Incidents by attack type:
A ransomware attack on SoftBank subsidiary IDC Frontier triggered an automatic shutdown of its IDCF Cloud platform in eastern Japan, knocking out websites for local governments and companies.
Japanese semiconductor test-equipment maker Advantest began notifying individuals that a February 2026 ransomware intrusion had exfiltrated personal data, including Social Security and passport numbers.
Osaka Metropolitan University said a suspected ransomware attack took down about 500 servers and may have exposed data on at least 130,000 students and staff.
FTAPI, a Munich secure file-transfer vendor used by 2,000+ organisations, confirmed attackers breached one internal server and deployed ransomware after The Gentlemen gang listed it as a victim.
German data-exchange provider FTAPI confirmed ransomware hit one internal server after The Gentlemen's leak-site claim; it says its platform and customer data were unaffected.
South Africa's state-owned ATNS said it found ransomware-linked malware in operational-technology systems supporting weather and air-navigation services, with signs of data exfiltration to China.
A ransomware attack in the early hours of 26 September 2026 disrupted business systems across Japan's Keio Group, hitting payment and reservation services in its hospitality division while train operations continued to run normally.
Bavarian municipal utility Stadtwerke Landsberg reported that ransomware encrypted its central IT systems overnight on 1 September 2026, disrupting phone and email contact while electricity, water, wastewater and district heating continued to run.
U.S. hospital and healthcare-facilities operator Nutex Health confirmed in an SEC filing that patient, employee, provider and financial information was accessed and exfiltrated in an August cyberattack claimed by the ransomware-as-a-service group The Gentlemen.
The town of Andover, Massachusetts, and its public schools suffered a four-day network outage after an August cyberattack, and the WallStreet ransomware group later listed the town on its leak site claiming to hold town documents and data.
The State of Berlin disclosed an extortion attempt after the Rhysida ransomware group stole data from the Senate administrations for urban development and for mobility, claiming 5.79 TB and demanding 30 bitcoin; Berlin refused to pay.
The U.S. Bureau of Alcohol, Tobacco, Firearms and Explosives confirmed a cyberattack on a standalone system holding information on investigation targets after the Qilin ransomware group claimed the breach and later leaked about 6.3 GB of files.
Kansas-based water and wastewater control-systems supplier Micro-Comm was hit by the Barracuda ransomware group, which claimed to have stolen roughly 644 GB of data, prompting FBI scrutiny amid heightened concern over attacks on the U.S. water sector.
The DireWolf extortion group claimed to have stolen roughly 253 GB of highly sensitive data — including donor and transplant-recipient medical records — from the National Kidney Registry, a U.S. nonprofit that facilitates living-donor kidney transplants.
Alphanumeric Systems, a US managed-service and technology provider to the healthcare and life-sciences industries, was listed by the Settra ransomware group, which claimed to have exfiltrated roughly 161 gigabytes of data including employee and health-related information.
Turner Construction disclosed that attackers accessed its network in July 2026 and stole Social Security numbers, bank account details and passport numbers, with the Payout Kings extortion group claiming to have exfiltrated some 27 terabytes of data including sensitive project files.
A ransomware attack knocked the Pennsylvania Office of Attorney General's website, email and phone systems offline for weeks, disrupting court cases; the Inc extortion group later claimed responsibility and the office confirmed a data breach without paying a ransom.
Shared Health confirmed a ransomware incident at Manitoba's largest hospital that hit facility maintenance systems, including central HVAC monitoring, door access controls and staff ID card issuance, while patient care continued.
The GENESIS ransomware group listed Interim HealthCare's Oklahoma City and Tulsa operations on its leak site on 10 August 2026, claiming to have exfiltrated about a terabyte of patient and company data.
Luxury enamel-jewellery maker FREYWILLE disclosed a cyberattack on 6 August 2026 after detecting unauthorised activity, as the Aurora ransomware group claimed to have stolen customer and employee data.
Indian hosting provider HostDZire confirmed a 5 August 2026 ransomware attack that encrypted VMware ESXi nodes across three regions and left affected customer data unrecoverable.
AnMed, a nonprofit health system in upstate South Carolina, said a malware attack forced it to close more than 80 facilities, with the ransomware group The Gentlemen linked to the incident.
Coca-Cola disclosed in an SEC filing that a ransomware attack on its fairlife dairy subsidiary forced the temporary suspension of all US production while investigators assessed the intrusion.
Mount Royal University in Calgary confirmed that a ransomware group calling itself CMD Organization broke into its shared file storage, exfiltrated data belonging to current and former students and employees, and then deliberately wiped the original files to hamper recovery.