{
"updated": "2026-11-08",
"countries": {
"MY": {
"name": "Malaysia",
"posture": {
"level": "Medium",
"prev": "Low",
"since": "2026-11-04",
"agency": "NACSA, announced by the National Security Council",
"scale": [
"Low",
"Medium"
],
"scaleNote": "Only Low and Medium have been named publicly.",
"summary": "Raised as a precaution over regional and international tensions. No attack was announced with it.",
"requires": [
"Critical infrastructure (NCII) operators apply nine preparedness measures, including 24-hour monitoring, patching, MFA and updated continuity plans.",
"NCII sector heads file weekly threat status reports to NACSA.",
"NC4 issued eight alerts and advisories on NCII and government vulnerabilities in October 2026."
],
"source": {
"name": "Bernama",
"url": "https://www.bernama.com/en/general/news.php?id=2630182"
},
"checked": "2026-11-07"
},
"timeline": [
{
"date": "2026-11-03",
"text": "PM Anwar tells Parliament Malaysia could be targeted, citing data centres and its stance on Palestine and Gaza.",
"url": "https://www.malaymail.com/news/malaysia/2026/11/03/pm-anwar-malaysia-vulnerable-to-sophisticated-cyber-attacks-home-ministry-to-hold-special-meeting-today/241783",
"src": "Malay Mail"
},
{
"date": "2026-11-04",
"text": "NACSA raises the national threat level from Low to Medium.",
"url": "https://www.bernama.com/en/general/news.php?id=2630182",
"src": "Bernama",
"level": true
},
{
"date": "2026-11-06",
"text": "MCMC steps up monitoring; Bank Negara restates RMiT duties; Cabinet orders a review of government, bank and GLC systems.",
"url": "https://www.thestar.com.my/news/nation/2026/11/06/mcmc-on-higher-alert",
"src": "The Star"
},
{
"date": "2026-11-07",
"text": "NACSA says it is aware of incidents at several financial institutions and the situation is under control. None named.",
"url": "https://www.thestar.com.my/tech/tech-news/2026/11/07/nacsa-says-it-is-aware-of-cyber-incidents-involving-financial-institutions-currently-monitoring-developments",
"src": "The Star"
},
{
"date": "2026-01-01",
"text": "MCMC: Online Safety Act 2025 takes effect, with platforms meeting licensing criteria deemed licensed under CMA s46A.",
"url": "https://www.malaymail.com/news/malaysia/2026/01/01/enforcement-of-online-safety-act-takes-effect-strengthening-online-protections-for-children-and-families-says-mcmc/203923",
"src": "Malay Mail"
},
{
"date": "2026-01-20",
"text": "BNM imposes RM1 million penalty on Bank Rakyat after an external actor gained unauthorised access to its IT infrastructure (made public 1 April).",
"url": "https://www.thestar.com.my/business/business-news/2026/04/01/bank-negara-fines-bank-rakyat-rm1mil-for-cybersecurity-customer-information-protection-breaches",
"src": "The Star"
},
{
"date": "2026-02-07",
"text": "NACSA says it is investigating alleged state-aligned espionage against government entities reported by Unit 42.",
"url": "https://www.thestar.com.my/tech/tech-news/2026/02/07/nacsa-investigating-alleged-cyber-espionage-targeting-multiple-government-bodies",
"src": "The Star"
},
{
"date": "2026-03-12",
"text": "Bursa Malaysia says broker-level cyber incidents are contained and orders all brokers and selected vendors to screen their systems.",
"url": "https://www.thestar.com.my/business/business-news/2026/03/12/bursa-malaysia-broker-level-cyber-incidents-contained",
"src": "The Star"
},
{
"date": "2026-05-22",
"text": "MCMC publishes the ONSA Child Protection Code and Risk Mitigation Code, effective 1 June.",
"url": "https://www.thestar.com.my/news/nation/2026/05/22/stricter-safeguards-for-children-under-changes-to-online-safety-law-from-june-1",
"src": "The Star"
},
{
"date": "2026-06-21",
"text": "MKN says viral personal data leak claims come from incidents before 2022, and NACSA, MyNIC and JPDP are taking the sites down.",
"url": "https://www.freemalaysiatoday.com/category/nation/2026/06/21/viral-data-leak-claims-old-incident-no-link-to-current-platforms-says-mkn",
"src": "FMT / Bernama"
},
{
"date": "2026-06-26",
"text": "NACSA issues an NC4 advisory on the Joomla content editor flaw behind government website defacements and urges an update to 2.9.99.6.",
"url": "https://www.thestar.com.my/news/nation/2026/06/28/govt-websites-hacked-says-nacsa",
"src": "The Star"
},
{
"date": "2026-07-01",
"text": "Dewan Rakyat passes the Cybercrimes Bill 2026.",
"url": "https://mediaselangor.com/en/2026/07/382321",
"src": "Media Selangor / Bernama"
},
{
"date": "2026-07-20",
"text": "Dewan Negara passes the Cybercrimes Bill 2026, which repeals the Computer Crimes Act 1997.",
"url": "https://www.bernama.com/en/general/news.php?id=2583510",
"src": "Bernama"
},
{
"date": "2026-07-21",
"text": "Deputy PM Zahid tells the Dewan Negara online fraud charges reached 8,014 by May 2026, above the 2025 total.",
"url": "https://www.thestar.com.my/news/nation/2026/07/21/zahid-fraud-charges-surge-past-2025s-total",
"src": "The Star"
},
{
"date": "2026-07-22",
"text": "JPDP opens a PDPA Section 130 investigation into the Maxis customer data disclosure, and MCMC also investigates.",
"url": "https://www.lowyat.net/2026/399392/maxis-khairul-aming-data-leak/",
"src": "Lowyat.NET"
},
{
"date": "2026-09-25",
"text": "BNM reissues RMiT with a NACSA-endorsed NCII Code of Practice for banking and finance.",
"url": "https://www.allenandgledhill.com/perspectives/publications/bulletins-malaysia/2026/bank-negara-malaysia-revises-risk-management-in-technology-policy-document/",
"src": "Allen & Gledhill"
},
{
"date": "2026-10-06",
"text": "BNM Governor says the financial sector blocked RM1.9 billion in attempted fraud in H1 2026.",
"url": "https://mediaselangor.com/en/2026/10/399563",
"src": "Media Selangor / Bernama"
},
{
"date": "2026-10-19",
"text": "NACSA chief Megat Zuhairy says most SEO poisoning incidents on government sites can be mitigated promptly.",
"url": "https://www.malaysiakini.com/news/887446-govt-websites-still-getting-hijacked-by-online-casinos",
"src": "Malaysiakini"
},
{
"date": "2026-10-27",
"text": "Home Minister tells the Dewan Rakyat NSRC recovered only RM14.3 million of RM1.2 billion in reported scam losses.",
"url": "https://www.malaymail.com/news/malaysia/2026/10/27/saifuddin-nasution-rm143m-returned-to-online-scam-victims-rm1009m-losses-prevented/240823",
"src": "Malay Mail"
},
{
"date": "2026-11-05",
"text": "NACSA tells users to turn off WhatsApp and Telegram auto-download after .vbs files disguised as financial and legal documents spread via WhatsApp Web.",
"url": "https://berita.rtm.gov.my/nasional/senarai-berita-nasional/senarai-artikel/matikan-muat-turun-automatik-whatsapp-telegram-elak-serangan-siber-nacsa/",
"src": "RTM"
},
{
"date": "2026-11-07",
"text": "Fahmi Fadzil says non-state actors attempted attacks but no data theft or online banking disruption has occurred, and Bank Rakyat's case was a defacement.",
"url": "https://www.thestar.com.my/news/nation/2026/11/07/malaysia039s-online-banking-system-remains-secure-says-comms-minister",
"src": "The Star"
},
{
"date": "2026-11-07",
"text": "Miri police receive four reports of failed ATM cash withdrawals and are checking whether a cyberattack or a technical fault caused them.",
"url": "https://utusansarawak.com.my/isu-serangan-siber-polis-sarawak-terima-empat-laporan-di-miri/",
"src": "Utusan Sarawak"
},
{
"date": "2026-11-07",
"text": "MyCERT advisory MA-1500.112026 rates the risk critical for Synology NAS owners: a C3RB3R ransomware wave is mass-encrypting internet-exposed devices through unpatched DSM flaws (CVE-2024-10441), and the Node2Shell Brotli flaw (CVE-2026-111497) is under investigation as another way in. Patch or reinstall within 24 to 48 hours.",
"url": "https://www.mycert.org.my/portal/advisory?id=MA-1500.112026",
"src": "MyCERT"
},
{
"date": "2026-11-07",
"text": "MKN warns the public against unverified cyberattack claims on social media, keeps the threat level at Medium and says BNM leads financial-sector preparedness.",
"url": "https://www.freemalaysiatoday.com/category/nation/2026/11/07/don-t-be-fooled-by-claims-of-cyberattack-says-security-council",
"src": "FMT"
}
],
"incidents": [
{
"org": "Bank Rakyat",
"sector": "finance",
"date": "2026-11-06",
"type": "defacement",
"actor": "MARLANWG",
"status": "confirmed",
"vendor": true,
"confirmed": "Websites defaced; the bank blames a third-party-managed site and says deposits, data and banking services were unaffected. On 7 November Fahmi Fadzil said the bank blocked the affected server and no data theft had been found so far.",
"claimed": "The actor claims internal access and a data sample, and no sample has been published. Screenshots shared on the night of 6 November show the same MARLANWG message and Session contact ID on both bankrakyat.com.my and the i-Rakyat online banking site, irakyat.com.my.",
"sources": [
{
"name": "Malay Mail",
"url": "https://www.malaymail.com/news/malaysia/2026/11/07/bank-rakyat-blames-third-party-glitch-for-website-outage-says-customer-funds-and-data-safe/242358"
},
{
"name": "Lowyat",
"url": "https://www.lowyat.net/2026/409395/bank-rakyat-takes-down-sites-after-suspected-cyber-attack/"
},
{
"name": "Screenshots on X (@Pelabur_Bijak)",
"url": "https://x.com/Pelabur_Bijak/status/2118711569681105127"
},
{
"name": "Malay Mail",
"url": "https://www.malaymail.com/news/malaysia/2026/11/07/fahmi-says-online-banking-remains-safe-despite-cyberattacks-and-bank-rakyat-hack/242378"
}
],
"state": "Kuala Lumpur",
"checked": "2026-11-08",
"domain": "bankrakyat.com.my",
"logo": "bankrakyat.com.my",
"ms": {
"confirmed": "Laman web diceroboh dan diubah. Bank menyalahkan laman yang diurus pihak ketiga dan berkata deposit, data dan perkhidmatan perbankan tidak terjejas. Pada 7 November, Fahmi Fadzil berkata bank menyekat pelayan yang terjejas dan tiada kecurian data dikesan setakat ini.",
"claimed": "Pelaku mendakwa mempunyai akses dalaman dan sampel data, tetapi tiada sampel diterbitkan. Tangkapan skrin pada malam 6 November menunjukkan mesej MARLANWG dan ID hubungan Session yang sama di bankrakyat.com.my dan laman perbankan dalam talian i-Rakyat, irakyat.com.my.",
"src": "d986c56ff2"
},
"actor_ids": [
"marlanwg"
],
"id": "3e79be0b",
"story": "bank-rakyat-website-defacement"
},
{
"org": "Several financial institutions",
"sector": "finance",
"date": "2026-11-07",
"type": "other",
"actor": "",
"status": "confirmed",
"vendor": false,
"confirmed": "NACSA says it is aware of incidents and NC4 is monitoring. Institutions and incident type not disclosed. MKN on 7 November called them cybersecurity incidents and system disruptions, with BNM leading sector preparedness.",
"claimed": "",
"sources": [
{
"name": "The Star",
"url": "https://www.thestar.com.my/tech/tech-news/2026/11/07/nacsa-says-it-is-aware-of-cyber-incidents-involving-financial-institutions-currently-monitoring-developments"
},
{
"name": "FMT",
"url": "https://www.freemalaysiatoday.com/category/nation/2026/11/07/don-t-be-fooled-by-claims-of-cyberattack-says-security-council"
}
],
"checked": "2026-11-08",
"ms": {
"confirmed": "NACSA berkata ia sedar tentang insiden ini dan NC4 sedang memantau. Institusi dan jenis insiden tidak didedahkan. Pada 7 November, MKN menyifatkannya sebagai insiden keselamatan siber dan gangguan sistem, dengan BNM menerajui persediaan sektor kewangan.",
"src": "930c025e3c"
},
"actor_ids": [],
"id": "0906e2cc"
},
{
"org": "Malaysia Airlines",
"sector": "transport",
"date": "2026-10-31",
"type": "supply-chain",
"actor": "",
"status": "confirmed",
"vendor": true,
"confirmed": "Customer data processed through Amadeus from August 2023 to September 2026 may be exposed. The airline's own systems were not breached.",
"claimed": "",
"sources": [
{
"name": "Malay Mail",
"url": "https://www.malaymail.com/news/malaysia/2026/11/01/malaysia-airlines-warns-customers-of-data-exposure-in-amadeus-cybersecurity-breach/241516"
},
{
"name": "Lowyat",
"url": "https://www.lowyat.net/2026/408920/malaysia-airlines-amadeus-data-breach/"
}
],
"state": "Selangor",
"checked": "2026-11-07",
"domain": "malaysiaairlines.com",
"logo": "malaysiaairlines.com",
"ms": {
"confirmed": "Data pelanggan yang diproses melalui Amadeus dari Ogos 2023 hingga September 2026 mungkin terdedah. Sistem syarikat penerbangan itu sendiri tidak dicerobohi.",
"src": "2b5dde55cd"
},
"actor_ids": [],
"id": "6cb596f8",
"story": "amadeus-airline-data-breach"
},
{
"org": "MP Kluang (Kluang council)",
"sector": "government",
"date": "2026-10-29",
"type": "intrusion",
"actor": "Leakers$",
"status": "confirmed",
"vendor": true,
"confirmed": "Eight public LED screens were hijacked to show obscene video and switched off. Police are investigating.",
"claimed": "A Telegram group claimed it, according to foreign outlets.",
"sources": [
{
"name": "The Star",
"url": "https://www.thestar.com.my/news/nation/2026/10/30/police-probing-obscene-content-on-kluang-led-screens"
},
{
"name": "Malay Mail",
"url": "https://www.malaymail.com/news/malaysia/2026/10/31/police-probe-hacking-of-kluang-council-led-screens-after-obscene-content-displayed/241350"
}
],
"state": "Johor",
"checked": "2026-11-07",
"domain": "mpkluang.gov.my",
"logo": "mpkluang.gov.my",
"ms": {
"confirmed": "Lapan skrin LED awam dirampas untuk memaparkan video lucah dan dimatikan. Polis sedang menyiasat.",
"claimed": "Sebuah kumpulan Telegram mendakwa bertanggungjawab, menurut media asing.",
"src": "39f7147cc5"
},
"actor_ids": [
"leakers"
],
"id": "9c6f9958"
},
{
"org": "Rakuten Trade",
"sector": "finance",
"date": "2026-10-30",
"type": "intrusion",
"actor": "",
"status": "confirmed",
"vendor": false,
"confirmed": "A cybersecurity attempt took trading offline for over a week; app trading returned on 4 November. No evidence of data loss, per the CEO. Web trading stays suspended for all markets; orders go only through the iSPEED.my app.",
"claimed": "",
"sources": [
{
"name": "The Edge",
"url": "https://theedgemalaysia.com/node/823904"
},
{
"name": "The Edge",
"url": "https://theedgemalaysia.com/node/824498"
}
],
"state": "Kuala Lumpur",
"checked": "2026-11-08",
"domain": "rakutentrade.my",
"logo": "rakutentrade.my",
"ms": {
"confirmed": "Satu cubaan serangan siber menyebabkan dagangan terhenti lebih seminggu; dagangan melalui aplikasi pulih pada 4 November. Tiada bukti kehilangan data, menurut Ketua Pegawai Eksekutif. Dagangan melalui web masih digantung bagi semua pasaran; pesanan hanya melalui aplikasi iSPEED.my.",
"src": "22c23d2852"
},
"actor_ids": [],
"id": "1311ba69",
"story": "rakuten-trade-outage"
},
{
"org": "Dewan Bahasa dan Pustaka",
"sector": "government",
"date": "2026-10-19",
"type": "seo-poisoning",
"actor": "",
"status": "confirmed",
"vendor": false,
"confirmed": "dbp.gov.my subdomains were hijacked to serve gambling pages. NACSA says it is aware of the campaign.",
"claimed": "",
"sources": [
{
"name": "Malaysiakini",
"url": "https://www.malaysiakini.com/news/887446-govt-websites-still-getting-hijacked-by-online-casinos"
}
],
"state": "Kuala Lumpur",
"checked": "2026-11-07",
"domain": "dbp.gov.my",
"logo": "dbp.gov.my",
"ms": {
"confirmed": "Subdomain dbp.gov.my dirampas untuk memaparkan halaman judi. NACSA berkata ia sedar tentang kempen ini.",
"src": "a5dbf35b23"
},
"actor_ids": [],
"id": "7bf613b5"
},
{
"org": "Lembaga Tabung Haji",
"sector": "finance",
"date": "2026-10-08",
"type": "intrusion",
"actor": "",
"status": "confirmed",
"vendor": false,
"confirmed": "Services suspended for four days after suspicious activity. Police, NACSA and the data protection department notified; savings and data said to be safe.",
"claimed": "",
"sources": [
{
"name": "Malay Mail",
"url": "https://www.malaymail.com/news/malaysia/2026/10/12/tabung-haji-systems-resume-after-cyberattack-depositors-savings-confirmed-safe/238782"
},
{
"name": "The Star",
"url": "https://thestar.com.my/tech/tech-news/2026/10/08/tabung-haji-suspends-services-after-detecting-suspicious-cyber-activity"
}
],
"state": "Kuala Lumpur",
"checked": "2026-11-07",
"domain": "tabunghaji.gov.my",
"logo": "tabunghaji.gov.my",
"ms": {
"confirmed": "Perkhidmatan digantung selama empat hari selepas aktiviti mencurigakan. Polis, NACSA dan jabatan perlindungan data dimaklumkan; simpanan dan data dikatakan selamat.",
"src": "35e2f7c5c5"
},
"actor_ids": [],
"id": "9ebf6e36",
"story": "tabung-haji-cyberattack"
},
{
"org": "Port of Tanjung Pelepas",
"sector": "transport",
"date": "2026-09-10",
"type": "ransomware",
"actor": "Direwolf",
"status": "confirmed",
"vendor": false,
"confirmed": "A cyber incident halted terminal operations overnight; systems were isolated and restored.",
"claimed": "Direwolf listed the port on its leak site and claims ransomware and data theft.",
"sources": [
{
"name": "The Loadstar",
"url": "https://theloadstar.com/cyber-attack-halts-operations-at-malaysias-tanjung-pelepas-port/"
},
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/UG9ydCBvZiBUYW5qdW5nIFBlbGVwYXNAZGlyZXdvbGY="
}
],
"state": "Johor",
"checked": "2026-11-07",
"domain": "ptp.com.my",
"logo": "ptp.com.my",
"ms": {
"confirmed": "Insiden siber menghentikan operasi terminal semalaman; sistem diasingkan dan dipulihkan.",
"claimed": "Direwolf menyenaraikan pelabuhan itu di laman kebocorannya dan mendakwa serangan ransomware serta kecurian data.",
"src": "709c2a0c6f"
},
"actor_ids": [
"direwolf"
],
"id": "e2e721f4",
"story": "port-of-tanjung-pelepas-cyberattack"
},
{
"org": "Royal Malaysian Customs (JKDM)",
"sector": "government",
"date": "2026-10-15",
"type": "access-sale",
"actor": "MARLANWG",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "Access to a webshell and production databases offered for US$1,500 on a crime forum. No statement from Customs.",
"sources": [
{
"name": "VECERT",
"url": "https://x.com/VECERTRadar/status/2112747404151640104"
}
],
"state": "Putrajaya",
"checked": "2026-11-07",
"domain": "customs.gov.my",
"logo": "customs.gov.my",
"ms": {
"claimed": "Akses kepada webshell dan pangkalan data produksi ditawarkan pada harga US$1,500 di forum jenayah. Tiada kenyataan daripada Kastam.",
"src": "257a7a51f0"
},
"actor_ids": [
"marlanwg"
],
"id": "c6c93457"
},
{
"org": "MISC Group",
"sector": "transport",
"date": "2026-10-26",
"type": "ransomware",
"actor": "Rhysida",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "Listed on Rhysida's leak site, which claims crew data and vessel system credentials.",
"sources": [
{
"name": "DeXpose",
"url": "https://www.dexpose.io/rhysida-ransomware-attack-on-misc-group/"
}
],
"state": "Kuala Lumpur",
"checked": "2026-11-07",
"domain": "misc.com.my",
"logo": "misc.com.my",
"ms": {
"claimed": "Disenaraikan di laman kebocoran Rhysida, yang mendakwa memiliki data anak kapal dan kelayakan log masuk sistem kapal.",
"src": "009f5ad4f8"
},
"actor_ids": [
"rhysida"
],
"id": "4e1c5d11"
},
{
"org": "Mah Sing Group",
"sector": "property",
"date": "2026-10-26",
"type": "data-leak",
"actor": "Scarlettgroup",
"status": "claimed",
"vendor": true,
"confirmed": "",
"claimed": "Claims 1TB from the company's Salesforce instance, including about 1.08 million customer accounts.",
"sources": [
{
"name": "ThreatMon",
"url": "https://x.com/MonThreat/status/2117529973120467401"
}
],
"state": "Kuala Lumpur",
"checked": "2026-11-07",
"domain": "mahsing.com.my",
"logo": "mahsing.com.my",
"ms": {
"claimed": "Mendakwa 1TB daripada akaun Salesforce syarikat, termasuk kira-kira 1.08 juta akaun pelanggan.",
"src": "a1d863b4db"
},
"actor_ids": [
"scarlettgroup"
],
"id": "b9daabf2"
},
{
"org": "Pengurusan Aset Air Bhd",
"sector": "government",
"date": "2026-10-18",
"type": "ransomware",
"actor": "Qilin",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "Listed on Qilin's leak site.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/map/MY"
}
],
"checked": "2026-11-07",
"domain": "paab.my",
"logo": "paab.my",
"ms": {
"claimed": "Disenaraikan di laman kebocoran Qilin.",
"src": "9cd3ab2c14"
},
"actor_ids": [
"qilin"
],
"id": "c158d832"
},
{
"org": "INTI International University",
"sector": "education",
"date": "2026-10-30",
"type": "ransomware",
"actor": "Rhysida",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "Listed on Rhysida's leak site.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/map/MY"
}
],
"checked": "2026-11-07",
"domain": "newinti.edu.my",
"logo": "newinti.edu.my",
"ms": {
"claimed": "Disenaraikan di laman kebocoran Rhysida.",
"src": "f4d099b73a"
},
"actor_ids": [
"rhysida"
],
"id": "aa0aff19"
},
{
"org": "Antah HealthCare",
"sector": "health",
"date": "2026-10-27",
"type": "ransomware",
"actor": "Crypto24",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "Listed on Crypto24's leak site, which claims 700GB.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/map/MY"
}
],
"checked": "2026-11-07",
"domain": "ahcg.com.my",
"ms": {
"claimed": "Disenaraikan di laman kebocoran Crypto24, yang mendakwa 700GB.",
"src": "efd3bbb604"
},
"actor_ids": [
"crypto24"
],
"id": "e32a12c0"
},
{
"org": "MARDEC Bhd",
"sector": "manufacturing",
"date": "2026-11-03",
"type": "ransomware",
"actor": "Orova",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "Listed on Orova's leak site.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/map/MY"
}
],
"checked": "2026-11-07",
"domain": "mardec.com.my",
"logo": "mardec.com.my",
"ms": {
"claimed": "Disenaraikan di laman kebocoran Orova.",
"src": "01c2b3db7b"
},
"actor_ids": [
"orova"
],
"id": "46612c2e"
},
{
"org": "Royal Selangor",
"sector": "retail",
"date": "2026-10-05",
"type": "ransomware",
"actor": "Byod",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "Listed on Byod's leak site.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/map/MY"
}
],
"checked": "2026-11-07",
"domain": "royalselangor.com",
"logo": "royalselangor.com",
"ms": {
"claimed": "Disenaraikan di laman kebocoran Byod.",
"src": "ee55216186"
},
"actor_ids": [
"byod"
],
"id": "5f2d185d"
},
{
"org": "CIMB Securities",
"sector": "finance",
"date": "2026-08-31",
"type": "ransomware",
"actor": "INC Ransom",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "cimbsecurities.com listed on INC Ransom's leak site.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/map/MY"
}
],
"state": "Kuala Lumpur",
"checked": "2026-11-07",
"domain": "cimb.com.my",
"logo": "cimb.com.my",
"ms": {
"claimed": "cimbsecurities.com disenaraikan di laman kebocoran INC Ransom.",
"src": "83a64f80de"
},
"actor_ids": [
"inc-ransom"
],
"id": "6236f580"
},
{
"org": "Government ministries and a microloan lender (espionage)",
"sector": "government",
"date": "2026-02-07",
"type": "intrusion",
"actor": "TGR-STA-1030",
"status": "claimed",
"vendor": false,
"confirmed": "NACSA said it has been investigating alleged cyber espionage against various government entities since September 2025 and has found no adverse impact so far.",
"claimed": "Palo Alto Networks Unit 42 alleged that a state-aligned group operating out of Asia compromised several ministries and departments to steal immigration and economic intelligence data.",
"sources": [
{
"name": "The Star",
"url": "https://www.thestar.com.my/tech/tech-news/2026/02/07/nacsa-investigating-alleged-cyber-espionage-targeting-multiple-government-bodies"
}
],
"checked": "2026-11-07",
"ms": {
"confirmed": "NACSA berkata ia telah menyiasat dakwaan pengintipan siber terhadap pelbagai entiti kerajaan sejak September 2025 dan setakat ini tidak menemui kesan buruk.",
"claimed": "Unit 42 Palo Alto Networks mendakwa sebuah kumpulan yang sejajar dengan negara dan beroperasi dari Asia menceroboh beberapa kementerian dan jabatan untuk mencuri data risikan imigresen dan ekonomi.",
"src": "c4ebec7fb0"
},
"actor_ids": [
"tgr-sta-1030"
],
"id": "5adfa462"
},
{
"org": "Malaysian Army and ministry databases",
"sector": "government",
"date": "2026-02-26",
"type": "data-leak",
"actor": "Ashborn",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "A forum seller listed records of 14,816 army personnel for US$2,500 and databases tied to five government bodies, and Fahmi Fadzil said his ministry had received no official report of a breach.",
"sources": [
{
"name": "Lowyat.NET",
"url": "https://www.lowyat.net/2026/384504/threat-actor-allegedly-selling-malaysian-army-ministry-data-on-dark-web/"
}
],
"checked": "2026-11-07",
"ms": {
"claimed": "Seorang penjual di forum menyenaraikan rekod 14,816 anggota tentera pada harga US$2,500 serta pangkalan data berkaitan lima badan kerajaan. Fahmi Fadzil berkata kementeriannya tidak menerima laporan rasmi tentang sebarang pencerobohan.",
"src": "f8d0db8b2a"
},
"actor_ids": [
"ashborn"
],
"id": "2ad60de1"
},
{
"org": "CIMB Bank",
"sector": "finance",
"date": "2026-03-04",
"type": "data-leak",
"actor": "Unnamed X account",
"status": "disputed",
"vendor": false,
"confirmed": "",
"claimed": "An X account claimed 1.2 million CIMB customer records, and CIMB said on X the allegation is false and its systems are secure.",
"sources": [
{
"name": "Lowyat.NET",
"url": "https://www.lowyat.net/2026/385274/cimb-dismisses-data-breach-as-false-mar-2026/"
}
],
"state": "Kuala Lumpur",
"checked": "2026-11-07",
"domain": "cimb.com.my",
"logo": "cimb.com.my",
"ms": {
"claimed": "Sebuah akaun X mendakwa memiliki 1.2 juta rekod pelanggan CIMB. CIMB berkata di X bahawa dakwaan itu palsu dan sistemnya selamat.",
"src": "970da09456"
},
"actor_ids": [],
"id": "017465fb"
},
{
"org": "Bursa stockbrokers (UOB Kay Hian, Phillip Capital, Hong Leong IB)",
"sector": "finance",
"date": "2026-03-12",
"type": "intrusion",
"actor": "",
"status": "confirmed",
"vendor": true,
"confirmed": "Bursa Malaysia said a few brokers reported cybersecurity incidents in their own system components that were contained, with no evidence of unauthorised trading or financial loss.",
"claimed": "An unnamed source told The Edge the problem was traced to a trading platform vendor.",
"sources": [
{
"name": "The Star",
"url": "https://www.thestar.com.my/business/business-news/2026/03/12/bursa-malaysia-broker-level-cyber-incidents-contained"
},
{
"name": "The Edge Malaysia",
"url": "https://theedgemalaysia.com/node/795939"
},
{
"name": "The Edge Malaysia",
"url": "https://theedgemalaysia.com/node/795944"
}
],
"state": "Kuala Lumpur",
"checked": "2026-11-07",
"ms": {
"confirmed": "Bursa Malaysia berkata beberapa broker melaporkan insiden keselamatan siber pada komponen sistem mereka sendiri yang telah dibendung, tanpa bukti dagangan tanpa kebenaran atau kerugian kewangan.",
"claimed": "Sumber tanpa nama memberitahu The Edge bahawa masalah itu dikesan berpunca daripada vendor platform dagangan.",
"src": "f03916ebae"
},
"actor_ids": [],
"id": "abbfcd9c"
},
{
"org": "Malacca Securities",
"sector": "finance",
"date": "2026-03-19",
"type": "intrusion",
"actor": "",
"status": "confirmed",
"vendor": true,
"confirmed": "Bursa Malaysia said Malacca Securities reported a cybersecurity incident on 19 March involving a specific system component, and the broker suspended Malaysian trading on its M+Global channels from 24 March.",
"claimed": "",
"sources": [
{
"name": "The Edge Malaysia",
"url": "https://theedgemalaysia.com/node/797232"
}
],
"state": "Melaka",
"checked": "2026-11-07",
"domain": "msec.com.my",
"ms": {
"confirmed": "Bursa Malaysia berkata Malacca Securities melaporkan insiden keselamatan siber pada 19 Mac melibatkan satu komponen sistem, dan broker itu menggantung dagangan pasaran Malaysia di saluran M+Global mulai 24 Mac.",
"src": "6620f1259a"
},
"logo": "msec.com.my",
"actor_ids": [],
"id": "e4f95c24"
},
{
"org": "OCBC Bank (Malaysia)",
"sector": "finance",
"date": "2026-05-04",
"type": "data-leak",
"actor": "Unnamed forum actor",
"status": "disputed",
"vendor": false,
"confirmed": "",
"claimed": "A forum actor posted a sample said to hold OCBC Malaysia customer data, and OCBC said the data is fabricated and is not its customer data.",
"sources": [
{
"name": "Lowyat.NET",
"url": "https://www.lowyat.net/2026/391717/ocbc-and-uob-malaysia-allegedly-hit-by-data-breach-claims/"
}
],
"checked": "2026-11-07",
"domain": "ocbc.com.my",
"logo": "ocbc.com.my",
"ms": {
"claimed": "Seorang pelaku di forum menyiarkan sampel yang dikatakan mengandungi data pelanggan OCBC Malaysia. OCBC berkata data itu rekaan dan bukan data pelanggannya.",
"src": "77c5badf71"
},
"actor_ids": [],
"id": "6e0d9357"
},
{
"org": "UOB Malaysia",
"sector": "finance",
"date": "2026-05-04",
"type": "data-leak",
"actor": "Unnamed forum actor",
"status": "disputed",
"vendor": false,
"confirmed": "",
"claimed": "A forum actor posted a small sample said to be UOB Malaysia account data, and UOB said the claims are false and no customer data was breached.",
"sources": [
{
"name": "Lowyat.NET",
"url": "https://www.lowyat.net/2026/391717/ocbc-and-uob-malaysia-allegedly-hit-by-data-breach-claims/"
}
],
"checked": "2026-11-07",
"domain": "uob.com.my",
"ms": {
"claimed": "Seorang pelaku di forum menyiarkan sampel kecil yang dikatakan data akaun UOB Malaysia. UOB berkata dakwaan itu palsu dan tiada data pelanggan dicerobohi.",
"src": "488722f93b"
},
"logo": "uob.com.my",
"actor_ids": [],
"id": "b4de44a5"
},
{
"org": "University of Nottingham Malaysia",
"sector": "education",
"date": "2026-06-09",
"type": "data-leak",
"actor": "ShinyHunters",
"status": "confirmed",
"vendor": false,
"confirmed": "The university said the incident on its UK-based student records system was contained, a forensic investigation was under way and affected students and alumni were told directly.",
"claimed": "ShinyHunters claimed more than 40 GB including billing, payment and student finance records from the UK, Malaysia and China campuses.",
"sources": [
{
"name": "Free Malaysia Today",
"url": "https://www.freemalaysiatoday.com/category/nation/2026/06/11/university-of-nottingham-malaysia-still-assessing-impact-of-cyberattack"
}
],
"state": "Selangor",
"checked": "2026-11-07",
"domain": "nottingham.edu.my",
"logo": "nottingham.edu.my",
"ms": {
"confirmed": "Universiti berkata insiden pada sistem rekod pelajar yang berpangkalan di UK telah dibendung, siasatan forensik sedang dijalankan dan pelajar serta alumni yang terjejas dimaklumkan secara terus.",
"claimed": "ShinyHunters mendakwa lebih 40 GB termasuk rekod bil, pembayaran dan kewangan pelajar dari kampus UK, Malaysia dan China.",
"src": "5080f8df15"
},
"actor_ids": [
"shinyhunters"
],
"id": "67c9383b"
},
{
"org": "Co-operative Societies Commission (SKM)",
"sector": "government",
"date": "2026-06-26",
"type": "defacement",
"actor": "",
"status": "confirmed",
"vendor": false,
"confirmed": "NACSA said several government websites including SKM were hacked through a flaw in a Joomla content editor extension.",
"claimed": "",
"sources": [
{
"name": "The Star",
"url": "https://www.thestar.com.my/news/nation/2026/06/28/govt-websites-hacked-says-nacsa"
}
],
"checked": "2026-11-07",
"domain": "skm.gov.my",
"ms": {
"confirmed": "NACSA berkata beberapa laman web kerajaan termasuk SKM digodam melalui kelemahan pada sambungan penyunting kandungan Joomla.",
"src": "2afa008377"
},
"actor_ids": [],
"id": "5f5dde9a"
},
{
"org": "Kraftangan Malaysia",
"sector": "government",
"date": "2026-06-26",
"type": "defacement",
"actor": "",
"status": "confirmed",
"vendor": false,
"confirmed": "NACSA named the Handicraft Development Corporation among government websites hacked through the Joomla content editor flaw.",
"claimed": "",
"sources": [
{
"name": "The Star",
"url": "https://www.thestar.com.my/news/nation/2026/06/28/govt-websites-hacked-says-nacsa"
}
],
"state": "Kuala Lumpur",
"checked": "2026-11-07",
"domain": "kraftangan.gov.my",
"logo": "kraftangan.gov.my",
"ms": {
"confirmed": "NACSA menamakan Perbadanan Kemajuan Kraftangan Malaysia antara laman web kerajaan yang digodam melalui kelemahan penyunting kandungan Joomla.",
"src": "fc85711afd"
},
"actor_ids": [],
"id": "26c6ef13"
},
{
"org": "Women's Development Department (JPW)",
"sector": "government",
"date": "2026-06-26",
"type": "defacement",
"actor": "",
"status": "confirmed",
"vendor": false,
"confirmed": "NACSA named the Women's Development Department among government websites hacked through the Joomla content editor flaw.",
"claimed": "",
"sources": [
{
"name": "The Star",
"url": "https://www.thestar.com.my/news/nation/2026/06/28/govt-websites-hacked-says-nacsa"
}
],
"state": "Putrajaya",
"checked": "2026-11-07",
"domain": "jpw.gov.my",
"logo": "jpw.gov.my",
"ms": {
"confirmed": "NACSA menamakan Jabatan Pembangunan Wanita antara laman web kerajaan yang digodam melalui kelemahan penyunting kandungan Joomla.",
"src": "451a274bcd"
},
"actor_ids": [],
"id": "85e21b4c"
},
{
"org": "Ministry of Health (KKM)",
"sector": "health",
"date": "2026-06-27",
"type": "defacement",
"actor": "Mushr00w",
"status": "confirmed",
"vendor": false,
"confirmed": "The Health Ministry said early findings tied the portal outage to a suspected cyberattack and urged the public to use its verified channels while the site was offline.",
"claimed": "A group calling itself Mushr00w left a message on the defaced page.",
"sources": [
{
"name": "The Star",
"url": "https://www.thestar.com.my/news/nation/2026/06/27/health-ministry-probing-cybersecurity-incident-involving-official-website"
},
{
"name": "The Star",
"url": "https://www.thestar.com.my/news/nation/2026/06/28/govt-websites-hacked-says-nacsa"
}
],
"state": "Putrajaya",
"checked": "2026-11-07",
"domain": "moh.gov.my",
"logo": "moh.gov.my",
"ms": {
"confirmed": "Kementerian Kesihatan berkata dapatan awal mengaitkan gangguan portal dengan serangan siber yang disyaki dan menggesa orang ramai menggunakan saluran rasminya ketika laman itu tidak dapat diakses.",
"claimed": "Sebuah kumpulan yang menggelar dirinya Mushr00w meninggalkan mesej pada halaman yang diubah.",
"src": "8ea4f5299c"
},
"actor_ids": [
"mushr00w"
],
"id": "2cad27aa"
},
{
"org": "Flexi Parking (LITS), 64 local councils",
"sector": "other",
"date": "2026-06-29",
"type": "intrusion",
"actor": "",
"status": "confirmed",
"vendor": true,
"confirmed": "The Selangor government confirmed a cyberattack on the Flexi Parking system and told councils to suspend summonses, and LITS said an intruder reached a legacy server and caused a 61-hour outage.",
"claimed": "The attacker claimed access to data on seven million users, which LITS disputes.",
"sources": [
{
"name": "The Star (StarMetro)",
"url": "https://www.thestar.com.my/metro/metro-news/2026/07/30/cyberattack-triggers-parking-platform-rebuild"
},
{
"name": "Malay Mail",
"url": "https://www.malaymail.com/news/malaysia/2026/07/01/selangor-confirms-flexi-parking-cyberattack-suspends-parking-summons-during-outage/225930"
}
],
"checked": "2026-11-07",
"ms": {
"confirmed": "Kerajaan Selangor mengesahkan serangan siber terhadap sistem Flexi Parking dan mengarahkan majlis menggantung saman. LITS berkata penceroboh mencapai pelayan lama dan menyebabkan gangguan selama 61 jam.",
"claimed": "Penyerang mendakwa mempunyai akses kepada data tujuh juta pengguna, yang dipertikaikan oleh LITS.",
