary information says over 300 Estonian healthcare providers are affected. Police detained a 45-year-old Estonian citizen, formerly associated with the company, as a suspect. According to RIA, the suspect has not misused or passed on the data.
Dodo Pizza confirmed a cyberattack and possible access to some customers' personal and order data, and said the attacker's access was blocked. DataSuckers claimed 2–3 TB of data, which is unverified. Suspects were arrested and a Moscow court placed one under house arrest.
Fakturownia.pl confirmed in an official notice on 29 September 2026 that an unauthorised person accessed its systems on 28 September and copied a large part of the database. The data includes user account data, contractor data, bank account numbers, password hashes, API tokens/keys and invoices. The company says post-2023 invoices, KSeF and card data were not affected. It reported the incident to police, CERT Polska and the data protection authority. The group 'fingerprint' reportedly claimed it.
FTAPI detected a security incident on 14 September 2026. Unauthorised parties accessed one internal server and deployed ransomware. FTAPI isolated the systems, engaged forensics, informed customers and authorities, and filed a criminal complaint. The Gentlemen listed FTAPI on its leak site.
Critical Citrix NetScaler vulnerabilities (CVE-2026-88771 and -88772, which Citrix reportedly says were exploited before a fix) made the patient portals of Amphia (Breda) and ETZ (Tilburg, Waalwijk) unreachable over a weekend. Frisius MC switched off services as a precaution, and the Rijksoverheid took its Citrix environments offline. ETZ had recovered by Monday; Amphia still had problems. The outages look precautionary. The source does not say whether hospital systems were compromised.
Attackers reportedly stole names, national IDs, addresses and contact data from the Medyc system developed by Qbusoft. The company has not confirmed theft of medical records. SQL injection was reportedly exploited in late August and the intrusion detected on 9 September. CBZC is reportedly investigating and UODO announced an inspection, as relayed by two press outlets (treated as one evidence chain; no primary statement reached). The group 'fingerprint', also linked to MyDr and Fakturownia attacks, reportedly claimed it. State is corroborated, not confirmed, as no direct authoritative source was read.
The hotel manager told Yle that the Porvoo hotel was breached through an external booking-related system on the Friday before 28 Sept 2026. Names and phone numbers of possibly hundreds of guests were exposed, and phishing followed. The cause and the vendor are not disclosed.
DIVD confirmed it was hacked and reported the breach to the police, the Autoriteit Persoonsgegevens and the NCSC. It says the modus operandi indicates an agentic AI-powered attack. What data was accessed and the attacker's purpose remain unclear.
On the evening of 24 September 2026, ENEL-MED, a private Polish outpatient medical network, identified unauthorised access to part of its IT infrastructure and to some patient data. It first disclosed the incident on 25 September. The company estimates about 3% of its patient base is affected. It says the attack was quickly detected and stopped, and it notified CBZC, the Centrum e-Zdrowia CSIRT, CERT Polska and UODO. Patients are being notified individually. Upstream reporting says the data taken included patient identifiers (no PESEL), health data and contact data. No attacker has been named.
In February 2026 fraudsters reportedly impersonated senior Intesa Sanpaolo executives (reportedly CEO Carlo Messina) via WhatsApp and induced Fideuram's then-chairman to authorise transfers of about 95M euros, mostly to China and Hong Kong. Reports say about 40M was returned and 13M blocked in Portugal, leaving at least 36M unrecovered. Coverage traces to Corriere della Sera and Reuters citing anonymous sources, so it is a single evidence chain. It is not confirmed because there is no direct authoritative evidence from the bank or a national authority.
A single press report (Tages-Anzeiger) describes a login disruption of the PostFinance app and E-Finance on a Friday morning. No cause is stated and no cyberattack is alleged, so it is recorded as an operational anomaly.
According to Cyberdefence24, Zdrowit S.A. confirmed unauthorised access and encryption of part of its resources. A ransomware group listed the company in early September 2026 and later published a 90+ GB file, which has not been verified as Zdrowit's. The company's confirmation is known only through one press article; no primary statement from the company or a national authority was reviewed, so the state is not confirmed.
The town hall confirmed a cyberattack in the middle of the week before 21 September 2026. It isolated the network, protected its backups, and restored all services by 21 September with help from the Madrid cybersecurity agency, an external IT firm and the Guardia Civil. Press reports describe ransomware that entered via an external provider and say the ransom was refused. The municipality's own statement does not include those details.
On 9 June 2026 the university found unauthorised activity in its Campus Solutions student records platform and took the systems offline. It says an outside party accessed student data, and that some alumni and applicant data may also be affected. The university attributes the attack to exploitation of an Oracle WebLogic remote-code-execution flaw by a cybercriminal group it does not name. The system has been rebuilt, and the university is still verifying the scope of the access.
Unknown attackers accessed LMU's IT systems from 16 September 2026 and copied enrolment master data: names, birth dates and addresses, and possibly IBAN, BAföG and health-insurance data. The systems were isolated and the Bavarian LKA is investigating. LMU has seen no evidence of publication or misuse.
On 17 September 2026 a combined DDoS attack in waves slowed the FreeДом website for hours and took it fully offline for about ten minutes before technical staff resolved it. The channel blames Russian hackers; this is unverified.
London property manager City Relay warned landlords and clients that intruders accessed its Metabase Cloud instance, reportedly twice, linked to an actively exploited Metabase vulnerability. Personal, financial and property-access data may have been taken, including bank details, passwords and key-safe codes. Exposed codes were changed and the company reports no evidence of unauthorised property entry. Evidence is a single press chain relaying the company's client notice, which was not read directly, so the state is corroborated rather than confirmed.
On 16 September 2026, two days before the State Duma elections, a group calling itself CikLeak claimed to have breached CEC infrastructure and its contractor Tsifrotekh (Rostelecom subsidiary, developer of GAS Vybory 2.0). It claims to have taken documents, source code, call recordings, chats, configurations and passwords. iStories says it verified that the leaked archive is authentic. The CEC has neither confirmed nor denied the breach. Evidence state is alleged: no affected-organisation or national-authority confirmation exists, and the outlets repeat a single claim chain (the group's claim and iStories' check).
Around 15 September 2026, Point Vision, a French network of ophthalmology centres, told patients by letter that an unauthorised party accessed data through its external appointment-management provider. The letter, quoted by ZATAZ, Kohen Avocats and Acuité, says names, dates of birth, addresses, email, phone and social security numbers were extracted (ZATAZ omits social security numbers). Appointment reasons and account passwords could not be ruled out. No access to medical-record servers was detected. Trade press names the provider as Alaxione. A seller later offered an Alaxione-attributed file on a criminal forum; those volumes are attributed claims only. A separate Alaxione notification (20 Oct) describes extraction on 27–28 Sept. No public notice from Point Vision or CNIL/ANSSI statement was found.
For about five months Revolut answered fraudulent evidence requests sent from a compromised Italian PEC mailbox (suspected Reggio Calabria prefecture) to Revolut Bank UAB (Lithuania), citing a European Investigation Order. It handed over KYC files, ID scans, selfies, statements and transaction histories, reportedly for about 680 mostly wealthy or crypto-linked customers. Polish customers are among those affected. Revolut notified customers and says its systems and funds were not affected. The actors are reportedly publishing records and demanding ransom.
On 14 September 2026 MEO described a 'mass attack' that degraded its international network. Its technical analysis, reported by DN and RTP, attributes the disruption to DDoS rather than an intrusion. MEO says no customer data was accessed. No actor attribution.
