Incidents in sector:
Japanese semiconductor test-equipment maker Advantest began notifying individuals that a February 2026 ransomware intrusion had exfiltrated personal data, including Social Security and passport numbers.
Bridgestone Americas confirmed a cyberattack that interrupted production at several of its North American manufacturing and retreading plants, though the company said it contained the incident early and found no evidence of customer data theft.
Medical-device maker Boston Scientific disclosed a cybersecurity incident that caused a network outage and disrupted company operations, including the systems used to process and ship customer orders for its cardiac and interventional devices.
After Baxter International declined to meet an extortion deadline, the ShinyHunters group published a data set it said contained 7.1 million records stolen from the medical-device maker's Salesforce environment through a third-party application compromise.
Luxury enamel-jewellery maker FREYWILLE disclosed a cyberattack on 6 August 2026 after detecting unauthorised activity, as the Aurora ransomware group claimed to have stolen customer and employee data.
Researchers reported that Cl0p was exploiting CVE-2026-12569 in internet-exposed PTC Windchill and FlexPLM product lifecycle management servers to steal engineering data, sending extortion emails to victims from 20 July 2026.
Swiss train manufacturer Stadler Rail confirmed that attackers used compromised credentials to steal technical data from a platform shared with a supplier, and refused a ransom demand of about $12.3 million from the Everest gang.
Cosmetics group Estée Lauder disclosed that attackers exploiting an Oracle E-Business Suite flaw accessed its HR system in August 2025, exposing Social Security numbers, passport and bank details, health data and employment records.
Coca-Cola disclosed in an SEC filing that a ransomware attack on its fairlife dairy subsidiary forced the temporary suspension of all US production while investigators assessed the intrusion.
Kubota North America said an unauthorised party had month-long access to its network in early 2026, reaching HR files with the personal data of employees and dependents.
Japanese beverage group Sapporo Holdings disclosed suspected unauthorised access at its overseas subsidiaries Pokka in Singapore and Sleeman Breweries in Canada, shutting down affected systems to investigate.
Nissan's Americas operations disclosed that attackers exploiting a zero-day in Oracle PeopleSoft accessed sensitive data belonging to current and former employees in the United States, Canada, Mexico and Brazil.
The fast-growing extortion group TheGentlemen added German naval-defense electronics manufacturer Atlas Elektronik to its dark-web leak site on 28 June 2026, claiming a double-extortion attack dated to around 25 June, though the TKMS subsidiary had not publicly confirmed any breach.
Indian automaker Bajaj Auto disclosed that a ransomware attack detected on the morning of 23 June 2026 affected systems at the company and its technology subsidiary, prompting containment measures and regulatory filings with CERT-In and SEBI.
Japanese motor and electronics giant Nidec confirmed a ransomware attack on its Taiwanese subsidiary Nidec Chaun Choung Technology, after which the Blackfield gang claimed the breach and demanded a $2 million ransom.
Tata Electronics confirmed a cyberattack after data-extortion group World Leaks published over 200,000 stolen files, including documents researchers say reference Apple and Tesla.
Imaging and materials company Eastman Kodak confirmed that an unauthorised third party temporarily accessed a limited amount of company data, after the ShinyHunters extortion gang listed Kodak on its dark-web leak site and claimed to hold more than 2.2 million records of customer and internal corporate data.
A dataset dubbed FortiBleed exposed valid Fortinet FortiGate VPN credentials — including plaintext passwords — for 73,932 firewall URLs across 194 countries, the product of a Russian-speaking crew that reused passwords from earlier breaches and infostealer logs rather than any new Fortinet vulnerability.
Australia's second-largest raw sugar producer, Mackay Sugar, shut down milling and cane haulage at two North Queensland mills after a ransomware attack at the start of the crushing season; The Gentlemen group later claimed the attack.
The Nitrogen ransomware group claimed on its dark-web leak site that it had stolen over 11 million files from Foxconn's North American facilities, including confidential information belonging to customers Apple, Dell, Google, Intel, Nvidia, and Sony. Foxconn said affected factories were resuming normal production.
In early May 2026, West Pharmaceutical's plant at Le Nouvion-en-Thiérache (Aisne, France), which employs around 770 people making rubber components for syringes and medical devices, was hit by a cyberattack that halted production for roughly two weeks; no data exfiltration was confirmed.
Kaspersky revealed that signed installers downloaded from the official DAEMON Tools website had carried a backdoor since 8 April 2026, infecting thousands of machines in more than 100 countries and delivering follow-on implants, including QUIC RAT, to about a dozen selected targets.
On 5 May 2026, the SpaceBears ransomware group listed French industrial-equipment manufacturer Erla Technologies SAS on its leak site, claiming to have stolen employee and client personal data, financial documents and project files — including documentation tied to a French army client.
Disclosed on 30 April 2026, a data leak at French smart-home manufacturer Delta Dore exposed personal data of at least 374 people registered on its professional training portal, formation-pro.deltadore.fr, prompting affected-user notifications.