"src": "5f1506ab2d"
},
"actor_ids": [],
"id": "fe8b0e46",
"story": "flexi-parking-cyberattack"
},
{
"org": "Maxis",
"sector": "telecom",
"date": "2026-07-22",
"type": "data-leak",
"actor": "Unnamed individual (unauthorised internal access)",
"status": "confirmed",
"vendor": false,
"confirmed": "Maxis said a customer's billing and account data was exposed through unauthorised actions by an identified person, and JPDP opened an investigation under Section 130 of the PDPA.",
"claimed": "",
"sources": [
{
"name": "Lowyat.NET",
"url": "https://www.lowyat.net/2026/399392/maxis-khairul-aming-data-leak/"
},
{
"name": "Malay Mail",
"url": "https://www.malaymail.com/news/malaysia/2026/07/22/personal-data-protection-department-investigates-maxis-over-khairul-aming-data-leak/228568"
}
],
"state": "Kuala Lumpur",
"checked": "2026-11-07",
"domain": "maxis.com.my",
"logo": "maxis.com.my",
"ms": {
"confirmed": "Maxis berkata data bil dan akaun seorang pelanggan terdedah melalui tindakan tanpa kebenaran oleh individu yang telah dikenal pasti, dan JPDP membuka siasatan di bawah Seksyen 130 PDPA.",
"src": "888fc9a82d"
},
"actor_ids": [],
"id": "2475fbb6"
},
{
"org": "Duopharma Biotech",
"sector": "health",
"date": "2026-09-11",
"type": "data-leak",
"actor": "",
"status": "confirmed",
"vendor": false,
"confirmed": "Duopharma told Bursa that data files allegedly including personal data were extracted after an unauthorised access attempt and that it will notify the Personal Data Protection Commissioner.",
"claimed": "",
"sources": [
{
"name": "The Star",
"url": "https://www.thestar.com.my/business/business-news/2026/09/11/duopharma-says-data-files-extracted-in-cyber-incident"
}
],
"state": "Selangor",
"checked": "2026-11-07",
"domain": "duopharmabiotech.com",
"logo": "duopharmabiotech.com",
"ms": {
"confirmed": "Duopharma memaklumkan Bursa bahawa fail data yang didakwa mengandungi data peribadi telah diambil selepas cubaan akses tanpa kebenaran, dan ia akan memaklumkan Pesuruhjaya Perlindungan Data Peribadi.",
"src": "773b470e89"
},
"actor_ids": [],
"id": "cb4ec531"
},
{
"org": "CTOS Digital",
"sector": "finance",
"date": "2026-09-23",
"type": "intrusion",
"actor": "",
"status": "confirmed",
"vendor": false,
"confirmed": "CTOS told Bursa it detected unauthorised access to an environment supporting its consumer business and that files with a limited subset of processed consumer information were accessed.",
"claimed": "",
"sources": [
{
"name": "The Star",
"url": "https://www.thestar.com.my/business/business-news/2026/09/23/ctos-digital-detects-unauthorised-access-some-consumer-data-affected"
}
],
"state": "Kuala Lumpur",
"checked": "2026-11-07",
"domain": "ctosdigital.com",
"logo": "ctosdigital.com",
"ms": {
"confirmed": "CTOS memaklumkan Bursa bahawa ia mengesan akses tanpa kebenaran pada persekitaran yang menyokong perniagaan penggunanya, dan fail dengan sebahagian kecil maklumat pengguna yang diproses telah diakses.",
"src": "ef97cf4ad7"
},
"actor_ids": [],
"id": "ddfb2326"
},
{
"org": "Sunzen Biotech",
"sector": "health",
"date": "2026-01-04",
"type": "ransomware",
"actor": "DireWolf",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "DireWolf listed Sunzen Biotech Berhad on its leak site.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/U3VuemVuIEJpb3RlY2ggQmVyaGFkQGRpcmV3b2xm"
}
],
"checked": "2026-11-07",
"domain": "sunzen.com.my",
"ms": {
"claimed": "DireWolf menyenaraikan Sunzen Biotech Berhad di laman kebocorannya.",
"src": "9e60f6bcac"
},
"logo": "sunzen.com.my",
"actor_ids": [
"direwolf"
],
"id": "5979273d"
},
{
"org": "Bina Darulaman",
"sector": "property",
"date": "2026-01-04",
"type": "ransomware",
"actor": "DireWolf",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "DireWolf listed Bina Darulaman Berhad on its leak site.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/QmluYSBEYXJ1bGFtYW4gQmVyaGFkQGRpcmV3b2xm"
}
],
"state": "Kedah",
"checked": "2026-11-07",
"domain": "bdb.com.my",
"logo": "bdb.com.my",
"ms": {
"claimed": "DireWolf menyenaraikan Bina Darulaman Berhad di laman kebocorannya.",
"src": "6c08899641"
},
"actor_ids": [
"direwolf"
],
"id": "159974b3"
},
{
"org": "REDtone",
"sector": "telecom",
"date": "2026-01-11",
"type": "ransomware",
"actor": "Obscura",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "Obscura listed REDtone on its leak site.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/UkVEdG9uZUBvYnNjdXJh"
}
],
"checked": "2026-11-07",
"domain": "redtone.com",
"logo": "redtone.com",
"ms": {
"claimed": "Obscura menyenaraikan REDtone di laman kebocorannya.",
"src": "c458411047"
},
"actor_ids": [
"obscura"
],
"id": "85c2399d"
},
{
"org": "Perdana Petroleum",
"sector": "energy",
"date": "2026-01-13",
"type": "ransomware",
"actor": "DireWolf",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "DireWolf listed Perdana Petroleum Berhad on its leak site.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/UGVyZGFuYSBQZXRyb2xldW0gQmVyaGFkQGRpcmV3b2xm"
}
],
"checked": "2026-11-07",
"domain": "perdana.my",
"logo": "perdana.my",
"ms": {
"claimed": "DireWolf menyenaraikan Perdana Petroleum Berhad di laman kebocorannya.",
"src": "688dad47b4"
},
"actor_ids": [
"direwolf"
],
"id": "362178dc"
},
{
"org": "Kontena Nasional",
"sector": "transport",
"date": "2026-01-20",
"type": "ransomware",
"actor": "Qilin and The Gentlemen",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "Qilin and The Gentlemen each listed Kontena Nasional Berhad on their leak sites on the same day.",
"sources": [
{
"name": "ransomware.live (Qilin)",
"url": "https://www.ransomware.live/id/S29udGVuYSBOYXNpb25hbCBCZXJoYWRAcWlsaW4"
},
{
"name": "ransomware.live (The Gentlemen)",
"url": "https://www.ransomware.live/id/S29udGVuYSBOYXNpb25hbCBCZXJoYWRAdGhlZ2VudGxlbWVu"
}
],
"checked": "2026-11-07",
"domain": "kn.com.my",
"logo": "kn.com.my",
"ms": {
"claimed": "Qilin dan The Gentlemen masing-masing menyenaraikan Kontena Nasional Berhad di laman kebocoran mereka pada hari yang sama.",
"src": "18849bdcdd"
},
"actor_ids": [
"qilin",
"the-gentlemen"
],
"id": "214b4ff1"
},
{
"org": "Prince Court Medical Centre",
"sector": "health",
"date": "2026-02-05",
"type": "data-leak",
"actor": "0APT",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "0APT claimed a 1.5 TB leak from the private hospital.",
"sources": [
{
"name": "Breachsense",
"url": "https://www.breachsense.com/breaches/prince-court-medical-data-breach/"
}
],
"state": "Kuala Lumpur",
"checked": "2026-11-07",
"domain": "princecourt.com",
"logo": "princecourt.com",
"ms": {
"claimed": "0APT mendakwa kebocoran 1.5 TB daripada hospital swasta itu.",
"src": "66fe5eda0d"
},
"actor_ids": [
"0apt"
],
"id": "e227e324"
},
{
"org": "PLUS Malaysia",
"sector": "transport",
"date": "2026-02-06",
"type": "ransomware",
"actor": "The Gentlemen, then Qilin",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "The Gentlemen listed the highway operator on 6 February and Qilin listed it again on 1 March.",
"sources": [
{
"name": "ransomware.live (The Gentlemen)",
"url": "https://www.ransomware.live/id/UExVUyBNYWxheXNpYSBCZXJoYWRAdGhlZ2VudGxlbWVu"
},
{
"name": "ransomware.live (Qilin)",
"url": "https://www.ransomware.live/id/UExVUyBNYWxheXNpYSBCZXJoYWRAcWlsaW4"
}
],
"state": "Selangor",
"checked": "2026-11-07",
"domain": "plus.com.my",
"logo": "plus.com.my",
"ms": {
"claimed": "The Gentlemen menyenaraikan pengendali lebuh raya itu pada 6 Februari dan Qilin menyenaraikannya sekali lagi pada 1 Mac.",
"src": "644b4276ae"
},
"actor_ids": [
"the-gentlemen",
"qilin"
],
"id": "fe103e22"
},
{
"org": "WCT Holdings",
"sector": "property",
"date": "2026-02-11",
"type": "ransomware",
"actor": "The Gentlemen",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "The Gentlemen listed WCT Holdings Berhad on its leak site.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/V0NUIEhvbGRpbmdzIEJlcmhhZEB0aGVnZW50bGVtZW4"
}
],
"checked": "2026-11-07",
"domain": "wct.com.my",
"logo": "wct.com.my",
"ms": {
"claimed": "The Gentlemen menyenaraikan WCT Holdings Berhad di laman kebocorannya.",
"src": "12491ad37b"
},
"actor_ids": [
"the-gentlemen"
],
"id": "532b7b61"
},
{
"org": "Malaysia Airlines",
"sector": "transport",
"date": "2026-02-26",
"type": "ransomware",
"actor": "Qilin",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "Qilin listed Malaysia Airlines on its leak site without data samples, separate from the later Amadeus incident.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/TWFsYXlzaWEgQWlybGluZXNAcWlsaW4"
},
{
"name": "SC Media",
"url": "https://www.scworld.com/brief/malaysia-airlines-allegedly-breached-by-qilin"
}
],
"state": "Selangor",
"checked": "2026-11-07",
"domain": "malaysiaairlines.com",
"logo": "malaysiaairlines.com",
"ms": {
"claimed": "Qilin menyenaraikan Malaysia Airlines di laman kebocorannya tanpa sampel data, berasingan daripada insiden Amadeus kemudiannya.",
"src": "939d7c7a52"
},
"actor_ids": [
"qilin"
],
"id": "6cc57e5d"
},
{
"org": "Omesti",
"sector": "other",
"date": "2026-03-03",
"type": "ransomware",
"actor": "Qilin",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "Qilin listed Omesti Berhad on its leak site.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/T21lc3RpIEJlcmhhZEBxaWxpbg"
}
],
"checked": "2026-11-07",
"domain": "omesti.com",
"logo": "omesti.com",
"ms": {
"claimed": "Qilin menyenaraikan Omesti Berhad di laman kebocorannya.",
"src": "d6548d3a73"
},
"actor_ids": [
"qilin"
],
"id": "697793d6"
},
{
"org": "Lam Soon Group",
"sector": "manufacturing",
"date": "2026-03-03",
"type": "ransomware",
"actor": "Qilin",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "Qilin listed Lam Soon Group on its leak site.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/TGFtIFNvb24gR3JvdXBAcWlsaW4"
}
],
"checked": "2026-11-07",
"domain": "lamsoon.com.my",
"ms": {
"claimed": "Qilin menyenaraikan Lam Soon Group di laman kebocorannya.",
"src": "268aa33e84"
},
"actor_ids": [
"qilin"
],
"id": "7740307d"
},
{
"org": "Kerjaya Prospek Group",
"sector": "property",
"date": "2026-03-27",
"type": "ransomware",
"actor": "Qilin",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "Qilin listed Kerjaya Prospek Group on its leak site.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/S2VyamF5YSBQcm9zcGVrIEdyb3VwQHFpbGlu"
}
],
"checked": "2026-11-07",
"domain": "kerjayagroup.com",
"ms": {
"claimed": "Qilin menyenaraikan Kerjaya Prospek Group di laman kebocorannya.",
"src": "03b7885ce2"
},
"actor_ids": [
"qilin"
],
"id": "38d857c9"
},
{
"org": "Keretapi Tanah Melayu (KTMB)",
"sector": "transport",
"date": "2026-05-06",
"type": "ransomware",
"actor": "The Gentlemen",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "The Gentlemen listed KTMB (ktmb.com.my) with an estimated attack date of 3 May.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/S2VyZXRhcGkgVGFuYWhAdGhlZ2VudGxlbWVu"
}
],
"state": "Kuala Lumpur",
"checked": "2026-11-07",
"domain": "ktmb.com.my",
"ms": {
"claimed": "The Gentlemen menyenaraikan KTMB (ktmb.com.my) dengan anggaran tarikh serangan 3 Mei.",
"src": "8ec857581b"
},
"logo": "ktmb.com.my",
"actor_ids": [
"the-gentlemen"
],
"id": "a1e96b83"
},
{
"org": "Majlis Perbandaran Alor Gajah",
"sector": "government",
"date": "2026-05-17",
"type": "ransomware",
"actor": "Qilin",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "Qilin listed the Alor Gajah municipal council on its leak site.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/TWFqbGlzIFBlcmJhbmRhcmFuIEFsb3IgR2FqYWhAcWlsaW4"
}
],
"state": "Melaka",
"checked": "2026-11-07",
"domain": "mpag.gov.my",
"logo": "mpag.gov.my",
"ms": {
"claimed": "Qilin menyenaraikan Majlis Perbandaran Alor Gajah di laman kebocorannya.",
"src": "140b095ef5"
},
"actor_ids": [
"qilin"
],
"id": "f8ccfceb"
},
{
"org": "PNSB Insurance Brokers",
"sector": "finance",
"date": "2026-05-17",
"type": "ransomware",
"actor": "Qilin",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "Qilin listed PNSB Insurance Brokers Sdn Bhd on its leak site.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/UE5TQiBJbnN1cmFuY2UgQnJva2VycyBTZG4gQmhkQHFpbGlu"
}
],
"checked": "2026-11-07",
"domain": "pnsbinsbroker.com.my",
"logo": "pnsbinsbroker.com.my",
"ms": {
"claimed": "Qilin menyenaraikan PNSB Insurance Brokers Sdn Bhd di laman kebocorannya.",
"src": "0c13c85ea6"
},
"actor_ids": [
"qilin"
],
"id": "0cab1379"
},
{
"org": "UiTM Holdings",
"sector": "education",
"date": "2026-06-11",
"type": "ransomware",
"actor": "The Gentlemen",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "The Gentlemen listed UiTM Holdings, the investment arm of UiTM, with an estimated attack date of 10 June.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/VWlUTSBIb2xkaW5nc0B0aGVnZW50bGVtZW4"
}
],
"state": "Selangor",
"checked": "2026-11-07",
"domain": "uitmholdings.com",
"logo": "uitmholdings.com",
"ms": {
"claimed": "The Gentlemen menyenaraikan UiTM Holdings, cabang pelaburan UiTM, dengan anggaran tarikh serangan 10 Jun.",
"src": "e3110287e3"
},
"actor_ids": [
"the-gentlemen"
],
"id": "87816ae0"
},
{
"org": "Intellectual Property Corporation of Malaysia (MyIPO)",
"sector": "government",
"date": "2026-06-13",
"type": "ransomware",
"actor": "Payload",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "Payload listed myipo.gov.my on its leak site.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/bXlpcG8uZ292Lm15QHBheWxvYWQ"
}
],
"state": "Kuala Lumpur",
"checked": "2026-11-07",
"domain": "myipo.gov.my",
"logo": "myipo.gov.my",
"ms": {
"claimed": "Payload menyenaraikan myipo.gov.my di laman kebocorannya.",
"src": "3342b22bb2"
},
"actor_ids": [
"payload"
],
"id": "174aa627"
},
{
"org": "SGS Malaysia",
"sector": "other",
"date": "2026-06-20",
"type": "ransomware",
"actor": "The Gentlemen",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "The Gentlemen listed SGS Malaysia with an estimated attack date of 18 June.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/U0dTIE1hbGF5c2lhQHRoZWdlbnRsZW1lbg"
}
],
"checked": "2026-11-07",
"domain": "sgs.com",
"logo": "sgs.com",
"ms": {
"claimed": "The Gentlemen menyenaraikan SGS Malaysia dengan anggaran tarikh serangan 18 Jun.",
"src": "29d9902914"
},
"actor_ids": [
"the-gentlemen"
],
"id": "8e4f025f"
},
{
"org": "Sunway Berhad",
"sector": "property",
"date": "2026-07-23",
"type": "ransomware",
"actor": "Qilin",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "Qilin listed Sunway Berhad (sunway.com.my) on its leak site.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/U3Vud2F5IEJlcmhhZEBxaWxpbg"
}
],
"state": "Selangor",
"checked": "2026-11-07",
"domain": "sunway.com.my",
"logo": "sunway.com.my",
"ms": {
"claimed": "Qilin menyenaraikan Sunway Berhad (sunway.com.my) di laman kebocorannya.",
"src": "47144e2d19"
},
"actor_ids": [
"qilin"
],
"id": "82a329e6"
},
{
"org": "Malaysian Nuclear Agency (Nuklear Malaysia)",
"sector": "government",
"date": "2026-07-30",
"type": "ransomware",
"actor": "The Gentlemen",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "The Gentlemen listed the Malaysian Nuclear Agency with an estimated attack date of 29 July.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/TWFsYXlzaWFuIE51Y2xlYXIgQWdlbmN5QHRoZWdlbnRsZW1lbg"
}
],
"state": "Selangor",
"checked": "2026-11-07",
"domain": "nuclearmalaysia.gov.my",
"logo": "nuclearmalaysia.gov.my",
"ms": {
"claimed": "The Gentlemen menyenaraikan Agensi Nuklear Malaysia dengan anggaran tarikh serangan 29 Julai.",
"src": "3ef6b7da27"
},
"actor_ids": [
"the-gentlemen"
],
"id": "53c26dcb"
},
{
"org": "CareClinics",
"sector": "health",
"date": "2026-08-29",
"type": "ransomware",
"actor": "Qilin",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "Qilin listed the CareClinics primary care network on its leak site.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/Q2FyZUNsaW5pY3NAcWlsaW4"
}
],
"checked": "2026-11-07",
"domain": "careclinics.com.my",
"logo": "careclinics.com.my",
"ms": {
"claimed": "Qilin menyenaraikan rangkaian klinik penjagaan primer CareClinics di laman kebocorannya.",
"src": "ca31c515f0"
},
"actor_ids": [
"qilin"
],
"id": "247c9e58"
},
{
"org": "EP Manufacturing (EPMB)",
"sector": "manufacturing",
"date": "2026-08-31",
"type": "ransomware",
"actor": "The Gentlemen",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "The Gentlemen listed EP Manufacturing Bhd on its leak site.",
"sources": [
{
"name": "ransomware.live (Malaysia map)",
"url": "https://www.ransomware.live/map/MY"
}
],
"checked": "2026-11-07",
"domain": "epmb.com.my",
"logo": "epmb.com.my",
"ms": {
"claimed": "The Gentlemen menyenaraikan EP Manufacturing Bhd di laman kebocorannya.",
"src": "e4d38e59eb"
},
"actor_ids": [
"the-gentlemen"
],
"id": "66ef9a5b"
},
{
"org": "OCK Group",
"sector": "telecom",
"date": "2026-10-17",
"type": "ransomware",
"actor": "LockBit 5",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "LockBit 5 listed ock.com.my with an estimated attack date of 16 October.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/b2NrLmNvbS5teUBsb2NrYml0NQ"
}
],
"checked": "2026-11-07",
"domain": "ock.com.my",
"ms": {
"claimed": "LockBit 5 menyenaraikan ock.com.my dengan anggaran tarikh serangan 16 Oktober.",
"src": "047e762e58"
},
"actor_ids": [
"lockbit-5-0"
],
"id": "074cc780"
},
{
"org": "Astino",
"sector": "manufacturing",
"date": "2026-11-02",
"type": "ransomware",
"actor": "Qilin",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "Qilin listed Astino Berhad on its leak site.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/QXN0aW5vIEJlcmhhZEBxaWxpbg"
}
],
"checked": "2026-11-07",
"domain": "astino.com.my",
"logo": "astino.com.my",
"ms": {
"claimed": "Qilin menyenaraikan Astino Berhad di laman kebocorannya.",
"src": "ebf96d32a1"
},
"actor_ids": [
"qilin"
],
"id": "9f363f13"
}
],
"slug": "malaysia",
"title": "Malaysia Cyber Threat Level: Medium, 2026 Incidents · pwnsy",
"lede": "Threat level Medium since 4 Nov 2026. 19 incidents confirmed, 35 claims in 2026.",
"h1": "![\"\"](\"/tools/cyber-watch/flags/my.svg\")
Malaysia Cyber Watch",
"desc": "Malaysia cyber threat level: Medium. 19 incidents confirmed and 35 claims in 2026, each sourced. Updated 8 Nov 2026.",
"since": "2026-01-01",
"stats": [
{
"label": "Cyber999 incidents, Q3 2025 (total 2,020): fraud 1,521, intrusion 173, data breach 142, intrusion attempt 78, malicious code 63, vulnerability reports 17, spam 16, DoS 10",
"value": "2,020",
"period": "Q3 2025",
"source": {
"name": "MyCERT SR-033.042026",
"url": "https://www.mycert.org.my/portal/advisory?id=SR-033.042026"
}
},
{
"label": "Cyber999 incidents, Q4 2025 (total 1,881): fraud 1,471, data breach 171, intrusion 101, intrusion attempt 73, malicious code 40, spam 13, vulnerability reports 10, DoS 2",
"value": "1,881",
"period": "Q4 2025 (report dated 11 April 2026)",
"source": {
"name": "MyCERT SR-033.042026",
"url": "https://www.mycert.org.my/portal/advisory?id=SR-033.042026"
}
},
{
"label": "Ransomware incidents reported to MyCERT, Q4 2025 (Qilin 2; Loki Locker, QuickLock, BitLocker, DireWolf, Enzo, NasLock 1 each; 1 unidentified)",
"value": "9",
"period": "Q4 2025",
"source": {
"name": "MyCERT SR-033.042026",
"url": "https://www.mycert.org.my/portal/advisory?id=SR-033.042026"
}
},
{
"label": "Cyber999 incidents, Q1 2026 (total 2,188): fraud 1,829, data breach 124, intrusion attempt 81, intrusion 64, spam 31, malicious code 28, vulnerability reports 26, DoS 5",
"value": "2,188",
"period": "Q1 2026",
"source": {
"name": "CyberSecurity Malaysia, Q1 2026 Cyber Incident Summary Report",
"url": "https://www.cybersecurity.my/portal-main/advisories-details/21046861-ac28-11f1-b812-0050568ccc16"
}
},
{
"label": "Cyber999 incidents, Q2 2026 (total 2,715, up 24.09%): fraud 2,314, data breach 175, intrusion attempt 91, intrusion 51, malicious code 34, spam 32, vulnerability reports 17, DoS 1",
"value": "2,715",
"period": "Q2 2026 (published 2 September 2026)",
"source": {
"name": "CyberSecurity Malaysia, Q2 2026 Cyber Incident Summary Report",
"url": "https://www.cybersecurity.my/portal-main/advisories-details/16acf41b-a6d5-11f1-b812-0050568ccc16"
}
},
{
"label": "Losses reported to NSRC 997 hotline (468,675 calls)",
"value": "RM1.2 billion",
"period": "12 October 2022 to August 2026",
"source": {
"name": "Malay Mail (Home Minister in Dewan Rakyat, 27 Oct 2026)",
"url": "https://www.malaymail.com/news/malaysia/2026/10/27/saifuddin-nasution-rm143m-returned-to-online-scam-victims-rm1009m-losses-prevented/240823"
}
},
{
"label": "Scam money returned to victims by NSRC / losses prevented",
"value": "RM14.3 million returned; RM100.93 million prevented",
"period": "October 2022 to September 2026",
"source": {
"name": "Malay Mail",
"url": "https://www.malaymail.com/news/malaysia/2026/10/27/saifuddin-nasution-rm143m-returned-to-online-scam-victims-rm1009m-losses-prevented/240823"
}
},
{
"label": "Anti-scam raids and arrests",
"value": "968 raids, 7,262 arrests",
"period": "2024 to September 2026",
"source": {
"name": "The Vibes (Home Minister)",
"url": "https://www.thevibes.com/articles/news/128865/online-scam-losses-hit-rm1.2b-but-only-rm14.3m-recovered-home-minster-says"
}
},
{
"label": "E-commerce scam losses",
"value": "Over RM430 million",
"period": "Q1 2026",
"source": {
"name": "The Edge Malaysia (Minister Armizan Mohd Ali)",
"url": "https://theedgemalaysia.com/node/809191"
}
},
{
"label": "QR code scam cases and losses (CCID)",
"value": "5,134 cases, RM28.67 million",
"period": "January to June 2026",
"source": {
"name": "The Star",
"url": "https://www.thestar.com.my/news/nation/2026/09/03/cops-qr-code-scams-on-the-rise"
}
},
{
"label": "Online fraud charges filed (2025 full year: 6,140)",
"value": "8,014 charges; 10,245 arrests",
"period": "2026 to May",
"source": {
"name": "The Star (Deputy PM Zahid in Dewan Negara)",
"url": "https://www.thestar.com.my/news/nation/2026/07/21/zahid-fraud-charges-surge-past-2025s-total"
}
},
{
"label": "Attempted fraudulent transactions blocked by the financial sector (RM1.2 billion in all of 2025); about 95% of online fraud cases involved victims transferring funds themselves",
"value": "RM1.9 billion",
"period": "H1 2026",
"source": {
"name": "Media Selangor / Bernama (BNM Governor, 6 Oct 2026)",
"url": "https://mediaselangor.com/en/2026/10/399563"
}
},
{
"label": "BNM penalty on Bank Rakyat for RMiT and customer information breaches after external intrusion",
"value": "RM1 million (imposed 20 Jan 2026, paid 26 Jan 2026)",
"period": "2026",
"source": {
"name": "The Star",
"url": "https://www.thestar.com.my/business/business-news/2026/04/01/bank-negara-fines-bank-rakyat-rm1mil-for-cybersecurity-customer-information-protection-breaches"
}
},
{
"label": "NC4 alerts and advisories on vulnerabilities affecting NCII entities and government agencies",
"value": "8",
"period": "October 2026",
"source": {
"name": "Bernama",
"url": "https://www.bernama.com/en/general/news.php?id=2630182"
}
},
{
"label": "National Cyber Threat Level",
"value": "Medium (raised from Low on 4 Nov 2026; still Medium on 7 Nov)",
"period": "November 2026",
"source": {
"name": "Bernama",
"url": "https://www.bernama.com/bm/am/news.php?id=2631489"
}
},
{
"label": "Compromised government and university hosts serving gambling SEO spam (vendor count quoted by Malaysiakini)",
"value": "83",
"period": "October 2026",
"source": {
"name": "Malaysiakini (Syntx Sdn Bhd figure)",
"url": "https://www.malaysiakini.com/news/887446-govt-websites-still-getting-hijacked-by-online-casinos"
}
}
],
"rules": [
{
"date": "2025-06-01",
"title": "PDPA amendment phase 3 (before the window, still the current baseline)",
"what": "Mandatory DPO appointment (s12), breach notification to the Commissioner and to affected people where significant harm is likely (s12B), and data portability (s43A) took effect in June 2025; no transmission period for portability has been prescribed.",
"url": "https://www.mayerbrown.com/en/insights/publications/2025/07/from-legislative-reform-to-practical-guidance-key-amendments-to-malaysias-pdpa-and-the-launch-of-cross-border-transfer-guidelines"
},
{
"date": "2026-01-01",
"title": "Online Safety Act 2025 in force",
"what": "ONSA took effect for ASP, CASP and NSP licensees, and the CMA 1998 s46A deeming provision brought social media platforms meeting the licensing criteria under the licensing framework.",
"url": "https://www.malaymail.com/news/malaysia/2026/01/01/enforcement-of-online-safety-act-takes-effect-strengthening-online-protections-for-children-and-families-says-mcmc/203923"
},
{
"date": "2026-03-12",
"title": "Bursa Malaysia review of broker IT Security Standards",
"what": "Bursa said it is reviewing its IT Security Standards for brokers including vendor oversight, with the enhanced framework targeted for Q4 2026.",
"url": "https://www.thestar.com.my/business/business-news/2026/03/12/bursa-malaysia-broker-level-cyber-incidents-contained"
},
{
"date": "2026-06-01",
"title": "ONSA Child Protection Code and Risk Mitigation Code effective",
"what": "MCMC published both codes on 22 May 2026, effective 1 June, requiring child safety by design, safeguards limiting account registration by under-16s, risk assessments, advertiser verification and labelling of manipulated content.",
"url": "https://www.thestar.com.my/news/nation/2026/05/22/stricter-safeguards-for-children-under-changes-to-online-safety-law-from-june-1"
},
{
"date": "2026-07-01",
"title": "NACSA cyber security service provider licensing forms",
"what": "NACSA's licensing portal states new, renewal and resubmitted applications for managed SOC and penetration testing licences must use the latest Forms A, B and C from 1 July 2026.",
"url": "https://licence.nacsa.gov.my/"
},
{
"date": "2026-07-20",
"title": "Cybercrimes Bill 2026 passed by Parliament",
"what": "The bill, passed by the Dewan Rakyat on 1 July and the Dewan Negara on 20 July, repeals the Computer Crimes Act 1997 and adds offences including identity theft, NDID credential misuse, AI-manipulated content used in crime and intimate image dissemination, with heavier penalties where NCII is involved.",
"url": "https://www.bernama.com/en/general/news.php?id=2583510"
},
{
"date": "2026-09-25",
"title": "BNM revised RMiT policy document with NCII Code of Practice",
"what": "BNM reissued RMiT (superseding the June 2023 version) with a NACSA-endorsed Code of Practice for designated banking and finance NCII entities that prevails over general RMiT where they conflict, plus stronger third-party and cyber risk requirements.",
"url": "https://www.allenandgledhill.com/perspectives/publications/bulletins-malaysia/2026/bank-negara-malaysia-revises-risk-management-in-technology-policy-document/"
},
{
"date": "2026-11-04",
"title": "NACSA nine mandatory preparedness measures for NCII entities",
"what": "With the threat level raised to Medium, all NCII entities must apply nine measures including 24-hour monitoring, patching, MFA and updated service continuity plans, and sector heads must send NACSA weekly threat status reports.",
"url": "https://www.bernama.com/en/general/news.php?id=2630182"
}
],
"actors": [
{
"name": "Qilin",
"kind": "ransomware",
"seen": "Listed Malaysia Airlines, PLUS, Omesti, Lam Soon, Kerjaya Prospek, Kontena Nasional, MP Alor Gajah, PNSB Insurance Brokers, Sunway, CareClinics, Pengurusan Aset Air and Astino in 2026, and was the top variant in MyCERT's Q4 2025 count.",
"sources": [
{
"name": "ransomware.live Malaysia",
"url": "https://www.ransomware.live/map/MY"
},
{
"name": "MyCERT SR-033.042026",
"url": "https://www.mycert.org.my/portal/advisory?id=SR-033.042026"
}
],
"actor_id": "qilin"
},
{
"name": "The Gentlemen",
"kind": "ransomware",
"seen": "Listed PLUS, WCT, Kontena Nasional, KTMB, UiTM Holdings, SGS Malaysia, the Malaysian Nuclear Agency and EP Manufacturing between February and August 2026.",
"sources": [
{
"name": "ransomware.live Malaysia",
"url": "https://www.ransomware.live/map/MY"
}
],
"actor_id": "the-gentlemen"
},
{
"name": "DireWolf",
"kind": "ransomware",
"seen": "Listed Bina Darulaman, Sunzen Biotech, Perdana Petroleum and Chemsain Konsultant in January 2026 and Port of Tanjung Pelepas in September.",
"sources": [
{
"name": "ransomware.live Malaysia",
"url": "https://www.ransomware.live/map/MY"
}
],
"actor_id": "direwolf"
},
{
"name": "Payload",
"kind": "ransomware",
"seen": "Listed MyIPO (myipo.gov.my) in June 2026 plus Villea Hotels and a group of manufacturing domains in May.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/bXlpcG8uZ292Lm15QHBheWxvYWQ"
}
],
"actor_id": "payload"
},
{
"name": "Lamashtu",
"kind": "ransomware",
"seen": "Listed several Malaysian firms from April to May 2026 including Malaysian NPK Fertilizer, Jesin Group and MSC Group.",
"sources": [
{
"name": "ransomware.live Malaysia",
"url": "https://www.ransomware.live/map/MY"
}
],
"actor_id": "lamashtu"
},
{
"name": "Orova",
"kind": "ransomware",
"seen": "Listed MARDEC, Alfameli Group, Wah Chan Consolidated and Bright Property Service in October and November 2026.",
"sources": [
{
"name": "ransomware.live Malaysia",
"url": "https://www.ransomware.live/map/MY"
}
],
"actor_id": "orova"
},
{
"name": "Obscura",
"kind": "ransomware",
"seen": "Listed telco REDtone in January 2026.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/UkVEdG9uZUBvYnNjdXJh"
}
],
"actor_id": "obscura"
},
{
"name": "LockBit 5",
"kind": "ransomware",
"seen": "Listed OCK Group in October 2026.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/b2NrLmNvbS5teUBsb2NrYml0NQ"
}
],
"actor_id": "lockbit-5-0"
},
{
"name": "ShinyHunters",
"kind": "extortion",
"seen": "Claimed more than 40 GB from the University of Nottingham records system covering its Malaysia campus in June 2026.",
"sources": [
{
"name": "Free Malaysia Today",
"url": "https://www.freemalaysiatoday.com/category/nation/2026/06/11/university-of-nottingham-malaysia-still-assessing-impact-of-cyberattack"
}
],
"actor_id": "shinyhunters"
},
{
"name": "0APT",
"kind": "extortion",
"seen": "Claimed a 1.5 TB leak from Prince Court Medical Centre in February 2026.",
"sources": [
{
"name": "Breachsense",
"url": "https://www.breachsense.com/breaches/prince-court-medical-data-breach/"
}
],
"actor_id": "0apt"
},
{
"name": "Ashborn",
"kind": "unknown",
"seen": "Offered Malaysian Army personnel records and MINDEF, KDN, KPT, MARA and GITN databases on a cybercrime forum in February 2026.",
"sources": [
{
"name": "Lowyat.NET",
"url": "https://www.lowyat.net/2026/384504/threat-actor-allegedly-selling-malaysian-army-ministry-data-on-dark-web/"
}
],
"actor_id": "ashborn"
},
{
"name": "Mushr00w",
"kind": "hacktivist",
"seen": "Left its name on the defaced Health Ministry homepage in the June 2026 Joomla extension wave that NACSA confirmed.",
"sources": [
{
"name": "The Star",
"url": "https://www.thestar.com.my/news/nation/2026/06/28/govt-websites-hacked-says-nacsa"
}
],
"actor_id": "mushr00w"
},
{
"name": "MARLANWG",
"kind": "unknown",
"seen": "Defaced Bank Rakyat's third-party-managed website in November 2026 and claims internal access and sample data, which the bank has not confirmed.",
"sources": [
{
"name": "Focus Malaysia",
"url": "https://focusmalaysia.my/a-sign-of-escalating-cyberattack-in-malaysia-after-bank-rakyat-becomes-latest-victim-of-hacking/"
},
{
"name": "The Star",
"url": "https://www.thestar.com.my/news/nation/2026/11/07/malaysia039s-online-banking-system-remains-secure-says-comms-minister"
}
],
"actor_id": "marlanwg"
},
{
"name": "Leakers$ (also reported as LeakersGov)",
"kind": "hacktivist",
"seen": "Claimed the October 2026 hijack of Kluang council LED screens, saying it exploited LED content software to expose weak security.",
"sources": [
{
"name": "SAYS",
"url": "https://says.com/my/news/hacker-group-explains-why-hijack-digital-billboards-malaysia-display-adult-content"
}
],
"actor_id": "leakers"
},
{
"name": "TGR-STA-1030",
"kind": "state",
"seen": "Named by Unit 42 as a state-aligned Asian group that compromised Malaysian ministries and a microloan lender for immigration and economic data, which NACSA is investigating.",
"sources": [
{
"name": "The Star",
"url": "https://www.thestar.com.my/tech/tech-news/2026/02/07/nacsa-investigating-alleged-cyber-espionage-targeting-multiple-government-bodies"
}
],
"actor_id": "tgr-sta-1030"
},
{
"name": "Unnamed China-linked APT",
"kind": "state",
"seen": "AhnLab reported document-based attacks on government agencies in the region alongside hacktivist defacements centred in Malaysia in June 2026.",
"sources": [
{
"name": "AhnLab ASEC",
"url": "https://asec.ahnlab.com/en/94417/"
}
]
},
{
"name": "C3RB3R",
"kind": "ransomware",
"seen": "A Cerber-family variant that MyCERT warned on 7 November 2026 is mass-encrypting internet-exposed Synology NAS devices, renaming files with .L0CK3D and leaving read-me3.txt notes; no decryptor exists.",
"sources": [
{
"name": "MyCERT MA-1500.112026",
"url": "https://www.mycert.org.my/portal/advisory?id=MA-1500.112026"
}
]
}
],
"region": "Southeast Asia",
"upd": "2026-11-08"
},
"SG": {
"name": "Singapore",
"posture": {
"level": "",
"summary": "CSA issues alerts and advisories instead, and launched the Singapore Cybersecurity Strategy 2026 on 13 Oct 2026.",
"agency": "Cyber Security Agency of Singapore (CSA)",
"source": {
"name": "Cyber Security Agency of Singapore (CSA)",
"url": "https://www.csa.gov.sg/alerts-and-advisories/"
},
"checked": "2026-11-07"
},
"timeline": [
{
"date": "2026-09-30",
"text": "Advisory on the CARBONATO botnet campaign targeting exposed Docker daemons.",
"url": "https://www.csa.gov.sg/alerts-and-advisories/advisories/ad-2026-012/",
"src": "CSA"
},
{
"date": "2026-10-13",
"text": "Launch of the Singapore Cybersecurity Strategy 2026, including an enhanced national cyber command centre for critical infrastructure.",
"url": "https://sg.finance.yahoo.com/news/singapore-updates-national-cybersecurity-strategy-224440364.html",
"src": "Yahoo Finance"
},
{
"date": "2026-10-21",
"text": "Alert on critical PHP2Shell vulnerabilities (CVE-2026-109618, CVE-2026-109619) allowing unauthenticated remote code execution.",
"url": "https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-151/",
"src": "CSA"
},
{
"date": "2026-10-28",
"text": "Advisory on malware campaigns spreading through WhatsApp.",
"url": "https://www.csa.gov.sg/alerts-and-advisories/advisories/ad-2026-013/",
"src": "CSA"
},
{
"date": "2026-11-03",
"text": "Alert on active exploitation of PHP2Shell against network and security products including Palo Alto Networks firewalls.",
"url": "https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-157/",
"src": "CSA"
},
{
"date": "2026-11-06",
"text": "Advisory on attacks against remotely accessible operational technology control systems, citing the European supermarket refrigeration attacks.",
"url": "https://www.csa.gov.sg/alerts-and-advisories/advisories/ad-2026-014/",