The Belgium-based nonprofit IMO said in its own notice, quoted by the press, that a cyberattack dealt a 'critical blow to aging infrastructure' and took much of its website offline. Fireball reporting was restored first, and several weeks of partial downtime were expected during a move to new infrastructure. The attack date, access method and data impact are undisclosed.
A single ziare.com tag-page headline reports an attack on Friday 11 Sep 2026 on state institution websites including the Presidency. No statement from affected bodies or STISC found. Relationship to the October incident not stated; kept separate.
Batipro, a Luxembourg building materials supplier with about 800 employees, reportedly had all six of its servers targeted in an attack overnight from Saturday to Sunday. The source does not give the exact date. Overtime pay may be slightly delayed. The only evidence is a Luxembourg Times article citing the company and the LCGB union.
A technical/software fault at NATS was reported shortly before 2 p.m. on 8 September 2026 and resolved by 7:30 p.m., causing mass disruption at UK airports. NATS said cyber had been ruled out at that point; an investigation was to follow. No source alleges an attack.
On 7 Sep 2026 CERT.at, relaying CERT Polska, reported large-scale active exploitation of RouterOS vulnerabilities that gives attackers control of devices. Over 100,000 Mikrotik systems are internet-exposed worldwide. Mikrotik has published an advisory with fixes.
On 3 September 2026 Dustin Group confirmed unauthorised access to internal IT systems and temporarily shut some of them down, which disrupted ordering and deliveries. On 14 September FulcrumSec claimed it had published 6.2 TB of data after a ransom went unpaid. This claim is unverified.
Drancy's municipal IT was hit by a major cyberattack in early July 2026, with a ransom demand that the mayor refused. Press reports give 3 July as the detection date. The town worked with ANSSI, rebuilt its network and filed a complaint. The September 2026 municipal magazine confirms the attack, the refused ransom, the long server shutdown and the ongoing investigations, and describes a return to normal as almost assured.
Reports all relaying a single dpa report quote a Fresenius Medical Care statement that unauthorized access to a limited number of internal IT systems occurred in September 2026. The company says patient care, medical devices and production were not affected. ShinyHunters reportedly listed the company on its leak site around 22 Sept 2026 with a 25 Sept deadline; data theft is attributed to the group and unverified.
The company says investigators notified it of a cyberattack on 18 June 2026, and it informed NKI, NAIH and the investigating authority. Data was later leaked and the personal data of two employees is confirmed exposed. The company cannot confirm or deny client data compromise. Rhysida claimed about 2 TB (1.2M files) and demanded about 20 BTC. Reported leak contents include non-public grant-fund, procurement and security documents.
A hacker-forum claim offers a database of 3,134,269 records linked to DZI clients and a Generali-linked dataset of 300,000+ people. DZI warned clients of a possible leak on 28 August 2026 and says it has no evidence that its systems were breached. Press reports say the Bulgarian data protection commission (KZLD) received GDPR Art. 33 notifications (DZI on 3 August, Generali on 11 September) and opened proceedings. Where the data came from, for example an external intermediary, is not verified. No company or authority has confirmed a breach.
MAG confirmed, in a spokesperson statement quoted by ITV News and in emails to about 8.7 million people, that an unauthorised third party obtained customer data (emails, phone numbers, vehicle registrations, postcodes) from car park, lounge and Fast Track bookings and in-airport WiFi sign-ups. A ransom was demanded and not paid. MAG says it contained the risk and informed the relevant authorities, that no bank or payment data was held, and that operations were not disrupted.
A file held by Kolmostien Terveys, with 10,263 identity numbers (about 12,000 people, data from 2016 or earlier), was breached. The breach is dated 24 July 2026 and was disclosed on 27 Aug 2026.
A DDoS attack on the infrastructure of Digdir's IT partner Vivicta ran from 03:38 on 24 August 2026 until about 26–27 August. It disrupted around 10 shared services, including ID-porten. Press reports call it the third DDoS against Digdir since June. There is no attribution.
UK energy minister Michael Shanks (DESNZ) confirmed a cyber incident affecting a small-scale energy generator, first reported by the Sunday Telegraph on 22 Aug 2026. Press reports say the plant was offline for about four days in July 2026 and attribute the attack to Iran-linked actors. The government has not formally attributed it.
The council published a communiqué and update on a cybersecurity incident, stating that data from shared working-document spaces was exfiltrated and published by the responsible group, and that it notified the Guardia Civil, CCN and AEPD. Kairos ransomware listed the council (SOCRadar, 20 Aug); the council does not name the group.
On 18 Aug 2026 ARMA said its servers suffered unauthorised interference with signs of a hacker attack, ahead of the IDS Ukraine asset-manager competition. The SBU is reportedly investigating. Acting head Yaroslava Maksymenko suggested coordinated interference and cited earlier interference since spring, including unauthorised access to the Register of Officials (NABU investigating). Outlets all relay ARMA's statement, so this is one evidence chain. The statement comes from the affected agency, but the primary text was not read directly and no technical confirmation exists; state kept at alleged.
On 18 Aug 2026, ZKB's e-banking, mobile banking and stock-exchange trading were unavailable for several hours and restored before 19:00. ZKB attributes the outage to a technical fault. No source alleges a cyberattack, so this is classed as an operational anomaly. Evidence rests on a single chain (20min.ch); the Blick topic page appears to repeat it.
Data was exfiltrated from two Berlin Senate administrations (Urban Development, Construction and Housing; Mobility, Transport, Climate Protection and Environment) on 7–12 August 2026. They were isolated on 14 August, and the Senate Chancellery announced an ICT incident on 17 August, with BKA, LKA and BSI involved. Rhysida demanded 30 BTC (~€2M). Berlin refused to pay, and on 4 September about 5.7 TB / 1.44 million files were published, including personnel files, passwords and civil-defence and critical-infrastructure documents.
TheGentlemen ransomware group reportedly listed ACLI as a victim on 14 August 2026, per a secondary aggregator relaying Malware News. No statement from ACLI or any authority found; unverified leak-site claim.
Attackers entered the Berlin state network at least a week before it was discovered on 14 August 2026. The Senate says data left the network between 7 and 12 August. The Berlin LKA and the public prosecutor are investigating. The scope of the data and the attacker's motive are unclear.
CSDD disclosed a cyberattack in which hackers accessed payment-receipt data dating back to 2008. The data includes ID numbers, plate numbers, payment amounts and dates, and addresses. CSDD says phone numbers, email addresses and credentials were not affected. A criminal case is open.
The finance ministry/DGFiP acknowledged an intrusion at the end of June 2026 using credentials obtained by identity theft, with taxpayer data (civil status, contact details, tax number, reference income, withholding rate) consulted and extracted; about 678,000 users reported affected. impots.gouv.fr account passwords reportedly not compromised. DGFiP notified the CNIL, filed a complaint, began notifying taxpayers from 17 Aug and announced new security measures on 18 Aug. A forum actor claimed the data.
SaTH states that Beacon, which provides an online CRM system to Shrewsbury and Telford Hospital Charity and the Community Engagement team, reported a data security breach potentially affecting hundreds of organisations. Beacon engaged specialist cyber experts; investigation ongoing. No other SaTH systems affected, no known misuse; affected individuals contacted.
Seekda, a Vienna-based hotel software provider, confirmed a security incident that it detected and contained on 11 Aug 2026. It says no data left its systems after that point and that only individual properties were affected; an external forensic firm confirmed these findings. Guests of affected hotels received convincing phishing messages containing their real booking data and asking for card details or repeat deposits. No ransomware or threat actor has been reported.
