Incidents in country:
224 incidents catalogued
A cyberattack on BAE Systems took down the Bankruptcy Noticing Center it operates for the U.S. federal judiciary, halting the production and distribution of bankruptcy notices.
Dutch-based retail group Ahold Delhaize took websites, apps and online grocery services offline across its European and US banners after a security incident on its network, while keeping stores open.
Proofpoint disclosed that China-aligned actor TA419 impersonated a senior Anthropic employee and former US officials in credential-phishing campaigns aimed at AI policy experts at American think tanks, in an apparent effort to collect intelligence on US artificial-intelligence policy.
Fortinet disclosed CVE-2026-104286, a critical FortiMail flaw exploited in the wild to write arbitrary files to email gateways, prompting an emergency CISA patching order.
US K-12 software vendor Frontline Education began notifying school districts that a flaw in a third-party product let attackers access employee data, including Social Security numbers.
The U.S. Defense Manpower Data Center said attackers exploited a file-sharing system flaw to access unencrypted data, including Social Security numbers, on more than three million people.
Citrix confirmed two critical NetScaler ADC and Gateway zero-days, CVE-2026-88771 and CVE-2026-88772, were exploited in the wild for unauthenticated remote code execution before patches shipped.
US brokerage DriveWealth said a social-engineering attack exposed historic personal data of fintech customers, including Revolut, Stake and Hatch users who once traded US stocks through it.
Astrana Health disclosed in an SEC filing that attackers used phone-based social engineering, spoofing its corporate number and impersonating staff, to access confidential data on its servers.
The FBI declared a cyber security incident and warned staff their personal data may have been exposed after the ShinyHunters group claimed it breached the bureau's FBIJobs.gov hiring portal.
Ecommerce platform BigCommerce warned merchants that attackers had compromised credentials for the third-party Ribon and Ribon 1.5 apps, used them to inject malicious scripts into storefronts and accessed shopper names, emails, phone numbers and shipping addresses.
Colorado officials disclosed that foreign actors breached the control systems of two small water utilities, altering equipment settings and disabling alarms before the intrusions were contained.
CenterPoint Energy confirmed unauthorized access to customer data through an external system after a hacker claimed to have pulled 7.49 million records from an API lacking authentication.
Cisco confirmed active exploitation of CVE-2026-76461, a pre-authentication SQL injection in Secure Email Gateway that lets a crafted email execute commands as root, prompting a CISA remediation order.
Florida's Department of Highway Safety and Motor Vehicles confirmed that attackers used a compromised law-enforcement account to breach its DAVID driver database, as the ShinyHunters extortion group claimed to have stolen more than 200,000 driver records.
Identity-verification provider IDScan.net confirmed that attackers stole more than 150 million driver's license and ID records from its cloud systems, after the data surfaced on a dark web site that let anyone look up individuals across the US and Canada.
Healthcare technology firm Veradigm disclosed that attackers used credentials stolen from a third-party vendor to reach a customer-service API and copy patient data, after The Gentlemen ransomware gang claimed to hold roughly 3.5 million records.
A database of 32.8 million alleged Condé Nast user records, covering readers of Vogue, The New Yorker, GQ, WIRED and other titles, was offered for sale on a Russian-language cybercrime forum, expanding a December 2025 leak that had exposed 2.3 million WIRED accounts.
Chess.com began notifying about 4,500 users that their personal information was exposed after an external threat actor gained unauthorised access to a third-party file-transfer application the platform used.
Bridgestone Americas confirmed a cyberattack that interrupted production at several of its North American manufacturing and retreading plants, though the company said it contained the incident early and found no evidence of customer data theft.
A wave of security and technology firms disclosed data theft after attackers tracked as UNC6395 abused stolen OAuth tokens from Salesloft's Drift chatbot integration to export data from hundreds of connected Salesforce environments.
Healthcare data migration and archiving vendor Aesto Health reported that an intruder accessed part of its Amazon Web Services environment in December 2025, exposing the medical and identity data of 9,540,683 patients across dozens of provider clients.
U.S. hospital and healthcare-facilities operator Nutex Health confirmed in an SEC filing that patient, employee, provider and financial information was accessed and exfiltrated in an August cyberattack claimed by the ransomware-as-a-service group The Gentlemen.
The town of Andover, Massachusetts, and its public schools suffered a four-day network outage after an August cyberattack, and the WallStreet ransomware group later listed the town on its leak site claiming to hold town documents and data.