"src": "CSA"
},
{
"date": "2026-01-08",
"text": "PDPC published decisions fining People Central, Singapore Data Hub, Air Sino-Euro Associates Travel and Goldheart Jewelry over data breaches.",
"url": "https://www.pdpc.gov.sg/media-events/new-commissions-decisions-and-undertaking-on-8-january-2026",
"src": "PDPC"
},
{
"date": "2026-02-09",
"text": "CSA disclosed that UNC3886 had targeted all four major telcos and that Operation Cyber Guardian, its largest coordinated cyber response, had contained the intrusion.",
"url": "https://www.csa.gov.sg/news-events/press-releases/largest-multi-agency-cyber-operation-mounted-to-counter-threat-posed-by-advanced-persistent-threat--apt--actor-unc3886-to-singapore-s-telecommunications-sector/",
"src": "CSA"
},
{
"date": "2026-02-25",
"text": "SPF reported 41,974 scam and cybercrime cases in 2025, down 24.8%, with scam losses of S$913.1 million.",
"url": "https://www.police.gov.sg/media-hub/police-life/2026/02/scams-and-cybercrime-fell-by-almost-a-quarter-in-2025",
"src": "SPF"
},
{
"date": "2026-02-26",
"text": "PDPC published a ransomware decision against SESAMi and Abecha and accepted undertakings from Cycle & Carriage, Lian Beng Group and St Francis Methodist School.",
"url": "https://www.pdpc.gov.sg/all-commissions-decisions/2026/02/breach-of-the-protection-obligation-by-sesami-singapore-pte-ltd-and-abecha-pte-ltd",
"src": "PDPC"
},
{
"date": "2026-03-02",
"text": "At the Committee of Supply, CSA announced Cyber Trust Mark requirements for CII owners, CII auditors and licensed cybersecurity providers.",
"url": "https://www.csa.gov.sg/news-events/press-releases/csa-to-raise-cybersecurity-standards-for-critical-information-infrastructure-owners/",
"src": "CSA"
},
{
"date": "2026-06-30",
"text": "CSA released the Singapore Cyber Landscape 2025/2026, reporting 165 ransomware cases and 284,300 infected systems in 2025.",
"url": "https://www.csa.gov.sg/news-events/press-releases/csa-s-initiatives-to-strengthen-singapore-s-cyber-defences-amid-an-ai-driven-threat-landscape/",
"src": "CSA"
},
{
"date": "2026-07-03",
"text": "SLA said an IBM-managed test cloud environment holding data of about 70,000 people was accessed without authorisation.",
"url": "https://www.sla.gov.sg/news/press-release/security-incident-involving-an-ibm-managed-cloud-environment-/",
"src": "SLA"
},
{
"date": "2026-08-18",
"text": "SPF announced new OCHA Codes of Practice for messaging, social media and e-commerce services issued on 17 August.",
"url": "https://www.police.gov.sg/media-hub/news/2026/08/20260818_issuance_of_codes_of_practice_under_the_online_criminal_harms_act",
"src": "SPF"
},
{
"date": "2026-08-26",
"text": "SPF reported scam losses of about S$410.6 million in the first half of 2026, down 17.9%.",
"url": "https://www.police.gov.sg/-/media/SPF/Media-Room/Statistics/Mid-Year-Scam-and-Cybercrime-Brief-2026/Mid-Year-Scam-and-Cybercrime-Brief-2026.pdf",
"src": "SPF"
},
{
"date": "2026-09-08",
"text": "MHA moved the second reading of the Scams (Countermeasures) and Other Matters Bill, which Parliament passed the next day.",
"url": "https://www.mha.gov.sg/media-room/newsroom/second-reading-of-the-scams-countermeasures-and-other-matters-bill/",
"src": "MHA"
},
{
"date": "2026-10-07",
"text": "Parliament passed the Digital Infrastructure Bill, and MAS issued its Guidelines on AI Risk Management.",
"url": "https://www.bakermckenzie.com/en/insight/publications/2026/10/singapore-parliament-passes-digital-infrastructure-bill",
"src": "Parliament"
},
{
"date": "2026-10-13",
"text": "Senior Minister K Shanmugam launched Singapore's Cybersecurity Strategy 2026 at Singapore International Cyber Week.",
"url": "https://www.csa.gov.sg/news-events/press-releases/singapore-launches-cybersecurity-strategy-2026-to-strengthen-national-cyber-resilience/",
"src": "CSA"
},
{
"date": "2026-01-08",
"text": "The PDPC fined Singapore Data Hub S$17,500 after at least two threat actors accessed its servers in 2024 and exfiltrated personal data that was likely posted on a hacking forum.",
"url": "https://www.pdpc.gov.sg/all-commissions-decisions/2026/01/breach-of-the-protection-obligation-by-singapore-data-hub-pte-ltd",
"src": "PDPC decision",
"kind": "enforcement"
},
{
"date": "2026-01-08",
"text": "The PDPC fined HR software provider People Central S$17,500 after a threat actor exploited SQL injection flaws, deleted databases and likely exfiltrated data of 95,000 client employees, which was later found for sale on the dark web.",
"url": "https://www.pdpc.gov.sg/all-commissions-decisions/2026/01/breach-of-the-protection-obligation-by-people-central-pte-ltd",
"src": "PDPC decision",
"kind": "enforcement"
},
{
"date": "2026-01-08",
"text": "The PDPC fined the travel agency S$47,000 after a cyberattack exfiltrated personal data of 336,759 people, citing an outdated operating system, no MFA on privileged accounts and no data protection officer.",
"url": "https://www.bakermckenzie.com/en/insight/publications/2026/01/singapore-pdpc-fines-travel-agency-for-data-breach",
"src": "Baker McKenzie",
"kind": "enforcement"
},
{
"date": "2026-01-08",
"text": "The PDPC fined Goldheart Jewelry, an Aspial subsidiary, S$58,000 after attackers exploited its unpatched Magento store, exfiltrated data of 41,379 customers and published the database on an online forum.",
"url": "https://www.pdpc.gov.sg/assets/852799ab-b5a0-4c88-a4d7-4ba1fe1f2786",
"src": "PDPC decision PDF",
"kind": "enforcement"
},
{
"date": "2026-02-26",
"text": "The PDPC fined SESAMi S$8,750 and issued directions to it and subsidiary Abecha after a 2024 ransomware attack encrypted a shared drive holding personal data, including bank and card details, of about 39,000 people.",
"url": "https://www.pdpc.gov.sg/all-commissions-decisions/2026/02/breach-of-the-protection-obligation-by-sesami-singapore-pte-ltd-and-abecha-pte-ltd",
"src": "PDPC decision",
"kind": "enforcement"
},
{
"date": "2026-02-26",
"text": "The PDPC accepted a voluntary undertaking from Cycle & Carriage Industries over a ransomware and system compromise incident linked to outdated systems, missing MFA and weak credential controls.",
"url": "https://www.bakermckenzie.com/en/insight/publications/2026/03/singapore-recent-pdpc-decisions-emphasise-ransomware-risks",
"src": "Baker McKenzie",
"kind": "enforcement"
},
{
"date": "2026-02-26",
"text": "The PDPC accepted a voluntary undertaking from Lian Beng Group over a ransomware and system compromise incident linked to outdated systems, missing MFA and weak credential controls.",
"url": "https://www.bakermckenzie.com/en/insight/publications/2026/03/singapore-recent-pdpc-decisions-emphasise-ransomware-risks",
"src": "Baker McKenzie",
"kind": "enforcement"
},
{
"date": "2026-02-26",
"text": "The PDPC accepted a voluntary undertaking from St Francis Methodist School (International) over a ransomware and system compromise incident linked to outdated systems, missing MFA and weak credential controls.",
"url": "https://www.bakermckenzie.com/en/insight/publications/2026/03/singapore-recent-pdpc-decisions-emphasise-ransomware-risks",
"src": "Baker McKenzie",
"kind": "enforcement"
},
{
"date": "2026-11-06",
"text": "CSA, GovTech and IMDA issue a joint advisory on using personal AI agents safely and securely.",
"url": "https://www.csa.gov.sg/alerts-and-advisories/advisories/ad-2026-015/",
"src": "CSA"
}
],
"incidents": [
{
"org": "Singapore Airlines",
"sector": "transport",
"date": "2026-11-04",
"type": "supply-chain",
"actor": "",
"status": "confirmed",
"vendor": true,
"confirmed": "About 46,000 booking records held by reservation provider Amadeus were accessed, about 620 with contact, travel document or KrisFlyer details. SIA's own systems were not breached.",
"claimed": "",
"sources": [
{
"name": "The Star",
"url": "https://www.thestar.com.my/business/business-news/2026/11/04/singapore-airlines-says-46000-booking-records-affected-by-amadeus-breach"
}
],
"checked": "2026-11-07",
"domain": "singaporeair.com",
"logo": "singaporeair.com",
"actor_ids": [],
"id": "8636cd46",
"story": "amadeus-airline-data-breach"
},
{
"org": "M1",
"sector": "telecom",
"date": "2026-11-06",
"type": "data-leak",
"actor": "",
"status": "confirmed",
"vendor": false,
"confirmed": "A breach found on 30 Oct exposed customer names, NRIC/FIN numbers, birth dates, mobile numbers, emails and addresses. Contained; payment data not affected. PDPC said on 6 November it is investigating; M1 has not said how many customers were affected.",
"claimed": "",
"sources": [
{
"name": "Mustsharenews",
"url": "https://mustsharenews.com/m1-data-breach/"
},
{
"name": "Goody Feed",
"url": "https://goodyfeed.com/m1-doctor-anywhere-disclose-separate-data-breaches-customer-numbers-not-revealed/"
}
],
"checked": "2026-11-08",
"domain": "m1.com.sg",
"logo": "m1.com.sg",
"actor_ids": [],
"id": "03ae1e45",
"story": "m1-data-breach"
},
{
"org": "MoneySmart",
"sector": "finance",
"date": "2026-11-03",
"type": "intrusion",
"actor": "",
"status": "confirmed",
"vendor": false,
"confirmed": "An unauthorised party accessed internal systems on 29 Oct and copied personal data of some Singapore and Hong Kong customers. PDPC informed.",
"claimed": "",
"sources": [
{
"name": "The Star",
"url": "https://www.thestar.com.my/aseanplus/aseanplus-news/2026/11/03/moneysmart-data-breach-hits-singapore-hk-users-ic-numbers-financial-info-potentially-exposed"
},
{
"name": "Hong Kong Free Press",
"url": "https://hongkongfp.com/2026/11/04/finance-portal-moneysmart-apologises-after-users-sensitive-data-accessed-in-it-system-hack/"
}
],
"checked": "2026-11-07",
"domain": "moneysmart.sg",
"logo": "moneysmart.sg",
"actor_ids": [],
"id": "829a9f15"
},
{
"org": "Doctor Anywhere",
"sector": "health",
"date": "2026-11-07",
"type": "data-leak",
"actor": "",
"status": "confirmed",
"vendor": false,
"confirmed": "A malicious cyber incident leaked user personal data. Police report filed; PDPC is investigating. It learned of the breach on 29 October, engaged Ensign InfoSecurity and says clinical records were not affected.",
"claimed": "",
"sources": [
{
"name": "AsiaOne",
"url": "https://www.asiaone.com/singapore/doctor-anywhere-data-breach"
},
{
"name": "The Straits Times via Yahoo",
"url": "https://sg.news.yahoo.com/doctor-anywhere-hit-data-breach-101642328.html"
}
],
"checked": "2026-11-08",
"domain": "doctoranywhere.com",
"logo": "doctoranywhere.com",
"actor_ids": [],
"id": "a96f3b22"
},
{
"org": "SIMBA Telecom",
"sector": "telecom",
"date": "2026-09-28",
"type": "data-leak",
"actor": "",
"status": "confirmed",
"vendor": false,
"confirmed": "Names, ID numbers, birth dates, mobile numbers and emails of 23,549 customers were breached. PDPC is investigating.",
"claimed": "",
"sources": [
{
"name": "Malay Mail",
"url": "https://www.malaymail.com/news/singapore/2026/09/28/data-breach-affects-23549-customers-of-singapore-telco-simba-personal-data-protection-commission-investigating/236820"
},
{
"name": "The Star",
"url": "https://www.thestar.com.my/aseanplus/aseanplus-news/2026/09/28/personal-information-of-over-23500-simba-telco-customers-leaked-in-data-breach-in-singapore"
}
],
"checked": "2026-11-07",
"domain": "simba.sg",
"logo": "simba.sg",
"actor_ids": [],
"id": "86c3e3f1"
},
{
"org": "Charles & Keith",
"sector": "retail",
"date": "2026-09-26",
"type": "ransomware",
"actor": "The Gentlemen",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "Listed on The Gentlemen's leak site.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/Q2hhcmxlcyBLZWl0aEB0aGVnZW50bGVtZW4"
}
],
"checked": "2026-11-07",
"domain": "charleskeith.com",
"logo": "charleskeith.com",
"actor_ids": [
"the-gentlemen"
],
"id": "c6273ced"
},
{
"org": "Ocean Network Express",
"sector": "transport",
"date": "2026-10-12",
"type": "ransomware",
"actor": "N0n",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "The Singapore-based container line is listed on N0n's leak site.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/T2NlYW4gTmV0d29yayBFeHByZXNzIChjb250YWluZXIgc2hpcHBpbmcpQE4wbg"
}
],
"checked": "2026-11-07",
"domain": "one-line.com",
"logo": "one-line.com",
"actor_ids": [
"n0n"
],
"id": "c8a7389f"
},
{
"org": "Unnamed energy storage terminal",
"sector": "energy",
"date": "2026-10-27",
"type": "ransomware",
"actor": "Everest",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "Everest lists an unnamed Singapore energy storage terminal on its leak site.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/RW5lcmd5IFN0b3JhZ2UgVGVybWluYWwgaW4gU2luZ2Fwb3JlQGV2ZXJlc3Q"
}
],
"checked": "2026-11-07",
"actor_ids": [
"everest"
],
"id": "a511eadc"
},
{
"org": "Harry's International",
"sector": "retail",
"date": "2026-11-02",
"type": "ransomware",
"actor": "Orova",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "The bar and restaurant chain is listed on Orova's leak site.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/SGFycnkncyBJbnRlcm5hdGlvbmFsQE9yb3Zh"
}
],
"checked": "2026-11-07",
"domain": "harrys.com.sg",
"logo": "harrys.com.sg",
"actor_ids": [
"orova"
],
"id": "daa71b23"
},
{
"org": "Royal Plaza on Scotts",
"sector": "other",
"date": "2026-09-02",
"type": "ransomware",
"actor": "Eclipse",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "The hotel is listed on Eclipse's leak site.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/Um95YWwgUGxhemEgT24gU2NvdHRzQEVjbGlwc2U"
}
],
"checked": "2026-11-07",
"domain": "royalplaza.com.sg",
"logo": "royalplaza.com.sg",
"actor_ids": [
"eclipse"
],
"id": "ceef1776"
},
{
"org": "Enviro-Hub Holdings",
"sector": "manufacturing",
"date": "2026-01-26",
"type": "ransomware",
"actor": "Insomnia",
"status": "confirmed",
"vendor": false,
"confirmed": "Enviro-Hub told SGX that an unknown party gained unauthorised access to its servers in a ransomware incident with no material impact on operations, and that it reported the matter to the PDPC.",
"claimed": "The Insomnia group listed Enviro-Hub Holdings on its leak site on 7 February 2026.",
"sources": [
{
"name": "Reuters via Tiger Brokers",
"url": "https://www.itiger.com/news/2606219597"
},
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/RW52aXJvLUh1YiBIb2xkaW5nc0BpbnNvbW5pYQ"
}
],
"checked": "2026-11-07",
"domain": "enviro-hub.com",
"logo": "enviro-hub.com",
"actor_ids": [
"insomnia"
],
"id": "298158dd"
},
{
"org": "Singtel, StarHub, M1 and SIMBA Telecom",
"sector": "telecom",
"date": "2026-02-09",
"type": "intrusion",
"actor": "UNC3886",
"status": "confirmed",
"vendor": false,
"confirmed": "CSA said China-linked APT UNC3886 gained access to parts of all four major telcos' networks, reached critical systems in one case without disrupting services, and took a small amount of mainly network-related technical data, with no evidence customer data was accessed.",
"claimed": "",
"sources": [
{
"name": "CSA press release",
"url": "https://www.csa.gov.sg/news-events/press-releases/largest-multi-agency-cyber-operation-mounted-to-counter-threat-posed-by-advanced-persistent-threat--apt--actor-unc3886-to-singapore-s-telecommunications-sector/"
},
{
"name": "Help Net Security",
"url": "https://www.helpnetsecurity.com/2026/02/10/singapore-telecommunications-unc3886-cyber-espionage/"
}
],
"checked": "2026-11-07",
"actor_ids": [
"unc3886"
],
"id": "089b14ab"
},
{
"org": "LHT Holdings",
"sector": "manufacturing",
"date": "2026-03-04",
"type": "ransomware",
"actor": "Incransom",
"status": "confirmed",
"vendor": false,
"confirmed": "SGX-listed LHT Holdings said unauthorised access to certain IT systems led to encryption of selected systems, the incident was contained, and it found no evidence of personal or confidential data being accessed or exfiltrated.",
"claimed": "The Incransom group listed LHT Holdings Limited on its leak site on 10 March 2026.",
"sources": [
{
"name": "Tiger Brokers (company announcement)",
"url": "https://www.itiger.com/news/2616312585"
},
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/TEhUIEhvbGRpbmdzIExpbWl0ZWRAaW5jcmFuc29t"
}
],
"checked": "2026-11-07",
"domain": "lht.com.sg",
"logo": "lht.com.sg",
"actor_ids": [
"inc-ransom"
],
"id": "e25acb54"
},
{
"org": "National University of Singapore, SUSS and SIM (Canvas)",
"sector": "education",
"date": "2026-05-08",
"type": "supply-chain",
"actor": "ShinyHunters",
"status": "confirmed",
"vendor": true,
"confirmed": "NUS said names, email addresses and matriculation numbers were exposed in the breach of the Instructure Canvas learning platform and that no login credentials were compromised; SUSS told students no passwords, NRIC numbers or financial data were involved.",
"claimed": "ShinyHunters claimed the attack on Canvas.",
"sources": [
{
"name": "AsiaOne",
"url": "https://www.asiaone.com/singapore/canvas-cyberattack-nus-suss-student-information-data-breach"
},
{
"name": "The Star",
"url": "https://www.thestar.com.my/aseanplus/aseanplus-news/2026/05/08/nus-sim-among-top-singapore-institutions-named-in-global-data-breach-list"
}
],
"checked": "2026-11-07",
"actor_ids": [
"shinyhunters"
],
"id": "f9a4c4c4"
},
{
"org": "Singapore Land Authority",
"sector": "government",
"date": "2026-07-03",
"type": "supply-chain",
"actor": "",
"status": "confirmed",
"vendor": true,
"confirmed": "SLA said IBM told it of unauthorised access to an IBM-managed development and testing cloud environment that held names, NRIC numbers and property addresses of about 70,000 people; live systems were not affected and SLA notified the PDPC and police.",
"claimed": "",
"sources": [
{
"name": "SLA press release",
"url": "https://www.sla.gov.sg/news/press-release/security-incident-involving-an-ibm-managed-cloud-environment-/"
}
],
"checked": "2026-11-07",
"domain": "sla.gov.sg",
"logo": "sla.gov.sg",
"actor_ids": [],
"id": "7e36be17"
},
{
"org": "Bee Cheng Hiang",
"sector": "retail",
"date": "2026-09-30",
"type": "data-leak",
"actor": "",
"status": "confirmed",
"vendor": false,
"confirmed": "The PDPC said an employee's AI-generated mailing script exposed the email addresses of 95,364 members to other recipients, its first notified AI-related breach, and accepted a voluntary undertaking from the company.",
"claimed": "",
"sources": [
{
"name": "Mothership",
"url": "https://mothership.sg/2026/10/bee-cheng-hiang-members-data-breach-ai/"
},
{
"name": "Bloomberg",
"url": "https://www.bloomberg.com/news/articles/2026-09-30/singapore-reports-first-data-breach-linked-to-ai-use-st"
}
],
"checked": "2026-11-07",
"domain": "beechenghiang.com.sg",
"logo": "beechenghiang.com.sg",
"actor_ids": [],
"id": "0e8c9419"
},
{
"org": "Alliance Healthcare Group (Alliance Medinet)",
"sector": "health",
"date": "2026-10-24",
"type": "data-leak",
"actor": "",
"status": "confirmed",
"vendor": false,
"confirmed": "Alliance Healthcare Group told SGX that a third party gained unauthorised access to subsidiary Alliance Medinet's membership database, exposing names, ID numbers and contact details of about 110,000 members, and that it reported the incident to the PDPC on 21 October.",
"claimed": "",
"sources": [
{
"name": "Little Big Red Dot",
"url": "https://littlebigreddot.com/alliance-medinet-data-breach-110000-members-october-2026/"
},
{
"name": "MLex",
"url": "https://www.mlex.com/mlex/articles/2542185"
}
],
"checked": "2026-11-07",
"domain": "alliancemedinet.com",
"logo": "alliancemedinet.com",
"actor_ids": [],
"id": "6cd54115"
},
{
"org": "Neo Group",
"sector": "retail",
"date": "2026-01-15",
"type": "ransomware",
"actor": "Qilin",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "The Qilin group listed Neo Group on its leak site on 2026-01-15.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/TmVvIEdyb3VwQHFpbGlu"
}
],
"checked": "2026-11-07",
"domain": "neogroup.com.sg",
"logo": "neogroup.com.sg",
"actor_ids": [
"qilin"
],
"id": "1fe32301"
},
{
"org": "Bolttech",
"sector": "finance",
"date": "2026-01-21",
"type": "ransomware",
"actor": "Everest",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "The Everest group listed Bolttech on its leak site on 2026-01-21.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/Qm9sdHRlY2hAZXZlcmVzdA"
}
],
"checked": "2026-11-07",
"domain": "bolttech.io",
"logo": "bolttech.io",
"actor_ids": [
"everest"
],
"id": "ea031f72"
},
{
"org": "Pleiad Investment Advisors (Singapore branch)",
"sector": "finance",
"date": "2026-03-09",
"type": "ransomware",
"actor": "Qilin",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "The Qilin group listed Pleiad Investment Advisors (Singapore branch) on its leak site on 2026-03-09.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/UGxlaWFkIEludmVzdG1lbnQgQWR2aXNvcnMgKFNpbmdhcG9yZSBicmFjaClAcWlsaW4"
}
],
"checked": "2026-11-07",
"actor_ids": [
"qilin"
],
"id": "ecdadae9"
},
{
"org": "K Subsea Group",
"sector": "energy",
"date": "2026-04-13",
"type": "ransomware",
"actor": "Everest",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "The Everest group listed K Subsea Group on its leak site on 2026-04-13.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/SyBTdWJzZWEgR3JvdXBAZXZlcmVzdA"
}
],
"checked": "2026-11-07",
"domain": "ksubsea-group.com",
"logo": "ksubsea-group.com",
"actor_ids": [
"everest"
],
"id": "a6d74bde"
},
{
"org": "MIMS",
"sector": "health",
"date": "2026-05-06",
"type": "ransomware",
"actor": "The Gentlemen",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "The The Gentlemen group listed MIMS on its leak site on 2026-05-06.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/TUlNU0B0aGVnZW50bGVtZW4"
}
],
"checked": "2026-11-07",
"domain": "mims.com",
"logo": "mims.com",
"actor_ids": [
"the-gentlemen"
],
"id": "4ab6d0c6"
},
{
"org": "WOHA",
"sector": "property",
"date": "2026-05-06",
"type": "ransomware",
"actor": "Lamashtu",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "The Lamashtu group listed WOHA on its leak site on 2026-05-06.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/V09IQUBsYW1hc2h0dQ"
}
],
"checked": "2026-11-07",
"domain": "woha.net",
"logo": "woha.net",
"actor_ids": [
"lamashtu"
],
"id": "659bf3cd"
},
{
"org": "One Legal",
"sector": "other",
"date": "2026-05-13",
"type": "ransomware",
"actor": "Qilin",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "The Qilin group listed One Legal on its leak site on 2026-05-13.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/T25lIExlZ2FsQHFpbGlu"
}
],
"checked": "2026-11-07",
"domain": "onelegal.sg",
"actor_ids": [
"qilin"
],
"id": "6a3d45df"
},
{
"org": "Global Schools Foundation",
"sector": "education",
"date": "2026-06-10",
"type": "data-leak",
"actor": "Fulcrumsec",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "The Fulcrumsec group listed Global Schools Foundation on its leak site on 2026-06-10.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/R2xvYmFsIFNjaG9vbHMgRm91bmRhdGlvbkBmdWxjcnVtc2Vj"
}
],
"checked": "2026-11-07",
"domain": "globalschoolsfoundation.org",
"logo": "globalschoolsfoundation.org",
"actor_ids": [
"fulcrumsec"
],
"id": "0fa9d4ff"
},
{
"org": "Times Software",
"sector": "other",
"date": "2026-06-15",
"type": "ransomware",
"actor": "The Gentlemen",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "The The Gentlemen group listed Times Software on its leak site on 2026-06-15.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/VGltZXMgU29mdHdhcmVAdGhlZ2VudGxlbWVu"
}
],
"checked": "2026-11-07",
"domain": "timesoftsg.com.sg",
"logo": "timesoftsg.com.sg",
"actor_ids": [
"the-gentlemen"
],
"id": "d37be774"
},
{
"org": "Akribis Systems",
"sector": "manufacturing",
"date": "2026-07-27",
"type": "ransomware",
"actor": "Nightspire",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "The Nightspire group listed Akribis Systems on its leak site on 2026-07-27.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/QWtyaWJpcyBTeXN0ZW1zIFB0ZSBMdGRAbmlnaHRzcGlyZQ"
}
],
"checked": "2026-11-07",
"domain": "akribis-sys.com",
"logo": "akribis-sys.com",
"actor_ids": [
"nightspire"
],
"id": "0c05ebc2"
},
{
"org": "ProHealth (prohealth.sg)",
"sector": "health",
"date": "2026-08-02",
"type": "ransomware",
"actor": "Krybit",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "The Krybit group listed ProHealth (prohealth.sg) on its leak site on 2026-08-02.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/d3d3LnByb2hlYWx0aC5zZ0BrcnliaXQ"
}
],
"checked": "2026-11-07",
"domain": "prohealth.sg",
"logo": "prohealth.sg",
"actor_ids": [
"krybit"
],
"id": "b4f4cece"
},
{
"org": "NTU Alumni Club",
"sector": "education",
"date": "2026-08-10",
"type": "ransomware",
"actor": "The Gentlemen",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "The The Gentlemen group listed NTU Alumni Club on its leak site on 2026-08-10.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/TlRVIEFsdW1uaSBDbHViQHRoZWdlbnRsZW1lbg"
}
],
"checked": "2026-11-07",
"domain": "ntualumni.org.sg",
"logo": "ntualumni.org.sg",
"actor_ids": [
"the-gentlemen"
],
"id": "c69b2553"
},
{
"org": "TTG Asia Media",
"sector": "media",
"date": "2026-09-08",
"type": "ransomware",
"actor": "Eclipse",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "The Eclipse group listed TTG Asia Media on its leak site on 2026-09-08.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/VFRHIEFzaWEgTWVkaWFARWNsaXBzZQ"
}
],
"checked": "2026-11-07",
"domain": "ttgasia.com",
"logo": "ttgasia.com",
"actor_ids": [
"eclipse"
],
"id": "d3c6f2a7"
},
{
"org": "Giti Corp",
"sector": "manufacturing",
"date": "2026-09-18",
"type": "ransomware",
"actor": "Killsec",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "The Killsec group listed Giti Corp on its leak site on 2026-09-18.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/R2l0aSBDb3JwQGtpbGxzZWM"
}
],
"checked": "2026-11-07",
"domain": "giti.com",
"logo": "giti.com",
"actor_ids": [
"killsec"
],
"id": "6c2014a2"
},
{
"org": "Global AirFreight International",
"sector": "transport",
"date": "2026-10-08",
"type": "other",
"actor": "Eclipse",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "The Eclipse group listed Global AirFreight International on its leak site on 2026-10-08.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/R2xvYmFsIEFpckZyZWlnaHQgSW50ZXJuYXRpb25hbEBFY2xpcHNl"
}
],
"checked": "2026-11-07",
"domain": "globalair.com.sg",
"actor_ids": [
"eclipse"
],
"id": "eba2e79e"
},
{
"org": "Apical Group",
"sector": "manufacturing",
"date": "2026-10-12",
"type": "ransomware",
"actor": "N0n",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "The N0n group listed Apical Group on its leak site on 2026-10-12.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/QXBpY2FsIEdyb3VwIChjb21tb2RpdHkgcHJvY2Vzc2luZyBhbmQgbG9naXN0aWNzKUBOMG4"
}
],
"checked": "2026-11-07",
"domain": "apicalgroup.com",
"logo": "apicalgroup.com",
"actor_ids": [
"n0n"
],
"id": "f0b66df4"
},
{
"org": "Raffles United Holdings",
"sector": "other",
"date": "2026-11-03",
"type": "ransomware",
"actor": "Orova",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "The Orova group listed Raffles United Holdings on its leak site on 2026-11-03.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/UmFmZmxlcyBVbml0ZWQgSG9sZGluZ3MgUHRlIEx0ZEBPcm92YQ"
}
],
"checked": "2026-11-07",
"domain": "rafflesunited.com.sg",
"logo": "rafflesunited.com.sg",
"actor_ids": [
"orova"
],
"id": "9def92ee"
},
{
"org": "Detronics",
"sector": "manufacturing",
"date": "2026-11-03",
"type": "ransomware",
"actor": "Orova",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "The Orova group listed Detronics on its leak site on 2026-11-03.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/RGV0cm9uaWNzIFB0ZSBMdGRAT3JvdmE"
}
],
"checked": "2026-11-07",
"domain": "detronics.com.sg",
"logo": "detronics.com.sg",
"actor_ids": [
"orova"
],
"id": "554deec3"
},
{
"org": "BOSH Engineering Private Limited",
"sector": "manufacturing",
"date": "2026-11-07",
"type": "ransomware",
"actor": "Qilin",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "Qilin listed the Singapore engineering firm on its leak site on 7 November. No data volume stated and no press coverage found.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/Qk9TSCBFbmdpbmVlcmluZyBQcml2YXRlIExpbWl0ZWRAcWlsaW4"
}
],
"checked": "2026-11-08",
"domain": "",
"actor_ids": [
"qilin"
],
"id": "965c2bee"
}
],
"slug": "singapore",
"title": "Singapore Cyber Incidents and Data Breaches 2026 · pwnsy",
"lede": "No public threat level. 12 incidents confirmed, 24 claims in 2026.",
"h1": "![\"\"](\"/tools/cyber-watch/flags/sg.svg\")
Singapore Cyber Watch",
"desc": "Singapore cyber threat level: none published. 12 incidents confirmed and 24 claims in 2026, each sourced. Updated 8 Nov 2026.",
"since": "2026-01-01",
"stats": [
{
"label": "Phishing attempts reported to CSA",
"value": "about 4,800 (down 21% from 6,100)",
"period": "2025",
"source": {
"name": "CSA, Singapore Cyber Landscape 2025/2026",
"url": "https://isomer-user-content.by.gov.sg/36/4cb7cea6-3c30-4fad-a148-b2d94798e9f6/Singapore%20Cyber%20Landscape%202025_2026.pdf"
}
},
{
"label": "Ransomware cases reported to CSA",
"value": "165 (up from 159)",
"period": "2025",
"source": {
"name": "CSA, Singapore Cyber Landscape 2025/2026",
"url": "https://isomer-user-content.by.gov.sg/36/4cb7cea6-3c30-4fad-a148-b2d94798e9f6/Singapore%20Cyber%20Landscape%202025_2026.pdf"
}
},
{
"label": "Infected systems detected in Singapore",
"value": "284,300 (up 142%)",
"period": "2025",
"source": {
"name": "CSA, Singapore Cyber Landscape 2025/2026",
"url": "https://isomer-user-content.by.gov.sg/36/4cb7cea6-3c30-4fad-a148-b2d94798e9f6/Singapore%20Cyber%20Landscape%202025_2026.pdf"
}
},
{
"label": "Defaced Singapore websites",
"value": "62 (down from 67)",
"period": "2025",
"source": {
"name": "CSA, Singapore Cyber Landscape 2025/2026",
"url": "https://isomer-user-content.by.gov.sg/36/4cb7cea6-3c30-4fad-a148-b2d94798e9f6/Singapore%20Cyber%20Landscape%202025_2026.pdf"
}
},
{
"label": "Share of reported phishing spoofing banking and financial services",
"value": "70%",
"period": "2025",
"source": {
"name": "CSA, Singapore Cyber Landscape 2025/2026",
"url": "https://isomer-user-content.by.gov.sg/36/4cb7cea6-3c30-4fad-a148-b2d94798e9f6/Singapore%20Cyber%20Landscape%202025_2026.pdf"
}
},
{
"label": "Scam and cybercrime cases",
"value": "41,974 (down 24.8%)",
"period": "2025",
"source": {
"name": "SPF, Police Life (25 Feb 2026)",
"url": "https://www.police.gov.sg/media-hub/police-life/2026/02/scams-and-cybercrime-fell-by-almost-a-quarter-in-2025"
}
},
{
"label": "Scam losses",
"value": "S$913.1 million (down from S$1.1 billion)",
"period": "2025",
"source": {
"name": "SPF, Police Life (25 Feb 2026)",
"url": "https://www.police.gov.sg/media-hub/police-life/2026/02/scams-and-cybercrime-fell-by-almost-a-quarter-in-2025"
}
},
{
"label": "Scam cases",
"value": "37,308",
"period": "2025",
"source": {
"name": "The Star (ST/ANN, police figures)",
"url": "https://www.thestar.com.my/aseanplus/aseanplus-news/2026/02/25/singapore-scam-losses-fall-to-s913mil-in-2025-new-trend-of-victims-handing-over-gold-bars-to-syndicates"
}
},
{
"label": "Scam and cybercrime cases",
"value": "18,391 (down 17.9%)",
"period": "January to June 2026",
"source": {
"name": "SPF, Mid-Year Scam and Cybercrime Brief 2026",
"url": "https://www.police.gov.sg/-/media/SPF/Media-Room/Statistics/Mid-Year-Scam-and-Cybercrime-Brief-2026/Mid-Year-Scam-and-Cybercrime-Brief-2026.pdf"
}
},
{
"label": "Scam cases",
"value": "16,821 (down 14.4%)",
"period": "January to June 2026",
"source": {
"name": "SPF, Mid-Year Scam and Cybercrime Brief 2026",
"url": "https://www.police.gov.sg/-/media/SPF/Media-Room/Statistics/Mid-Year-Scam-and-Cybercrime-Brief-2026/Mid-Year-Scam-and-Cybercrime-Brief-2026.pdf"
}
},
{
"label": "Scam losses",
"value": "about S$410.6 million (down 17.9%)",
"period": "January to June 2026",
"source": {
"name": "SPF, Mid-Year Scam and Cybercrime Brief 2026",
"url": "https://www.police.gov.sg/-/media/SPF/Media-Room/Statistics/Mid-Year-Scam-and-Cybercrime-Brief-2026/Mid-Year-Scam-and-Cybercrime-Brief-2026.pdf"
}
},
{
"label": "Government official impersonation scam losses",
"value": "S$90.8 million (down 31.7%)",
"period": "January to June 2026",
"source": {
"name": "SPF, Mid-Year Scam and Cybercrime Brief 2026",
"url": "https://www.police.gov.sg/-/media/SPF/Media-Room/Statistics/Mid-Year-Scam-and-Cybercrime-Brief-2026/Mid-Year-Scam-and-Cybercrime-Brief-2026.pdf"
}
},
{
"label": "Cryptocurrency scam losses",
"value": "about S$65.5 million (16% of losses)",
"period": "January to June 2026",
"source": {
"name": "SPF, Mid-Year Scam and Cybercrime Brief 2026",
"url": "https://www.police.gov.sg/-/media/SPF/Media-Room/Statistics/Mid-Year-Scam-and-Cybercrime-Brief-2026/Mid-Year-Scam-and-Cybercrime-Brief-2026.pdf"
}
},
{
"label": "Scam losses recovered by the Anti-Scam Centre",
"value": "more than S$97.7 million",
"period": "January to June 2026",
"source": {
"name": "SPF, Mid-Year Scam and Cybercrime Brief 2026",
"url": "https://www.police.gov.sg/-/media/SPF/Media-Room/Statistics/Mid-Year-Scam-and-Cybercrime-Brief-2026/Mid-Year-Scam-and-Cybercrime-Brief-2026.pdf"
}
},
{
"label": "Malicious websites disrupted by SPF",
"value": "52,200",
"period": "January to June 2026",
"source": {
"name": "SPF, Mid-Year Scam and Cybercrime Brief 2026",
"url": "https://www.police.gov.sg/-/media/SPF/Media-Room/Statistics/Mid-Year-Scam-and-Cybercrime-Brief-2026/Mid-Year-Scam-and-Cybercrime-Brief-2026.pdf"
}
}
],
"rules": [
{
"date": "2026-03-02",
"title": "Cyber Trust Mark requirements for CII owners, auditors and licensed providers",
"what": "CSA will require CII auditors to hold Cyber Trust Mark Level 5 by end-2026, licensed pen-test and SOC providers to hold CTM Promoter Tier 3 by 31 December 2026, and CII owners to reach Level 5 for supporting non-CII systems by end-2027.",
"url": "https://www.csa.gov.sg/news-events/press-releases/csa-to-raise-cybersecurity-standards-for-critical-information-infrastructure-owners/"
},
{
"date": "2026-08-17",
"title": "New and enhanced Codes of Practice under the Online Criminal Harms Act",
"what": "SPF issued Messaging, Social Media and E-Commerce Codes requiring platforms such as WhatsApp, Telegram, Facebook and Carousell to curb scams, with government anti-spoofing due by 30 September 2026 and the rest by 31 January 2027.",
"url": "https://www.police.gov.sg/media-hub/news/2026/08/20260818_issuance_of_codes_of_practice_under_the_online_criminal_harms_act"
},
{
"date": "2026-09-09",
"title": "Scams (Countermeasures) and Other Matters Act 2026",
"what": "Parliament passed a law adding account disabling and service limitation orders, offences for supplying or misusing online accounts, and administrative penalties of up to S$10 million per breach of OCHA codes or directives.",
"url": "https://www.mha.gov.sg/media-room/newsroom/second-reading-of-the-scams-countermeasures-and-other-matters-bill/"
},
{
"date": "2026-10-07",
"title": "Digital Infrastructure Bill passed",