Majinahanashi claimed on 12 August 2026 theft of 135,426 files from the Fasano (Brindisi) radiology clinic. Single secondary tracker report; no samples, no clinic statement, no authority confirmation.
A Polish government communique (Joint Cybersecurity Operations Centre) states that MyDr, a software supplier for doctors and healthcare facilities, confirmed unauthorised access to historical practice data up to April 2024. The breach may affect up to 18.8 million people and more than 12,000 facilities. The incident is reportedly limited to MyDr systems. UODO, the Prosecutor's Office, CBZC and the health ministry are coordinating.
A cyber intrusion hit CEVA's European contract logistics operations between about 29 July and 1 August 2026, affecting eight European warehouses. Customer shipping data (names, addresses, contact and order details) of clients including Bol, De Bijenkorf, Valve, Ajax, ING and Ace & Tate was possibly viewed or copied. CEVA's air, ocean, ground and rail transport reportedly continued normally.
A forum post on 11 Aug 2026 claimed an intrusion into Santé publique France. Several press outlets report that the agency itself acknowledged on 13 Aug 2026 an attack on its moncoupon brochure-ordering platform, run by an external provider, exposing contact data (email/postal) of about 80,000 people. The agency's own communiqué was not retrieved, so the acknowledgement is known through press quoting one agency statement (a single evidence chain). Under the step definitions, press quoting an organisation's statement counts as confirmed; the state covers only what the agency acknowledged. The forum claim, the privilege-escalation mechanism and the attribution to a group called ZeroBytes remain attributed and unverified.
Netzwoche reports a cyberattack on Thurcom's webshop, detected on 27 July 2026, that affected 14 number-portability forms. No encryption or data download was reported.
FOITT detected anomalies on its on-premises SharePoint servers on 28 July 2026. On 31 July it confirmed that credentials of about 200 user and technical accounts were compromised. It reset the passwords, blocked external access and is reinstalling the affected servers. Exploitation of SharePoint vulnerabilities is suspected but not officially confirmed. This incident is kept separate from the generic BACS SharePoint phishing wave.
A KVKK breach notification, relayed by Turkish media, says an SQL injection flaw on a Hyundai Türkiye web application was exploited on 1 Aug 2026. Hyundai Group SOC detected it; Hyundai Motor Türkiye and processor Baltaş Eksen began investigating on 3 Aug. Up to 422 employees and job candidates may be affected (names, emails, assessment results, personality inventory data, usernames, passwords, job titles). No customer data accessed.
The group said it was hit by a high-complexity cyberattack, identified on the Friday before 4 Aug 2026, affecting several group companies. Website, email and contact channels were disrupted and gradually restored. The company and regulator ERSAR said there was no indication water supply or quality was affected. PJ and CNCS are investigating.
On 3 Aug 2026 Żabka confirmed to Niebezpiecznik that late in the previous week it had detected unauthorised access to selected technical resources through an external service provider's account. The attacker reached the ticket queue system. Access was blocked and the incident was reported to UODO and law enforcement. Separately, an attacker is advertising allegedly stolen Jira and Git data and credentials for EUR 5,000; this claim is unverified.
In the night to 30 July 2026, unknown actors accessed the VwbP and copied data on about 31,000 legal entities. The Office of Justice took the system offline, and a crisis team led by the Prime Minister and the Justice Minister was convened.
On 2 Aug 2026 the Hungarian State Treasury (Magyar Államkincstár) told Telex that the network of its Agricultural and Rural Development area (National Paying Agency) had suffered a cyberattack. Infected servers were disconnected and some internal users' files were encrypted. The National Cybersecurity Institute is investigating and the data protection authority NAIH was notified. CERT-EU's August 2026 brief records the attack as a breach plus ransomware. The ByteToBreach attribution, the Oracle WebLogic entry vector and the claimed data theft come only from Risky Bulletin, press and researchers. The Treasury has not confirmed them.
The ministry's communiqué of 31 July 2026 acknowledged fraudulent access overnight on 25 July through a hijacked professional account into the staff-training information system. The ministry's security operations center was alerted on 26 July, and external access was suspended. The group ZeroBytes claimed about 43 GB of data. A complaint was filed, and ANSSI and CNIL were notified. A second ministry communiqué followed on 18 August. The ministry pages were seen only as search results, not read in full.
Qilin claimed to have stolen at least 300 GB (about 270,000 files) from Retelit, an Italian telecom and cloud operator, and published a sample including passports. Secondary reports quote a Retelit statement that an attack occurred on 8 June 2026 and was notified to authorities, and that CERT-AGID began warning potentially affected public administrations on 30 July. No primary Retelit or authority publication was reached, so the state stays alleged.
ANP announced on its website on 29 July 2026 a ransomware attack on several workstations and servers. Its IT team contacted DNSC, which intervened, and all equipment was physically isolated. ANP said it would file a complaint with DIICOT. AGERPRES quotes the ANP notice directly. Several services were switched off as a precaution. Press reports link the attack to the ANCPI incident, but no source establishes that link, so the two records stay separate.
The university stated on 29 July 2026 that it had detected improper access to its information systems, which exposed personal and institutional data and some e-mail accounts. RTP quotes CNCS/CERT.PT as saying it was notified on 20 July, that the attack was ransomware with exfiltration (mailbox contents and at least one database), that activity resumed from backups and that the source was blocked. The incident was reported to the Polícia Judiciária and the CNPD. The attack date is not stated beyond 'a few days ago'.
University management stated on 28 July 2026 that a cyberattack hit its IT infrastructure and the digital services used for academic and administrative work. It notified DNSC, ANSPDCP and DIICOT, and technical teams are restoring services gradually.
The town of Šumperk said it was the target of a cyberattack that affected some of its information systems, and the municipal office suspended operations until further notice. Lupa.cz reported this on 28 July 2026, quoting the town's official statement. It says the attack mainly hit internal systems and was not a DDoS attack on the website.
ExfilSquad listed Newcastle University on 26 July 2026 and claimed about 440,000 applicant and student records. Computing, CyberInsider and The Tab report a university statement acknowledging a breach caused by a configuration flaw in a connection to an admissions system, with exposure limited to basic contact details. The record count and any leak are unconfirmed. The state is corroborated, not confirmed, because the university's own statement was not read directly.
The operator's own notice (updated 23 July 2026) confirms a ransomware attack on 21 July 2026 on its IT systems. It runs four primary-care (POZ) facilities in Gryfice and Kołobrzeg counties. Data theft not confirmed but not excluded; UODO and law enforcement notified. Services continued with partial paper-based working.
Attackers took down and defaced Nextcloud's corporate WordPress website, and some visitors were reportedly redirected to a third-party page. Nextcloud first described the outage as an infrastructure problem and later acknowledged an attack. It isolated the server and restored the site from backup on a new server. Downloads, the App Store, updates and customer servers were reported unaffected. The DE country code assumes the company's base.
A cyberattack hit the Wriezen city administration several days before it became public on 19 July 2026. The only evidence is one rbb24 report, which relays the mayor's statement that it was ransomware. It is unknown whether a ransom was demanded.
Metro Mondego, the light-rail and bus operator for the Coimbra area, disclosed a ransomware attack on 6 July 2026 that affected part of its internal systems. It notified CNCS, CNPD and criminal investigators. On 26 July it said personal data of personalised pass holders had probably been copied. Transport operations and payment data were not affected.
An attack on an unnamed IWB service provider led to theft of about 40,000 customer records. IWB says its own systems and energy supply were unaffected. Reports attribute the statements to IWB, but IWB's original release was not found.
