Incidents in sector:
A cyber incident at Femern Link Contractors brought construction of the DenmarkβGermany Fehmarnbelt tunnel to a standstill at the RΓΈdbyhavn site.
Tokyo Metro disclosed that an unauthorised third party had accessed the email addresses of roughly 59,000 customers enrolled in its Metpo loyalty programme, warning members to watch for follow-on phishing attempts.
South Africa's state-owned ATNS said it found ransomware-linked malware in operational-technology systems supporting weather and air-navigation services, with signs of data exfiltration to China.
A ransomware attack in the early hours of 26 September 2026 disrupted business systems across Japan's Keio Group, hitting payment and reservation services in its hospitality division while train operations continued to run normally.
Japanese mobility group Park24 said unauthorized access to its Times Car car-sharing system exposed personal data, including driver's license images, for about 6.6 million members.
Security researchers disclosed that an unsecured Advance Passenger Information System database hosted in Vietnamese IP space had exposed roughly 220 million passenger and crew travel records spanning 2017 to 2026 through misconfigurations and default credentials.
Manchester Airports Group disclosed a data security incident in which an unauthorized third party obtained personal details relating to around 8.7 million customers of car-park, lounge and in-airport Wi-Fi services across its Manchester, Stansted and East Midlands airports.
An attacker exploited an unpatched, internet-facing system at Latvia's Road Traffic Safety Directorate (CSDD) to steal historical payment and vehicle records covering roughly 1.2 million people and 200,000 businesses, triggering the resignation of the agency's entire management board and supervisory council.
A cyberattack on logistics giant CEVA Logistics disrupted eight European warehouses and exposed customer shipment data belonging to downstream clients including Valve's Steam hardware store, Dutch retailer Bol, De Bijenkorf, Ace & Tate and football club Ajax.
A cyberattack detected on 4 August 2026 disrupted IT systems at the North Carolina State Ports Authority, forcing manual gate processing at the Port of Wilmington, the Port of Morehead City and the Charlotte Inland Port.
Swiss train manufacturer Stadler Rail confirmed that attackers used compromised credentials to steal technical data from a platform shared with a supplier, and refused a ransom demand of about $12.3 million from the Everest gang.
Nihon Kotsu, Japan's largest taxi operator, disclosed that a malware infection had forced it to take core systems offline, knocking out its telephone dispatch, web booking and reservation services while it investigates whether any data was stolen.
Ukraine's state postal operator Ukrposhta said a hostile overnight attack on its IT systems left its mobile application and some digital services malfunctioning, amid ongoing Russian cyber and physical attacks on Ukrainian infrastructure.
The world's largest cruise operator began notifying almost 6 million people that an attacker who socially engineered an employee had copied names, contact details, dates of birth and passport and driver's license numbers, weeks after ShinyHunters leaked data it claimed to have stolen.
A December 2025 cyberattack on Eurail B.V., operator of the Interrail and Eurail rail passes, exposed personal data of roughly 308,000 travellers β including names, contact details, dates of birth and passport numbers β which by 2026 was being sold on the dark web.
A student allegedly cloned Taiwan High Speed Rail's TETRA radio parameters and sent a General Alarm that stopped three trains on 5 April 2026; he and an accomplice were arrested in late April.
On 19 March 2026, French vehicle-rental company Mingat confirmed a data leak affecting its customers, notifying them of a security incident that exposed personal information held in its rental records.
Iran-linked hackers breached Los Angeles' transit agency LA Metro in March 2026, stealing at least 700 GB of internal data and disrupting passenger-information and TAP fare systems.
On 8 March 2026, a threat actor put a 121 GB database from flight-compensation platform Airclaim up for sale on a hacker forum, claiming 55,867 affected passengers β including 1,042 French nationals β with scanned passports, signatures and boarding passes exposed.
In February 2026 the LAPSUS$ extortion group claimed the theft of about 420 GB of data from France's Civil Aviation Safety Organisation (OSAC), including ID cards, passports, diplomas, proof-of-address documents and internal files; the data was later leaked in full.
On 20 February 2026 the LAPSUS$ extortion group claimed to have stolen about 420 GB of data from France's civil-aviation safety body OSAC, including ID documents, passports and internal files; the full dataset was later published online.
Voyage PrivΓ©, the French flash-sale travel platform, confirmed in February 2026 that a compromised third-party partner exposed reservation data for customers with upcoming trips β including names, country of residence, emails, phone numbers and, in some cases, passport numbers β fuelling a wave of WhatsApp phishing.
Gustave-Auto, a French automotive services platform (vehicle convoyage, fleet management and repairs), disclosed in February 2026 that an access anomaly exposed partner data β names, postal and email addresses, phone numbers, IBAN/BIC banking details and SIRET/VAT numbers β with a tracker claim citing around 3,600 records.
In early February 2026, the Qilin ransomware group listed French coach-travel operator Voyages Robin on its dark-web leak site, claiming to have stolen customer booking details, travel itineraries and financial records.