"what": "Parliament passed a bill creating IMDA licensing regimes for the security, resilience and sustainability of major cloud services and data centres.",
"url": "https://www.bakermckenzie.com/en/insight/publications/2026/10/singapore-parliament-passes-digital-infrastructure-bill"
},
{
"date": "2026-10-07",
"title": "MAS Guidelines on AI Risk Management for financial institutions",
"what": "MAS issued supervisory expectations for how financial institutions manage AI risk, with a transition period to 7 October 2027.",
"url": "https://www.mas.gov.sg/regulation/guidelines/guidelines-on-artificial-intelligence-risk-management-for-financial-institutions"
},
{
"date": "2026-10-13",
"title": "Singapore Cybersecurity Strategy 2026",
"what": "The government launched a five-year strategy to build national cyber defence capabilities for critical infrastructure, secure the wider cyberspace, accelerate quantum-safe migration and grow the cyber workforce.",
"url": "https://www.csa.gov.sg/news-events/press-releases/singapore-launches-cybersecurity-strategy-2026-to-strengthen-national-cyber-resilience/"
}
],
"actors": [
{
"name": "UNC3886",
"kind": "state",
"seen": "CSA said in February 2026 that this China-linked APT breached parts of all four major Singapore telcos' networks.",
"sources": [
{
"name": "CSA press release",
"url": "https://www.csa.gov.sg/news-events/press-releases/largest-multi-agency-cyber-operation-mounted-to-counter-threat-posed-by-advanced-persistent-threat--apt--actor-unc3886-to-singapore-s-telecommunications-sector/"
}
],
"actor_id": "unc3886"
},
{
"name": "ShinyHunters",
"kind": "extortion",
"seen": "Claimed the May 2026 Canvas breach that exposed NUS, SUSS and SIM student data, and listed Aman Resorts in April.",
"sources": [
{
"name": "AsiaOne",
"url": "https://www.asiaone.com/singapore/canvas-cyberattack-nus-suss-student-information-data-breach"
},
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/QW1hbiBSZXNvcnRzIChhbWFuLmNvbSlAc2hpbnlodW50ZXJz"
}
],
"actor_id": "shinyhunters"
},
{
"name": "Qilin",
"kind": "ransomware",
"seen": "Listed Singapore victims including Neo Group, Pleiad Investment Advisors and One Legal in 2026.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/TmVvIEdyb3VwQHFpbGlu"
},
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/T25lIExlZ2FsQHFpbGlu"
}
],
"actor_id": "qilin"
},
{
"name": "The Gentlemen",
"kind": "ransomware",
"seen": "Listed MIMS, Times Software, NTU Alumni Club and Charles & Keith in 2026.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/TUlNU0B0aGVnZW50bGVtZW4"
},
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/TlRVIEFsdW1uaSBDbHViQHRoZWdlbnRsZW1lbg"
}
],
"actor_id": "the-gentlemen"
},
{
"name": "Everest",
"kind": "ransomware",
"seen": "Listed Bolttech, K Subsea Group and an unnamed Singapore energy storage terminal in 2026.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/Qm9sdHRlY2hAZXZlcmVzdA"
},
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/SyBTdWJzZWEgR3JvdXBAZXZlcmVzdA"
}
],
"actor_id": "everest"
},
{
"name": "Orova",
"kind": "ransomware",
"seen": "Listed several Singapore firms in October and November 2026, including Raffles United Holdings, Detronics and Harry's International.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/UmFmZmxlcyBVbml0ZWQgSG9sZGluZ3MgUHRlIEx0ZEBPcm92YQ"
},
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/RGV0cm9uaWNzIFB0ZSBMdGRAT3JvdmE"
}
],
"actor_id": "orova"
},
{
"name": "Eclipse",
"kind": "ransomware",
"seen": "Listed TTG Asia Media, Global AirFreight International and Royal Plaza on Scotts in 2026.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/VFRHIEFzaWEgTWVkaWFARWNsaXBzZQ"
},
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/R2xvYmFsIEFpckZyZWlnaHQgSW50ZXJuYXRpb25hbEBFY2xpcHNl"
}
],
"actor_id": "eclipse"
},
{
"name": "Insomnia",
"kind": "ransomware",
"seen": "Claimed the January 2026 attack on SGX-listed Enviro-Hub Holdings, which the company confirmed as ransomware.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/RW52aXJvLUh1YiBIb2xkaW5nc0BpbnNvbW5pYQ"
}
],
"actor_id": "insomnia"
},
{
"name": "Incransom",
"kind": "ransomware",
"seen": "Claimed SGX-listed LHT Holdings in March 2026 after the company disclosed encrypted systems.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/TEhUIEhvbGRpbmdzIExpbWl0ZWRAaW5jcmFuc29t"
}
],
"actor_id": "inc-ransom"
},
{
"name": "Krybit",
"kind": "ransomware",
"seen": "Listed ProHealth and Disk Precision Group among Singapore victims in 2026.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/d3d3LnByb2hlYWx0aC5zZ0BrcnliaXQ"
}
],
"actor_id": "krybit"
},
{
"name": "N0n",
"kind": "extortion",
"seen": "Listed Apical Group and Ocean Network Express in October 2026.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/QXBpY2FsIEdyb3VwIChjb21tb2RpdHkgcHJvY2Vzc2luZyBhbmQgbG9naXN0aWNzKUBOMG4"
}
],
"actor_id": "n0n"
},
{
"name": "Government official impersonation scam syndicates",
"kind": "scam-syndicate",
"seen": "SPF said this scam type caused S$90.8 million in losses in the first half of 2026, the second highest of any type.",
"sources": [
{
"name": "SPF, Mid-Year Scam and Cybercrime Brief 2026",
"url": "https://www.police.gov.sg/-/media/SPF/Media-Room/Statistics/Mid-Year-Scam-and-Cybercrime-Brief-2026/Mid-Year-Scam-and-Cybercrime-Brief-2026.pdf"
}
]
}
],
"region": "Southeast Asia",
"upd": "2026-11-08"
},
"ID": {
"name": "Indonesia",
"posture": {
"level": "",
"summary": "BSSN issues security advisories and statements; Komdigi handles personal data protection reports.",
"agency": "BSSN (Badan Siber dan Sandi Negara)",
"source": {
"name": "BSSN (Badan Siber dan Sandi Negara)",
"url": "https://katadata.co.id/digital/teknologi/6ada569d0383f/bssn-beri-peringatan-soal-celah-php-server-berisiko-diambil-alih-hacker"
},
"checked": "2026-11-07"
},
"timeline": [
{
"date": "2026-10-05",
"text": "BSSN says personal data circulating online, including the Komdigi minister's, came from old leaks and open sources, not a new breach.",
"url": "https://www.cnnindonesia.com/teknologi/20261005143246-185-1411797/bssn-sebut-ramai-data-beredar-di-internet-bukan-kebocoran-baru",
"src": "CNN Indonesia"
},
{
"date": "2026-10-23",
"text": "BSSN warns PHP2Shell flaws let attackers take over servers and urges patching or isolating exposed PHP systems.",
"url": "https://katadata.co.id/digital/teknologi/6ada569d0383f/bssn-beri-peringatan-soal-celah-php-server-berisiko-diambil-alih-hacker",
"src": "Katadata"
},
{
"date": "2026-10-23",
"text": "Komdigi tells users of national data centre PDN-1 and government cloud to update PHP against PHP2Shell.",
"url": "https://teknologi.bisnis.com/read/20261023/101/2015094/komdigi-peringatkan-ancaman-kerentanan-php2shell-minta-pengguna-pdn-1-update-php",
"src": "Bisnis"
},
{
"date": "2026-10-24",
"text": "The Ministry of Industry takes some websites and systems offline as a PHP2Shell mitigation.",
"url": "https://teknologi.bisnis.com/read/20261024/101/2015333/kemenperin-matikan-situs-sementara-gegara-kerentanan-php2shell",
"src": "Bisnis"
},
{
"date": "2026-01-16",
"text": "Komdigi says it summoned Meta over a reported Instagram data leak and relays Meta's view that no passwords were exposed.",
"url": "https://www.cnnindonesia.com/teknologi/20260116113321-192-1317647/komdigi-panggil-meta-minta-penjelasan-dugaan-kebocoran-data-instagram",
"src": "CNN Indonesia"
},
{
"date": "2026-01-19",
"text": "Kemdiktisaintek says it is still verifying claims that student and lecturer data from a dozen-plus universities is on sale.",
"url": "https://www.kompas.com/tren/read/2026/01/20/153000365/ramai-soal-kebocoran-data-mahasiswa-di-sejumlah-kampus-indonesia-ini-kata?page=all",
"src": "Kompas"
},
{
"date": "2026-01-22",
"text": "Deputy Minister Nezar Patria says the university data leak may stem from the higher education ministry's data centre and asks ministries to review CSIRT readiness.",
"url": "https://www.cnbcindonesia.com/tech/20260123101312-37-704671/komdigi-jawab-isu-data-13-universitas-di-indonesia-bocor",
"src": "CNBC Indonesia"
},
{
"date": "2026-02-04",
"text": "Komdigi Secretary General Ismail tells the DPR that exposed job applicant files are being handled internally.",
"url": "https://www.cnnindonesia.com/teknologi/20260204152007-192-1324555/viral-data-pelamar-kerja-diduga-bocor-komdigi-buka-suara",
"src": "CNN Indonesia"
},
{
"date": "2026-04-07",
"text": "Bandung Diskominfo denies that a claimed one-million-record dataset came from the city's civil registry server.",
"url": "http://www.merdeka.com/peristiwa/read/8099329/heboh-kabar-kebocoran-data-1-juta-penduduk-pemkot-bandung-berikan-penjelasan-bantah-dari-server-disdukcapil",
"src": "Merdeka"
},
{
"date": "2026-04-23",
"text": "BSSN Deputy Bondan Widiawan reports 5.5 billion traffic anomalies in 2025 and 1.5 billion from 1 January to 15 April 2026.",
"url": "https://inet.detik.com/security/d-8458200/duh-ri-dihantam-1-5-miliar-anomali-trafik-dalam-4-bulan",
"src": "detikInet"
},
{
"date": "2026-05-21",
"text": "BCA says an internal investigation found no customer data leak after a dark web listing claimed 4.9 million records.",
"url": "https://money.kompas.com/read/2026/05/21/173101926/bca-pastikan-data-nasabah-aman-bantah-isu-kebocoran-di-media-sosial",
"src": "Kompas"
},
{
"date": "2026-05-22",
"text": "BNI says it found no sign of unauthorised taking or transfer of customer data.",
"url": "https://money.kompas.com/read/2026/05/23/060800226/isu-kebocoran-data-nasabah-bni--kami-tidak-temukan-itu-",
"src": "Kompas"
},
{
"date": "2026-06-24",
"text": "BSSN notifies North Kalimantan of a valid leak sample from its Simpeg civil service system.",
"url": "https://www.detik.com/kalimantan/berita/d-8549558/bssn-temukan-indikasi-kebocoran-data-dalam-aplikasi-simpeg-pemprov-kaltara",
"src": "detikKalimantan"
},
{
"date": "2026-06-29",
"text": "The government and DPR Commission I form a working committee on the Cyber Security and Resilience Bill.",
"url": "https://www.antaranews.com/berita/5626912/pemerintah-dan-dpr-bentuk-panja-ruu-keamanan-dan-ketahanan-siber",
"src": "ANTARA"
},
{
"date": "2026-07-14",
"text": "Minister Meutya Hafid says Komdigi took down 3.7 million gambling sites and content items between October 2024 and July 2026.",
"url": "https://inet.detik.com/law-and-policy/d-8573944/komdigi-tutup-3-7-juta-konten-judi-online-sejak-oktober-2024",
"src": "detikInet"
},
{
"date": "2026-07-27",
"text": "Komdigi tells the Constitutional Court the PDP agency Perpres awaits presidential enactment.",
"url": "https://nasional.kompas.com/read/2026/07/27/15423511/komdigi-ungkap-perpres-pembentukan-badan-perlindungan-data-pribadi-sedang",
"src": "Kompas"
},
{
"date": "2026-07-30",
"text": "Polda Jatim announces the arrest of a hacker who sold access to 260 hacked Indonesian websites for gambling promotion.",
"url": "https://surabaya.kompas.com/read/2026/07/31/055009678/hacker-demak-retas-website-sekolah-hingga-pemda-belajar-otodidak-dari-grup",
"src": "Kompas"
},
{
"date": "2026-08-09",
"text": "Diskominfo Badung confirms two defaced subdomain sites and takes them down.",
"url": "https://balitribune.co.id/content/dua-website-pemkab-badung-diretas-sempat-muncul-iklan-obat-aborsi-dan-judi-online",
"src": "Bali Tribune"
},
{
"date": "2026-09-01",
"text": "Satgas PASTI reports 637,055 IASC scam reports and Rp724.1 billion blocked as of 31 July.",
"url": "https://money.kompas.com/read/2026/09/02/054000426/iasc-ojk-terima-laporan-1-17-juta-rekening-terkait-scam-dana-rp-724-miliar",
"src": "Kompas"
},
{
"date": "2026-10-06",
"text": "BSSN inaugurates 59 new incident response teams, bringing registered TTIS to 514.",
"url": "https://www.riliskalimantan.com/2026/10/bssn-kukuhkan-59-tim-tanggap-insiden.html",
"src": "Rilis Kalimantan"
},
{
"date": "2026-11-05",
"text": "OJK reports 737,686 IASC scam reports and Rp967.5 billion in blocked funds as of 28 October.",
"url": "https://www.antaranews.com/berita/5834751/ojk-iasc-blokir-rp9675-miliar-dana-terkait-penipuan",
"src": "ANTARA"
}
],
"incidents": [
{
"org": "Fore Coffee",
"sector": "retail",
"date": "2026-11-05",
"type": "data-leak",
"actor": "",
"status": "confirmed",
"vendor": false,
"confirmed": "Fore reported unauthorised access to customer data to Komdigi on 28 Oct; Komdigi puts it at about 5.7 million customer accounts.",
"claimed": "",
"sources": [
{
"name": "CNBC Indonesia",
"url": "https://www.cnbcindonesia.com/tech/20261105084917-37-782483/fore-lapor-data-pelanggan-bocor-ke-komdigi-begini-sanksinya"
},
{
"name": "Investortrust",
"url": "https://investortrust.id/business/121838/data-fore-coffee-diduga-bocor-kemenkomdigi-bakal-kasih-sanksi"
}
],
"checked": "2026-11-07",
"domain": "fore.coffee",
"logo": "fore.coffee",
"actor_ids": [],
"id": "f50c4488"
},
{
"org": "Komdigi minister's personal data",
"sector": "government",
"date": "2026-10-03",
"type": "data-leak",
"actor": "",
"status": "confirmed",
"vendor": false,
"confirmed": "The minister's personal data circulated online; Komdigi and BSSN say it came from old leaks and opened a probe into illegal data trading with police.",
"claimed": "",
"sources": [
{
"name": "Okezone",
"url": "https://news.okezone.com/read/2026/10/03/337/3245769/sebut-data-menkomdigi-yang-beredar-data-lama-komdigi-gandeng-bssn-usut-jual-beli-data-pribadi"
},
{
"name": "Kompas",
"url": "https://nasional.kompas.com/read/2026/10/06/17570791/data-pribadi-menkomdigi-diduga-bocor-bssn-lakukan-penelusuran"
}
],
"checked": "2026-11-07",
"actor_ids": [],
"id": "b2618a78"
},
{
"org": "Directorate General of Taxes (DJP)",
"sector": "government",
"date": "2026-10-31",
"type": "access-sale",
"actor": "MARLANWG",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "A crime-forum seller offers a 0-day exploit and more than 10 million taxpayer records allegedly from DJP. No DJP response found.",
"sources": [
{
"name": "VECERT",
"url": "https://x.com/VECERTRadar/status/2116551923146846504"
}
],
"checked": "2026-11-07",
"domain": "pajak.go.id",
"logo": "pajak.go.id",
"actor_ids": [
"marlanwg"
],
"id": "2c23c6e7"
},
{
"org": "DJP Coretax",
"sector": "government",
"date": "2026-09-21",
"type": "data-leak",
"actor": "",
"status": "disputed",
"vendor": false,
"confirmed": "DJP denied the leak, saying the data had fields it never stores and plaintext passwords.",
"claimed": "A dark-web monitoring account claimed taxpayer data with passwords and tokens was stolen.",
"sources": [
{
"name": "CNN Indonesia",
"url": "https://www.cnnindonesia.com/ekonomi/20260921114415-532-1406253/djp-kemenkeu-buka-suara-soal-kabar-data-pajak-bocor"
},
{
"name": "CNBC Indonesia",
"url": "https://www.cnbcindonesia.com/news/20260921110739-4-769485/ditjen-pajak-bantah-data-coretax-bocor"
}
],
"checked": "2026-11-07",
"domain": "pajak.go.id",
"logo": "pajak.go.id",
"actor_ids": [],
"id": "7f46e87d"
},
{
"org": "Pertamina",
"sector": "energy",
"date": "2026-09-17",
"type": "ransomware",
"actor": "RansomHouse",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "Listed on RansomHouse's leak site; Pertamina has not confirmed it.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/UGVydGFtaW5hQHJhbnNvbWhvdXNl"
}
],
"checked": "2026-11-07",
"domain": "pertamina.com",
"logo": "pertamina.com",
"actor_ids": [
"ransomhouse"
],
"id": "ce7a90a9"
},
{
"org": "ILCS Pelindo",
"sector": "transport",
"date": "2026-10-12",
"type": "ransomware",
"actor": "N0n",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "Pelindo's port logistics IT unit is listed on N0n's leak site.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/SUxDUyBQZWxpbmRvIChwb3J0IGxvZ2lzdGljcyBvcGVyYXRpb25zKUBOMG4"
}
],
"checked": "2026-11-07",
"domain": "ilcs.co.id",
"logo": "ilcs.co.id",
"actor_ids": [
"n0n"
],
"id": "ecbb81fd"
},
{
"org": "Indo Tambangraya Megah",
"sector": "energy",
"date": "2026-10-02",
"type": "ransomware",
"actor": "RansomHouse",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "The coal producer is listed on RansomHouse's leak site.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/UFQgSW5kbyBUYW1iYW5ncmF5YSBNZWdhaEByYW5zb21ob3VzZQ"
}
],
"checked": "2026-11-07",
"domain": "itmg.co.id",
"actor_ids": [
"ransomhouse"
],
"id": "7a784c0f"
},
{
"org": "Supreme Energy",
"sector": "energy",
"date": "2026-10-09",
"type": "ransomware",
"actor": "Panzer",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "The geothermal developer is listed on Panzer's leak site.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/U3VwcmVtZSBFbmVyZ3lAUGFuemVy"
}
],
"checked": "2026-11-07",
"domain": "supreme-energy.com",
"logo": "supreme-energy.com",
"actor_ids": [
"panzer"
],
"id": "1024521c"
},
{
"org": "Instagram (Meta) users in Indonesia",
"sector": "media",
"date": "2026-01-14",
"type": "data-leak",
"actor": "",
"status": "disputed",
"vendor": false,
"confirmed": "Komdigi summoned Meta on 14 January and relayed Meta's position that no passwords were exposed and no misuse of the password reset feature was found, with Meta's investigation still ongoing.",
"claimed": "A third-party report claimed a leak of Instagram user data linked to a wave of password reset emails.",
"sources": [
{
"name": "CNN Indonesia",
"url": "https://www.cnnindonesia.com/teknologi/20260116113321-192-1317647/komdigi-panggil-meta-minta-penjelasan-dugaan-kebocoran-data-instagram"
},
{
"name": "Kompas Tekno",
"url": "https://tekno.kompas.com/read/2026/01/17/16150017/komdigi-panggil-meta-buntut-dugaan-kebocoran-data-17-5-juta-pengguna-instagram"
}
],
"checked": "2026-11-07",
"actor_ids": [],
"id": "546a2d86"
},
{
"org": "Kemdiktisaintek and a dozen-plus universities",
"sector": "education",
"date": "2026-01-19",
"type": "data-leak",
"actor": "",
"status": "claimed",
"vendor": false,
"confirmed": "Kemdiktisaintek Secretary General Togar Mangihut Simatupang said the ministry was still tracing and verifying the data and that some of it appeared old; Deputy Minister Nezar Patria said the leak may have come from the ministry's data centre.",
"claimed": "Screenshots shared on Facebook claimed student and lecturer data (names, NIM, emails, passwords) from more than a dozen universities was being sold on a dark web forum.",
"sources": [
{
"name": "Kompas",
"url": "https://www.kompas.com/tren/read/2026/01/20/153000365/ramai-soal-kebocoran-data-mahasiswa-di-sejumlah-kampus-indonesia-ini-kata?page=all"
},
{
"name": "CNBC Indonesia",
"url": "https://www.cnbcindonesia.com/tech/20260123101312-37-704671/komdigi-jawab-isu-data-13-universitas-di-indonesia-bocor"
}
],
"checked": "2026-11-07",
"actor_ids": [],
"id": "4915adc4"
},
{
"org": "Komdigi (job applicant recruitment)",
"sector": "government",
"date": "2026-02-04",
"type": "data-leak",
"actor": "",
"status": "confirmed",
"vendor": false,
"confirmed": "Komdigi Secretary General Ismail told a DPR Commission I hearing on 4 February that the exposed applicant files were being handled internally and that the Inspector General was reviewing procedures.",
"claimed": "",
"sources": [
{
"name": "CNN Indonesia",
"url": "https://www.cnnindonesia.com/teknologi/20260204152007-192-1324555/viral-data-pelamar-kerja-diduga-bocor-komdigi-buka-suara"
},
{
"name": "CNN Indonesia",
"url": "https://www.cnnindonesia.com/teknologi/20260206131624-185-1325322/komdigi-telusuri-data-pelamar-kerja-di-google-drive-diduga-bocor"
}
],
"checked": "2026-11-07",
"domain": "komdigi.go.id",
"logo": "komdigi.go.id",
"actor_ids": [],
"id": "2d527ed5"
},
{
"org": "Garuda Indonesia",
"sector": "transport",
"date": "2026-02-21",
"type": "ransomware",
"actor": "The Gentlemen",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "The Gentlemen listed the state airline on its leak site; the tracker estimates the attack date as July 2023.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/R2FydWRhIEluZG9uZXNpYSBBaXJsaW5lc0B0aGVnZW50bGVtZW4"
}
],
"checked": "2026-11-07",
"domain": "garuda-indonesia.com",
"logo": "garuda-indonesia.com",
"actor_ids": [
"the-gentlemen"
],
"id": "31681266"
},
{
"org": "PT Darma Henwa Tbk",
"sector": "energy",
"date": "2026-02-16",
"type": "ransomware",
"actor": "Spacebears",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "Spacebears listed the mining contractor on its leak site with an estimated attack date of 15 February.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/RGFybWEgSGVud2FAc3BhY2ViZWFycw"
}
],
"checked": "2026-11-07",
"domain": "ptdh.co.id",
"logo": "ptdh.co.id",
"actor_ids": [
"spacebears"
],
"id": "4055ad0d"
},
{
"org": "Bandung city population data",
"sector": "government",
"date": "2026-03-26",
"type": "data-leak",
"actor": "petrusnism",
"status": "disputed",
"vendor": false,
"confirmed": "Bandung Diskominfo head Henryco Arie Sapiie said on 7 April that the data did not come from the Disdukcapil server and did not match the SIAK format, after checks coordinated with BSSN.",
"claimed": "An actor called petrusnism claimed a database of more than one million Bandung residents' records.",
"sources": [
{
"name": "Merdeka",
"url": "http://www.merdeka.com/peristiwa/read/8099329/heboh-kabar-kebocoran-data-1-juta-penduduk-pemkot-bandung-berikan-penjelasan-bantah-dari-server-disdukcapil"
}
],
"checked": "2026-11-07",
"actor_ids": [
"petrusnism"
],
"id": "014520f1"
},
{
"org": "PT Energi Mega Persada Tbk",
"sector": "energy",
"date": "2026-03-30",
"type": "ransomware",
"actor": "LockBit 5.0",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "LockBit 5.0 listed the upstream oil and gas company with an estimated attack date of 26 February.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/ZW1wLmlkQGxvY2tiaXQ1"
}
],
"checked": "2026-11-07",
"domain": "emp.id",
"logo": "emp.id",
"actor_ids": [
"lockbit-5-0"
],
"id": "3b4bdc6a"
},
{
"org": "PT Brantas Abipraya (BUMN)",
"sector": "property",
"date": "2026-03-31",
"type": "ransomware",
"actor": "Everest",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "Everest listed the state-owned construction company on its leak site.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/UFQgQnJhbnRhcyBBYmlwcmF5YUBldmVyZXN0"
}
],
"checked": "2026-11-07",
"domain": "brantas-abipraya.co.id",
"logo": "brantas-abipraya.co.id",
"actor_ids": [
"everest"
],
"id": "1dc8dd87"
},
{
"org": "Equity Life Indonesia",
"sector": "finance",
"date": "2026-04-04",
"type": "ransomware",
"actor": "The Gentlemen",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "The Gentlemen listed the life insurer on its leak site.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/RXF1aXR5IExpZmVAdGhlZ2VudGxlbWVu"
}
],
"checked": "2026-11-07",
"domain": "equity.co.id",
"logo": "equity.co.id",
"actor_ids": [
"the-gentlemen"
],
"id": "562245a0"
},
{
"org": "Pemerintah Kabupaten Bojonegoro",
"sector": "government",
"date": "2026-04-05",
"type": "ransomware",
"actor": "Nova",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "Nova listed the Bojonegoro regency government on its leak site.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/UGVtZXJpbnRhaCBLYWJ1cGF0ZW4gQm9qb25lZ29yb0Bub3Zh"
}
],
"checked": "2026-11-07",
"domain": "bojonegorokab.go.id",
"logo": "bojonegorokab.go.id",
"actor_ids": [
"nova"
],
"id": "c3cb4dae"
},
{
"org": "Kementerian Pemberdayaan Perempuan dan Perlindungan Anak (KemenPPPA)",
"sector": "government",
"date": "2026-04-15",
"type": "ransomware",
"actor": "CoinbaseCartel",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "CoinbaseCartel listed the women's empowerment and child protection ministry on its leak site.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/S2VtZW5wcHBhQGNvaW5iYXNlY2FydGVs"
}
],
"checked": "2026-11-07",
"domain": "kemenpppa.go.id",
"logo": "kemenpppa.go.id",
"actor_ids": [
"coinbase-cartel"
],
"id": "fc360545"
},
{
"org": "Kementerian Pertanian",
"sector": "government",
"date": "2026-04-23",
"type": "data-leak",
"actor": "CoinbaseCartel",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "CoinbaseCartel listed the Ministry of Agriculture on its leak site; no leak size was given.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/S2VtZW50ZXJpYW4gUGVydGFuaWFuQGNvaW5iYXNlY2FydGVs"
}
],
"checked": "2026-11-07",
"domain": "pertanian.go.id",
"logo": "pertanian.go.id",
"actor_ids": [
"coinbase-cartel"
],
"id": "5fbe5bad"
},
{
"org": "Star Energy Geothermal Salak",
"sector": "energy",
"date": "2026-04-24",
"type": "ransomware",
"actor": "RansomHouse",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "RansomHouse listed the geothermal operator with an estimated attack date of 11 April.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/U3RhciBFbmVyZ3kgR2VvdGhlcm1hbCBTYWxha0ByYW5zb21ob3VzZQ"
}
],
"checked": "2026-11-07",
"domain": "starenergy.co.id",
"logo": "starenergy.co.id",
"actor_ids": [
"ransomhouse"
],
"id": "0bf37339"
},
{
"org": "Bapenda Kabupaten Jombang",
"sector": "government",
"date": "2026-04-28",
"type": "data-leak",
"actor": "",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "A threat actor claimed about 100,000 taxpayer and service-request records (2025 to 2026) from the Jombang regional revenue agency website.",
"sources": [
{
"name": "Dark Web Intelligence on X",
"url": "https://x.com/DailyDarkWeb/status/2048555625630626141"
},
{
"name": "Jawa Pos Jombang",
"url": "https://jombangbanget.jawapos.com/politika/2604280019/waduh-100000-data-wajib-pajak-bocor-dari-web-pemkab-jombang-kini-disebar-di-darkweb"
},
{
"name": "Melekmedia",
"url": "https://melekmedia.org/artikel/berita-kebocoran-data-indonesia-makin-marak/"
}
],
"checked": "2026-11-07",
"domain": "jombangkab.go.id",
"logo": "jombangkab.go.id",
"actor_ids": [],
"id": "baf8db7d"
},
{
"org": "Direktorat Jenderal Bea dan Cukai (customs analytics platform)",
"sector": "government",
"date": "2026-04-28",
"type": "ransomware",
"actor": "Everest",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "Everest claimed about 44.86 GB in 437 files from a customs analytics system, including Power BI audit models and about 173,292 corporate tax ID records, with a short publication deadline.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/SW5kb25lc2lhJ3MgQ3VzdG9tcyBBbmFseXRpY3MgUGxhdGZvcm1AZXZlcmVzdA"
},
{
"name": "Reskrim Polda News",
"url": "https://reskrimpolda.news/2026/05/06/sistem-analitik-bea-cukai-diduga-dibobol-ransomware-everest-44-gb-data-sensitif-terancam-dipublikasikan/"
}
],
"checked": "2026-11-07",
"domain": "beacukai.go.id",
"logo": "beacukai.go.id",
"actor_ids": [
"everest"
],
"id": "c4768653"
},
{
"org": "Bank Central Asia (BCA)",
"sector": "finance",
"date": "2026-05-21",
"type": "access-sale",
"actor": "",
"status": "disputed",
"vendor": false,
"confirmed": "BCA EVP Corporate Communication Hera F. Haryn said an internal investigation found no match between the circulating data and BCA's database and no customer data leaked.",
"claimed": "A dark web seller offered a dataset called BCA Mobile Bank Access & Database, claiming about 890,000 accesses and 4.9 million records.",
"sources": [
{
"name": "Kompas",
"url": "https://money.kompas.com/read/2026/05/21/173101926/bca-pastikan-data-nasabah-aman-bantah-isu-kebocoran-di-media-sosial"
}
],
"checked": "2026-11-07",
"domain": "bca.co.id",
"logo": "bca.co.id",
"actor_ids": [],
"id": "004d8407"
},
{
"org": "Bank Negara Indonesia (BNI)",
"sector": "finance",
"date": "2026-05-22",
"type": "data-leak",
"actor": "TripleX",
"status": "disputed",
"vendor": false,
"confirmed": "BNI Corporate Secretary Okki Rushartomo said on 22 May that the bank found no sign of unauthorised taking or transfer of customer data and services were running normally.",
"claimed": "A social media post claimed customer data was for sale; ransomware.live later logged a TripleX listing for bni.co.id on 13 June with an estimated attack date of 11 May.",
"sources": [
{
"name": "Kompas",
"url": "https://money.kompas.com/read/2026/05/23/060800226/isu-kebocoran-data-nasabah-bni--kami-tidak-temukan-itu-"
},
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/Qm5pLmNvLmlkIGJhbmsgb2YgaW5kb25lc2lhIGZyZWUgZGF0YS5AVHJpcGxlIFg"
}
],
"checked": "2026-11-07",
"domain": "bni.co.id",
"logo": "bni.co.id",
"actor_ids": [
"triplex"
],
"id": "0b7f98ba"
},
{
"org": "Badan Pangan Nasional",
"sector": "government",
"date": "2026-05-29",
"type": "ransomware",
"actor": "Nova",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "Nova listed the national food agency on its leak site.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/QmFkYW4gUGFuZ2FuIE5hc2lvbmFsQG5vdmE"
}
],
"checked": "2026-11-07",
"domain": "badanpangan.go.id",
"logo": "badanpangan.go.id",
"actor_ids": [
"nova"
],
"id": "53f0f317"
},
{
"org": "JEC Eye Hospitals and Clinics",
"sector": "health",
"date": "2026-06-11",
"type": "ransomware",
"actor": "LockBit 5.0",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "LockBit 5.0 listed the eye hospital group with an estimated attack date of 19 April.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/amVjLmNvLmlkQGxvY2tiaXQ1"
}
],
"checked": "2026-11-07",
"domain": "jec.co.id",
"logo": "jec.co.id",
"actor_ids": [
"lockbit-5-0"
],
"id": "2e2e1291"
},
{
"org": "Balai Besar POM di Bandung",
"sector": "health",
"date": "2026-06-14",
"type": "ransomware",
"actor": "Nova",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "Nova listed the Bandung office of the food and drug regulator on its leak site.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/QmFuZHVuZ0Bub3Zh"
}
],
"checked": "2026-11-07",
"domain": "pom.go.id",
"logo": "pom.go.id",
"actor_ids": [
"nova"
],
"id": "d68651d6"
},
{
"org": "Pemprov Kalimantan Utara (Simpeg civil service system)",
"sector": "government",
"date": "2026-06-22",
"type": "data-leak",
"actor": "B4d0kAhay",
"status": "confirmed",
"vendor": false,
"confirmed": "BSSN notified the province of a leak indication found on 22 June and judged the posted sample valid after matching names and phone numbers; the provincial DKISP confirmed the notice and ordered password changes.",
"claimed": "An actor called B4d0kAhay posted a sample of civil servant names, NIP numbers and positions on a darknet forum, reportedly using infostealer-harvested credentials.",
"sources": [
{
"name": "detikKalimantan",
"url": "https://www.detik.com/kalimantan/berita/d-8549558/bssn-temukan-indikasi-kebocoran-data-dalam-aplikasi-simpeg-pemprov-kaltara"
}
],
"checked": "2026-11-07",
"domain": "kaltaraprov.go.id",
"actor_ids": [
"b4d0kahay"
],
"id": "661f127a"
},
{
"org": "Kementerian Perhubungan (Directorate General of Sea Transportation)",
"sector": "transport",
"date": "2026-07-19",
"type": "ransomware",
"actor": "Nova",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "Nova listed the transport ministry's shipping and maritime directorate and threatened to leak maritime data.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/RGVwaHViQG5vdmE"
}
],
"checked": "2026-11-07",
"domain": "kemenhub.go.id",
"logo": "kemenhub.go.id",
"actor_ids": [
"nova"
],
"id": "a59db781"
},
{
"org": "Rumah Sakit Universitas Indonesia (RSUI)",
"sector": "health",
"date": "2026-07-20",
"type": "ransomware",
"actor": "Nova",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "Nova listed the University of Indonesia teaching hospital on its leak site.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/UnVtYWggU2FraXQgVW5pdmVyc2l0YXMgSW5kb25lc2lhIChSU1VJKUBub3Zh"
}
],
"checked": "2026-11-07",
"domain": "rs.ui.ac.id",
"actor_ids": [
"nova"
],
"id": "4f1d6eb2"
},
{
"org": "260 Indonesian school, university and government websites",
"sector": "education",
"date": "2026-07-30",
"type": "seo-poisoning",
"actor": "AAK (Demak)",
"status": "confirmed",
"vendor": false,
"confirmed": "Polda Jatim cyber director Kombes Bimo Ariyanto said police arrested a Demak man, AAK, who hacked 80 school, 20 university, 13 government and 147 private Indonesian sites since 2023 and sold access to promote online gambling.",
"claimed": "",
"sources": [
{
"name": "Kompas",
"url": "https://surabaya.kompas.com/read/2026/07/31/055009678/hacker-demak-retas-website-sekolah-hingga-pemda-belajar-otodidak-dari-grup"
},
{
"name": "detikJatim",
"url": "https://www.detik.com/jatim/hukum-dan-kriminal/d-8596821/hacker-di-jatim-jual-web-sekolah-pemerintah-buat-promosi-judi-online"
}
],
"checked": "2026-11-07",
"actor_ids": [
"aak"
],
"id": "ffd926b7"
},
{
"org": "Pertamina",
"sector": "energy",
"date": "2026-07-31",
"type": "ransomware",
"actor": "The Gentlemen",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "The Gentlemen claimed more than 1.2 TB of Pertamina data including HR records, technical drawings, SCADA documents and bank statements; this listing is separate from the later RansomHouse claim.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/UGVydGFtaW5hQHRoZWdlbnRsZW1lbg"
},
{
"name": "cybersecurity.or.id",
"url": "https://www.cybersecurity.or.id/2026/08/dugaan-kebocoran-12-tb-data-pertamina.html"
}
],
"checked": "2026-11-07",
"domain": "pertamina.com",
"logo": "pertamina.com",
"actor_ids": [
"the-gentlemen"
],
"id": "ce7fa6a3"
},
{
"org": "Pusat Hidro-Oseanografi TNI AL (Pushidrosal)",
"sector": "government",
"date": "2026-08-04",
"type": "ransomware",
"actor": "INC Ransom",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "INC Ransom listed pushidrosal.id, the navy hydro-oceanographic centre, on its leak site.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/cHVzaGlkcm9zYWwuaWRAaW5jcmFuc29t"
}
],
"checked": "2026-11-07",
"domain": "pushidrosal.id",
"logo": "pushidrosal.id",
"actor_ids": [
"inc-ransom"
],
"id": "ff668928"
},
{
"org": "Pemkab Badung (Museum Yadnya and Desa Ayunan sites)",
"sector": "government",
"date": "2026-08-09",
"type": "defacement",
"actor": "",
"status": "confirmed",
"vendor": false,
"confirmed": "Diskominfo Badung e-government head I Gusti Agung Angga Mulyanta confirmed on 9 August that two subdomain sites showed abortion drug and online gambling ads and were taken down.",
"claimed": "",
"sources": [
{
"name": "Bali Tribune",
"url": "https://balitribune.co.id/content/dua-website-pemkab-badung-diretas-sempat-muncul-iklan-obat-aborsi-dan-judi-online"
}
],
"checked": "2026-11-07",
"domain": "badungkab.go.id",
"logo": "badungkab.go.id",
"actor_ids": [],
"id": "f3ba9d64"
},
{
"org": "Kepolisian Negara Republik Indonesia (Polri) personnel database",
"sector": "government",
"date": "2026-08-20",
"type": "data-leak",
"actor": "DYSPHOR1A",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "DYSPHOR1A claimed a database of about 52,000 police officers with emails and phone numbers.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/SW5kb25lc2lhbiBQb2xpY2UgRGF0YWJhc2VARFlTUEhPUjFB"
}
],
"checked": "2026-11-07",
"domain": "polri.go.id",
"logo": "polri.go.id",
"actor_ids": [
"dysphor1a"
],
"id": "249866d6"
},
{
"org": "Frisian Flag Indonesia",
"sector": "manufacturing",
"date": "2026-08-20",
"type": "ransomware",