Slavia halted app-only season-ticket sales shortly after the 14:00 start, citing a hacker attack (a reported 4.6 million+ requests against the app database). Ticketportal, which runs the ticketing backend, reported no outage on its own platform and said it would refer the matter to criminal investigators. Only one media report (Lupa.cz) was found, and an overload from genuine demand cannot be excluded.
Syadem confirmed that an unauthorised third party accessed and copied personal data from its Carnet de Vaccination Numérique / Colibri platform; it became aware on 15 June 2026. Potentially affected: contact details, civil status, address, social security number where provided, and coded vaccination/health-profile data. Encrypted passwords and bank data not affected; all account holders treated as potentially affected. CNIL notified 15 June 2026 and a complaint filed. Haute-Savoie departmental council (PMI) was informed 22 June and published a notice on 8 July 2026 declaring the incident closed.
The hospital noticed anomalies in its information system on 2 July 2026, identified a cyberattack and says it was contained. Its statement says it is working with CHU Dijon Bourgogne, GHT 21-52, State services, ARS Grand Est and cybersecurity experts to secure and restore its systems. Phone lines stayed operational, and the hospital said it would release no further information.
CERT.lv says the attacker who hit LVM also accessed at least one Olpha server, deleting logs without encrypting anything. CERT.lv describes the two incidents as technically unrelated. Olpha says the attempt failed and that CERT.lv is wrong.
The association reportedly said it was the target of a cyberattack. Emails sent in its name carry an attachment that leads to a fake Microsoft login page. This was reported on 3 July 2026; the onset date is not stated. The association's own statement was not found, and 24ur and Zurnal24 appear to relay the same report.
A cyberattack took Romania's cadastre and land registry agency ANCPI (e-Terra platform) offline from 14 July 2026, halting property transactions. Independent outlets and a CERT-EU threat report (an institutional source, not the victim or a Romanian national authority) describe the outage; ByteToBreach claimed responsibility and offered allegedly stolen data. No primary ANCPI or DNSC statement was read directly, so the state is corroborated rather than confirmed. Attribution remains unverified.
The University of Alicante reported a cyberattack on 2 July 2026 that hit one of its virtualisation nodes. By 23 July it said about 95% of the environment was operational. Both sources are the university's own news site, so they form a single primary evidence chain.
A forum poster called 'Saturne' claims to hold a database of 30,728 people from FHF.fr (names, phone numbers, professional emails). A single breach-tracker listing relays the claim. No statement from FHF, CNIL or ANSSI was found, and the data's origin and authenticity are unconfirmed.
A cyberattack on LVM's IT infrastructure was detected around 22 June 2026, and the Prime Minister convened ministries on 25 June. LVM and the PM's office acknowledged the incident. A financially motivated ransomware group reportedly claimed it and leaked about 44 GB, and State Police opened a criminal case. Timber deliveries resumed on 26 June and returned to full volume on 1 July. The LVM GEO app came back in late July.
HCL reportedly said on 25 June 2026 that a cyberattack hit one of its unnamed providers; a database from a 2020 migration containing HCL professionals' data may have been stolen. Evidence is two local press reports relaying the same HCL communication (one chain); no primary HCL, CNIL or ANSSI document was verified, so the state is not upgraded to confirmed.
Traficom NCSC-FI says the global FortiBleed campaign, revealed in June 2026, used leaked or stolen credentials against FortiGate firewalls and SSL-VPN devices. In Finland a few attacks were observed and data of about twenty targets was compromised, with moderate impact. The victims are unnamed, so this is kept as one national record.
According to Delfi as relayed by TV3 (19 June 2026), criminals compromised tens of thousands of Fortinet firewalls and VPNs worldwide using automated scanning and previously leaked credentials. Fourteen organisations with devices in Lithuania were listed, including Telia and the state body VTPSI. Telia says it found possible risk signs at two Telia-managed customers, fixed them, and reports no data leaked. VTPSI has not been quoted. No primary statement from a national authority (e.g. NKSC) or VTPSI was found, so the Lithuanian impact rests on one press chain.
Worldwide 'FortiBleed' campaign harvesting credentials from FortiGate appliances. Fortinet PSIRT confirmed it on 19 June 2026 and attributes it to credentials reused from earlier incidents plus brute force. CERT.at warned Austrian operators, and CISA and the UK NCSC issued advisories. No individual victim organisation or Austrian victim has been verified.
V-Bank in Munich says personal data of customers and business partners was taken in a cyberattack on an external cloud IT service provider. The bank says its own infrastructure, core systems and accounts were not accessed and no funds left. It says publication of the data cannot be ruled out, warns of phishing and has switched off its end-customer app as a precaution. Forensics are ongoing.
On 11 June 2026 Novo Nordisk disclosed unauthorised access to a limited number of internal IT systems. Certain non-public data, including personal data of clinical trial participants and healthcare professionals, was copied externally. The company brought in external experts and took several systems offline as a precaution. It reports core operations unaffected. Ingeniøren reports that the company notified Datatilsynet.
A database allegedly covering about 4.9M customers of Wise's Spanish subsidiary was reportedly offered for sale on a forum and surfaced via Hackmanac. It reportedly holds date of birth, gender, DNI, phone, email and location. Wise has not confirmed, the data has not been independently verified, and it is unclear whether all records are Spanish. Single media report.
Social media users claimed that the e-Devlet portal was hit by a cyberattack and crashed. The Presidency's Disinformation Combating Centre denied any attack, breach or systemic crash and attributed the disruption to heavy user load. No independent evidence of an attack was found.
The hospital ran in emergency mode for several hours and ambulances were diverted. The hospital denies any virus or cyberattack and attributes the outage to a hardware fault. Only one press source was found, with no authority or vendor evidence of a cyber cause, so it is kept as an operational anomaly.
Powys County Council stated that personal data of pupils, staff and others at one school was accessed without authorisation. The access was first identified in April 2026 and contained quickly. The investigation was ongoing at disclosure on 4 June 2026, and no disruption to education was reported.
Lapsus$ claims to hold about 180 GB of Ingka Group data, including source code, architecture documents and logistics material. The company says it is aware of the claim and investigating, but has not confirmed a breach. The press reports all repeat the same claim, so they form one evidence chain. Primary country NL is an assumption because the sources do not state Ingka's HQ; operations span many countries.
A threat actor using the name 'spain' claims to be selling a 109.8 GB Iberdrola customer database with over 7 million records; Hackmanac flagged the listing around 2 June 2026. The claim is repeated only in trade press and threat-intel posts, with no confirmation from Iberdrola or a Spanish authority. Authenticity is unverified. The Zirconite partner leak and the 2022 and 2024 breaches are separate incidents.
Threat actor Skull1172/EsqueleSquad claims to have exfiltrated about 13 GB and 19M records, including biometric photos and DNI numbers, from Spain's DGP. The actor also claims to have compromised FTP, an admin panel, a database, a VPS and a domain. Only one press report (Escudo Digital) relays the claim, and no police or Interior Ministry response was found.
Threat-monitoring platforms raised an alert on 11 May 2026 about possible exposure of 27,629 guest files linked to Lopesan properties in Meloneras/Maspalomas. Whether the central system was accessed is not clarified. Only one secondary report was found, with no confirmation from Lopesan or a Spanish authority.
On 27 May 2026 Incransom posted a leak-site claim of 100 GB exfiltrated and systems encrypted at the Romanian gas distributor. A single secondary source (a consultancy blog) reports it. No company or national authority statement was found.
On 24 May 2026 the ministry's web portal showed a nationalist message and then went offline. Subpages linked to the 'INF Grupa' Telegram channel. The ministry says the vandalism was limited to the website, databases were not exposed, and the cause was a lost password. Service was restored.
Lithuanian authorities reportedly disclosed a leak of over 600,000 national register entries, mainly real estate and legal entity records, and suspect foreign state involvement; no actor officially named. Evidence is a CERT-EU brief plus AP-derived press quoting officials (one underlying chain). Primary statements from the registers operator or Lithuanian authorities were not read directly, so the state is corroborated, not confirmed.
Attack mid-April 2026 on Saarland billing provider; patient data of self-paying patients stolen from many clinics; encryption prevented per Unimed.
On 19 May 2026 the Lamashtu ransomware group listed Austrian pipe-fitting manufacturer ROTH-TECHNIK AUSTRIA on its leak site, as relayed by a single aggregator (dexpose.io). No victim or authority confirmation was found.
On 19 May 2026 Rhysida listed Stuttgart on its leak site, claiming it had copied sensitive documents, with a seven-day countdown. Heise and Borncity relayed the claim and the city said it was investigating. Neither the city nor any authority has confirmed a breach.
On 18 May 2026 the Akira ransomware group listed UK tyre retreader Vacu-Lug, threatening to publish 40GB of data. The only source is a single leak-site tracker report. There is no company or authority confirmation.
Arwini discovered a cyberattack on 4 May 2026 and shut down its systems. Hannover police confirmed to heise that data was exfiltrated and that the 'Kairos' ransomware group is responsible. Kairos has listed a 2.87 TB data set on its leak site since 11 May. Arwini puts the worst case at about 75,000 records, while media report 70,000–80,000. The record counts and the authenticity of the leaked samples are unverified.
On 18 May 2026 the SafePay ransomware group claimed an attack on UK print service provider Printroom. The only evidence is the leak-site claim as reported by dexpose.io. No victim or authority confirmation was found.
Salt's fixed network failed for about 40 minutes from around 19:00 on 15 May 2026. Netzwoche, citing Le Temps, attributes it to a DDoS attack.
The group was informed on 14 May 2026 of a security incident on its booking platform 'La France du Nord au Sud' (Maeva), with about 1.6 million booking records leaked. On 15 May it announced a complaint and CNIL notification. A hacker and a leak tracker claim 4–4.5 million people are affected.
On 14 May 2026 the actor shadowbyt3$ claimed an attack on UK technology consultancy Amplify Technology, saying it stole 1.69GB of data. The only evidence is a leak-site aggregator listing.
A single local-press report (apd.cat) says artificial traffic, described as a DDoS attack, slowed internal editing at two local newspapers. The text gives the start as 25 March without a year. A complaint was reportedly filed with the Mossos d'Esquadra. Reader access was reportedly unaffected, and the publisher says no data was compromised.
The council detected an incident affecting its servers on 5 May 2026. Online procedures went down and staff switched to manual paper registration. Around 11 May the Kairos group claimed the attack and alleged it stole 1.8TB of data, including police reports and municipal documents. The council has not confirmed the volume or nature of the data.
The Krybit ransomware group listed the Spanish management firm Eclagestió 360 as a victim on 9 May 2026. The only source is a leak-tracker post (dexpose.io); neither the organisation nor any authority has confirmed it.
On 7 May 2026 the Akira ransomware group listed Hamburg-based Grau GmbH, claiming 19GB of data. Only a threat-intelligence aggregator (dexpose.io) reports it.
A cyberattack on 30 April 2026 restricted capacity at about 20 Groupe 3R radiology centres in western Switzerland. The company confirmed data theft and encryption and refuses to pay. Akira listed the victim in early May 2026. A similar incident hit the group in April 2025.
The municipal IT system was hit on 3 May 2026. The town hall communicated on 5 May, services were disrupted and an investigation is ongoing. The Qilin attribution rests on a RansomLook listing cited by IT-Connect. 'Active' is the last reported status, not a current check.
Ransomware reportedly encrypted part of the municipal office's data on 4 May 2026. UODO and CSIRT NASK were reportedly notified, and personal data such as PESEL numbers may have been accessed. A single CyberDefence24 article is the only source.
Cyfrowy Polsat notified customers by email, SMS and a website notice of unauthorised access to personal data of part of its subscribers. It informed UODO and law enforcement, and a spokesperson confirmed the access to money.pl. Media report that PESEL and ID data were exposed. The company says its systems themselves were not breached.
The municipality itself reported that personal data (name, address, BSN) of almost all residents was stolen in a cyberattack in March 2026. About 600,000 files were taken (one source says 552,000), including 845 copies of ID documents. This is backed by the municipality's own letter and its June 2026 evaluation report.
On 20 April 2026 UK Biobank told the UK Government that de-identified participant data had been listed on Alibaba e-commerce platforms. There were three listings, and at least one appeared to cover all 500,000 volunteers. The listings were removed, and the vendor believes nothing was sold. Access was revoked for the three source research institutions, the Research Analysis Platform (UKB-RAP) has been suspended since April, and UK Biobank referred itself to the ICO. On 23 Oct 2026 UK Biobank said the platform is secure and that a phased reopening awaits approval.
ANTS (France Titres) detected unauthorised access to personal data of ants.gouv.fr accounts on 15 April 2026. The Interior Ministry and info.gouv.fr acknowledged the incident, saying about 11.7 million accounts may be concerned. CNIL was notified under GDPR Art. 33 and the Paris prosecutor opened a case. A parliamentary answer reportedly attributes the breach to a 15-year-old.
Suspicious activity was found on 16 April 2026 and municipal servers were taken offline in consultation with CCB. Remote-viewing software was found. VRT first reported a possible hack and data leak on 19 April. On 21 April the municipality said there was no cyberattack and no data leak. Services were restored by about 23 April. The hack claim is disputed by the affected organisation and not independently confirmed.
Inditex confirmed unauthorised access to its databases hosted by a former technology provider. The company links it to a supplier breach that affected several international companies. Its statement was relayed by multiple outlets and Reuters, and was first reported by La Voz de Galicia.
Both municipalities were hit by an IT attack on Thursday 9 April 2026. Dorotea went into staff (crisis) mode, and Vilhelmina posted rolling updates. CERT-SE reported the attack and cited both municipalities' announcements. Secondary sources attribute it to INC Ransom, but this is unverified.
ChipSoft, the Dutch supplier of the HiX electronic patient record system, suffered a ransomware attack, publicly reported from 7-8 April 2026, and took systems offline. On 16 April it told customers that patient data had been stolen. The Dutch data protection authority (AP) reportedly received 66 breach notifications. ChipSoft later reportedly said the stolen data was destroyed and not published.
The Education Authority said the C2k school IT system, managed by Capita, was hit by a cyber attack. Access was suspended and every password was reset. Restoration began with post-primary schools by 6 April, and the system was reported largely restored by about 17 April 2026. A 15 April EA update, seen only as a search snippet, reportedly says some personal data at a small number of schools was probably compromised and that a 16-year-old was arrested. Neither point is verified from the full text.
On 8 April 2026 there was unauthorised access to Basic-Fit's club-visit system. Monitoring detected it and stopped it within minutes, but some data had already been downloaded. Basic-Fit disclosed the breach around 13 April and, per press reports, notified the Dutch Data Protection Authority and emailed affected members. About 200,000 members are reported affected in the Netherlands. Total estimates range from about 1 million to over 4.5 million in Spain, France and Germany alone.
A threat actor claims to have extracted 4.3 million user records from Centauro Rent a Car and published a sample on the dark web. The Catalan data protection authority (APD) reported the claim and said it contacted the company. No confirmation from the company was found.