"actor": "Panzer",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "Panzer listed the dairy maker on its leak site.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/RnJpc2lhbiBGbGFnIEluZG9uZXNpYUBQYW56ZXI"
}
],
"checked": "2026-11-07",
"domain": "frisianflag.com",
"logo": "frisianflag.com",
"actor_ids": [
"panzer"
],
"id": "03408c8d"
},
{
"org": "PT Bank Perekonomian Rakyat Bintan",
"sector": "finance",
"date": "2026-08-22",
"type": "ransomware",
"actor": "CoinbaseCartel",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "CoinbaseCartel listed the rural bank on its leak site.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/UFQuIEJhbmsgUGVyZWtvbm9taWFuIFJha3lhdCBCaW50YW5AY29pbmJhc2VjYXJ0ZWw"
}
],
"checked": "2026-11-07",
"domain": "bprbintan.co.id",
"actor_ids": [
"coinbase-cartel"
],
"id": "80b895f3"
},
{
"org": "Sinar Mas Agribusiness and Food (Golden Agri-Resources)",
"sector": "manufacturing",
"date": "2026-08-25",
"type": "data-leak",
"actor": "ShadowByt3$",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "ShadowByt3$ claimed it breached the company months earlier and posted 375.66 MB of data.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/U2luYXIgTWFzIEFncmlidXNpbmVzcyBhbmQgRm9vZCBHb2xkZW4gQWdyaS1SZXNvdXJjZXMpQFNoYWRvd0J5dDMk"
}
],
"checked": "2026-11-07",
"domain": "smart-tbk.com",
"logo": "smart-tbk.com",
"actor_ids": [
"shadowbyt3"
],
"id": "ca20ba59"
},
{
"org": "Diskominfo Provinsi Jawa Tengah",
"sector": "government",
"date": "2026-09-03",
"type": "ransomware",
"actor": "Panzer",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "Panzer listed the Central Java communications and informatics office on its leak site.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/RGluYXMgS29tdW5pa2FzaSBkYW4gSW5mb3JtYXRpa2FAUGFuemVy"
}
],
"checked": "2026-11-07",
"domain": "jatengprov.go.id",
"logo": "jatengprov.go.id",
"actor_ids": [
"panzer"
],
"id": "77e1ed26"
},
{
"org": "Solaria restaurant chain",
"sector": "retail",
"date": "2026-09-30",
"type": "ransomware",
"actor": "The Gentlemen",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "The Gentlemen listed the Solaria restaurant chain with an estimated attack date of 29 September.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/U29sYXJpYUB0aGVnZW50bGVtZW4"
}
],
"checked": "2026-11-07",
"domain": "solaria.co.id",
"actor_ids": [
"the-gentlemen"
],
"id": "efba3b5e"
},
{
"org": "WIKA Beton (PT Wijaya Karya Beton Tbk, BUMN group)",
"sector": "manufacturing",
"date": "2026-10-31",
"type": "ransomware",
"actor": "The Gentlemen",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "The Gentlemen listed the state-group precast concrete maker with an estimated attack date of 26 October; no data volume was stated.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/V0lLQSBCZXRvbkB0aGVnZW50bGVtZW4"
},
{
"name": "Dark Web Intelligence on X",
"url": "https://x.com/DailyDarkWeb/status/2114740361176236435"
}
],
"checked": "2026-11-07",
"domain": "wika-beton.co.id",
"logo": "wika-beton.co.id",
"actor_ids": [
"the-gentlemen"
],
"id": "c16fbb5a"
},
{
"org": "Bank Mandiri",
"sector": "finance",
"date": "2026-11-05",
"type": "data-leak",
"actor": "",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "A dark web forum seller posted a sample and offered a 2026 database of Mandiri debit card users with names, phones, emails, card and account details and limits.",
"sources": [
{
"name": "Harian Massa",
"url": "https://harianmassa.id/ototekno/2717861940/nasabah-bank-mandiri-hati-hati-data-kartu-debit-bocor-di-dark-web"
}
],
"checked": "2026-11-07",
"domain": "bankmandiri.co.id",
"logo": "bankmandiri.co.id",
"actor_ids": [],
"id": "3fdcf528"
}
],
"slug": "indonesia",
"title": "Indonesia Cyber Incidents and Data Breaches 2026 · pwnsy",
"lede": "No public threat level. 6 incidents confirmed, 32 claims in 2026.",
"h1": "![\"\"](\"/tools/cyber-watch/flags/id.svg\")
Indonesia Cyber Watch",
"desc": "Indonesia cyber threat level: none published. 6 incidents confirmed and 32 claims in 2026, each sourced. Updated 7 Nov 2026.",
"since": "2026-01-01",
"stats": [
{
"label": "BSSN traffic anomalies recorded in 2025",
"value": "5.5 billion",
"period": "2025",
"source": {
"name": "detikInet (BSSN Deputy Bondan Widiawan, 23 Apr 2026)",
"url": "https://inet.detik.com/security/d-8458200/duh-ri-dihantam-1-5-miliar-anomali-trafik-dalam-4-bulan"
}
},
{
"label": "BSSN traffic anomalies in early 2026",
"value": "1.5 billion (1.52 billion per Kompas)",
"period": "1 Jan to 15 Apr 2026",
"source": {
"name": "detikInet",
"url": "https://inet.detik.com/security/d-8458200/duh-ri-dihantam-1-5-miliar-anomali-trafik-dalam-4-bulan"
}
},
{
"label": "Rise in 2025 attacks over the 2020 to 2024 annual average",
"value": "714 percent",
"period": "2025",
"source": {
"name": "Kompas (BSSN, 23 Apr 2026)",
"url": "https://lestari.kompas.com/read/2026/04/23/192503686/bssn-serangan-siber-naik-7-kali-lipat-pada-2025-dan-berlanjut-di-awal-2026?page=all"
}
},
{
"label": "BSSN incident notifications sent in 2026 (and responded to)",
"value": "1,002 (776 responded)",
"period": "1 Jan to about 23 Apr 2026",
"source": {
"name": "detikInet",
"url": "https://inet.detik.com/security/d-8458200/duh-ri-dihantam-1-5-miliar-anomali-trafik-dalam-4-bulan"
}
},
{
"label": "BSSN incident notifications sent in 2025 (and responded to)",
"value": "2,855 (about 2,186 responded)",
"period": "2025",
"source": {
"name": "detikInet",
"url": "https://inet.detik.com/security/d-8458200/duh-ri-dihantam-1-5-miliar-anomali-trafik-dalam-4-bulan"
}
},
{
"label": "Registered government cyber incident response teams (TTIS)",
"value": "514",
"period": "as of 6 Oct 2026",
"source": {
"name": "Rilis Kalimantan (BSSN Deputy Sulistyo)",
"url": "https://www.riliskalimantan.com/2026/10/bssn-kukuhkan-59-tim-tanggap-insiden.html"
}
},
{
"label": "Scam reports received by IASC",
"value": "737,686",
"period": "22 Nov 2024 to 28 Oct 2026",
"source": {
"name": "ANTARA (OJK, 5 Nov 2026)",
"url": "https://www.antaranews.com/berita/5834751/ojk-iasc-blokir-rp9675-miliar-dana-terkait-penipuan"
}
},
{
"label": "Scam-linked funds blocked by IASC",
"value": "Rp967.5 billion",
"period": "22 Nov 2024 to 28 Oct 2026",
"source": {
"name": "ANTARA (OJK, 5 Nov 2026)",
"url": "https://www.antaranews.com/berita/5834751/ojk-iasc-blokir-rp9675-miliar-dana-terkait-penipuan"
}
},
{
"label": "Accounts reported to IASC and blocked",
"value": "1,471,112 reported, 743,589 blocked",
"period": "22 Nov 2024 to 28 Oct 2026",
"source": {
"name": "ANTARA (OJK, 5 Nov 2026)",
"url": "https://www.antaranews.com/berita/5834751/ojk-iasc-blokir-rp9675-miliar-dana-terkait-penipuan"
}
},
{
"label": "Scam victim funds returned via IASC",
"value": "Rp208.9 billion",
"period": "22 Nov 2024 to 28 Oct 2026",
"source": {
"name": "ANTARA (OJK, 5 Nov 2026)",
"url": "https://www.antaranews.com/berita/5834751/ojk-iasc-blokir-rp9675-miliar-dana-terkait-penipuan"
}
},
{
"label": "Scam reports received by IASC (mid-year checkpoint)",
"value": "637,055",
"period": "22 Nov 2024 to 31 Jul 2026",
"source": {
"name": "Kompas (Satgas PASTI, 1 Sep 2026)",
"url": "https://money.kompas.com/read/2026/09/02/054000426/iasc-ojk-terima-laporan-1-17-juta-rekening-terkait-scam-dana-rp-724-miliar"
}
},
{
"label": "Online gambling sites and content taken down by Komdigi",
"value": "3.7 million",
"period": "20 Oct 2024 to 12 Jul 2026",
"source": {
"name": "detikInet (Minister Meutya Hafid, 14 Jul 2026)",
"url": "https://inet.detik.com/law-and-policy/d-8573944/komdigi-tutup-3-7-juta-konten-judi-online-sejak-oktober-2024"
}
},
{
"label": "Phone numbers reported to Komdigi as used for scams",
"value": "about 85,500",
"period": "period not stated (reported 14 Jul 2026)",
"source": {
"name": "detikInet",
"url": "https://inet.detik.com/law-and-policy/d-8573944/komdigi-tutup-3-7-juta-konten-judi-online-sejak-oktober-2024"
}
},
{
"label": "Accounts reported via cekrekening.id for gambling or fraud",
"value": "more than 156,000",
"period": "period not stated (reported 14 Jul 2026)",
"source": {
"name": "detikInet",
"url": "https://inet.detik.com/law-and-policy/d-8573944/komdigi-tutup-3-7-juta-konten-judi-online-sejak-oktober-2024"
}
}
],
"rules": [
{
"date": "2026-01-23",
"title": "PADK OJK No. 1 of 2026 on IT implementation by commercial banks",
"what": "Sets IT risk and security controls for banks from 1 March 2026, with 24-hour notice to OJK for significant non-cyber IT incidents and a full report within five business days.",
"url": "https://www.veritask.ai/en/artikel/ojk-tightens-risk-control-and-information-technology-security-for-banks-through-regulation-of-the-members-of-the-board-of-commissioners-of-ojk-number-1-of-2026"
},
{
"date": "2026-05-20",
"title": "Draft Perpres on the personal data protection agency sent to the President",
"what": "Komdigi told the Constitutional Court on 27 July that the draft Perpres creating the PDP agency was sent for enactment on 20 May and is not yet signed; Komdigi handles PDP oversight until then.",
"url": "https://nasional.kompas.com/read/2026/07/27/15423511/komdigi-ungkap-perpres-pembentukan-badan-perlindungan-data-pribadi-sedang"
},
{
"date": "2026-05-20",
"title": "Revision of the PDP Law added to the 2026 Prolegnas priority list",
"what": "The DPR plenary listed a revision of Law 27/2022 among 68 priority bills for 2026; drafting had not started at the time.",
"url": "https://www.cnbcindonesia.com/tech/20260522084017-37-736912/dpr-kebut-undang-undang-ojol-aturan-data-pribadi-mau-direvisi"
},
{
"date": "2026-06-29",
"title": "DPR and government form working committee on the Cyber Security and Resilience Bill (RUU KKS)",
"what": "Commission I and the government set up a 23-member panja chaired by Sukamta to deliberate the bill, which covers critical information infrastructure duties, post-incident audits, sanctions and criminal provisions.",
"url": "https://www.antaranews.com/berita/5626912/pemerintah-dan-dpr-bentuk-panja-ruu-keamanan-dan-ketahanan-siber"
},
{
"date": "2026-07-16",
"title": "PP 33/2026 implementing the PDP Law",
"what": "President Prabowo signed the implementing regulation for the PDP Law covering consent, children's data and data subject rights; it takes effect on 16 January 2027.",
"url": "https://katadata.co.id/finansial/makro/6a9979b7c5745/pp-pelindungan-data-pribadi-berlaku-januari-2027-ini-aturan-baru-data-anak"
},
{
"date": "2026-11-05",
"title": "Komdigi Kepmen 127 and 128 of 2026 on urgent content takedown",
"what": "Platforms must take down urgent content such as online gambling within four hours of a Komdigi takedown order (date is the report date; the decree dates were not stated).",
"url": "https://www.cnnindonesia.com/teknologi/20261104202904-185-1423408/komdigi-konten-judol-wajib-ditakedown-platfofrm-dalam-4-jam"
}
],
"actors": [
{
"name": "The Gentlemen",
"kind": "ransomware",
"seen": "Listed Garuda Indonesia, Equity Life, Pertamina, Solaria and WIKA Beton on its leak site between February and October 2026.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/V0lLQSBCZXRvbkB0aGVnZW50bGVtZW4"
},
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/UGVydGFtaW5hQHRoZWdlbnRsZW1lbg"
}
],
"actor_id": "the-gentlemen"
},
{
"name": "Nova",
"kind": "ransomware",
"seen": "Listed at least nine Indonesian victims in 2026, mostly public bodies, including Bojonegoro regency, Badan Pangan Nasional, BPOM Bandung, the transport ministry and RSUI.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/RGVwaHViQG5vdmE"
},
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/UnVtYWggU2FraXQgVW5pdmVyc2l0YXMgSW5kb25lc2lhIChSU1VJKUBub3Zh"
}
],
"actor_id": "nova"
},
{
"name": "CoinbaseCartel",
"kind": "extortion",
"seen": "Data-extortion listings against KemenPPPA, the agriculture ministry, BPR Bintan, Jamu Air Mancur and others in 2026.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/S2VtZW50ZXJpYW4gUGVydGFuaWFuQGNvaW5iYXNlY2FydGVs"
},
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/S2VtZW5wcHBhQGNvaW5iYXNlY2FydGVs"
}
],
"actor_id": "coinbase-cartel"
},
{
"name": "Everest",
"kind": "ransomware",
"seen": "Claimed the customs analytics platform and BUMN contractor Brantas Abipraya in March and April 2026.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/SW5kb25lc2lhJ3MgQ3VzdG9tcyBBbmFseXRpY3MgUGxhdGZvcm1AZXZlcmVzdA"
},
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/UFQgQnJhbnRhcyBBYmlwcmF5YUBldmVyZXN0"
}
],
"actor_id": "everest"
},
{
"name": "Panzer",
"kind": "ransomware",
"seen": "Listed Frisian Flag, Universitas Surakarta and the Central Java Diskominfo between August and September 2026.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/RGluYXMgS29tdW5pa2FzaSBkYW4gSW5mb3JtYXRpa2FAUGFuemVy"
}
],
"actor_id": "panzer"
},
{
"name": "LockBit 5.0",
"kind": "ransomware",
"seen": "Listed Energi Mega Persada, Murni Solusindo, JEC Eye Hospitals and Synergy in 2026.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/ZW1wLmlkQGxvY2tiaXQ1"
},
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/amVjLmNvLmlkQGxvY2tiaXQ1"
}
],
"actor_id": "lockbit-5-0"
},
{
"name": "RansomHouse",
"kind": "extortion",
"seen": "Listed Star Energy Geothermal Salak in April 2026 in addition to its later energy-sector claims.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/U3RhciBFbmVyZ3kgR2VvdGhlcm1hbCBTYWxha0ByYW5zb21ob3VzZQ"
}
],
"actor_id": "ransomhouse"
},
{
"name": "Tengu",
"kind": "ransomware",
"seen": "Listed KSP TLM Indonesia, Jakarta Nanyang School and Mitra Antar Tangguh in January and February 2026.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/S1NQIFRMTSBJTkRPTkVTSUFAdGVuZ3U"
}
],
"actor_id": "tengu"
},
{
"name": "WorldLeaks",
"kind": "extortion",
"seen": "Listed IT firm Intikom and BMJ Paperpack in April and May 2026.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/SW50aWtvbUB3b3JsZGxlYWtz"
}
],
"actor_id": "world-leaks"
},
{
"name": "DYSPHOR1A",
"kind": "unknown",
"seen": "Claimed a database of about 52,000 Indonesian police officers in August 2026.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/SW5kb25lc2lhbiBQb2xpY2UgRGF0YWJhc2VARFlTUEhPUjFB"
}
],
"actor_id": "dysphor1a"
},
{
"name": "TripleX",
"kind": "unknown",
"seen": "Listed bni.co.id customer data in June 2026, which BNI says it found no evidence of.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/Qm5pLmNvLmlkIGJhbmsgb2YgaW5kb25lc2lhIGZyZWUgZGF0YS5AVHJpcGxlIFg"
}
],
"actor_id": "triplex"
},
{
"name": "B4d0kAhay",
"kind": "unknown",
"seen": "Posted a sample of North Kalimantan civil servant data that BSSN judged valid in June 2026.",
"sources": [
{
"name": "detikKalimantan",
"url": "https://www.detik.com/kalimantan/berita/d-8549558/bssn-temukan-indikasi-kebocoran-data-dalam-aplikasi-simpeg-pemprov-kaltara"
}
],
"actor_id": "b4d0kahay"
},
{
"name": "Online gambling SEO access sellers",
"kind": "scam-syndicate",
"seen": "Police arrested a Demak man who sold hacked school, campus and government site access to gambling promoters; Badung sites were defaced with gambling ads in August.",
"sources": [
{
"name": "Kompas",
"url": "https://surabaya.kompas.com/read/2026/07/31/055009678/hacker-demak-retas-website-sekolah-hingga-pemda-belajar-otodidak-dari-grup"
},
{
"name": "Bali Tribune",
"url": "https://balitribune.co.id/content/dua-website-pemkab-badung-diretas-sempat-muncul-iklan-obat-aborsi-dan-judi-online"
}
]
}
],
"region": "Southeast Asia",
"upd": "2026-11-07"
},
"TH": {
"name": "Thailand",
"posture": {
"level": "",
"summary": "NCSA and ThaiCERT send alerts to agencies and critical infrastructure; the National Security Council said on 3 Nov it has a cyber response plan.",
"agency": "National Cyber Security Agency (NCSA) and ThaiCERT",
"source": {
"name": "National Cyber Security Agency (NCSA) and ThaiCERT",
"url": "https://mgronline.com/politics/detail/9690000102150"
},
"checked": "2026-11-07"
},
"timeline": [
{
"date": "2026-10-22",
"text": "NCSA tells agencies, critical infrastructure and sector CERTs to patch PHP2Shell urgently and steps up monitoring.",
"url": "https://mgronline.com/politics/detail/9690000102150",
"src": "MGR Online"
},
{
"date": "2026-11-03",
"text": "The National Security Council says a cyber response plan is in place and calls agencies to a rehearsal on 4 Nov.",
"url": "https://www.thebangkokinsight.com/news/politics-general/1716325/",
"src": "Bangkok Insight"
},
{
"date": "2026-11-06",
"text": "The digital ministry asks regulator NBTC to order mobile operators to tighten defences after the NTT Docomo attack in Japan.",
"url": "https://spacebar.th/business/docomo-outage-thai-telecom",
"src": "Spacebar"
},
{
"date": "2026-01-17",
"text": "The DSI arrested a suspect at Suvarnabhumi Airport over the hacking of 16 government websites to redirect to gambling sites.",
"url": "https://today.line.me/th/v3/article/zN2r07k",
"src": "DSI via LINE Today"
},
{
"date": "2026-02-18",
"text": "The NBTC said it suspended 28,112 numbers suspected of tech crime use in January 2026, with Sa Kaeo highest at 7,331.",
"url": "https://siamrath.co.th/technology/130032",
"src": "NBTC via Siam Rath"
},
{
"date": "2026-02-26",
"text": "The NBTC ordered carriers to suspend 495 SIMs registered with Chiang Mai students' data and sold to scam groups.",
"url": "https://www.thaipbs.or.th/news/content/502685",
"src": "NBTC via Thai PBS"
},
{
"date": "2026-04-14",
"text": "The Department of Provincial Administration filed complaints against three people who said its voter lookup data leaked.",
"url": "https://www.bangkokbiznews.com/politics/1229644",
"src": "DOPA via Bangkok Biz News"
},
{
"date": "2026-04-24",
"text": "The PDPC opened an inquiry into the Council of Engineers breach detected on 17 April.",
"url": "https://www.dailynews.co.th/news/5810167/",
"src": "PDPC via Daily News"
},
{
"date": "2026-07-13",
"text": "Government spokesperson Ratchada Thanadirek said more than 351,000 mule accounts were closed and over 3.6 billion baht frozen in nine months.",
"url": "https://english.news.cn/20260713/8afa7a37ce1e4a2ea37bd12ee394d8be/c.html",
"src": "Government spokesperson via Xinhua"
},
{
"date": "2026-07-28",
"text": "TSD said about 200,000 Investor Portal accounts had personal data accessed through a profile page flaw.",
"url": "https://mgronline.com/stockmarket/detail/9690000074068",
"src": "TSD via MGR Online"
},
{
"date": "2026-07-29",
"text": "The PDPC asked the Public Health Ministry and TSD for evidence of PDPA compliance.",
"url": "https://www.thaipost.net/economy-news/1040694/",
"src": "PDPC via Thai Post"
},
{
"date": "2026-08-06",
"text": "The prime minister ordered an inquiry into leaked personal data, and the NCSA was told to review about 300 departments.",
"url": "https://www.thaipost.net/politics-news/1045444/",
"src": "Government spokesperson via Thai Post"
},
{
"date": "2026-08-06",
"text": "The Deputy Transport Minister said DLT data leaked through misused API credentials, not a hack of the main database.",
"url": "https://www.thaipbs.or.th/news/content/509122",
"src": "Ministry of Transport via Thai PBS"
},
{
"date": "2026-08-11",
"text": "The cabinet approved forced password resets, a 15-day cleanup of 30,000 systems and MFA across government.",
"url": "https://www.thansettakij.com/economy/666195",
"src": "Government spokesperson via Thansettakij"
},
{
"date": "2026-09-02",
"text": "Cyber police said the online reporting system logged about 221,626 reports and over 11,039 million baht in losses from January to August.",
"url": "https://thailandedition.com/i/cyber-police-retirees-lose-315-billion-baht-scams-00a26a97d1686b2e930c400d",
"src": "TCSD via Thailand Edition"
},
{
"date": "2026-10-20",
"text": "The PDPC said it had received 4,210 complaints and 1,650 breach notifications from 2023 to May 2026.",
"url": "https://www.todayvariety.com/2026/10/pdpa-4210-1650.html",
"src": "PDPC via Today Variety"
}
],
"incidents": [
{
"org": "Opposition leaders (People's Party, Democrats)",
"sector": "other",
"date": "2026-11-03",
"type": "other",
"actor": "",
"status": "confirmed",
"vendor": false,
"confirmed": "Natthaphong Ruengpanyawut posted an Apple spyware threat notification; Abhisit Vejjajiva also got one but his phone was not compromised. The government calls claims of state involvement baseless.",
"claimed": "",
"sources": [
{
"name": "The Star",
"url": "https://www.thestar.com.my/aseanplus/aseanplus-news/2026/11/04/thai-opposition-leader-targeted-in-spyware-attack-party"
},
{
"name": "Naewna",
"url": "https://www.naewna.com/n/politics/147878/"
}
],
"checked": "2026-11-07",
"actor_ids": [],
"id": "53e8bf72"
},
{
"org": "Royal Thai Air Force",
"sector": "government",
"date": "2026-10-10",
"type": "ransomware",
"actor": "The Gentlemen",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "Listed on The Gentlemen's leak site.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/Um95YWwgVGhhaSBBaXIgRm9yY2VAdGhlZ2VudGxlbWVu"
}
],
"checked": "2026-11-07",
"domain": "rtaf.mi.th",
"logo": "rtaf.mi.th",
"actor_ids": [
"the-gentlemen"
],
"id": "5ca43fe5"
},
{
"org": "Thai Lion Air",
"sector": "transport",
"date": "2026-10-02",
"type": "ransomware",
"actor": "Qilin",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "Listed on Qilin's leak site with a threat to publish data.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/VGhhaSBMaW9uIEFpckBxaWxpbg"
}
],
"checked": "2026-11-07",
"domain": "lionairthai.com",
"logo": "lionairthai.com",
"actor_ids": [
"qilin"
],
"id": "71a8f6f6"
},
{
"org": "PTT Oil and Retail Business (OR)",
"sector": "energy",
"date": "2026-09-02",
"type": "ransomware",
"actor": "Dire Wolf",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "Listed on Dire Wolf's leak site with an extortion notice.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/UFRUIE9pbCBhbmQgUmV0YWlsIEJ1c2luZXNzQGRpcmV3b2xm"
}
],
"checked": "2026-11-07",
"domain": "pttor.com",
"logo": "pttor.com",
"actor_ids": [
"direwolf"
],
"id": "4d1372f8"
},
{
"org": "Bangkok Post",
"sector": "media",
"date": "2026-10-30",
"type": "data-leak",
"actor": "d00101",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "An actor claims a 6.9 GB dump with 822,140 member and 385 employee records.",
"sources": [
{
"name": "Dark Web Informer",
"url": "https://darkwebinformer.com/bangkok-post-breach-claim-includes-822-140-member-accounts-and-6-9-gb-infrastructure-dump/"
}
],
"checked": "2026-11-07",
"domain": "bangkokpost.com",
"logo": "bangkokpost.com",
"actor_ids": [
"d00101"
],
"id": "0d8ffb80"
},
{
"org": "Xspring Capital",
"sector": "finance",
"date": "2026-10-29",
"type": "ransomware",
"actor": "LockBit 5",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "xspringcapital.com is listed on LockBit 5's leak site.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/eHNwcmluZ2NhcGl0YWwuY29tQGxvY2tiaXQ1"
}
],
"checked": "2026-11-07",
"domain": "xspringcapital.com",
"logo": "xspringcapital.com",
"actor_ids": [
"lockbit-5-0"
],
"id": "3394119e"
},
{
"org": "Thai Ha PCL",
"sector": "manufacturing",
"date": "2026-10-16",
"type": "ransomware",
"actor": "The Gentlemen",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "The SET-listed food maker is listed on The Gentlemen's leak site.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/VGhhaSBIYSBQQ0wgS0FTRVRAdGhlZ2VudGxlbWVu"
}
],
"checked": "2026-11-07",
"actor_ids": [
"the-gentlemen"
],
"id": "e456ca3b"
},
{
"org": "Council of Engineers Thailand",
"sector": "other",
"date": "2026-04-17",
"type": "data-leak",
"actor": "",
"status": "confirmed",
"vendor": false,
"confirmed": "The Council of Engineers said it detected a breach of member data on 17 April 2026, contained it and notified the PDPC, which opened an inquiry and ordered it to remedy the damage.",
"claimed": "A council board member said data on more than 300,000 members had reached fraudsters; the council has not stated a final count.",
"sources": [
{
"name": "Daily News",
"url": "https://www.dailynews.co.th/news/5810167/"
},
{
"name": "DataBreaches.net (citing Bangkok Post)",
"url": "https://databreaches.net/2026/04/26/th-hacker-steals-personal-data-of-350000-engineers/"
},
{
"name": "Prachachat",
"url": "https://www.prachachat.net/hilight-prachachat/news-1997412"
}
],
"checked": "2026-11-07",
"domain": "coe.or.th",
"actor_ids": [],
"id": "f566ff3c"
},
{
"org": "Fastwork",
"sector": "other",
"date": "2026-10-13",
"type": "data-leak",
"actor": "",
"status": "confirmed",
"vendor": false,
"confirmed": "Fastwork said an attacker extracted national ID numbers, names, phone numbers and emails of some users on 13 October 2026, and that it notified the PDPC on 15 October.",
"claimed": "",
"sources": [
{
"name": "Postjung News",
"url": "https://news.postjung.com/1729610"
}
],
"checked": "2026-11-07",
"domain": "fastwork.co",
"logo": "fastwork.co",
"actor_ids": [],
"id": "8b68039d"
},
{
"org": "Thailand Securities Depository (TSD Investor Portal)",
"sector": "finance",
"date": "2026-07-25",
"type": "data-leak",
"actor": "",
"status": "confirmed",
"vendor": false,
"confirmed": "TSD said a flaw on its Investor Portal profile page let a logged-in user pull personal and account data of about 200,000 of more than 5 million accounts on 25 and 26 July 2026, and it reported the case to cyber police; the PDPC asked TSD for evidence of PDPA compliance.",
"claimed": "",
"sources": [
{
"name": "MGR Online",
"url": "https://mgronline.com/stockmarket/detail/9690000074068"
},
{
"name": "Thai Post",
"url": "https://www.thaipost.net/economy-news/1040694/"
}
],
"checked": "2026-11-07",
"actor_ids": [],
"id": "0ce5c4d0"
},
{
"org": "Department of Land Transport",
"sector": "transport",
"date": "2026-08-06",
"type": "data-leak",
"actor": "",
"status": "confirmed",
"vendor": false,
"confirmed": "Deputy Transport Minister Siripong Angkasakulkiat said vehicle registration data, including records on the prime minister and ministers, was pulled through the DLT API using credentials of connected agencies, and the DLT cut access for three agencies and filed Computer Crime Act complaints.",
"claimed": "Search access to the data was sold through Discord bots at 350 baht a day or 2,500 baht a month.",
"sources": [
{
"name": "Thai PBS",
"url": "https://www.thaipbs.or.th/news/content/509122"
},
{
"name": "The Nation",
"url": "https://www.nationthailand.com/news/general/40069456"
}
],
"checked": "2026-11-07",
"domain": "dlt.go.th",
"actor_ids": [],
"id": "9a1aebd8",
"story": "thailand-government-data-leak"
},
{
"org": "Government agencies in 19 ministries and the Office of the Prime Minister",
"sector": "government",
"date": "2026-08-06",
"type": "data-leak",
"actor": "",
"status": "confirmed",
"vendor": false,
"confirmed": "Cyber police said attackers used compromised staff accounts with access rights to pull citizen data from government systems and sold it on the dark web, Telegram and Discord; the Digital Economy Ministry, the Interior Ministry and the Department of Provincial Administration filed complaints, and the cabinet ordered password resets across 300 departments.",
"claimed": "Domecloud CEO Thanarat Kuawattanaphan said data on more than 500,000 people across about 20 agencies was exposed, mostly through staff passwords stolen by infostealer malware.",
"sources": [
{
"name": "Thairath",
"url": "https://www.thairath.co.th/news/crime/2951036"
},
{
"name": "The Nation",
"url": "https://www.nationthailand.com/news/general/40069456"
},
{
"name": "Thansettakij",
"url": "https://www.thansettakij.com/economy/666195"
}
],
"checked": "2026-11-07",
"actor_ids": [],
"id": "6f428aa1",
"story": "thailand-government-data-leak"
},
{
"org": "16 government agency websites",
"sector": "government",
"date": "2026-01-17",
"type": "seo-poisoning",
"actor": "Online gambling advertising network",
"status": "confirmed",
"vendor": false,
"confirmed": "The DSI arrested a suspect at Suvarnabhumi Airport on 17 January 2026 in a special case over the hacking of 16 government agency websites that were made to redirect visitors to online gambling sites.",
"claimed": "",
"sources": [
{
"name": "LINE Today",
"url": "https://today.line.me/th/v3/article/zN2r07k"
}
],
"checked": "2026-11-07",
"actor_ids": [
"online-gambling-advertising-network"
],
"id": "b58449f5"
},
{
"org": "Online game top-up and mobile credit platform (unnamed)",
"sector": "retail",
"date": "2026-07-18",
"type": "intrusion",
"actor": "",
"status": "confirmed",
"vendor": false,
"confirmed": "The CCIB arrested a 26-year-old in Phuket on 18 July 2026 who police say manipulated a top-up platform's payment system in June and tried and failed to break into Royal Thai Police systems to erase his arrest warrants.",
"claimed": "",
"sources": [
{
"name": "Thai Examiner",
"url": "https://www.thaiexaminer.com/thai-news-foreigners/2026/07/19/self-taught-thai-hacker-learned-the-trade-to-access-police-data-systems-and-wipe-his-own-arrest-warrants/"
},
{
"name": "Khaosod English",
"url": "https://www.khaosodenglish.com/news/crimecourtscalamity/2026/07/19/grade-6-educated-hacker-tried-to-erase-own-arrest-warrants-police-say/"
}
],
"checked": "2026-11-07",
"actor_ids": [],
"id": "43596233"
},
{
"org": "Schools in Mae Ai district, Chiang Mai",
"sector": "education",
"date": "2026-02-26",
"type": "other",
"actor": "SIM registration fraud ring",
"status": "confirmed",
"vendor": false,
"confirmed": "The NBTC said people posing as mobile carrier staff used students' ID card scans and face images to register 495 SIM cards for scam groups, and it ordered carriers to suspend them.",
"claimed": "",
"sources": [
{
"name": "Thai PBS",
"url": "https://www.thaipbs.or.th/news/content/502685"
}
],
"checked": "2026-11-07",
"actor_ids": [
"sim-registration-fraud-ring"
],
"id": "17a6193d"
},
{
"org": "Department of Provincial Administration (voter eligibility lookup)",
"sector": "government",
"date": "2026-02-15",
"type": "data-leak",
"actor": "",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "IT specialist Thanarat Kuawattanaphan said the election voter lookup exposed ID numbers, first names and ballot list numbers nationwide until a fix on 14 February 2026; the DOPA called the claim inaccurate and filed defamation and Computer Crime Act complaints on 10 April.",
"sources": [
{
"name": "MGR Online",
"url": "https://mgronline.com/onlinesection/detail/9690000015741"
},
{
"name": "Bangkok Biz News",
"url": "https://www.bangkokbiznews.com/politics/1229644"
}
],
"checked": "2026-11-07",
"domain": "dopa.go.th",
"logo": "dopa.go.th",
"actor_ids": [],
"id": "e29871f5"
},
{
"org": "Public health treatment-rights database",
"sector": "health",
"date": "2026-06-10",
"type": "data-leak",
"actor": "",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "Domecloud CEO Thanarat Kuawattanaphan told a House committee that a health-rights database searchable by ID number covering about 67.1 million living and dead people was being sold cheaply; the PDPC later asked the Public Health Ministry to explain its Mor Prom system after more than 30 complaints.",
"sources": [
{
"name": "Naewna",
"url": "https://www.naewna.com/politic/969902"
},
{
"name": "Thai Post",
"url": "https://www.thaipost.net/economy-news/1040694/"
}
],
"checked": "2026-11-07",
"actor_ids": [],
"id": "f2b8c19a"
},
{
"org": "Ministry of Interior (volunteer registration database)",
"sector": "government",
"date": "2026-08-04",
"type": "data-leak",
"actor": "",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "Thanarat Kuawattanaphan said high-resolution face photos of the prime minister, ministers and citizens leaked from a Ministry of Interior system used to register volunteers.",
"sources": [
{
"name": "MGR Online",
"url": "https://mgronline.com/stockmarket/detail/9690000076472"
},
{
"name": "The Nation",
"url": "https://www.nationthailand.com/news/general/40069456"
}
],
"checked": "2026-11-07",
"domain": "moi.go.th",
"logo": "moi.go.th",
"actor_ids": [],
"id": "01015e18"
},
{
"org": "Office of the Vocational Education Commission",
"sector": "education",
"date": "2026-08-04",
"type": "data-leak",
"actor": "",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "MGR Online reported a commission database holding data on about 2.5 million students protected only by the password 123456.",
"sources": [
{
"name": "MGR Online",
"url": "https://mgronline.com/stockmarket/detail/9690000076472"
}
],
"checked": "2026-11-07",
"domain": "vec.go.th",
"actor_ids": [],
"id": "529ab7ee"
},
{
"org": "Ministry of Finance",
"sector": "government",
"date": "2026-07-15",
"type": "intrusion",
"actor": "Unnamed, likely Chinese-speaking operators",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "Hunt.io said attackers using the Hermes AI agent and a Hades backdoor compromised several ministry systems from mid to late June 2026 and that it notified ThaiCERT and the NCSA on 15 July; the ministry did not comment.",
"sources": [
{
"name": "The Record",
"url": "https://therecord.media/thailand-hackers-ai-finance-ministry"
}
],
"checked": "2026-11-07",
"domain": "mof.go.th",
"logo": "mof.go.th",
"actor_ids": [
"likely-chinese-speaking-operators"
],
"id": "0e29c8d2"
},
{
"org": "Bangkok Metropolitan Administration",
"sector": "government",
"date": "2026-05-23",
"type": "ransomware",
"actor": "Krybit",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "Krybit listed bangkok.go.th on its leak site and threatened to publish government data.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/YmFuZ2tvay5nby50aEBrcnliaXQ"
}
],
"checked": "2026-11-07",
"domain": "bangkok.go.th",
"actor_ids": [
"krybit"
],
"id": "47ab12d0"
},
{
"org": "Major Cineplex Group",
"sector": "media",
"date": "2026-06-20",
"type": "ransomware",
"actor": "LockBit 5.0",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "LockBit 5.0 listed majorcineplex.com on its leak site.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/bWFqb3JjaW5lcGxleC5jb21AbG9ja2JpdDU"
}
],
"checked": "2026-11-07",
"domain": "majorcineplex.com",
"logo": "majorcineplex.com",
"actor_ids": [
"lockbit-5-0"
],
"id": "423a065f"
},
{
"org": "Isuzu Motors (Thailand)",
"sector": "manufacturing",
"date": "2026-06-08",
"type": "ransomware",
"actor": "Qilin",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "Qilin listed Isuzu Motors (isuzu-motors.co.th) on its leak site.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/SXN1enUgTW90b3JzQHFpbGlu"
}
],
"checked": "2026-11-07",
"domain": "isuzu-motors.co.th",
"logo": "isuzu-motors.co.th",
"actor_ids": [
"qilin"
],
"id": "cfca35db"
},
{
"org": "CH Karnchang PCL",
"sector": "property",
"date": "2026-06-05",
"type": "data-leak",
"actor": "World Leaks",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "World Leaks listed CH Karnchang on its extortion site.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/Q0ggS2FybmNoYW5nIFB1YmxpY0B3b3JsZGxlYWtz"
}
],
"checked": "2026-11-07",
"domain": "ch-karnchang.co.th",
"logo": "ch-karnchang.co.th",
"actor_ids": [
"world-leaks"
],
"id": "1125fcfd"
},
{
"org": "The Minor Food Group",