The clinic was attacked in the night to 22 Feb 2026. The state criminal police of Mecklenburg-Vorpommern (LKA MV) and the state data protection commissioner (LfDI MV) say the perpetrators are using stolen patient data to extort former patients by email. The LKA is investigating with international partners. Recovery status was not verified.
The Commission detected unauthorised access on 24 March 2026 to the AWS-hosted cloud infrastructure behind Europa.eu and disclosed it on 27 March. The compromised AWS secret was secured. CERT-EU links the attack to the Trivy supply-chain compromise, and ShinyHunters claimed it. Data from about 29–30 EU entities was affected, and the investigation is ongoing.
After a cyberattack the port operates without IT, with pen and paper; reported 27 March 2026.
Die Linke detected a serious compromise of its IT around 26–27 March 2026. It took parts of its IT offline, filed a criminal complaint and cited indications of Qilin ransomware. Qilin listed the party on its leak site around 1 April and threatened publication. The party says its member database was unaffected, but party-apparatus data and federal office staff data were affected.
Local press reports that a cyberattack paralysed the hospital's terminals, databases and SovraCup booking system for hours. The hospital reportedly activated its cyber security plan, moved operations to the cloud from backups, filed a complaint with the Polizia Postale and informed the Garante. Care continued. The exact onset date is not established.
Unauthorised access to part of the Ministry of Finance ICT systems was discovered on 19 March 2026. On 23 March systems, including the treasury banking portal used by about 1,600 public institutions, were taken offline as a precaution. The Minister reported the incident to Parliament on 30 March. A report was filed with police (Team High Tech Crime) and the Data Protection Authority was informed. A June 2026 update said the perpetrator was not identified, data was probably taken, and all systems were back online. Tax collection and benefit payments were not affected.
CERT-FR alert CERTFR-2026-ALE-003 (20 Mar 2026) reports a surge of account-takeover campaigns on Signal and WhatsApp. Attackers use QR-code device linking and requests for PIN or verification codes. No vulnerability is exploited and no victims are named.
La Mutuelle Familiale said in its own press release of 20 March 2026 that it discovered a cybersecurity incident on 17 March 2026. Reimbursements, third-party payment, the phone platform, the member area and the app were temporarily unavailable. The impact on data was still under investigation, and the authorities were notified.
The municipal IT of Matten bei Interlaken was reportedly targeted by a cyberattack over the weekend of 14–15 March 2026. Some data were reportedly encrypted and then fully restored. Residents registry, finance and case-management systems were reportedly unaffected. Kantonspolizei Bern was informed and a complaint against persons unknown filed. The council says no data were exfiltrated (preliminary). Evidence is a single chain relaying the municipality's announcement; the primary notice was not directly verified.
Telekom Srbija stated on 17 March 2026 that a smaller part of its m:SAT TV customer database was stolen and the perpetrators attempted extortion. The Belgrade Higher Public Prosecutor's high-tech crime unit is investigating; the data protection Commissioner opened a procedure. Scale varies: ~150,000 users (company) vs 338,934 distinct ID numbers (Share Foundation, second-hand).
On 17 March 2026 the MGA said publicly that it had found a breach in one of its systems and activated response protocols. Early indications pointed to an individual posing as a security researcher. Berlin-based researcher Lilith Wittmann claimed responsibility and alleged that the regulator enables organised crime. On 20 March the MGA called the hack unacceptable and rejected the allegations as unsubstantiated. The MGA has not confirmed what data was accessed or the attack vector.
CGI Sverige acknowledged an incident on 12 March 2026 after the actor ByteToBreach leaked source code and credentials for Sweden's e-government platform. CGI says two internal test servers were affected and an older application version and its source code were accessed. It reports no evidence of impact on production data or services. The minister reportedly confirmed the leak, and CERT-SE and the National Cyber Security Centre are assessing it.
On 12 March 2026 AiLock listed England Hockey on its leak site and claimed 129GB of stolen data. Press reports quote England Hockey as saying it is aware of an incident and is investigating it as a priority. It has not confirmed ransomware, data theft or the attackers' claims. The press coverage traces back to the same leak-site claim and the same organisational statement, so it counts as one evidence chain. The organisation's own statement was not retrieved directly.
NCBJ announced an attempted cyberattack on its IT infrastructure, reported on 12 March 2026. Polish authorities said it was blocked and system integrity was not compromised. The MARIA research reactor and research operations continued normally. Iran-linked indicators were reported, but attribution is unconfirmed and possibly a false flag.
The Parliament of Albania stated that around 9 p.m. on 9 March 2026 it detected unauthorised access to its IT infrastructure, and that data in several administration staff accounts was deleted. The main infrastructure and the website were not affected. Iran-linked Homeland Justice claimed the attack on Telegram. The Parliament has not attributed it.
Around 10:00 on 9 March 2026 Oschadbank said its security systems had detected signs of a possible DDoS attack. As a precaution it switched off its servers and online services. Services were reported restored the same day, at about 16:40. The bank reported no compromise of client data or funds. The DDoS cause is only suspected.
Ransomware reportedly hit the hospital's IT on the night of 7/8 March 2026. Part of the data was encrypted and access blocked, and staff moved to paper-based emergency procedures. Several national outlets quote the hospital's own statement and report a prosecutor's investigation and Defence Minister support with soldiers. No primary page from the hospital, CSIRT or prosecutor was read directly, so the state is corroborated, not confirmed. The RA World attribution is secondary only and unverified.
The mall announced on 6 March 2026 that an unauthorised party accessed a database of Westfield Club loyalty members and newsletter subscribers. It reported the incident to data protection authorities and warned members about phishing. Evidence is a single chain: two media reports relaying the mall's own announcement, which was not read directly, so no primary document was verified.
On 28 Feb 2026 BACS warned of extortion emails falsely claiming possession of personal data. The sender addresses are spoofed. The campaign is confirmed but the claimed data compromise is not.
A threat actor (reported under the alias 84City) posted a data sample and claimed about 400,000 supporter records. OM issued an official statement on 24 Feb 2026 acknowledging an attempted cyberattack that it says was contained, and said it would notify the CNIL and file a complaint. The occurrence of an intrusion attempt is confirmed by the organisation. The scale of any data exposure is not independently verified.
The NBU numismatic online shop went offline on 19 Feb 2026 after a cyber attack on the contractor that runs it. Customer contact data may have been accessed, but NBU reportedly says payment card data was not. Operation resumed, as reported on 8 Mar 2026. The NBU statement was not read directly on a primary NBU page, so the state is corroborated, not confirmed.
The webumenia.sk website reportedly faced hacker attacks in the days before 19 Feb 2026, and service has been restored. SNG says the CEDVU database and cultural heritage were not affected; an MP disputes this.
From midday on 17 Feb 2026, a targeted DDoS attack in waves disrupted DB connection search, ticket display and booking on bahn.de and DB Navigator. DB confirmed the attack on its newsblog, and BSI head Claudia Plattner called it unusually large. DB said its defences held. Attribution is officially unresolved; media point to pro-Russian actors.
DGFiP's press release of 18 Feb 2026 confirms illegitimate access to the FICOBA national bank account file. The actor used stolen credentials of a civil servant and was active from 28 Jan until 13 Feb 2026, when the access was detected and cut. About 1.2 million accounts are concerned (civil status, address, bank details). CNIL was notified, a complaint was filed and ANSSI is involved.
Odido said criminals gained unauthorised access over the weekend of 7–8 Feb 2026 and downloaded customer data on about 6.2 million accounts. The data included names, addresses, contact details, IBANs, birth dates and ID document numbers. ShinyHunters claimed the attack and demanded a ransom, which Odido refused to pay. The group published about 680,000 records by 26 Feb and reportedly the full set later. Dutch prosecutors are investigating.
The municipality's own notice of 10 Feb 2026 says ransomware hit its IT infrastructure on 9 Feb 2026, encrypting part of the server data and paralysing its IT systems. The servers were cut from the network. The incident was reported to the Police, CSIRT NASK and UODO, and restoration from backups is under way. The municipality assesses a high risk that residents' personal data was exfiltrated; this is its own assessment, not independently verified.
Conpet, Romania's national oil pipeline operator, disclosed a cyberattack detected on 3 February 2026. It affected corporate IT and the company website. Qilin claimed the attack, and Conpet later confirmed that data was stolen. Pipeline operational systems were reportedly unaffected.
A breach was detected on 30 January 2026 in the state mobile device management service run by Valtori. An unpatched vulnerability in commercial vendor software was exploited. Names, phone numbers, work emails and device information of up to about 50,000 state employees may have been exposed. KRP is investigating it as an aggravated data breach, and Yle reported an espionage angle.
The actor 'HaciendaSec' claimed to hold and sell personal and tax data on about 47 million people; the claim was first flagged by Hackmanac. Ministry spokespeople said no trace of an incident or unauthorised access had been found, and checks continued. No independent technical verification of the data was found.
ZATAZ roundup of 30 January 2026 mentions cyberattacks on Dresden museums: ticketing down, cash-only payments, artworks safe. Headline-level only; onset unknown and exact museum operator not named.
On 29 January 2026 the municipal IT services of Bourg-Achard (Eure) were hit by a cyberattack; the mayor acknowledged a data leak. A contractor reinforced security; CNIL, the gendarmerie and ANSSI/Normandie Cyber were informed; residents were warned about fraudulent calls, SMS and emails.
An external attack on 22 January 2026 encrypted the local SQL database behind the payroll and online-order software. It was detected on 23 January. The company notified KVKK, which published the notification on 27 January 2026 (Board decision 2026/141).
CTIE confirmed to Paperjam that a DDoS attack made websites on the *.public.lu domain unavailable 07:58-08:39 on 20 January 2026 (41 minutes). CTIE said such attacks do not aim to compromise data; origin and scale undisclosed.
On 21 Jan 2026 CERT.at reported growing but unverified user reports of a new exploitation wave against CVE-2025-59718, including on already-patched Fortinet devices. No victim organisations are named.
Around 21 January 2026 Waltio disclosed a data breach and extortion attempt. It said the intrusion was no longer active and services were normal, and it notified the CNIL and filed a complaint. ShinyHunters is reported as the extorting actor.
From 15 January 2026 the Heinsberg city administration was unreachable by phone and email. Press reports relay a city statement describing a technical fault probably ('wohl') caused by a cyberattack; ZAC NRW is reported to be investigating. The city has not been shown to state definitively that a cyberattack occurred, and no primary statement was retrieved, so the state is held at alleged. No attacker claim or recovery information found.
Cyberattack on the Hénin-Carvin agglomeration around 11 January 2026; messaging and digital tools were shut down as a precaution. Whether data was stolen was undetermined at last report. Two sources (LeMagIT press roundup and a Senate written question relaying that the agglomeration confirmed an IT intrusion) report it, but neither is a direct statement from the organisation or a national authority.
Sinobi ransomware group listed UK publisher Merit Group plc as a victim on 14 January 2026 and threatened to publish data. Only threat-intelligence aggregators repeat the leak-site claim; no statement from Merit Group or a UK authority was found.
On 13 January 2026 both AZ Monica campuses (Antwerp, Deurne) were hit by a cyberattack and servers were shut down as a precaution. The Antwerp prosecutor confirmed a cyberattack and the federal computer crime unit is investigating. The hospital describes ransomware; the prosecutor says no ransom was demanded, though a message was left that the hospital did not answer.
The FFT announced on 12 January 2026, including by email to licensees, that a platform used by tennis clubs had been accessed without authorisation. Press reports (KultureGeek, Mac4ever, Next.ink) quote or relay that announcement and say names, postal and email addresses and phone numbers were taken. The outlets repeat one FFT announcement, so they count as one evidence chain. The state is confirmed because the organisation's own statement is relayed. The FFT's original communiqué was not retrieved. The 1.2 million licensee figure comes from press and is not an FFT-stated figure. The incident is part of a wider wave of French sports-federation breaches.
On Saturday 10 January 2026 around 22:00, 16 sirens in Halle (Saale) sounded for about 10 minutes with an English 'active shooter' message. On 12 January the city said it had not triggered the alarm and assumed an external cyberattack; police confirmed unauthorised access and are investigating, with the state criminal police reportedly leading.
Interlock ransomware group claimed on 6 January 2026 an attack on UK aerospace component maker Aero Fabrications, alleging all data was leaked. The only evidence is the group's claim relayed by a leak-monitoring site (a single evidence chain). No statement from the company or a national authority was found, so the incident is not confirmed and remains an attacker claim.
On 5 Jan 2026 CERT.at, the Austrian national CSIRT, stated that the 2020 Fortinet 2FA-bypass flaw CVE-2020-12812 is being actively exploited. Shadowserver counts about 10,000 vulnerable systems worldwide and more than 100 in Austria. No named victim or confirmed Austrian compromise.
On 10 January 2026, around 22:00-23:00, the settings of boiler RK1 (1000 kW) at the Ruciane-Nida heating plant were changed. Press reports quote the operator as seeing no pressure or temperature change and no customer impact. Reported to police and CERT Polska; the Olsztyn regional prosecutor is reported to be investigating unauthorised access. Pro-Russian attribution is reported but not confirmed.
On the night to Monday 2 Nov 2026, unknown perpetrators manipulated the remote cooling controls of a butcher's cold rooms, setting temperatures as high as 150°C. Damage is in the five figures and control has been regained. Any link to the wider wave is unconfirmed.
The threat actor 'dejavu' reportedly leaked data on more than 7 million Civilim.com customers and about 2,500 employee files, according to a VECERT post repeated by Turkish tech outlets. Neither the company nor an authority has confirmed it.
InformNapalm claims that interception and influence operations against a Russian volunteer air-defence unit came before the loss of a Su-57 near Moscow on 23 July 2026. Russian media blamed a technical fault. The claim is unverified and comes from one source (Militarnyi repeating InformNapalm).
The ransomware group Coinbase Cartel claimed an attack on ASTM Group on 18 April 2026 and threatened to leak data. The claim rests on a single tracker post (DeXpose). ASTM and Italian authorities have not confirmed it.
The council website was unavailable for much of the morning of 9 June 2026 (Gateway Timeout). NoName057(16) claimed a DDoS on Telegram. The council confirmed the outage but declined to comment on whether it was a cyber attack.
Press reports say the Slovenian motorway company Dars detected and prevented a cyber attack on 3 Feb 2026 and notified SI-CERT, with no disruption to operations. No method, system or attacker is stated.
Lørenskog municipality confirms a serious data attack. An employee downloaded malware on 7 Apr 2026; the attackers moved to servers on 22 Apr and attacked on 8 May, and the attack was discovered on 9 May. About 1.3 million files were stolen and published on the dark web. Datatilsynet, the police and NSM were notified, and Kripos and NSM assisted.
AP-HP says it learned on 24 Sept 2026 that data from meal management software it uses was being offered for sale. It confirmed the theft of identity data for 1,015 patients. A forum seller claims a larger volume, which is unverified.