"sector": "retail",
"date": "2026-08-10",
"type": "ransomware",
"actor": "Panzer",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "Panzer listed The Minor Food Group on its leak site.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/VGhlIE1pbm9yIEZvb2QgR3JvdXBAUGFuemVy"
}
],
"checked": "2026-11-07",
"domain": "minorfood.com",
"logo": "minorfood.com",
"actor_ids": [
"panzer"
],
"id": "99bbe365"
},
{
"org": "Terminal 21",
"sector": "retail",
"date": "2026-04-04",
"type": "ransomware",
"actor": "The Gentlemen",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "The Gentlemen listed Terminal 21 on its leak site.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/VGVybWluYWwgMjFAdGhlZ2VudGxlbWVu"
}
],
"checked": "2026-11-07",
"domain": "terminal21.co.th",
"actor_ids": [
"the-gentlemen"
],
"id": "57f26f78"
},
{
"org": "Amata Corporation PCL",
"sector": "property",
"date": "2026-02-26",
"type": "ransomware",
"actor": "The Gentlemen",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "The Gentlemen listed Amata on its leak site.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/QW1hdGFAdGhlZ2VudGxlbWVu"
}
],
"checked": "2026-11-07",
"domain": "amata.com",
"logo": "amata.com",
"actor_ids": [
"the-gentlemen"
],
"id": "0f473830"
},
{
"org": "Mahidol University",
"sector": "education",
"date": "2026-04-27",
"type": "data-leak",
"actor": "APT73 (Bashe)",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "APT73 listed mahidol.ac.th on its leak site.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/bWFoaWRvbC5hYy50aEBhcHQ3Mw"
}
],
"checked": "2026-11-07",
"domain": "mahidol.ac.th",
"logo": "mahidol.ac.th",
"actor_ids": [
"apt73"
],
"id": "590b8210"
},
{
"org": "National Astronomical Research Institute of Thailand",
"sector": "government",
"date": "2026-05-21",
"type": "data-leak",
"actor": "APT73 (Bashe)",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "APT73 listed narit.or.th on its leak site.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/bmFyaXQub3IudGhAYXB0NzM"
}
],
"checked": "2026-11-07",
"domain": "narit.or.th",
"logo": "narit.or.th",
"actor_ids": [
"apt73"
],
"id": "d64d790d"
},
{
"org": "Chonburi Provincial Administration",
"sector": "government",
"date": "2026-02-06",
"type": "ransomware",
"actor": "The Gentlemen",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "The Gentlemen listed a Chonburi provincial administration (chon.go.th) on its leak site.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/Q2hvbmJ1cmkgUHJvdmluY2lhbCBBZG1pbmlzdHJhdGlvbkB0aGVnZW50bGVtZW4"
}
],
"checked": "2026-11-07",
"domain": "chonburi.go.th",
"actor_ids": [
"the-gentlemen"
],
"id": "a04c4588"
},
{
"org": "Sukhothai Thammathirat Open University",
"sector": "education",
"date": "2026-01-27",
"type": "ransomware",
"actor": "Qilin",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "Qilin listed STOU (stou.ac.th) on its leak site.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/U3VraG90aGFpIFRoYW1tYXRoaXJhdCBPcGVuIFVuaXZlcnNpdHlAcWlsaW4"
}
],
"checked": "2026-11-07",
"domain": "stou.ac.th",
"logo": "stou.ac.th",
"actor_ids": [
"qilin"
],
"id": "4b553c9b"
},
{
"org": "Thammasat University",
"sector": "education",
"date": "2026-02-11",
"type": "ransomware",
"actor": "The Gentlemen",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "The Gentlemen listed Thammasat University on its leak site.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/VGhhbW1hc2F0IFVuaXZlcnNpdHlAdGhlZ2VudGxlbWVu"
}
],
"checked": "2026-11-07",
"domain": "tu.ac.th",
"logo": "tu.ac.th",
"actor_ids": [
"the-gentlemen"
],
"id": "07528d23"
},
{
"org": "Payap University",
"sector": "education",
"date": "2026-03-16",
"type": "ransomware",
"actor": "The Gentlemen",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "The Gentlemen listed Payap University on its leak site.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/UGF5YXAgVW5pdmVyc2l0eUB0aGVnZW50bGVtZW4"
}
],
"checked": "2026-11-07",
"domain": "payap.ac.th",
"logo": "payap.ac.th",
"actor_ids": [
"the-gentlemen"
],
"id": "5bfdda66"
},
{
"org": "Wellington College International School Bangkok",
"sector": "education",
"date": "2026-10-17",
"type": "ransomware",
"actor": "The Gentlemen",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "The Gentlemen listed Wellington College International School Bangkok on its leak site.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/V2VsbGluZ3RvbiBDb2xsZWdlIEludGVybmF0aW9uYWwgU2Nob29sIEJhbmdrb2tAdGhlZ2VudGxlbWVu"
}
],
"checked": "2026-11-07",
"domain": "wellingtoncollege.ac.th",
"logo": "wellingtoncollege.ac.th",
"actor_ids": [
"the-gentlemen"
],
"id": "a1da8d5f"
},
{
"org": "Museum Siam",
"sector": "other",
"date": "2026-10-16",
"type": "ransomware",
"actor": "The Gentlemen",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "The Gentlemen listed Museum Siam on its leak site.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/TXVzZXVtIFNpYW1AdGhlZ2VudGxlbWVu"
}
],
"checked": "2026-11-07",
"domain": "museumsiam.org",
"actor_ids": [
"the-gentlemen"
],
"id": "0f823839"
},
{
"org": "Ayudhya insurance (listed as AYUDHYA TH Insurance)",
"sector": "finance",
"date": "2026-08-20",
"type": "data-leak",
"actor": "Dysphor1a",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "Dysphor1a listed AYUDHYA TH Insurance on its leak site.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/QVlVREhZQSBUSCBJbnN1cmFuY2VARFlTUEhPUjFB"
}
],
"checked": "2026-11-07",
"domain": "ayud.co.th",
"logo": "ayud.co.th",
"actor_ids": [
"dysphor1a"
],
"id": "8f337cf9"
},
{
"org": "Thai Solar Energy PCL",
"sector": "energy",
"date": "2026-03-14",
"type": "ransomware",
"actor": "Payload",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "Payload listed Thai Solar Energy on its leak site.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/VGhhaSBTb2xhciBFbmVyZ3kgUHVibGljQHBheWxvYWQ"
}
],
"checked": "2026-11-07",
"domain": "thaisolarenergy.com",
"logo": "thaisolarenergy.com",
"actor_ids": [
"payload"
],
"id": "a7a5b273"
},
{
"org": "Ruamjairak Hospital",
"sector": "health",
"date": "2026-02-24",
"type": "ransomware",
"actor": "The Gentlemen",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "The Gentlemen listed Ruamjai (ruamjaimedical.co.th) on its leak site.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/UnVhbWphaUB0aGVnZW50bGVtZW4"
}
],
"checked": "2026-11-07",
"domain": "ruamjairak.com",
"logo": "ruamjairak.com",
"actor_ids": [
"the-gentlemen"
],
"id": "7e04b8be"
},
{
"org": "Royal Thai Navy Housing Cooperative",
"sector": "finance",
"date": "2026-07-01",
"type": "ransomware",
"actor": "The Gentlemen",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "The Gentlemen listed the Royal Thai Navy Housing Cooperative on its leak site.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/Um95YWwgVGhhaSBOYXZ5IEhvdXNpbmcgQ29vcGVyYXRpdmVAdGhlZ2VudGxlbWVu"
}
],
"checked": "2026-11-07",
"domain": "kehanavycoop.com",
"logo": "kehanavycoop.com",
"actor_ids": [
"the-gentlemen"
],
"id": "b3dee18e"
},
{
"org": "Thoresen Thai Agencies",
"sector": "transport",
"date": "2026-06-04",
"type": "ransomware",
"actor": "The Gentlemen",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "The Gentlemen listed Thoresen Thai Agencies on its leak site.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/VGhvcmVzZW4gVGhhaSBBZ2VuY2llc0B0aGVnZW50bGVtZW4"
}
],
"checked": "2026-11-07",
"domain": "thoresen.com",
"actor_ids": [
"the-gentlemen"
],
"id": "d182a9e4"
},
{
"org": "Thai Hua Rubber PCL",
"sector": "manufacturing",
"date": "2026-03-30",
"type": "ransomware",
"actor": "LockBit 5.0",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "LockBit 5.0 listed thaihua.com on its leak site.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/dGhhaWh1YS5jb21AbG9ja2JpdDU"
}
],
"checked": "2026-11-07",
"domain": "thaihua.com",
"actor_ids": [
"lockbit-5-0"
],
"id": "b2fca5d8"
},
{
"org": "Katathani Phuket Beach Resort",
"sector": "other",
"date": "2026-07-27",
"type": "ransomware",
"actor": "DragonForce",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "DragonForce listed Katathani Phuket Beach Resort on its leak site.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/S2F0YXRoYW5pIFBodWtldCBCZWFjaCBSZXNvcnRAZHJhZ29uZm9yY2U"
}
],
"checked": "2026-11-07",
"domain": "katathani.com",
"actor_ids": [
"dragonforce"
],
"id": "5b0a916f"
}
],
"slug": "thailand",
"title": "Thailand Cyber Incidents and Data Breaches 2026 · pwnsy",
"lede": "No public threat level. 9 incidents confirmed, 33 claims in 2026.",
"h1": "![\"\"](\"/tools/cyber-watch/flags/th.svg\")
Thailand Cyber Watch",
"desc": "Thailand cyber threat level: none published. 9 incidents confirmed and 33 claims in 2026, each sourced. Updated 7 Nov 2026.",
"since": "2026-01-01",
"stats": [
{
"label": "Incidents handled by ThaiCERT",
"value": "3,264",
"period": "January to September 2026",
"source": {
"name": "ThaiCERT",
"url": "https://www.thaicert.or.th/en/homepage/"
}
},
{
"label": "ThaiCERT intrusion attempts",
"value": "1,138",
"period": "January to September 2026",
"source": {
"name": "ThaiCERT",
"url": "https://www.thaicert.or.th/en/homepage/"
}
},
{
"label": "ThaiCERT fraud incidents",
"value": "529",
"period": "January to September 2026",
"source": {
"name": "ThaiCERT",
"url": "https://www.thaicert.or.th/en/homepage/"
}
},
{
"label": "Online crime reports to the police reporting system",
"value": "221,626",
"period": "1 January to 31 August 2026",
"source": {
"name": "Thailand Edition (citing Technology Crime Suppression Division)",
"url": "https://thailandedition.com/i/cyber-police-retirees-lose-315-billion-baht-scams-00a26a97d1686b2e930c400d"
}
},
{
"label": "Reported online crime losses",
"value": "Over 11,039 million baht",
"period": "1 January to 31 August 2026",
"source": {
"name": "Thailand Edition (citing Technology Crime Suppression Division)",
"url": "https://thailandedition.com/i/cyber-police-retirees-lose-315-billion-baht-scams-00a26a97d1686b2e930c400d"
}
},
{
"label": "Losses by victims aged 60 and over",
"value": "About 3,152 million baht (28.55% of losses)",
"period": "1 January to 31 August 2026",
"source": {
"name": "Thailand Edition (citing Technology Crime Suppression Division)",
"url": "https://thailandedition.com/i/cyber-police-retirees-lose-315-billion-baht-scams-00a26a97d1686b2e930c400d"
}
},
{
"label": "Weekly Thai Police Online scam complaints",
"value": "6,060 complaints, THB260 million lost",
"period": "9 to 15 August 2026",
"source": {
"name": "The Nation (citing ACSC)",
"url": "https://www.nationthailand.com/news/general/40069932"
}
},
{
"label": "Mule accounts closed",
"value": "More than 351,000",
"period": "October 2025 to June 2026",
"source": {
"name": "Xinhua (citing government spokesperson)",
"url": "https://english.news.cn/20260713/8afa7a37ce1e4a2ea37bd12ee394d8be/c.html"
}
},
{
"label": "Scam-linked assets frozen",
"value": "Over 3.6 billion baht",
"period": "October 2025 to June 2026",
"source": {
"name": "Xinhua (citing government spokesperson)",
"url": "https://english.news.cn/20260713/8afa7a37ce1e4a2ea37bd12ee394d8be/c.html"
}
},
{
"label": "Scam suspects arrested",
"value": "More than 29,000",
"period": "October 2025 to June 2026",
"source": {
"name": "Xinhua (citing government spokesperson)",
"url": "https://english.news.cn/20260713/8afa7a37ce1e4a2ea37bd12ee394d8be/c.html"
}
},
{
"label": "Youth mule accounts",
"value": "5,741 (up 70.3% from 3,371 in January 2025)",
"period": "March 2026",
"source": {
"name": "The Nation (citing Bank of Thailand)",
"url": "https://www.nationthailand.com/news/general/40069312"
}
},
{
"label": "Phone numbers suspended for suspected tech crime",
"value": "28,112",
"period": "January 2026",
"source": {
"name": "Siam Rath (citing NBTC)",
"url": "https://siamrath.co.th/technology/130032"
}
},
{
"label": "PDPA breach notifications received by PDPC",
"value": "1,650 (747 cyber, 849 non-cyber)",
"period": "2023 to 31 May 2026",
"source": {
"name": "Today Variety (PDPC press briefing)",
"url": "https://www.todayvariety.com/2026/10/pdpa-4210-1650.html"
}
},
{
"label": "PDPA complaints received by PDPC",
"value": "4,210 (3,889 private sector, 321 public sector)",
"period": "2023 to 31 May 2026",
"source": {
"name": "Today Variety (PDPC press briefing)",
"url": "https://www.todayvariety.com/2026/10/pdpa-4210-1650.html"
}
},
{
"label": "Online fraud cases and losses (consumer council count)",
"value": "Over 170,000 cases, nearly THB9 billion",
"period": "January to June 2026",
"source": {
"name": "The Nation (citing Thailand Consumers Council)",
"url": "https://www.nationthailand.com/business/tech/40069582"
}
}
],
"rules": [
{
"date": "2026-08-11",
"title": "Cabinet orders password reset, system cleanup and MFA across government",
"what": "The cabinet ordered staff in more than 300 departments to reset passwords, required ministries to check over 30,000 systems and shut unused ones within 15 days, and mandated multi-factor authentication such as ThaID.",
"url": "https://www.thansettakij.com/economy/666195"
},
{
"date": "2026-08-06",
"title": "NCSA review of about 300 government departments",
"what": "The government said the NCSA would assess about 300 departments within 30 days and push multi-factor authentication as a standard after the August data leaks.",
"url": "https://www.thaipost.net/politics-news/1045444/"
},
{
"date": "2026-08-02",
"title": "Bank of Thailand caps digital transfers from minors' accounts",
"what": "Daily caps of 3,000 to 10,000 baht by age apply to e-money and mobile banking for under 18s, with banks due by September 2026 and e-money providers by October 2026.",
"url": "https://www.nationthailand.com/news/general/40069312"
},
{
"date": "2026-07-13",
"title": "Source-of-funds declaration for large cash deposits",
"what": "The government said cash deposits above 5 million baht would need a declaration of the source of funds starting in October 2026.",
"url": "https://english.news.cn/20260713/8afa7a37ce1e4a2ea37bd12ee394d8be/c.html"
},
{
"date": "2026-07-29",
"title": "PDPC demands PDPA compliance evidence from Public Health Ministry and TSD",
"what": "The PDPC asked both bodies to document breach scope, security controls and notifications, and said action could range from corrective orders to legal proceedings.",
"url": "https://www.thaipost.net/economy-news/1040694/"
},
{
"date": "2026-04-24",
"title": "PDPC orders Council of Engineers to remedy breach",
"what": "The PDPC ordered the council to fix the problem, limit damage and compensate those affected, and said it may refer the case for administrative penalties.",
"url": "https://www.dailynews.co.th/news/5810167/"
},
{
"date": "2026-02-18",
"title": "NBTC ghost SIM screening under its tech crime announcement",
"what": "Under the NBTC announcement on preventing technology crime, carriers screen and suspend numbers with abnormal use and report results to the NBTC weekly.",
"url": "https://siamrath.co.th/technology/130032"
}
],
"actors": [
{
"name": "The Gentlemen",
"kind": "ransomware",
"seen": "Most active group on Thai victims in 2026 by leak-site count, listing universities, a provincial administration, Terminal 21, Amata and Museum Siam.",
"sources": [
{
"name": "ransomware.live Thailand",
"url": "https://www.ransomware.live/country/THA"
}
],
"actor_id": "the-gentlemen"
},
{
"name": "Qilin",
"kind": "ransomware",
"seen": "Listed Isuzu Motors Thailand, STOU and several Thai firms in 2026.",
"sources": [
{
"name": "ransomware.live Thailand",
"url": "https://www.ransomware.live/country/THA"
}
],
"actor_id": "qilin"
},
{
"name": "LockBit 5.0",
"kind": "ransomware",
"seen": "Listed Major Cineplex and four other Thai firms on 20 June 2026, plus Thai Hua Rubber in March.",
"sources": [
{
"name": "ransomware.live Thailand",
"url": "https://www.ransomware.live/country/THA"
}
],
"actor_id": "lockbit-5-0"
},
{
"name": "Krybit",
"kind": "ransomware",
"seen": "Listed the Bangkok Metropolitan Administration in May 2026 and several Thai manufacturers and printers.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/YmFuZ2tvay5nby50aEBrcnliaXQ"
}
],
"actor_id": "krybit"
},
{
"name": "APT73 (Bashe)",
"kind": "extortion",
"seen": "Listed Mahidol University in April and NARIT in May 2026.",
"sources": [
{
"name": "ransomware.live Thailand",
"url": "https://www.ransomware.live/country/THA"
}
],
"actor_id": "apt73"
},
{
"name": "World Leaks",
"kind": "extortion",
"seen": "Listed CH Karnchang in June 2026.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/Q0ggS2FybmNoYW5nIFB1YmxpY0B3b3JsZGxlYWtz"
}
],
"actor_id": "world-leaks"
},
{
"name": "Panzer",
"kind": "ransomware",
"seen": "Listed The Minor Food Group and Siam Oil Product in August 2026.",
"sources": [
{
"name": "ransomware.live Thailand",
"url": "https://www.ransomware.live/country/THA"
}
],
"actor_id": "panzer"
},
{
"name": "DragonForce",
"kind": "ransomware",
"seen": "Listed Thai resorts and manufacturers between March and September 2026.",
"sources": [
{
"name": "ransomware.live Thailand",
"url": "https://www.ransomware.live/country/THA"
}
],
"actor_id": "dragonforce"
},
{
"name": "Unnamed Chinese-speaking operators (Hermes agent, Hades backdoor)",
"kind": "state",
"seen": "Hunt.io linked an AI-agent-driven intrusion into the Finance Ministry in June and July 2026 to Chinese-speaking operators; no state attribution was made public by Thai officials.",
"sources": [
{
"name": "The Record",
"url": "https://therecord.media/thailand-hackers-ai-finance-ministry"
}
]
},
{
"name": "Government data resellers on Discord and Telegram",
"kind": "scam-syndicate",
"seen": "Police said sellers used stolen staff credentials to query government systems and sold lookups on the dark web, Telegram and Discord, with call centres the main buyers of concern.",
"sources": [
{
"name": "Thairath",
"url": "https://www.thairath.co.th/news/crime/2951036"
},
{
"name": "The Nation",
"url": "https://www.nationthailand.com/news/general/40069456"
}
]
},
{
"name": "Gambling SEO network",
"kind": "unknown",
"seen": "The DSI arrested a suspect returning from Sihanoukville in January 2026 over government websites rigged to redirect to gambling sites.",
"sources": [
{
"name": "LINE Today",
"url": "https://today.line.me/th/v3/article/zN2r07k"
}
]
}
],
"region": "Southeast Asia",
"upd": "2026-11-07"
},
"PH": {
"name": "Philippines",
"posture": {
"level": "",
"summary": "DICT and CERT-PH issue advisories; the National Privacy Commission handles breach notifications.",
"agency": "DICT (CERT-PH)",
"source": {
"name": "DICT (CERT-PH)",
"url": "https://newsbytes.ph/?p=112574"
},
"checked": "2026-11-07"
},
"timeline": [
{
"date": "2026-10-22",
"text": "CERT-PH tells government and private organisations running PHP to patch PHP2Shell; no local compromise established.",
"url": "https://newsbytes.ph/?p=112574",
"src": "Newsbytes.PH"
},
{
"date": "2026-11-06",
"text": "The privacy commission will verify reported 5 Nov leaks at several agencies and reminds them of the 72-hour notification rule.",
"url": "https://newsbytes.ph/2026/11/06/npc-checking-data-leaks-following-nov-5-cyberattack-reports/",
"src": "Newsbytes.PH"
},
{
"date": "2026-01-22",
"text": "CICC reported 18,633 cybercrime complaints and PHP 418.187 million in losses for 2025.",
"url": "https://www.gmanetwork.com/news/topstories/nation/973804/consumer-fraud-topped-cybercrime-complaints-in-2025-cicc/story/",
"src": "GMA News"
},
{
"date": "2026-03-20",
"text": "DICT said it found no verified breach of eGov PH core infrastructure.",
"url": "https://newsbytes.ph/2026/03/20/dict-says-no-verified-breach-in-egov-ph-system/",
"src": "Newsbytes.PH"
},
{
"date": "2026-03-23",
"text": "DPWH Secretary Vince Dizon said initial findings showed systems secure after a 50 GB leak claim.",
"url": "https://tribune.net.ph/amp/story/2026/03/23/dpwh-checking-alleged-50gb-data-breach",
"src": "Daily Tribune"
},
{
"date": "2026-04-06",
"text": "PNP-ACG reported 332 cybercrime arrests and 593 referred cases in Q1 2026.",
"url": "https://www.gmanetwork.com/news/topstories/nation/982689/pnp-acg-arrests-cybercrimes-quarter/story/",
"src": "GMA News"
},
{
"date": "2026-06-11",
"text": "The Senate EDP-MIS bureau confirmed its website was defaced and said no sensitive data was compromised.",
"url": "https://www.philstar.com/headlines/2026/06/11/2534452/hacktivist-group-defaces-senate-website-calls-accountability-govt",
"src": "Philstar"
},
{
"date": "2026-07-23",
"text": "BSP general counsel Roberto Figueroa said banks that fail AFASA requirements may have to fully reimburse victims.",
"url": "https://www.gmanetwork.com/news/money/economy/995881/over-500-cases-filed-against-scammers-bsp-warns-banks-may-have-to-reimburse-victims/story/",
"src": "GMA News"
},
{
"date": "2026-09-07",
"text": "DICT said NCERT detected unauthorized access to the DMW website and that a PPA ransomware report was a false positive.",
"url": "https://newsbytes.ph/2026/09/08/hackers-claim-access-to-dmw-network-as-dict-probes-govt-cyberattacks/",
"src": "Newsbytes.PH"
},
{
"date": "2026-09-08",
"text": "DICT and CICC ordered agencies and critical infrastructure operators to complete 24-hour cyber readiness checks.",
"url": "https://newsbytes.ph/2026/09/10/dict-cicc-order-24-hour-cyber-checks-after-attacks-on-govt-websites/",
"src": "Newsbytes.PH"
},
{
"date": "2026-09-19",
"text": "LTFRB confirmed a data breach and took its Electronic Support System offline.",
"url": "https://newsbytes.ph/2026/09/19/ltfrb-confirms-data-breach-takes-records-system-offline/",
"src": "Newsbytes.PH"
},
{
"date": "2026-09-25",
"text": "DICT said NCERT was handling a possible data exposure involving a D-TAP accredited provider.",
"url": "https://astig.ph/dict-dtap-data-exposure-410-files-48-firms-2026/",
"src": "Astig.ph"
},
{
"date": "2026-10-27",
"text": "DICT advised agencies to harden defenses around 5 November and said the advisory did not confirm an imminent attack.",
"url": "https://philstartech.com/news/2026/11/05/20296/philippines-nov-5-data-breach-government-agencies-2025/",
"src": "Philstar Tech"
},
{
"date": "2026-10-29",
"text": "NTC ordered telcos to verify subscribers holding more than 100 SIMs within 15 days.",
"url": "https://www.manilatimes.net/2026/10/29/business/top-business/ntc-orders-checks-on-mobile-phone-subscribers-with-over-100-sim-cards/2456748",
"src": "The Manila Times"
},
{
"date": "2026-10-30",
"text": "NPC confirmed it received a personal data breach notification from St. Luke's Medical Center.",
"url": "https://www.gmanetwork.com/news/topstories/nation/1008108/st-luke-s-medical-center-probing-cybersecurity-incident-on-mobile-app/story/",
"src": "GMA News"
},
{
"date": "2026-11-06",
"text": "NPC said it had received no breach notifications from agencies named in the 5 November leak claims and would verify them.",
"url": "https://newsbytes.ph/2026/11/06/npc-checking-data-leaks-following-nov-5-cyberattack-reports/",
"src": "Newsbytes.PH"
},
{
"date": "2026-11-07",
"text": "PNP reported eight cybercrime convictions and 144 referred cases for October.",
"url": "https://tribune.net.ph/2026/11/07/pnp-records-eight-cybercrime-convictions-144-referred-cases-in-october",
"src": "Daily Tribune"
}
],
"incidents": [
{
"org": "Bureau of Internal Revenue (BIR)",
"sector": "government",
"date": "2026-11-07",
"type": "data-leak",
"actor": "",
"status": "confirmed",
"vendor": false,
"confirmed": "BIR is investigating an alleged leak of its data with DICT, NCERT, CICC and the PNP Anti-Cybercrime Group.",
"claimed": "Posts online allege BIR data was leaked; extent not stated.",
"sources": [
{
"name": "GMA News",
"url": "https://www.gmanetwork.com/news/topstories/nation/1008620/bir-data-leak-under-gov-t-probe/story/"
}
],
"checked": "2026-11-07",
"domain": "bir.gov.ph",
"logo": "bir.gov.ph",
"actor_ids": [],
"id": "f8251b00",
"story": "philippines-government-leak-claims-november-2026"
},
{
"org": "Department of Migrant Workers (DMW)",
"sector": "government",
"date": "2026-10-29",
"type": "data-leak",
"actor": "",
"status": "confirmed",
"vendor": false,
"confirmed": "The privacy commission is investigating with the DMW.",
"claimed": "Researchers say 27 database backups (about 68.8 GiB) tied to DMW portals were copied on 6 Sep; contents unverified.",
"sources": [
{
"name": "Newsbytes.PH",
"url": "https://newsbytes.ph/?p=112671"
},
{
"name": "Dark Reading",
"url": "https://darkreading.com/cyberattacks-data-breaches/philippine-migrant-worker-data-69gb-government-breach"
}
],
"checked": "2026-11-07",
"domain": "dmw.gov.ph",
"logo": "dmw.gov.ph",
"actor_ids": [],
"id": "5e1b27c8"
},
{
"org": "DICT",
"sector": "government",
"date": "2026-10-02",
"type": "defacement",
"actor": "4HMDOS4",
"status": "confirmed",
"vendor": false,
"confirmed": "DICT acknowledged unauthorised access and defacement of a website staging environment.",
"claimed": "4HMDOS4 claimed the defacement.",
"sources": [
{
"name": "Newsbytes.PH",
"url": "https://newsbytes.ph/?p=112176"
}
],
"checked": "2026-11-07",
"domain": "dict.gov.ph",
"logo": "dict.gov.ph",
"actor_ids": [
"4hmdos4"
],
"id": "4674ee86"
},
{
"org": "Office of the Vice President",
"sector": "government",
"date": "2026-11-05",
"type": "data-leak",
"actor": "DeathNoteHackers",
"status": "claimed",
"vendor": true,
"confirmed": "The OVP says the scheduling platform is run by a third party and holds no classified files, without confirming or denying a breach.",
"claimed": "DeathNoteHackers claims about 10 GB of documents from the platform.",
"sources": [
{
"name": "Politiko",
"url": "https://politiko.com.ph/hack-or-political-attack-sara-dutertes-ovp-cries-smear-over-alleged-data-leak/"
}
],
"checked": "2026-11-07",
"domain": "ovp.gov.ph",
"logo": "ovp.gov.ph",
"actor_ids": [
"deathnote-hackers"
],
"id": "58563435",
"story": "philippines-government-leak-claims-november-2026"
},
{
"org": "PhilJobNet (DOLE)",
"sector": "government",
"date": "2026-11-05",
"type": "data-leak",
"actor": "DeathNote Hackers",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "DeathNote Hackers claims about 19.2 million records from the government job portal.",
"sources": [
{
"name": "Philstar Tech",
"url": "https://philstartech.com/news/2026/11/05/20296/philippines-nov-5-data-breach-government-agencies-2025/"
}
],
"checked": "2026-11-07",
"domain": "philjobnet.gov.ph",
"logo": "philjobnet.gov.ph",
"actor_ids": [
"deathnote-hackers"
],
"id": "85457edc",
"story": "philippines-government-leak-claims-november-2026"
},
{
"org": "Philippine Air Force",
"sector": "government",
"date": "2026-11-05",
"type": "data-leak",
"actor": "",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "A forum user claims about 11 GB of files including personnel records and ID copies.",
"sources": [
{
"name": "Philstar Tech",
"url": "https://philstartech.com/news/2026/11/05/20296/philippines-nov-5-data-breach-government-agencies-2025/"
}
],
"checked": "2026-11-07",
"domain": "paf.mil.ph",
"logo": "paf.mil.ph",
"actor_ids": [],
"id": "c25eb5eb",
"story": "philippines-government-leak-claims-november-2026"
},
{
"org": "Philippine Ports Authority",
"sector": "transport",
"date": "2026-09-05",
"type": "ransomware",
"actor": "Qilin",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "Listed on Qilin's leak site; not confirmed by the PPA.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/UGhpbGlwcGluZSBQb3J0cyBBdXRob3JpdHlAcWlsaW4"
}
],
"checked": "2026-11-07",
"domain": "ppa.com.ph",
"logo": "ppa.com.ph",
"actor_ids": [
"qilin"
],
"id": "87b2701e"
},
{
"org": "Light Rail Manila (LRT-1)",
"sector": "transport",
"date": "2026-10-30",
"type": "ransomware",
"actor": "Qilin",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "Listed on Qilin's leak site.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/TGlnaHQgUmFpbCBNYW5pbGFAcWlsaW4"
}
],
"checked": "2026-11-07",
"domain": "lrmc.ph",
"logo": "lrmc.ph",
"actor_ids": [
"qilin"
],
"id": "9c2dc1e4"
},
{
"org": "General Santos Doctors Hospital",
"sector": "health",
"date": "2026-09-10",
"type": "ransomware",
"actor": "Rhysida",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "Listed on Rhysida's leak site.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/R2VuZXJhbCBTYW50b3MgRG9jdG9ycyBIb3NwaXRhbEByaHlzaWRh"
}
],
"checked": "2026-11-07",
"domain": "gsdh.com.ph",
"logo": "gsdh.com.ph",
"actor_ids": [
"rhysida"
],
"id": "5f077913"
},
{
"org": "St. Luke's Medical Center",
"sector": "health",
"date": "2026-10-30",
"type": "data-leak",
"actor": "",
"status": "confirmed",
"vendor": true,
"confirmed": "St. Luke's said on 30 October that someone gained unauthorized access to a third-party managed platform behind its mobile app, and the NPC confirmed it received the breach notification the same day.",
"claimed": "",
"sources": [
{
"name": "GMA News",
"url": "https://www.gmanetwork.com/news/topstories/nation/1008108/st-luke-s-medical-center-probing-cybersecurity-incident-on-mobile-app/story/"
},
{
"name": "Newsbytes.PH",
"url": "https://newsbytes.ph/2026/11/03/st-lukes-mobile-app-breach-may-have-exposed-patient-employee-data/"
}
],
"checked": "2026-11-07",
"domain": "stluke.com.ph",
"logo": "stluke.com.ph",
"actor_ids": [],
"id": "db0d58b7"
},
{
"org": "Coral Bay Nickel Corporation (Sumitomo Metal Mining)",
"sector": "manufacturing",
"date": "2026-04-08",
"type": "ransomware",
"actor": "",
"status": "confirmed",
"vendor": false,
"confirmed": "Parent Sumitomo Metal Mining announced on 8 April that two servers at its Philippine nickel subsidiary were encrypted on 2 April and that plant production continued.",
"claimed": "",
"sources": [
{
"name": "ScanNetSecurity",
"url": "https://scan.netsecurity.ne.jp/article/2026/04/15/55066.html"
}
],
"checked": "2026-11-07",
"domain": "cbnc.com.ph",
"logo": "cbnc.com.ph",
"actor_ids": [],
"id": "62c19f93"
},
{
"org": "Pricon Microelectronics (Yamaichi Electronics)",
"sector": "manufacturing",
"date": "2026-04-22",
"type": "ransomware",
"actor": "LockBit 5.0",
"status": "confirmed",
"vendor": false,
"confirmed": "Parent Yamaichi Electronics announced on 22 April that ransomware hit some servers at its Philippine subsidiary, confirmed on 17 April.",
"claimed": "LockBit 5.0 listed pricon.com.ph on its leak site on 29 April and threatened to publish data.",
"sources": [
{
"name": "ScanNetSecurity",
"url": "https://scan.netsecurity.ne.jp/article/2026/05/11/55233.html"
},
{
"name": "DeXpose",
"url": "https://www.dexpose.io/lockbit-5-0-targets-pricon-microelectronics-in-philippines/"
}
],
"checked": "2026-11-07",
"domain": "pricon.com.ph",
"actor_ids": [
"lockbit-5-0"
],
"id": "d5e612f6"
},
{
"org": "Land Transportation Franchising and Regulatory Board (LTFRB)",
"sector": "transport",
"date": "2026-09-19",
"type": "data-leak",
"actor": "core849",
"status": "confirmed",
"vendor": false,
"confirmed": "The LTFRB confirmed a data breach in a public advisory and took its LTFRB Electronic Support System offline.",
"claimed": "A user called core849 claimed 7.7 GB of personnel, vehicle registration and franchise records.",
"sources": [
{
"name": "Newsbytes.PH",
"url": "https://newsbytes.ph/2026/09/19/ltfrb-confirms-data-breach-takes-records-system-offline/"
}
],
"checked": "2026-11-07",
"domain": "ltfrb.gov.ph",
"logo": "ltfrb.gov.ph",
"actor_ids": [
"core849"
],
"id": "2694dd8b"
},
{
"org": "Department of Labor and Employment (DOLE) web host",
"sector": "government",
"date": "2026-09-07",
"type": "defacement",
"actor": "",
"status": "confirmed",
"vendor": false,
"confirmed": "DICT said a DOLE web host was modified without authorization, the node was isolated, and no sensitive databases or personal data were compromised.",
"claimed": "",
"sources": [
{
"name": "Newsbytes.PH",
"url": "https://newsbytes.ph/2026/09/08/hackers-claim-access-to-dmw-network-as-dict-probes-govt-cyberattacks/"
}
],
"checked": "2026-11-07",
"domain": "dole.gov.ph",
"logo": "dole.gov.ph",
"actor_ids": [],
"id": "910de9c6"
},
{
"org": "Senate of the Philippines",
"sector": "government",
"date": "2026-06-10",
"type": "defacement",
"actor": "Nullsec Philippines",
"status": "confirmed",
"vendor": false,
"confirmed": "The Senate EDP-MIS bureau confirmed the website defacement and said there was no indication confidential information was compromised.",
"claimed": "Nullsec Philippines claimed the defacement in a Facebook post.",
"sources": [
{
"name": "Philstar",
"url": "https://www.philstar.com/headlines/2026/06/11/2534452/hacktivist-group-defaces-senate-website-calls-accountability-govt"
}
],
"checked": "2026-11-07",
"domain": "senate.gov.ph",
"logo": "senate.gov.ph",
"actor_ids": [
"nullsec-philippines"
],
"id": "baeafba5"
},
{
"org": "DICT Trusted Assessment Provider (D-TAP) files",
"sector": "government",
"date": "2026-09-24",
"type": "data-leak",
"actor": "core849",
"status": "claimed",
"vendor": true,
"confirmed": "",
"claimed": "core849 claimed 410 files tied to 48 accredited cybersecurity firms; DICT said on 25 September that NCERT was verifying a possible exposure involving a D-TAP provider.",
"sources": [
{
"name": "Astig.ph",
"url": "https://astig.ph/dict-dtap-data-exposure-410-files-48-firms-2026/"
}
],
"checked": "2026-11-07",
"domain": "dict.gov.ph",
"logo": "dict.gov.ph",
"actor_ids": [
"core849"
],
"id": "225b98f0"
},
{
"org": "eGov PH platform",
"sector": "government",
"date": "2026-03-20",
"type": "intrusion",
"actor": "",
"status": "claimed",
"vendor": true,
"confirmed": "",
"claimed": "Online posts alleged unauthorized access to eGov PH; DICT said it found no verified breach of core infrastructure and linked the reports to isolated third-party components.",
"sources": [
{
"name": "Newsbytes.PH",
"url": "https://newsbytes.ph/2026/03/20/dict-says-no-verified-breach-in-egov-ph-system/"
}
],
"checked": "2026-11-07",
"domain": "e.gov.ph",
"logo": "e.gov.ph",
"actor_ids": [],
"id": "2bf38c82"
},
{
"org": "Department of Public Works and Highways (DPWH)",
"sector": "government",
"date": "2026-03-23",
"type": "data-leak",
"actor": "Bashe (APT73)",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "Bashe (APT73) listed about 50 GB of DPWH files on its leak site; Secretary Vince Dizon said initial findings showed internal systems secure.",
"sources": [
{
"name": "Daily Tribune",
"url": "https://tribune.net.ph/amp/story/2026/03/23/dpwh-checking-alleged-50gb-data-breach"
},
{
"name": "Ransomware.live (Philippines)",
"url": "https://www.ransomware.live/map/PH"
}
],
"checked": "2026-11-07",
"domain": "dpwh.gov.ph",
"logo": "dpwh.gov.ph",
"actor_ids": [
"apt73"
],
"id": "3ddc4550"
},
{
"org": "Department of Transportation (DOTr) HRIS",
"sector": "transport",
"date": "2026-11-06",
"type": "data-leak",
"actor": "sinigangmixwithgabi",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "A forum user claimed payroll, attendance and biometric records for about 4,534 DOTr employees plus HRIS source code.",
"sources": [
{
"name": "Astig.ph",
"url": "https://astig.ph/hacker-claims-dotr-payroll-biometric-data-4534-employees-2026/"
},
{
"name": "Radar PH",
"url": "https://radar.ph/govt-data-breach-claims-pile-up-npc-yet-to-receive-reports/"
},
{
"name": "HackNotice",
"url": "https://hacknotice.com/2026/11/06/philippines-dotr-hris-complete-personnel-payroll-data-employee-pii-biometrics-s/"
}
],
"checked": "2026-11-07",
"domain": "dotr.gov.ph",
"logo": "dotr.gov.ph",
"actor_ids": [
"sinigangmixwithgabi"
],
"id": "55cd1ae6",
"story": "philippines-government-leak-claims-november-2026"
},
{
"org": "Philippine Coast Guard",
"sector": "government",
"date": "2026-11-05",
"type": "data-leak",
"actor": "DeathNoteHackers",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "DeathNoteHackers claimed about 1.35 GB across 6,698 files, including personnel and rescue records.",
"sources": [
{
"name": "Astig.ph",
"url": "https://astig.ph/hacker-claims-dotr-payroll-biometric-data-4534-employees-2026/"
},
{
"name": "Radar PH",
"url": "https://radar.ph/govt-data-breach-claims-pile-up-npc-yet-to-receive-reports/"
}
],
"checked": "2026-11-07",
"domain": "coastguard.gov.ph",
"logo": "coastguard.gov.ph",
"actor_ids": [
"deathnote-hackers"
],
"id": "b1cb7823",
"story": "philippines-government-leak-claims-november-2026"
},
{
"org": "Presidential Commission on Good Government (PCGG)",
"sector": "government",
"date": "2026-11-05",
"type": "data-leak",
"actor": "HappyGoLuckyPH",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "HappyGoLuckyPH claimed about 8 GB of PCGG data.",
"sources": [
{
"name": "Philstar Tech",
"url": "https://philstartech.com/news/2026/11/05/20296/philippines-nov-5-data-breach-government-agencies-2025/"
},
{
"name": "Radar PH",
"url": "https://radar.ph/govt-data-breach-claims-pile-up-npc-yet-to-receive-reports/"
}
],
"checked": "2026-11-07",
"domain": "pcgg.gov.ph",
"logo": "pcgg.gov.ph",
"actor_ids": [
"happygoluckyph"
],
"id": "5bfaca10",
"story": "philippines-government-leak-claims-november-2026"
},
{
"org": "Department of Information and Communications Technology (DICT) internal files",
"sector": "government",
"date": "2026-11-05",
"type": "data-leak",
"actor": "core849",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "A forum user claimed about 3.6 GB of internal DICT documents, including procurement and budget records. Bilyonaryo News Channel, citing a source, reports the intrusion hit DocTracks, the internal document-routing system; DICT has not commented.",
"sources": [
{
"name": "Philstar Tech",
"url": "https://philstartech.com/news/2026/11/05/20296/philippines-nov-5-data-breach-government-agencies-2025/"
},
{
"name": "Radar PH",
"url": "https://radar.ph/govt-data-breach-claims-pile-up-npc-yet-to-receive-reports/"
},
{
"name": "Bilyonaryo News Channel",
"url": "https://bnc.bilyonaryo.com/even-dict-isnt-safe-hackers-allegedly-breach-agencys-internal-document-system/business/"
}
],
"checked": "2026-11-08",
"domain": "dict.gov.ph",
"logo": "dict.gov.ph",
"actor_ids": [
"core849"
],
"id": "8dd34ecc",
"story": "philippines-government-leak-claims-november-2026"
},
{
"org": "Nueva Ecija University of Science and Technology (NEUST)",
"sector": "education",
"date": "2026-11-05",
"type": "data-leak",
"actor": "",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "A forum user claimed personal and academic data on more than 81,000 NEUST students.",
"sources": [
{
"name": "Philstar Tech",
"url": "https://philstartech.com/news/2026/11/05/20296/philippines-nov-5-data-breach-government-agencies-2025/"
}
],
"checked": "2026-11-07",
"domain": "neust.edu.ph",
"logo": "neust.edu.ph",
"actor_ids": [],
"id": "de93887b",
"story": "philippines-government-leak-claims-november-2026"
},
{
"org": "DILG Local Government Unit Support System",
"sector": "government",
"date": "2026-11-05",
"type": "data-leak",
"actor": "HappyGoLuckyPH",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "HappyGoLuckyPH claimed a breach of the DILG LGU support system.",
"sources": [
{
"name": "Radar PH",
"url": "https://radar.ph/govt-data-breach-claims-pile-up-npc-yet-to-receive-reports/"
}
],
"checked": "2026-11-07",
"domain": "dilg.gov.ph",
"logo": "dilg.gov.ph",
"actor_ids": [
"happygoluckyph"
],
"id": "4e474b28",
"story": "philippines-government-leak-claims-november-2026"
},
{
"org": "Philippine Amusement and Gaming Corporation (PAGCOR)",
"sector": "government",
"date": "2026-11-05",
"type": "data-leak",
"actor": "Porman2344",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "A forum user claimed PAGCOR's National Database of Restricted Persons.",
"sources": [
{
"name": "Radar PH",
"url": "https://radar.ph/govt-data-breach-claims-pile-up-npc-yet-to-receive-reports/"
}
],
"checked": "2026-11-07",
"domain": "pagcor.ph",
"logo": "pagcor.ph",
"actor_ids": [
"porman2344"
],
"id": "a9c63316",
"story": "philippines-government-leak-claims-november-2026"
},
{
"org": "Securities and Exchange Commission (SEC)",
"sector": "finance",
"date": "2026-11-06",
"type": "data-leak",
"actor": "sinigangmixwithgabi",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "A forum user claimed files from the SEC.",
"sources": [
{
"name": "Radar PH",
"url": "https://radar.ph/govt-data-breach-claims-pile-up-npc-yet-to-receive-reports/"
}
],
"checked": "2026-11-07",
"domain": "sec.gov.ph",
"logo": "sec.gov.ph",
"actor_ids": [
"sinigangmixwithgabi"
],
"id": "47e08580",
"story": "philippines-government-leak-claims-november-2026"
},
{
"org": "Eastern Visayas State University",
"sector": "education",
"date": "2026-11-05",
"type": "intrusion",
"actor": "",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "Monitors listed the university among the 5 November alleged hacking incidents.",
"sources": [
{
"name": "Newsbytes.PH",
"url": "https://newsbytes.ph/2026/11/06/npc-checking-data-leaks-following-nov-5-cyberattack-reports/"
}
],
"checked": "2026-11-07",
"domain": "evsu.edu.ph",
"logo": "evsu.edu.ph",
"actor_ids": [],
"id": "633994d5",
"story": "philippines-government-leak-claims-november-2026"
},
{
"org": "Bataan provincial government website",
"sector": "government",
"date": "2026-11-05",
"type": "defacement",
"actor": "",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "Monitors reported a defacement of a Bataan government website.",
"sources": [
{
"name": "Newsbytes.PH",
"url": "https://newsbytes.ph/2026/11/06/npc-checking-data-leaks-following-nov-5-cyberattack-reports/"
},
{
"name": "Astig.ph",
"url": "https://astig.ph/hacker-claims-dotr-payroll-biometric-data-4534-employees-2026/"
}
],
"checked": "2026-11-07",
"domain": "bataan.gov.ph",
"logo": "bataan.gov.ph",
"actor_ids": [],
"id": "5db8fc76",
"story": "philippines-government-leak-claims-november-2026"
},
{
"org": "Philippine Nurses Association",
"sector": "health",
"date": "2026-11-05",
"type": "defacement",
"actor": "Nullsec Philippines",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "The association's website was defaced with a Nullsec Philippines message.",
"sources": [
{
"name": "Philstar Tech",
"url": "https://philstartech.com/news/2026/11/05/20296/philippines-nov-5-data-breach-government-agencies-2025/"
},
{
"name": "Newsbytes.PH",
"url": "https://newsbytes.ph/2026/11/06/npc-checking-data-leaks-following-nov-5-cyberattack-reports/"
}
],
"checked": "2026-11-07",
"domain": "pna-ph.org",
"logo": "pna-ph.org",
"actor_ids": [
"nullsec-philippines"
],
"id": "c01d3d79",
"story": "philippines-government-leak-claims-november-2026"
},
{
"org": "Alliance Graduate School",
"sector": "education",
"date": "2026-11-05",
"type": "defacement",
"actor": "",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "Monitors reported a defacement of the school's website.",
"sources": [
{
"name": "Newsbytes.PH",
"url": "https://newsbytes.ph/2026/11/06/npc-checking-data-leaks-following-nov-5-cyberattack-reports/"
}
],
"checked": "2026-11-07",
"domain": "ags.edu.ph",
"actor_ids": [],
"id": "47db545a",
"story": "philippines-government-leak-claims-november-2026"
},
{
"org": "Department of Science and Technology (DOST) website",
"sector": "government",
"date": "2026-11-05",
"type": "ddos",
"actor": "",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "Reports described a DDoS attack that left the DOST website inaccessible for several hours; the cause was not confirmed.",
"sources": [
{
"name": "Philstar Tech",
"url": "https://philstartech.com/news/2026/11/05/20296/philippines-nov-5-data-breach-government-agencies-2025/"
},
{
"name": "Bilyonaryo",
"url": "https://bnc.bilyonaryo.com/even-dict-isnt-safe-hackers-allegedly-breach-agencys-internal-document-system/business/"
}
],
"checked": "2026-11-07",
"domain": "dost.gov.ph",
"logo": "dost.gov.ph",
"actor_ids": [],
"id": "c2e4daf8",
"story": "philippines-government-leak-claims-november-2026"
},
{
"org": "Philippine Nuclear Research Institute and a naval shipbuilder",
"sector": "government",
"date": "2026-08-27",
"type": "intrusion",
"actor": "Suspected Chinese-speaking operator",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "Hunt.io found an attacker server holding reactor, fuel and staff records taken through an ownCloud flaw, plus 195 MB from a Navy-linked shipbuilder.",
"sources": [
{
"name": "Cybersecurity News",
"url": "https://cybersecuritynews.com/hackers-exploit-owncloud/"
},
{
"name": "SC Media",
"url": "https://www.scworld.com/brief/suspected-chinese-actor-targets-philippine-nuclear-and-naval-entities-using-known-vulnerabilities"
}
],
"checked": "2026-11-07",
"actor_ids": [
"suspected-chinese-speaking-operator"
],
"id": "642f87bb"
},
{
"org": "City Government of Baguio (BUILDPass)",
"sector": "government",
"date": "2026-08-12",
"type": "ransomware",
"actor": "Emperador",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "Emperador listed the city on 12 August claiming 2.9 GB of permits, IDs and blueprints; the city disabled its BUILDPass permit system.",
"sources": [
{
"name": "Ransomware.live",
"url": "https://www.ransomware.live/id/Q2l0eSBHb3Zlcm5tZW50IG9mIEJhZ3Vpb0BlbXBlcmFkb3I"
},
{
"name": "BlackFog",
"url": "https://www.blackfog.com/the-state-of-ransomware-august-2026/"
}
],
"checked": "2026-11-07",
"domain": "baguio.gov.ph",
"logo": "baguio.gov.ph",
"actor_ids": [
"emperador"
],
"id": "9af81c9e"
},
{
"org": "Philippine Savings Bank (PSBank)",
"sector": "finance",
"date": "2026-01-28",
"type": "ransomware",
"actor": "Qilin",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "Qilin listed PSBank on its leak site on 28 January; The Gentlemen listed it again on 1 August.",
"sources": [
{
"name": "Ransomware.live",
"url": "https://www.ransomware.live/id/UGhpbGlwcGluZSBTYXZpbmdzIEJhbmsgKE1ldHJvYmFuayBHcm91cClAcWlsaW4"
},
{
"name": "Deep Web Konek",
"url": "https://konek.hn.plus/item/165114/philippine-savings-bank-allegedly-named-by-qilin-ransomware-group-on-dark-web-leak-site"
}
],
"checked": "2026-11-07",
"domain": "psbank.com.ph",
"logo": "psbank.com.ph",
"actor_ids": [
"qilin"
],
"id": "9314d537"
},
{
"org": "Megawide Construction",
"sector": "property",
"date": "2026-08-16",
"type": "ransomware",
"actor": "Qilin",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "Qilin listed Megawide on its leak site on 16 August.",
"sources": [
{
"name": "Ransomware.live (Philippines)",
"url": "https://www.ransomware.live/map/PH"
},
{
"name": "DeXpose",
"url": "https://www.dexpose.io/qilin-ransomware-targets-megawide/"
}
],
"checked": "2026-11-07",
"domain": "megawide.com.ph",
"logo": "megawide.com.ph",
"actor_ids": [
"qilin"
],
"id": "f6fddfbc"
},
{
"org": "Philex Mining",
"sector": "other",
"date": "2026-04-30",
"type": "ransomware",
"actor": "Qilin",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "Qilin listed Philex Mining on its leak site on 30 April.",
"sources": [
{
"name": "Ransomware.live (Philippines)",
"url": "https://www.ransomware.live/map/PH"
}
],
"checked": "2026-11-07",
"domain": "philexmining.com.ph",
"logo": "philexmining.com.ph",
"actor_ids": [
"qilin"
],
"id": "242e34b2"
},
{
"org": "LT Group / Fortune Tobacco Corp",
"sector": "manufacturing",
"date": "2026-08-10",
"type": "ransomware",
"actor": "Deadlock",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "Deadlock listed LT Group and Fortune Tobacco on its leak site on 10 August.",
"sources": [
{
"name": "Ransomware.live (Philippines)",
"url": "https://www.ransomware.live/map/PH"
}
],
"checked": "2026-11-07",
"domain": "ltg.com.ph",
"logo": "ltg.com.ph",
"actor_ids": [
"deadlock"
],
"id": "6ef303d6"
},
{
"org": "Globalport Terminals",
"sector": "transport",
"date": "2026-08-27",
"type": "ransomware",
"actor": "Qilin",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "Qilin listed Globalport Terminals on its leak site on 27 August.",
"sources": [
{
"name": "Ransomware.live (Philippines)",
"url": "https://www.ransomware.live/map/PH"
}
],
"checked": "2026-11-07",
"domain": "globalport.com.ph",
"logo": "globalport.com.ph",
"actor_ids": [
"qilin"
],
"id": "bddd39b7"
},
{
"org": "LifeBank Microfinance Foundation",
"sector": "finance",
"date": "2026-08-22",
"type": "ransomware",
"actor": "Coinbase Cartel",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "Coinbase Cartel listed LifeBank Microfinance Foundation on its leak site on 22 August.",
"sources": [
{
"name": "Ransomware.live (Philippines)",
"url": "https://www.ransomware.live/map/PH"
}
],
"checked": "2026-11-07",
"actor_ids": [
"coinbase-cartel"
],
"id": "c32be14e"
},
{
"org": "Liberty Insurance Corporation",
"sector": "finance",
"date": "2026-06-10",
"type": "ransomware",
"actor": "Krybit",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "Krybit listed libertyinsurance.com.ph on its leak site on 10 June.",
"sources": [
{
"name": "Ransomware.live (Philippines)",
"url": "https://www.ransomware.live/map/PH"
}
],
"checked": "2026-11-07",
"domain": "libertyinsurance.com.ph",
"logo": "libertyinsurance.com.ph",
"actor_ids": [
"krybit"
],
"id": "7e7f65f1"
},
{
"org": "DTI Foreign Trade Service Corps",
"sector": "government",
"date": "2026-01-11",
"type": "ransomware",
"actor": "The Gentlemen",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "The Gentlemen listed the DTI Foreign Trade Service Corps on its leak site on 11 January.",
"sources": [
{
"name": "Ransomware.live (Philippines)",
"url": "https://www.ransomware.live/map/PH"
}
],
"checked": "2026-11-07",
"domain": "dti.gov.ph",
"logo": "dti.gov.ph",
"actor_ids": [
"the-gentlemen"
],
"id": "6ba7dd7f"
},
{
"org": "Lenotech Corporation",
"sector": "other",
"date": "2026-01-27",
"type": "ransomware",
"actor": "Tengu",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "Tengu listed lenotech.com.ph on its leak site on 27 January, reportedly with about 136 GB of data.",
"sources": [
{
"name": "Ransomware.live (Philippines)",
"url": "https://www.ransomware.live/map/PH"
}
],
"checked": "2026-11-07",
"actor_ids": [
"tengu"
],
"id": "d8f970e7"
},
{
"org": "KTU Shipyard",
"sector": "manufacturing",
"date": "2026-10-30",
"type": "ransomware",
"actor": "Whitearmor",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "Whitearmor listed KTU Shipyard on its leak site on 30 October.",
"sources": [
{
"name": "Ransomware.live (Philippines)",
"url": "https://www.ransomware.live/map/PH"
}
],
"checked": "2026-11-07",
"domain": "ktushipyard.com",
"logo": "ktushipyard.com",
"actor_ids": [
"whitearmor"
],
"id": "738dc63b"
},
{
"org": "Panorama BPO",
"sector": "other",
"date": "2026-06-01",
"type": "ransomware",
"actor": "DragonForce",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "DragonForce listed Panorama BPO on its leak site on 1 June.",
"sources": [
{
"name": "Ransomware.live (Philippines)",
"url": "https://www.ransomware.live/map/PH"
}
],
"checked": "2026-11-07",
"domain": "panoramabpo.com",
"logo": "panoramabpo.com",
"actor_ids": [
"dragonforce"
],
"id": "96bc884a"
}
],
"subject": "The Philippines",
"slug": "philippines",
"title": "Philippines Cyber Incidents and Data Breaches 2026 · pwnsy",
"lede": "No public threat level. 9 incidents confirmed, 35 claims in 2026.",
"h1": "![\"\"](\"/tools/cyber-watch/flags/ph.svg\")
Philippines Cyber Watch",
"desc": "Philippines cyber threat level: none published. 9 incidents confirmed and 35 claims in 2026, each sourced. Updated 8 Nov 2026.",
"since": "2026-01-01",
"stats": [
{
"label": "CICC cybercrime complaints",
"value": "18,633",
"period": "2025 (announced 22 Jan 2026)",
"source": {
"name": "GMA News",
"url": "https://www.gmanetwork.com/news/topstories/nation/973804/consumer-fraud-topped-cybercrime-complaints-in-2025-cicc/story/"
}
},
{
"label": "CICC consumer fraud complaints",
"value": "6,453",
"period": "2025 (announced 22 Jan 2026)",
"source": {
"name": "GMA News",
"url": "https://www.gmanetwork.com/news/topstories/nation/973804/consumer-fraud-topped-cybercrime-complaints-in-2025-cicc/story/"
}
},
{
"label": "Losses reported to CICC (fraud, hacking, phishing)",
"value": "PHP 418.187 million",
"period": "2025 (announced 22 Jan 2026)",
"source": {
"name": "GMA News",
"url": "https://www.gmanetwork.com/news/topstories/nation/973804/consumer-fraud-topped-cybercrime-complaints-in-2025-cicc/story/"
}
},
{
"label": "PNP-ACG cybercrime arrests",
"value": "332",
"period": "Q1 2026",
"source": {
"name": "GMA News",
"url": "https://www.gmanetwork.com/news/topstories/nation/982689/pnp-acg-arrests-cybercrimes-quarter/story/"
}
},
{
"label": "PNP-ACG cases referred",
"value": "593",
"period": "Q1 2026",
"source": {
"name": "GMA News",
"url": "https://www.gmanetwork.com/news/topstories/nation/982689/pnp-acg-arrests-cybercrimes-quarter/story/"
}
},
{
"label": "PNP-ACG cybercrime convictions",
"value": "143",
"period": "Q1 2026",
"source": {
"name": "GMA News",
"url": "https://www.gmanetwork.com/news/topstories/nation/982689/pnp-acg-arrests-cybercrimes-quarter/story/"
}
},
{
"label": "PNP-ACG cybercrime arrests",
"value": "766",
"period": "January to July 2026",
"source": {
"name": "Technobaboy",
"url": "https://www.technobaboy.com/2026/09/02/pnp-acg-arrests-766-cybercrime-suspects-in-first-half-of-2026/"
}
},
{
"label": "PNP-ACG referred cybercrime cases",
"value": "144",
"period": "October 2026",
"source": {
"name": "Daily Tribune",
"url": "https://tribune.net.ph/2026/11/07/pnp-records-eight-cybercrime-convictions-144-referred-cases-in-october"
}
},
{
"label": "Cases filed under AFASA",
"value": "More than 500",
"period": "As of 23 Jul 2026",
"source": {
"name": "GMA News",
"url": "https://www.gmanetwork.com/news/money/economy/995881/over-500-cases-filed-against-scammers-bsp-warns-banks-may-have-to-reimburse-victims/story/"
}
},
{
"label": "Hospital data breach reports received by NPC",
"value": "18",
"period": "Cumulative as of 3 Nov 2026",
"source": {
"name": "GMA News",
"url": "https://www.gmanetwork.com/news/topstories/nation/1008108/st-luke-s-medical-center-probing-cybersecurity-incident-on-mobile-app/story/"
}
}
],
"rules": [
{
"date": "2026-06-25",
"title": "AFASA fraud management deadline (BSP Circular 1213)",
"what": "Banks and e-wallets had to upgrade fraud management systems and limit interceptable authentication such as SMS OTPs, or face reimbursing victims.",
"url": "https://www.gmanetwork.com/news/money/economy/995881/over-500-cases-filed-against-scammers-bsp-warns-banks-may-have-to-reimburse-victims/story/"
},
{
"date": "2026-08-03",
"title": "DOJ and BSP AFASA information-sharing agreement",
"what": "The BSP will refer financial account scam reports to the DOJ, which gets access to account information for prosecutions.",
"url": "https://tribune.net.ph/2026/08/03/doj-bsp-team-up-to-crack-down-on-bank-scams-under-afasa"
},
{
"date": "2026-08-12",
"title": "House passes HB 9605, National Cybersecurity and Critical Information Infrastructure Protection Act",
"what": "The House approved, 198 to 3, a bill creating a National Cybersecurity Agency and minimum security duties for agencies and critical infrastructure; it awaits Senate action.",
"url": "https://businessmirror.com.ph/2026/08/13/house-passes-cyber-security-bill/"
},
{
"date": "2026-08-14",
"title": "NPC draft updated Privacy Impact Assessment guidelines",
"what": "Public consultation closed on a draft circular replacing the blanket PIA duty with a risk-tiered framework.",
"url": "https://privacy.gov.ph/wp-content/uploads/2026/08/For-Public-Consultation-Draft-Circular-Updated-PIA-Guidelines.pdf"
},
{
"date": "2026-09-08",
"title": "DICT and CICC 24-hour cyber readiness order",
"what": "Agencies, GOCCs, LGUs and critical infrastructure operators had 24 hours to fix critical gaps and file a one-page readiness assessment.",
"url": "https://newsbytes.ph/2026/09/10/dict-cicc-order-24-hour-cyber-checks-after-attacks-on-govt-websites/"
},
{
"date": "2026-10-29",
"title": "NTC order on subscribers with more than 100 SIMs",
"what": "Telcos have 15 days to verify owners of more than 100 SIMs and deactivate SIMs without proven control and legitimate use.",
"url": "https://www.manilatimes.net/2026/10/29/business/top-business/ntc-orders-checks-on-mobile-phone-subscribers-with-over-100-sim-cards/2456748"
}
],
"actors": [
{
"name": "Qilin",
"kind": "ransomware",
"seen": "Most active ransomware group against Philippine firms in 2026, listing PSBank, Megawide, Philex Mining and Globalport Terminals.",
"sources": [
{
"name": "Ransomware.live (Philippines)",
"url": "https://www.ransomware.live/map/PH"
},
{
"name": "Cyber Security Asia (Check Point report)",
"url": "https://cybersecurityasia.net/check-point-2026-philippine-threat-landscape/"
}
],
"actor_id": "qilin"
},
{
"name": "The Gentlemen",
"kind": "ransomware",
"seen": "Listed DTI Foreign Trade Service Corps, PTT Philippines, White Beach Hotel and PSBank between January and August.",
"sources": [
{
"name": "Ransomware.live (Philippines)",
"url": "https://www.ransomware.live/map/PH"
}
],
"actor_id": "the-gentlemen"
},
{
"name": "Payload",
"kind": "ransomware",
"seen": "Listed four Philippine firms in March and April, including TS Lines Philippines and Sunlight Express Airways.",
"sources": [
{
"name": "Ransomware.live (Philippines)",
"url": "https://www.ransomware.live/map/PH"
}
],
"actor_id": "payload"
},
{
"name": "DragonForce",
"kind": "ransomware",
"seen": "Listed Alliance Select Foods, Panorama BPO and Trans World Trading.",
"sources": [
{
"name": "Ransomware.live (Philippines)",
"url": "https://www.ransomware.live/map/PH"
}
],
"actor_id": "dragonforce"
},
{
"name": "LockBit 5.0",
"kind": "ransomware",
"seen": "Claimed Pricon Microelectronics, whose parent confirmed a ransomware attack, and Feliz Hotel Boracay.",
"sources": [
{
"name": "Ransomware.live (Philippines)",
"url": "https://www.ransomware.live/map/PH"
},
{
"name": "DeXpose",
"url": "https://www.dexpose.io/lockbit-5-0-targets-pricon-microelectronics-in-philippines/"
}
],
"actor_id": "lockbit-5-0"
},
{
"name": "Emperador",
"kind": "ransomware",
"seen": "New group that claimed 2.9 GB from the City Government of Baguio in August.",
"sources": [
{
"name": "Ransomware.live",
"url": "https://www.ransomware.live/id/Q2l0eSBHb3Zlcm5tZW50IG9mIEJhZ3Vpb0BlbXBlcmFkb3I"
}
],
"actor_id": "emperador"
},
{
"name": "Bashe (APT73)",
"kind": "extortion",
"seen": "Listed about 50 GB of alleged DPWH files in March and the dpwh.gov.ph domain in April.",
"sources": [
{
"name": "Daily Tribune",
"url": "https://tribune.net.ph/amp/story/2026/03/23/dpwh-checking-alleged-50gb-data-breach"
}
],
"actor_id": "apt73"
},
{
"name": "DeathNoteHackers",
"kind": "hacktivist",
"seen": "Claimed the PhilJobNet, Office of the Vice President and Philippine Coast Guard data on 5 November.",
"sources": [
{
"name": "Radar PH",
"url": "https://radar.ph/govt-data-breach-claims-pile-up-npc-yet-to-receive-reports/"
},
{
"name": "Philstar Tech",
"url": "https://philstartech.com/news/2026/11/05/20296/philippines-nov-5-data-breach-government-agencies-2025/"
}
],
"actor_id": "deathnote-hackers"
},
{
"name": "HappyGoLuckyPH",
"kind": "hacktivist",
"seen": "Defaced the DMW website in September and claimed PCGG and DILG data on 5 November.",
"sources": [
{
"name": "Newsbytes.PH",
"url": "https://newsbytes.ph/2026/09/08/hackers-claim-access-to-dmw-network-as-dict-probes-govt-cyberattacks/"
},
{
"name": "Radar PH",
"url": "https://radar.ph/govt-data-breach-claims-pile-up-npc-yet-to-receive-reports/"
}
],
"actor_id": "happygoluckyph"
},
{
"name": "Nullsec Philippines",
"kind": "hacktivist",
"seen": "Defaced the Senate website in June and the Philippine Nurses Association site in November.",
"sources": [
{
"name": "Philstar",
"url": "https://www.philstar.com/headlines/2026/06/11/2534452/hacktivist-group-defaces-senate-website-calls-accountability-govt"
},
{
"name": "Philstar Tech",
"url": "https://philstartech.com/news/2026/11/05/20296/philippines-nov-5-data-breach-government-agencies-2025/"
}
],
"actor_id": "nullsec-philippines"
},
{
"name": "core849",
"kind": "unknown",
"seen": "Forum user tied to the LTFRB, DICT D-TAP and DICT internal-file claims between September and November.",
"sources": [
{
"name": "Astig.ph",
"url": "https://astig.ph/dict-dtap-data-exposure-410-files-48-firms-2026/"
},
{
"name": "Radar PH",
"url": "https://radar.ph/govt-data-breach-claims-pile-up-npc-yet-to-receive-reports/"
}
],
"actor_id": "core849"
},
{
"name": "sinigangmixwithgabi",
"kind": "unknown",
"seen": "Forum user who claimed DOTr, SEC and BIR files on 6 November.",
"sources": [
{
"name": "Radar PH",
"url": "https://radar.ph/govt-data-breach-claims-pile-up-npc-yet-to-receive-reports/"
},
{
"name": "Astig.ph",
"url": "https://astig.ph/hacker-claims-dotr-payroll-biometric-data-4534-employees-2026/"
}
],
"actor_id": "sinigangmixwithgabi"
},
{
"name": "Chinese state-sponsored actors",
"kind": "state",
"seen": "Microsoft ranked the Philippines fifth among targets of Chinese state cyber operations, and Hunt.io tied a Chinese-speaking operator to theft from the Philippine Nuclear Research Institute.",
"sources": [
{
"name": "GMA News",
"url": "https://www.gmanetwork.com/news/topstories/nation/1006192/philippines-5th-most-targeted-by-chinese-cyber-operations-microsoft/story/"
},
{
"name": "Cybersecurity News",
"url": "https://cybersecuritynews.com/hackers-exploit-owncloud/"
}
]
}
],
"region": "Southeast Asia",
"upd": "2026-11-08"
},
"VN": {
"name": "Vietnam",
"posture": {
"level": "",
"summary": "The Ministry of Public Security's Department of Cybersecurity and the National Cybersecurity Association issue warnings.",
"agency": "Ministry of Public Security, Department of Cybersecurity",
"source": {
"name": "Ministry of Public Security, Department of Cybersecurity",
"url": "https://vietnamnet.vn/cuc-an-ninh-mang-khuyen-cao-doanh-nghiep-ra-soat-lo-hong-php-2567511.html"
},
"checked": "2026-11-07"
},
"timeline": [
{
"date": "2026-10-22",
"text": "The Department of Cybersecurity urges organisations running PHP sites to patch PHP2Shell by priority and keep monitoring.",
"url": "https://vietnamnet.vn/cuc-an-ninh-mang-khuyen-cao-doanh-nghiep-ra-soat-lo-hong-php-2567511.html",
"src": "VietNamNet"
},
{
"date": "2026-11-05",
"text": "The foreign ministry says Vietnam is closely monitoring the cyberattacks on supermarket refrigeration systems.",
"url": "https://hanoionline.vn/viet-nam-len-an-manh-me-truoc-cac-vu-tan-cong-mang-246261105231444029.htm",
"src": "Hanoi Online"
},
{
"date": "2026-03-24",
"text": "Thanh Hoa police charged 12 people over PXA Stealer malware that infected more than 94,000 computers worldwide.",
"url": "https://tuoitre.vn/plo/thanh-hoa-pha-duong-day-phat-tan-ma-doc-danh-cap-du-lieu-94000-may-tinh-tren-toan-cau-post900947.html",
"src": "Tuoi Tre"
},
{
"date": "2026-05-22",
"text": "VNCERT director Tran Trung Hieu said two ministry-level systems lost millions of user records and warned that leaders may face criminal liability for hidden incidents.",
"url": "https://vietnamnet.vn/en/hackers-breach-two-vietnamese-ministerial-systems-in-major-cyberattack-2518404.html",
"src": "VietNamNet"
},
{
"date": "2026-06-10",
"text": "Lam Dong police announced charges against a 16-year-old who allegedly sold 20 million records from the national vaccination system.",
"url": "https://vietnamnews.vn/society/1783172/teenager-accused-of-hacking-viet-nam-s-vaccination-system-selling-20-million-personal-records.html",
"src": "Viet Nam News"
},
{
"date": "2026-07-02",
"text": "SBV said 100% of accounts with digital transactions were biometrically matched and SIMO247 warnings led 1.5 million customers to stop transfers worth over VND 5,200 billion.",
"url": "https://vietstock.vn/2026/07/nhnn-100-tai-khoan-giao-dich-so-da-xac-thuc-sinh-trac-hoc-chan-dung-hon-5200-ty-dong-lua-dao-757-1461413.htm",
"src": "Vietstock"
},
{
"date": "2026-07-07",
"text": "Nghe An police reported seizing over 50 million personal records from a two-person data trading group.",
"url": "https://afamily.vn/triet-pha-duong-day-mua-ban-hon-50-trieu-du-lieu-ca-nhan-can-bo-lanh-dao-doanh-nghiep-236260707173947045.chn",
"src": "aFamily / Tien Phong"
},
{
"date": "2026-08-12",
"text": "Quang Ninh police and A05 dismantled a data trading and fraud ring that took over VND 110 billion.",
"url": "https://baotintuc.vn/an-ninh-trat-tu/danh-sap-duong-day-lua-dao-mua-ban-du-lieu-ca-nhan-quy-mo-lon-tren-mang-20260812191859222.htm",
"src": "Bao Tin Tuc"
},
{
"date": "2026-09-24",
"text": "An A05 report said police handled 40 data leak and data trading cases in the first half of 2026.",
"url": "https://congan.com.vn/vu-an/triet-pha-nhieu-vu-mua-ban-du-lieu-trai-phep_198051.html",
"src": "Cong An TP.HCM"
},
{
"date": "2026-10-08",
"text": "C06 said fraud cases fell 52% in 2025 and over 400 fraud accounts reported through VNeID had been frozen since June.",
"url": "https://vtv.vn/so-vu-lua-dao-giam-52-nho-xac-thuc-sinh-trac-hoc-100261007193308883.htm",
"src": "VTV"
},
{
"date": "2026-10-22",
"text": "SBV Deputy Governor Pham Tien Dung warned at Smart Banking 2026 that hackers may target banks' own funds and that banks must monitor security and transactions together.",
"url": "https://baodautu.vn/bao-dong-bao-mat-tin-tac-khong-chi-trom-tien-khach-hang-ma-da-nham-vao-kho-tien-ngan-hang-d729141.html",
"src": "Bao Dau Tu"
},
{
"date": "2026-10-30",
"text": "The State Securities Commission ordered securities and fund firms to review cybersecurity after attacks affected financial, banking and some securities systems.",
"url": "https://cafef.vn/uy-ban-chung-khoan-yeu-cau-cong-ty-chung-khoan-ra-soat-tang-cuong-an-ninh-mang-188261103222147325.chn",
"src": "CafeF"
},
{
"date": "2026-11-06",
"text": "A05 deputy director Col. Nguyen Ba Son said more than 668,000 payment accounts showed signs of unlawful activity.",
"url": "https://dantri.com.vn/kinh-doanh/hon-668000-tai-khoan-thanh-toan-co-dau-hieu-vi-pham-phap-luat-can-lam-gi-20261107142442193.htm",
"src": "Dan Tri"
},
{
"date": "2026-09-21",
"text": "Provincial police charged a man for collecting and selling about 120 million personal records linked to agencies and businesses.",
"url": "https://baolaocai.vn/hai-anh-em-bi-khoi-to-vi-mua-ban-120-trieu-du-lieu-ca-nhan-post910025.html",
"src": "Bao Lao Cai",
"kind": "enforcement"
},
{
"date": "2026-03-24",
"text": "Thanh Hoa provincial police charged 12 people on 24 March 2026 for building and spreading PXA Stealer and Adonis malware that infected more than 94,000 computers worldwide.",
"url": "https://tuoitre.vn/plo/thanh-hoa-pha-duong-day-phat-tan-ma-doc-danh-cap-du-lieu-94000-may-tinh-tren-toan-cau-post900947.html",
"src": "Tuoi Tre / Phap Luat TP.HCM",
"kind": "enforcement"
},
{
"date": "2026-06-23",
"text": "Nghe An provincial police arrested two people on 23 June 2026 who held over 50 million personal records (72.4 GB) of officials, students and business leaders and sold them on Facebook and Telegram.",
"url": "https://afamily.vn/triet-pha-duong-day-mua-ban-hon-50-trieu-du-lieu-ca-nhan-can-bo-lanh-dao-doanh-nghiep-236260707173947045.chn",
"src": "aFamily (from Tien Phong)",
"kind": "enforcement"
}
],
"incidents": [
{
"org": "HOCMAI",
"sector": "education",
"date": "2026-11-01",
"type": "intrusion",
"actor": "",
"status": "confirmed",
"vendor": false,
"confirmed": "Outsiders accessed the system on 30 Oct; contained, users must reset passwords.",
"claimed": "A headline suggests over 7 million accounts were hacked; HOCMAI has not confirmed a figure.",
"sources": [
{
"name": "Tap chi An ninh mang",
"url": "https://tapchianninhmang.vn/hocmai-len-tieng-sau-nghi-van-lo-du-lieu-yeu-cau-doi-mat-khau"
}
],
"checked": "2026-11-07",
"domain": "hocmai.vn",
"actor_ids": [],
"id": "6e913aff"
},
{
"org": "FPT Software",
"sector": "other",
"date": "2026-10-31",
"type": "ransomware",
"actor": "The Gentlemen",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "Listed on The Gentlemen's leak site; FPT has not commented.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/RlBUIFNvZnR3YXJlQHRoZWdlbnRsZW1lbg"
}
],
"checked": "2026-11-07",
"domain": "fptsoftware.com",
"logo": "fptsoftware.com",
"actor_ids": [
"the-gentlemen"
],
"id": "96d3e8b1"
},
{
"org": "Mat Bao Corporation",
"sector": "other",
"date": "2026-10-02",
"type": "ransomware",
"actor": "Rhysida",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "Rhysida claims about 106.8 GB from the hosting and domain provider.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/TWF0IEJhbyBDb3Jwb3JhdGlvbkByaHlzaWRh"
}
],
"checked": "2026-11-07",
"domain": "matbao.net",
"logo": "matbao.net",
"actor_ids": [
"rhysida"
],
"id": "dfeed286"
},
{
"org": "Vietnam SuperPort",
"sector": "transport",
"date": "2026-10-09",
"type": "ransomware",
"actor": "Nightspire",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "The logistics hub is listed on Nightspire's leak site.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/VmlldG5hbSBTdXBlclBvcnRAbmlnaHRzcGlyZQ"
}
],
"checked": "2026-11-07",
"domain": "superport.vn",
"logo": "superport.vn",
"actor_ids": [
"nightspire"
],
"id": "0a05db43"
},
{
"org": "Nam Dinh Vu Port",
"sector": "transport",
"date": "2026-10-12",
"type": "ransomware",
"actor": "N0n",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "The container terminal operator is listed on N0n's leak site.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/TmFtIERpbmggVnUgUG9ydCAoY29udGFpbmVyIHRlcm1pbmFsIG9wZXJhdGlvbnMpQE4wbg"
}
],
"checked": "2026-11-07",
"actor_ids": [
"n0n"
],
"id": "22d68f2e"
},
{
"org": "VUS English Center",
"sector": "education",
"date": "2026-09-30",
"type": "ransomware",
"actor": "The Gentlemen",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "Listed on The Gentlemen's leak site.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/VlVTIC0gVGhlIEVuZ2xpc2ggQ2VudGVyQHRoZWdlbnRsZW1lbg"
}
],
"checked": "2026-11-07",
"domain": "vus.edu.vn",
"logo": "vus.edu.vn",
"actor_ids": [
"the-gentlemen"
],
"id": "1e1cbdbc"
},
{
"org": "Quy Nhon University",
"sector": "education",
"date": "2026-09-19",
"type": "ransomware",