A cyberattack on 28 June 2026 hit GSW, the municipal utility for Kamen, Bönen and Bergkamen. Internal systems and the customer portal were taken offline as a precaution, and phone and e-mail were disrupted. The state criminal police (LKA) is reportedly investigating. Trade press reports attackers accessed customer data. Systems were later reported returning gradually to operation. Evidence rests on consistent trade-press reporting relaying company and police information; no primary statement was read directly, so not marked confirmed.
Gozo Channel, the Malta–Gozo ferry operator, reportedly suffered a cyber attack on certain IT systems in early February 2026. Ferry operations were reported unaffected while teams restored administrative systems. The attacker, the method and any data theft are not stated.
On 4 January 2026 the primary and backup radio communications at Athens area control failed, grounding about 120 flights. Authorities said a cyberattack was unlikely and sabotage was ruled out. A committee report pointed to ageing equipment, but the exact cause is unclear. Recorded as an operational anomaly, not a cyber incident. Assessment relies on the collected sources; no new primary search was run.
HSE email and internet systems were down for several hours on 4 June 2026. A single report in The Journal, citing an unnamed source, links the outage to ransomware at a third-party data holder. The HSE denies a cyber cause and attributes the outage to a networking problem.
A major IT incident at La Hague town hall (Manche) was noticed on 13 January 2026, per press roundups. Cause, attack type and impact not stated; no primary statement found.
LockBit 5 listed Defcon 5 Italy (defcon5italy.com) on its leak site around 6 April 2026 and threatened to publish data. Only ransomware-tracker aggregators relay the claim, and the victim and Italian authorities have not confirmed it.
Maileva, a La Poste service, shut down its services as a precaution on 23 September 2026 after unauthorised access attempts. A cybercriminal reportedly tried to use the platform to send mail illegitimately. No personal-data leak announced; a complaint was filed. Source is a weekly press review citing frenchbreaches.com.
On 3 May 2026 Optimed detected unauthorised access to part of its IT infrastructure and isolated its systems. A data sample was reportedly published on the darknet, and PESEL numbers and lab results may have been accessed. Press reports say UODO and law enforcement were notified. Optimed blames Belarusian cybercriminals, but other outlets dispute or soften that attribution. Several Polish outlets relay the company's statements, but no primary document from Optimed or an authority was reviewed, so the state is corroborated, not confirmed.
Nationwide Orange/Sosh mobile outage from about 11:20 to just after 21:00 on 21 Oct 2026, affecting up to 21.6m customers. Orange attributed it to equipment failure and reportedly ruled out a cyberattack. Recorded as an operational anomaly, not a cyber incident.
After a CERT Brandenburg warning about an attack on firewalls, the city shut down its administrative network as a precaution from Thursday 18:00 (reported 18 June 2026). Citizen services became phone-only and the Bürgeramt consultation hour was cancelled. The city says that, as far as it knows, its own network was not compromised. No link to the Fortinet campaign is stated in the sources. No reinstatement has been reported.
The commune reportedly took its website offline on 28 July 2026. The cause is attributed to an attack on its web host. The only source is a single AI-written article, and no statement from the commune or a French authority was reviewed, so the cyber cause is unverified. The same article mentions data claims about Allo.Solar and Supreme Body; these are excluded because a shared-host link is unproven.
Italian trade and national outlets report a cyberattack on Sapienza University of Rome from about 2 February 2026. Press quote a university statement, from prorector Leonardo Querzoni, acknowledging the attack. Under the evidence rules, a newspaper quoting the organisation's statement counts as confirmation, so the incident is confirmed. No primary university or authority page was retrieved directly. The following details are attributed by press only and are not confirmed by the university: ransomware, the Bablock/Rorschach family, the Femwar02 signature, the 72-hour ransom ultimatum, and ACN and Postal Police involvement. The outlets may share one underlying report.
The administration and utility works of the Verbandsgemeinde were reportedly hit by ransomware on 16 April 2026. Systems were taken offline, the administration closed on 21 April, and an emergency registry operation was planned for 22 April. BSI-certified forensics are under way. No recovery information has been found.
Second-wave attack of about 2 Nov 2026 on Belgian retail refrigeration controls (also reported in Luxembourg). Evidence is secondary press largely repeating one underlying report (Euronews via trans.info); no direct Delhaize or authority statement retrieved, so kept as alleged. Kept separate from the Ahold Delhaize Netherlands incident of 11 Oct.
Cooling at an Edeka store in Reisbach (Bavaria) reportedly rose to about 50 °C overnight to 2 Nov 2026. Further cases were reported in NRW, Lower Saxony and Rhineland-Palatinate. The cyber cause is unconfirmed and the attribution is unsupported.
On the evening of 6 April 2026 a mass outage hit Russian online services. Rostelecom attributed it to a powerful DDoS attack, but Roskomnadzor attributed it to a backbone network failure. The outage is reported, but the cyber cause rests only on the operator's statement and the regulator contests it. No attacker has been named.
On 16 September 2026 an outage at SMIT affected the 112 emergency service and state registers. The Estonian Information System Authority (RIA) attributes it to a configuration error during planned maintenance, not a cyberattack. Recorded as an operational anomaly, not a cyber incident.
Press reports that Radenza Group confirmed an attack on the frozen-goods refrigeration telecontrol in four Coop stores in Sicily (Catania and Palermo) around 2 Nov 2026. There is no primary company or authority statement.
The ministry partially closed its electronic office from 3 Feb 2026, citing a technical incident, suspended procedures and extended deadlines. Threat actor 'GordonFreeman' claims access via IDOR or leaked credentials and the sale of student and citizen data; this is unverified. Press reports of a ministry-acknowledged limited hack are secondary and not backed by a primary statement. Kept separate from the Hacienda claim.
A hacker attack on 18 June 2026 reportedly made the theatre's email, telephone, server data and backups inaccessible. Performances continue with analogue workarounds. Regional outlets report it quoting theatre statements (one underlying chain), and a ransomware tracker listing also names the theatre (attacker claim only). No direct authoritative publication was reached, so the incident is corroborated but not confirmed.
The municipal utility's central IT network was reportedly encrypted overnight around 1 September 2026. OT was reportedly separate, so supply continued. Emergency protocols were activated and external forensic experts engaged. No group named and no data exfiltration confirmed. Rated corroborated, not confirmed: several outlets report it but they appear to trace to one utility statement not directly verified. No recovery information found as of last check.
A third-party status aggregator log (isdown.app), apparently mirroring Sucuri's status updates, describes sustained DDoS traffic against Sucuri infrastructure in the Paris, Frankfurt and London regions from 2 April 2026. The traffic caused packet loss and latency and was marked resolved on 6 April. Sucuri's own country is not stated, so the primary country is set by the first affected region.
Media report that at around 2 a.m. on 2 Nov 2026, refrigeration devices outside the central network were manipulated in 23 ICA stores and reportedly 6–7 Coop stores, pushing freezers up to 50°C. Whether the companies confirmed a cyberattack is contested in the coverage.
Three Association of Independent Meat Suppliers members and Langridge Organic had fridges put into defrost through Copeland XWEB controllers around 2 Nov 2026. No stock was lost and the NCSC says national impact is minimal. There is no attribution.
Several outlets relay a statement from Ukraine's state postal operator Ukrposhta that an overnight attack on its IT systems on 25 June 2026 temporarily disrupted its mobile app and online services. The company blamed 'enemy forces'; attribution to Russia is not evidenced. Reports rest on one company statement that was not read directly, so the incident is rated corroborated, not confirmed.