"actor": "Vexy",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "Listed on Vexy's leak site.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/UXV5IE5ob24gVW5pdmVyc2l0eUBWZXh5IFJhbnNvbXdhcmU"
}
],
"checked": "2026-11-07",
"domain": "qnu.edu.vn",
"logo": "qnu.edu.vn",
"actor_ids": [
"vexy"
],
"id": "4aa017e0"
},
{
"org": "National Vaccination Information System (Ministry of Health, Department of Preventive Medicine)",
"sector": "health",
"date": "2026-06-05",
"type": "intrusion",
"actor": "Unnamed 16-year-old student from Nghe An",
"status": "confirmed",
"vendor": false,
"confirmed": "Lam Dong provincial police charged a Grade 10 student on 5 June 2026 with breaking into the national vaccination system through a security flaw and selling about 20 million personal records for over VND 100 million.",
"claimed": "",
"sources": [
{
"name": "Viet Nam News",
"url": "https://vietnamnews.vn/society/1783172/teenager-accused-of-hacking-viet-nam-s-vaccination-system-selling-20-million-personal-records.html"
},
{
"name": "Techz (Lam Dong police announcement)",
"url": "https://www.techz.vn/187-626-5-hoc-sinh-lop-10-o-nghe-an-bi-khoi-to-vi-hack-he-thong-tiem-chung-quoc-gia-danh-cap-du-lieu-ca-nhan-quy-mo-lon-ylt695967.html"
}
],
"checked": "2026-11-07",
"actor_ids": [],
"id": "fc77924c"
},
{
"org": "Two unnamed ministry-level agencies",
"sector": "government",
"date": "2026-05-22",
"type": "data-leak",
"actor": "Unknown",
"status": "confirmed",
"vendor": false,
"confirmed": "VNCERT director Tran Trung Hieu said on 22 May 2026 that VNCERT was handling a very serious incident in which two ministry-level systems lost millions of user records, undetected by their SOCs.",
"claimed": "",
"sources": [
{
"name": "VietNamNet",
"url": "https://vietnamnet.vn/en/hackers-breach-two-vietnamese-ministerial-systems-in-major-cyberattack-2518404.html"
},
{
"name": "Viet Bao (from VietNamNet)",
"url": "https://vietbao.vn/hacker-tan-cong-danh-cap-du-lieu-o-2-co-quan-cap-bo-voi-muc-do-nghiem-trong-592874.html"
}
],
"checked": "2026-11-07",
"actor_ids": [],
"id": "0a2047cb"
},
{
"org": "Quang Ninh cross-province data and fraud ring",
"sector": "other",
"date": "2026-08-12",
"type": "other",
"actor": "Scam ring (18 prosecuted)",
"status": "confirmed",
"vendor": false,
"confirmed": "Quang Ninh police and the A05 department dismantled a ring that bought personal data, posed as bank staff, took over VND 110 billion from thousands of victims and laundered 1.24 million USDT.",
"claimed": "",
"sources": [
{
"name": "Bao Tin Tuc",
"url": "https://baotintuc.vn/an-ninh-trat-tu/danh-sap-duong-day-lua-dao-mua-ban-du-lieu-ca-nhan-quy-mo-lon-tren-mang-20260812191859222.htm"
}
],
"checked": "2026-11-07",
"actor_ids": [
"scam-ring"
],
"id": "4277c9fd"
},
{
"org": "Ho Chi Minh City vacation-contract fraud rings",
"sector": "other",
"date": "2026-06-19",
"type": "other",
"actor": "Scam rings (nearly 200 suspects)",
"status": "confirmed",
"vendor": false,
"confirmed": "Ho Chi Minh City police announced 11 cases with nearly 200 suspects who bought victims' personal data online and took VND 612 billion through vacation-contract fraud.",
"claimed": "",
"sources": [
{
"name": "Cong An TP.HCM",
"url": "https://congan.com.vn/vu-an/triet-pha-nhieu-vu-mua-ban-du-lieu-trai-phep_198051.html"
}
],
"checked": "2026-11-07",
"actor_ids": [
"scam-rings"
],
"id": "0dc98062"
},
{
"org": "Vietnam Airlines",
"sector": "transport",
"date": "2026-01-18",
"type": "ransomware",
"actor": "Qilin",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "Qilin listed Vietnam Airlines on its leak site on 18 January 2026 and threatened to publish data unless the airline negotiated.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/VmlldG5hbSBBaXJsaW5lc0BxaWxpbg"
},
{
"name": "DeXpose",
"url": "https://www.dexpose.io/qilin-strikes-vietnam-airlines-in-major-ransomware-attack/"
}
],
"checked": "2026-11-07",
"domain": "vietnamairlines.com",
"logo": "vietnamairlines.com",
"actor_ids": [
"qilin"
],
"id": "89c50bfc"
},
{
"org": "SASI JSC",
"sector": "other",
"date": "2026-01-20",
"type": "ransomware",
"actor": "The Gentlemen",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "The Gentlemen listed SASI JSC on its leak site on 20 January 2026.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/U0FTSSBKU0NAdGhlZ2VudGxlbWVu"
}
],
"checked": "2026-11-07",
"domain": "sasi.com.vn",
"logo": "sasi.com.vn",
"actor_ids": [
"the-gentlemen"
],
"id": "8a7b7a4e"
},
{
"org": "Pacific Airlines",
"sector": "transport",
"date": "2026-01-29",
"type": "data-leak",
"actor": "Coinbase Cartel",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "Coinbase Cartel, a data-theft extortion group, listed the Ho Chi Minh City-based carrier on 29 January 2026.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/UGFjaWZpYyBBaXJsaW5lc0Bjb2luYmFzZWNhcnRlbA"
}
],
"checked": "2026-11-07",
"domain": "pacificairlines.com",
"logo": "pacificairlines.com",
"actor_ids": [
"coinbase-cartel"
],
"id": "c89baba5"
},
{
"org": "FindNear",
"sector": "other",
"date": "2026-02-23",
"type": "ransomware",
"actor": "Cipherforce",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "Cipherforce listed FindNear on its leak site on 23 February 2026.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/RmluZE5lYXJAY2lwaGVyZm9yY2U"
}
],
"checked": "2026-11-07",
"domain": "findnear.vn",
"logo": "findnear.vn",
"actor_ids": [
"cipherforce"
],
"id": "611abb21"
},
{
"org": "Vietnam Fortress Tools JSC",
"sector": "manufacturing",
"date": "2026-04-04",
"type": "ransomware",
"actor": "DragonForce",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "DragonForce listed the export-focused garden tool maker on its leak site on 4 April 2026.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/VmlldG5hbSBGb3J0cmVzcyBUb29scyBKU0NAZHJhZ29uZm9yY2U"
}
],
"checked": "2026-11-07",
"domain": "fortresstools.com.vn",
"actor_ids": [
"dragonforce"
],
"id": "54cab63a"
},
{
"org": "TTT Corporation (ttt.vn)",
"sector": "other",
"date": "2026-05-06",
"type": "ransomware",
"actor": "Stormous",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "Stormous claimed about 5 TB of design files, contracts, staff records and building security plans, demanded USD 900,000, and posted a full dump on 13 May 2026.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/dHR0LnZuIFRUVCBDb3Jwb3JhdGlvbkBzdG9ybW91cw"
},
{
"name": "ransomware.live (full dump post)",
"url": "https://www.ransomware.live/id/dHR0LnZuIFVQREFURS1GVUxMIERBVEEgRFVNUEBzdG9ybW91cw"
}
],
"checked": "2026-11-07",
"domain": "ttt.vn",
"logo": "ttt.vn",
"actor_ids": [
"stormous"
],
"id": "5b5000a5"
},
{
"org": "Ministry of Health of Vietnam",
"sector": "health",
"date": "2026-05-14",
"type": "data-leak",
"actor": "FEMBOYSec Intelligence Team / KurdFemboys",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "An actor claimed more than 480,000 records of doctors, nurses and medical staff and published a first batch, threatening to sell the rest.",
"sources": [
{
"name": "Hendry Adrian (repost of Dark Web Informer)",
"url": "https://www.hendryadrian.com/?p=101459"
}
],
"checked": "2026-11-07",
"domain": "moh.gov.vn",
"logo": "moh.gov.vn",
"actor_ids": [
"femboysec-intelligence-team-kurdfemboys"
],
"id": "d60c0260"
},
{
"org": "AMACCAO",
"sector": "other",
"date": "2026-05-22",
"type": "ransomware",
"actor": "Nova",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "Nova listed AMACCAO on its leak site on 22 May 2026.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/QU1BQ0NBT0Bub3Zh"
}
],
"checked": "2026-11-07",
"domain": "amaccao.vn",
"logo": "amaccao.vn",
"actor_ids": [
"nova"
],
"id": "808dbd79"
},
{
"org": "Hansoll Textile (Vietnam)",
"sector": "manufacturing",
"date": "2026-06-08",
"type": "ransomware",
"actor": "Payload",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "Payload listed Hansoll Textile's Vietnam operation on its leak site on 8 June 2026.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/SGFuc29sbCBUZXh0aWxlIGluIFZpZXRuYW1AcGF5bG9hZA"
}
],
"checked": "2026-11-07",
"domain": "hansoll.com",
"actor_ids": [
"payload"
],
"id": "e8f01b1a"
},
{
"org": "Hop Long Tech (hoplongtech.com)",
"sector": "other",
"date": "2026-06-12",
"type": "ransomware",
"actor": "ThreeAM",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "ThreeAM listed hoplongtech.com on its leak site on 12 June 2026.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/aG9wbG9uZ3RlY2guY29tQHRocmVlYW0"
}
],
"checked": "2026-11-07",
"domain": "hoplongtech.com",
"logo": "hoplongtech.com",
"actor_ids": [
"threeam"
],
"id": "13422c54"
},
{
"org": "Construction consulting JSC (name garbled on leak site)",
"sector": "property",
"date": "2026-06-15",
"type": "ransomware",
"actor": "Qilin",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "Qilin listed a Vietnamese general construction consulting joint stock company on 15 June 2026; the tracker shows the name with Vietnamese characters stripped.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/Q25nIFR5IENwIFQgVm4gWGQgVG5nIEhwQHFpbGlu"
}
],
"checked": "2026-11-07",
"domain": "nagecco.com",
"logo": "nagecco.com",
"actor_ids": [
"qilin"
],
"id": "81617d12"
},
{
"org": "utb.edu.vn",
"sector": "education",
"date": "2026-06-20",
"type": "ransomware",
"actor": "LockBit 5",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "LockBit 5 listed the higher education institution at utb.edu.vn on 20 June 2026, with an estimated attack date of 15 May 2026.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/dXRiLmVkdS52bkBsb2NrYml0NQ"
}
],
"checked": "2026-11-07",
"domain": "utb.edu.vn",
"logo": "utb.edu.vn",
"actor_ids": [
"lockbit-5-0"
],
"id": "490738f4"
},
{
"org": "Go2Joy (go2joy.vn)",
"sector": "other",
"date": "2026-06-20",
"type": "ransomware",
"actor": "RansomEXX",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "RansomEXX said it released the complete database of the hourly hotel booking platform on 20 June 2026.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/R28ySm95IChnbzJqb3kudm4pQHJhbnNvbWV4eA"
}
],
"checked": "2026-11-07",
"domain": "go2joy.vn",
"actor_ids": [
"ransomexx"
],
"id": "2040678c"
},
{
"org": "Nha Thanh Pho",
"sector": "other",
"date": "2026-06-21",
"type": "ransomware",
"actor": "Nova",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "Nova listed Nha Thanh Pho on its leak site on 21 June 2026.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/TmjDoCBUaMOgbmggUGjhu5FAbm92YQ"
}
],
"checked": "2026-11-07",
"actor_ids": [
"nova"
],
"id": "a863e9f1"
},
{
"org": "Digipro",
"sector": "other",
"date": "2026-07-17",
"type": "ransomware",
"actor": "Nova",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "Nova listed Digipro on its leak site on 17 July 2026.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/RGlnaXByb0Bub3Zh"
}
],
"checked": "2026-11-07",
"domain": "digipro.com.vn",
"logo": "digipro.com.vn",
"actor_ids": [
"nova"
],
"id": "f3ad2350"
},
{
"org": "Vedan Vietnam",
"sector": "manufacturing",
"date": "2026-07-18",
"type": "ransomware",
"actor": "INC Ransom",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "INC Ransom listed Vedan Corp on its leak site on 18 July 2026.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/dmVkYW4gY29ycEBpbmNyYW5zb20"
}
],
"checked": "2026-11-07",
"domain": "vedan.com.vn",
"logo": "vedan.com.vn",
"actor_ids": [
"inc-ransom"
],
"id": "6a9a2ca5"
},
{
"org": "VNSO",
"sector": "other",
"date": "2026-07-22",
"type": "ransomware",
"actor": "Nova",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "Nova listed VNSO on its leak site on 22 July 2026.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/Vk5TT0Bub3Zh"
}
],
"checked": "2026-11-07",
"domain": "vnso.vn",
"logo": "vnso.vn",
"actor_ids": [
"nova"
],
"id": "80439c7c"
},
{
"org": "Geleximco (geleximco.vn)",
"sector": "other",
"date": "2026-08-04",
"type": "ransomware",
"actor": "INC Ransom",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "INC Ransom listed the conglomerate's domain on 4 August 2026 and claimed 200 GB of data.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/aHR0cHM6Ly9nZWxleGltY28udm4vQGluY3JhbnNvbQ"
}
],
"checked": "2026-11-07",
"domain": "geleximco.vn",
"actor_ids": [
"inc-ransom"
],
"id": "2a0a3b44"
},
{
"org": "l-a.com.vn",
"sector": "other",
"date": "2026-08-07",
"type": "ransomware",
"actor": "L Group",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "L Group listed l-a.com.vn on its leak site on 7 August 2026.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/bC1hLmNvbS52bkBMIEdyb3Vw"
}
],
"checked": "2026-11-07",
"domain": "l-a.com.vn",
"logo": "l-a.com.vn",
"actor_ids": [
"l-group"
],
"id": "fc96ff69"
},
{
"org": "EVN Hanoi Power Corporation (EVNHANOI)",
"sector": "energy",
"date": "2026-08-22",
"type": "data-leak",
"actor": "Emperador",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "Emperador claimed over 300 GB including about 13.36 million customer records, 6.99 million subscriptions and 2.26 million account records, offered for sale.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/VmlldG5hbSBFbGVjdHJpY2l0eShFVk5IQU5PSSlAZW1wZXJhZG9y"
},
{
"name": "cyberthreatintelligence.net",
"url": "https://cyberthreatintelligence.net/ransomware-victim/vietnam-electricity-evnhanoi-emperador-2026"
}
],
"checked": "2026-11-07",
"domain": "evnhanoi.vn",
"logo": "evnhanoi.vn",
"actor_ids": [
"emperador"
],
"id": "432437a7"
},
{
"org": "Sanko Vietnam (sankovn.com)",
"sector": "manufacturing",
"date": "2026-08-26",
"type": "ransomware",
"actor": "Krybit",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "Krybit listed sankovn.com on its leak site on 26 August 2026.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/d3d3LnNhbmtvdm4uY29tQGtyeWJpdA"
}
],
"checked": "2026-11-07",
"domain": "sankovn.com",
"logo": "sankovn.com",
"actor_ids": [
"krybit"
],
"id": "d62a3169"
},
{
"org": "FE CREDIT",
"sector": "finance",
"date": "2026-08-30",
"type": "data-leak",
"actor": "Black X",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "Black X said it obtained personal information of millions of FE CREDIT customers and threatened to leak it unless contacted (estimated attack 28 August 2026).",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/RkUgQ1JFRElUQEJsYWNrIFg"
},
{
"name": "Darkfield",
"url": "https://darkfield.orizon.one/victims/24f405e8-ca66-46e5-bd2d-97aa1c902f23"
}
],
"checked": "2026-11-07",
"domain": "fecredit.com.vn",
"logo": "fecredit.com.vn",
"actor_ids": [
"black-x"
],
"id": "9dee569a"
},
{
"org": "BeLi Teacher / FSC education centers",
"sector": "education",
"date": "2026-09-18",
"type": "data-leak",
"actor": "N0n",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "N0n posted data it said came from the AWS environment of BeLi Teacher and FSC education centers on 18 September 2026.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/QmVMaSBUZWFjaGVyIC8gRlNDIGVkdWNhdGlvbiBjZW50ZXJzIChBV1MpQE4wbg"
}
],
"checked": "2026-11-07",
"actor_ids": [
"n0n"
],
"id": "94504e3a"
},
{
"org": "GC789 betting network (Boundless TE)",
"sector": "other",
"date": "2026-09-18",
"type": "data-leak",
"actor": "N0n",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "N0n listed a Vietnamese betting operator it named as the GC789 network on 18 September 2026.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/VmlldG5hbWVzZSBiZXR0aW5nIG9wZXJhdG9yIChHQzc4OSBuZXR3b3JrIC8gQm91bmRsZXNzIFRFKUBOMG4"
}
],
"checked": "2026-11-07",
"actor_ids": [
"n0n"
],
"id": "cc05aa1f"
},
{
"org": "Ministry of Foreign Affairs (sso-ingo.mofa.gov.vn)",
"sector": "government",
"date": "2026-09-21",
"type": "intrusion",
"actor": "Unattributed operator (Singapore-hosted infrastructure)",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "Researchers found an exposed attacker toolkit, captured 21 September 2026, with a realm-admin token for the MOFA Keycloak sign-on server plus attempted attacks on Ministry of Public Security mail and a Ministry of Construction portal.",
"sources": [
{
"name": "InfraHunter",
"url": "https://www.infrahunter.com/research/inside-attacker-toolkit-targeting-vietnam-government-networks"
}
],
"checked": "2026-11-07",
"domain": "mofa.gov.vn",
"actor_ids": [
"unattributed-operator"
],
"id": "3353fb64"
},
{
"org": "dangvuongcac",
"sector": "other",
"date": "2026-10-21",
"type": "ransomware",
"actor": "Hyflock",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "Hyflock listed dangvuongcac on its leak site on 21 October 2026.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/ZGFuZ3Z1b25nY2FjQEhZRkxPQ0s"
}
],
"checked": "2026-11-07",
"actor_ids": [
"hyflock"
],
"id": "8f6c7095"
},
{
"org": "ZipAI (zipai.vn)",
"sector": "other",
"date": "2026-11-05",
"type": "ransomware",
"actor": "Vexy",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "Vexy Ransomware listed the Vietnamese AI image and voice service on 5 November 2026.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/WmlwQUlAVmV4eSBSYW5zb213YXJl"
}
],
"checked": "2026-11-07",
"domain": "zipai.vn",
"actor_ids": [
"vexy"
],
"id": "722d2ded"
},
{
"org": "Unidentified APIS passenger database (Viettel-hosted, Hanoi)",
"sector": "transport",
"date": "2026-06-03",
"type": "data-leak",
"actor": "None (misconfiguration)",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "Kinryu Labs researchers found an open Elasticsearch cluster holding about 220.8 million passenger and crew records from 2017 to April 2026, reported it on 3 June and saw it closed on 8 June; no operator has been named.",
"sources": [
{
"name": "eSecurity Planet",
"url": "https://www.esecurityplanet.com/threats/news-220-million-travel-records-default-credentials-apac-vietnam/"
}
],
"checked": "2026-11-07",
"actor_ids": [
"none"
],
"id": "e5db1703"
}
],
"slug": "vietnam",
"title": "Vietnam Cyber Incidents and Data Breaches 2026 · pwnsy",
"lede": "No public threat level. 5 incidents confirmed, 34 claims in 2026.",
"h1": "![\"\"](\"/tools/cyber-watch/flags/vn.svg\")
Vietnam Cyber Watch",
"desc": "Vietnam cyber threat level: none published. 5 incidents confirmed and 34 claims in 2026, each sourced. Updated 7 Nov 2026.",
"since": "2026-01-01",
"stats": [
{
"label": "Cyberattacks on information systems, including critical national systems",
"value": "more than 500,000",
"period": "2025",
"source": {
"name": "Tuoi Tre (Col. Nguyen Ba Son, A05)",
"url": "https://tuoitre.vn/gan-19-trieu-tai-khoan-ngan-hang-cua-nguoi-viet-van-dung-mat-khau-don-gian-nhu-123456-100261106185812843.htm"
}
},
{
"label": "Online fraud cases taking property, with losses in the thousands of billions of VND",
"value": "nearly 1,000",
"period": "H1 2026",
"source": {
"name": "Tuoi Tre (Col. Nguyen Ba Son, A05)",
"url": "https://tuoitre.vn/gan-19-trieu-tai-khoan-ngan-hang-cua-nguoi-viet-van-dung-mat-khau-don-gian-nhu-123456-100261106185812843.htm"
}
},
{
"label": "Data leak, loss and illegal data trading cases detected and handled by police",
"value": "40",
"period": "H1 2026",
"source": {
"name": "Cong An TP.HCM (A05 report)",
"url": "https://congan.com.vn/vu-an/triet-pha-nhieu-vu-mua-ban-du-lieu-trai-phep_198051.html"
}
},
{
"label": "Bank accounts, e-wallets and payment intermediary accounts flagged for signs of unlawful activity by the SBV monitoring system",
"value": "more than 668,000",
"period": "as of 6 November 2026",
"source": {
"name": "Dan Tri (Col. Nguyen Ba Son, A05)",
"url": "https://dantri.com.vn/kinh-doanh/hon-668000-tai-khoan-thanh-toan-co-dau-hieu-vi-pham-phap-luat-can-lam-gi-20261107142442193.htm"
}
},
{
"label": "Customer files biometrically matched against chip ID or VNeID (100% of accounts with digital transactions)",
"value": "more than 178 million",
"period": "as of 2 October 2026",
"source": {
"name": "Sai Gon Giai Phong (SBV)",
"url": "https://www.sggp.org.vn/ngan-lua-dao-thoi-ai-them-la-chan-tang-canh-giac-post880459.html"
}
},
{
"label": "Individual and organisational customer files biometrically matched",
"value": "162.9 million individual, 2.6 million organisational",
"period": "H1 2026 (reported 2 July 2026)",
"source": {
"name": "Vietstock (SBV IT Department)",
"url": "https://vietstock.vn/2026/07/nhnn-100-tai-khoan-giao-dich-so-da-xac-thuc-sinh-trac-hoc-chan-dung-hon-5200-ty-dong-lua-dao-757-1461413.htm"
}
},
{
"label": "SIMO fraud alerts sent; customers who paused or cancelled; value of those transactions",
"value": "5.8 million alerts; about 1.9 million customers; nearly VND 7,200 billion",
"period": "first year of SIMO operation (reported 7 November 2026)",
"source": {
"name": "Sai Gon Giai Phong (SBV)",
"url": "https://www.sggp.org.vn/ngan-lua-dao-thoi-ai-them-la-chan-tang-canh-giac-post880459.html"
}
},
{
"label": "SIMO247 warnings; customers who paused or cancelled; transaction value",
"value": "about 4.6 million; over 1.5 million; over VND 5,200 billion",
"period": "as of 29 June 2026",
"source": {
"name": "Vietstock (SBV IT Department)",
"url": "https://vietstock.vn/2026/07/nhnn-100-tai-khoan-giao-dich-so-da-xac-thuc-sinh-trac-hoc-chan-dung-hon-5200-ty-dong-lua-dao-757-1461413.htm"
}
},
{
"label": "Change in fraud cases",
"value": "down 52%",
"period": "2025 vs 2024",
"source": {
"name": "VTV (C06, Ministry of Public Security)",
"url": "https://vtv.vn/so-vu-lua-dao-giam-52-nho-xac-thuc-sinh-trac-hoc-100261007193308883.htm"
}
},
{
"label": "Accounts with fraud signs frozen from VNeID reports",
"value": "more than 400",
"period": "June to October 2026",
"source": {
"name": "VTV (C06, Ministry of Public Security)",
"url": "https://vtv.vn/so-vu-lua-dao-giam-52-nho-xac-thuc-sinh-trac-hoc-100261007193308883.htm"
}
},
{
"label": "Personal customer records cleaned through MPS and SBV coordination",
"value": "over 107.9 million",
"period": "cumulative to October 2026",
"source": {
"name": "VTV (C06, Ministry of Public Security)",
"url": "https://vtv.vn/so-vu-lua-dao-giam-52-nho-xac-thuc-sinh-trac-hoc-100261007193308883.htm"
}
},
{
"label": "Ransomware incidents in Vietnam (vendor figure)",
"value": "5 in Q1, 11 in Q2, 15 in Q3",
"period": "Q1 to Q3 2026",
"source": {
"name": "Thanh Nien Viet (Viettel Cyber Security report)",
"url": "https://thanhnienviet.vn/an-ninh-mang-viet-nam-quy-iii-2026-tan-cong-da-dien-rui-ro-ngay-cang-phuc-tap-209261104153315304.htm"
}
},
{
"label": "DDoS attacks recorded by Viettel Anti-DDoS (vendor figure); largest 4.01 Tbps",
"value": "1,958,124",
"period": "Q3 2026",
"source": {
"name": "IPSIP (Viettel Threat Intelligence)",
"url": "https://www.ipsip.vn/en/post/vietnam-cybersecurity-landscape-q3-2026-ddos-surges-ransomware-escalates"
}
},
{
"label": "Publicly leaked data incidents and compromised user records (vendor figure)",
"value": "536 incidents; over 316 million records",
"period": "H1 2026",
"source": {
"name": "CafeF (VNPT Cyber Immunity)",
"url": "https://cafef.vn/so-vu-lo-lot-du-lieu-giam-khong-dong-nghia-muc-do-rui-ro-giam-188260831172601399.chn"
}
}
],
"rules": [
{
"date": "2026-01-01",
"title": "Personal Data Protection Law 2025 in force",
"what": "The Personal Data Protection Law passed on 26 June 2025 took effect, putting personal data rules into a full statute for the first time.",
"url": "https://luatvietan.vn/diem-moi-cua-nghi-dinh-356-2025-so-voi-nghi-dinh-13-2023-ve-huong-dan-bao-ve-du-lieu-ca-nhan.html"
},
{
"date": "2026-01-01",
"title": "Decree 356/2025/ND-CP replaces Decree 13/2023",
"what": "The decree guiding the Personal Data Protection Law took effect and replaced Decree 13/2023 on personal data protection.",
"url": "https://luatvietan.vn/diem-moi-cua-nghi-dinh-356-2025-so-voi-nghi-dinh-13-2023-ve-huong-dan-bao-ve-du-lieu-ca-nhan.html"
},
{
"date": "2026-01-05",
"title": "SBV Circular 45/2025/TT-NHNN on card issuance",
"what": "Card issuers must verify biometrics face to face before a bank card can be used for electronic transactions, and credit card cash withdrawals are capped at VND 100 million a month.",
"url": "https://htv.vn/doanhnhansaigon/tu-2026-bat-buoc-xac-thuc-sinh-trac-hoc-khi-mo-the-ngan-hang-329436.html"
},
{
"date": "2026-03-01",
"title": "SBV Circular 77/2025/TT-NHNN app security rules",
"what": "Banking apps must stop and tell the customer why when they detect debugging, emulators, hooking, repackaging, rooted or jailbroken devices.",
"url": "https://thitruongtaichinhtiente.vn/cac-ngan-hang-thong-bao-ngung-cung-cap-dich-vu-truc-tuyen-tren-cac-thiet-bi-di-dong-co-dau-hieu-rui-ro-bao-mat-tu-ngay-1-3-2026-78009.html"
},
{
"date": "2026-07-01",
"title": "SBV Circular 77/2025/TT-NHNN biometric rules for business accounts",
"what": "High-value or above-threshold online transactions by companies require stronger authentication such as face verification of the legal representative.",
"url": "https://nguoiquansat.vn/tu-1-7-nhieu-giao-dich-ngan-hang-cua-doanh-nghiep-phai-xac-thuc-sinh-trac-hoc-300141.html"
},
{
"date": "2026-07-01",
"title": "Cybersecurity Law 2025 (No. 116/2025/QH15) in force",
"what": "The consolidated Cybersecurity Law took effect and the 2018 Cybersecurity Law ceased to apply; it adds data security as a legal concept, 24-hour takedown duties and a ban on AI deepfake impersonation.",
"url": "https://hethongphapluat.com/luat-an-ninh-mang-2025/dieu-44"
},
{
"date": "2026-08-19",
"title": "Decree 330/2026/ND-CP on cybersecurity and personal data penalties",
"what": "Administrative fines took effect on issue with no transition period, including VND 30 to 50 million for processing data without consent and VND 50 to 70 million for continuing after an objection.",
"url": "https://vov.vn/chinh-tri/tu-1982026-tu-y-thu-thap-xu-ly-du-lieu-ca-nhan-bi-phat-toi-70-trieu-dong-post1326424.vov"
},
{
"date": "2026-10-30",
"title": "State Securities Commission cybersecurity dispatch",
"what": "The SSC told securities and fund management firms to prepare incident plans, reset all passwords, review logs and remote access, and flag large or out-of-hours transfers.",
"url": "https://cafef.vn/uy-ban-chung-khoan-yeu-cau-cong-ty-chung-khoan-ra-soat-tang-cuong-an-ninh-mang-188261103222147325.chn"
},
{
"date": "2026-11-07",
"title": "Planned 24-hour delay on first-time transfers (from early 2027)",
"what": "SBV officials said banks will from early 2027 let customers set their own limits and hold transfers to a first-time payee for at least 24 hours.",
"url": "https://www.sggp.org.vn/ngan-lua-dao-thoi-ai-them-la-chan-tang-canh-giac-post880459.html"
}
],
"actors": [
{
"name": "Qilin",
"kind": "ransomware",
"seen": "Listed Vietnam Airlines in January 2026 and a Vietnamese construction consultancy in June 2026; Viettel names it among double-extortion groups hitting Vietnam in Q3.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/VmlldG5hbSBBaXJsaW5lc0BxaWxpbg"
},
{
"name": "Thanh Nien Viet",
"url": "https://thanhnienviet.vn/an-ninh-mang-viet-nam-quy-iii-2026-tan-cong-da-dien-rui-ro-ngay-cang-phuc-tap-209261104153315304.htm"
}
],
"actor_id": "qilin"
},
{
"name": "The Gentlemen",
"kind": "ransomware",
"seen": "Listed SASI JSC in January and a Vietnamese firm in June 2026, besides the tracked FPT Software and VUS claims.",
"sources": [
{
"name": "ransomware.live Vietnam map",
"url": "https://www.ransomware.live/map/VN"
}
],
"actor_id": "the-gentlemen"
},
{
"name": "Nova",
"kind": "ransomware",
"seen": "Listed four Vietnamese organisations between May and July 2026: AMACCAO, Nha Thanh Pho, Digipro and VNSO.",
"sources": [
{
"name": "ransomware.live Vietnam map",
"url": "https://www.ransomware.live/map/VN"
}
],
"actor_id": "nova"
},
{
"name": "INC Ransom",
"kind": "ransomware",
"seen": "Listed Vedan in July and Geleximco in August 2026.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/aHR0cHM6Ly9nZWxleGltY28udm4vQGluY3JhbnNvbQ"
}
],
"actor_id": "inc-ransom"
},
{
"name": "N0n",
"kind": "extortion",
"seen": "Posted data from BeLi Teacher, FSC education centers and the GC789 betting network in September 2026, besides the tracked Nam Dinh Vu Port claim.",
"sources": [
{
"name": "ransomware.live Vietnam map",
"url": "https://www.ransomware.live/map/VN"
}
],
"actor_id": "n0n"
},
{
"name": "Vexy",
"kind": "ransomware",
"seen": "Listed ZipAI on 5 November 2026 after the tracked Quy Nhon University claim.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/WmlwQUlAVmV4eSBSYW5zb213YXJl"
}
],
"actor_id": "vexy"
},
{
"name": "Emperador",
"kind": "extortion",
"seen": "Claimed EVN Hanoi customer data and offered it for sale in August 2026.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/VmlldG5hbSBFbGVjdHJpY2l0eShFVk5IQU5PSSlAZW1wZXJhZG9y"
}
],
"actor_id": "emperador"
},
{
"name": "Black X",
"kind": "extortion",
"seen": "Claimed millions of FE CREDIT customer records in August 2026.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/RkUgQ1JFRElUQEJsYWNrIFg"
}
],
"actor_id": "black-x"
},
{
"name": "Coinbase Cartel",
"kind": "extortion",
"seen": "Data-theft group without an encryptor that listed Pacific Airlines in January 2026.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/UGFjaWZpYyBBaXJsaW5lc0Bjb2luYmFzZWNhcnRlbA"
}
],
"actor_id": "coinbase-cartel"
},
{
"name": "Stormous",
"kind": "extortion",
"seen": "Claimed 5 TB from TTT Corporation in May 2026 and posted a full dump.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/dHR0LnZuIFRUVCBDb3Jwb3JhdGlvbkBzdG9ybW91cw"
}
],
"actor_id": "stormous"
},
{
"name": "FEMBOYSec Intelligence Team / KurdFemboys",
"kind": "hacktivist",
"seen": "Claimed 480,000 Ministry of Health staff records in May 2026.",
"sources": [
{
"name": "Hendry Adrian (Dark Web Informer repost)",
"url": "https://www.hendryadrian.com/?p=101459"
}
],
"actor_id": "femboysec-intelligence-team-kurdfemboys"
},
{
"name": "Mustang Panda",
"kind": "state",
"seen": "Viettel Threat Intelligence ranked it the most prevalent APT group tracked against Vietnam in Q3 2026, at 72.3% relative prevalence.",
"sources": [
{
"name": "IPSIP (Viettel Threat Intelligence)",
"url": "https://www.ipsip.vn/en/post/vietnam-cybersecurity-landscape-q3-2026-ddos-surges-ransomware-escalates"
}
]
},
{
"name": "PXA Stealer ring",
"kind": "scam-syndicate",
"seen": "Vietnamese operators charged in Thanh Hoa in March 2026 for infostealer malware that hit more than 94,000 computers abroad.",
"sources": [
{
"name": "Tuoi Tre",
"url": "https://tuoitre.vn/plo/thanh-hoa-pha-duong-day-phat-tan-ma-doc-danh-cap-du-lieu-94000-may-tinh-tren-toan-cau-post900947.html"
}
]
},
{
"name": "Unattributed MOFA intrusion operator",
"kind": "unknown",
"seen": "Operator whose exposed toolkit showed admin access to the Ministry of Foreign Affairs sign-on server and probes of MPS and Ministry of Construction systems in September 2026.",
"sources": [
{
"name": "InfraHunter",
"url": "https://www.infrahunter.com/research/inside-attacker-toolkit-targeting-vietnam-government-networks"
}
]
}
],
"region": "Southeast Asia",
"upd": "2026-11-07"
},
"IL": {
"name": "Israel",
"subject": "Israel",
"region": "Middle East and Africa",
"posture": {
"level": "",
"summary": "The INCD publishes no public cyber threat level and signals threat through statements by its director general Yossi Karadi and warnings to the public.",
"agency": "Israel National Cyber Directorate (INCD)",
"source": {
"name": "Al-Monitor (Reuters)",
"url": "https://www.al-monitor.com/originals/2026/06/iran-cyberattacks-israel-surged-2026-israeli-cyber-chief-says"
},
"checked": "2026-11-07"
},
"timeline": [
{
"date": "2026-03-24",
"text": "INCD head Yossi Karadi said Iran had not infiltrated or disrupted energy grids, banks or hospitals, and noted Israel has not yet passed a cyber law.",
"url": "https://www.jpost.com/israel-news/defense-news/article-891024",
"src": "Jerusalem Post"
},
{
"date": "2026-05-12",
"text": "The INCD warned of a broad influence operation using threatening text messages and told recipients not to reply, click links or forward them.",
"url": "https://www.ynetnews.com/tech-and-digital/article/s1igpbeyfx",
"src": "Ynet"
},
{
"date": "2026-06-29",
"text": "Karadi told Die Welt that hostile cyber incidents rose to about 4,800 in June 2026 and that attacks on critical infrastructure had been fended off.",
"url": "https://www.al-monitor.com/originals/2026/06/iran-cyberattacks-israel-surged-2026-israeli-cyber-chief-says",
"src": "Al-Monitor (Reuters)"
},
{
"date": "2026-10-02",
"text": "Commenting on Microsoft's Digital Defense Report, Karadi said Israel keeps operational continuity under this scale of threats and that there is no ceasefire in cyber.",
"url": "https://www.ynetnews.com/tech-and-digital/article/syucjr3qfe",
"src": "Ynet"
}
],
"incidents": [
{
"org": "More than 50 small Israeli companies",
"sector": "other",
"date": "2026-03-24",
"type": "intrusion",
"actor": "Iran-linked groups",
"status": "confirmed",
"vendor": false,
"confirmed": "INCD head Yossi Karadi said Iran-linked hackers destroyed the data of more than 50 small Israeli companies in the weeks after the war began, and most have restored operations.",
"claimed": "",
"sources": [
{
"name": "Insurance Journal (Bloomberg)",
"url": "https://www.insurancejournal.com/news/international/2026/03/25/863254.htm"
},
{
"name": "Jerusalem Post",
"url": "https://www.jpost.com/israel-news/defense-news/article-891024"
}
],
"checked": "2026-11-07",
"actor_ids": [],
"id": "368768ae"
},
{
"org": "Israeli public and residential security cameras",
"sector": "other",
"date": "2026-03-24",
"type": "intrusion",
"actor": "Iran-linked groups",
"status": "confirmed",
"vendor": false,
"confirmed": "Karadi said about 50 public cameras were hacked in three weeks and the INCD helped block 50 attempts, mostly on poorly secured residential cameras.",
"claimed": "",
"sources": [
{
"name": "Insurance Journal (Bloomberg)",
"url": "https://www.insurancejournal.com/news/international/2026/03/25/863254.htm"
},
{
"name": "Jerusalem Post",
"url": "https://www.jpost.com/israel-news/defense-news/article-891024"
}
],
"checked": "2026-11-07",
"actor_ids": [],
"id": "82dd0097"
},
{
"org": "Israel Railways",
"sector": "transport",
"date": "2026-03-11",
"type": "defacement",
"actor": "",
"status": "confirmed",
"vendor": false,
"confirmed": "Karadi said hackers took over Israel Railways monitors at a couple of locations and broadcast false messages to cause panic.",
"claimed": "",
"sources": [
{
"name": "Jerusalem Post",
"url": "https://www.jpost.com/israel-news/defense-news/article-891024"
}
],
"checked": "2026-11-07",
"domain": "rail.co.il",
"logo": "rail.co.il",
"actor_ids": [],
"id": "03e34e96"
},
{
"org": "Israeli public (mass text messages)",
"sector": "other",
"date": "2026-05-12",
"type": "other",
"actor": "Attributed to Iran by ynet",
"status": "confirmed",
"vendor": false,
"confirmed": "The INCD said it identified a broad influence operation of threatening text messages sent to thousands of Israelis and told recipients not to reply or click links.",
"claimed": "",
"sources": [
{
"name": "Ynet",
"url": "https://www.ynetnews.com/tech-and-digital/article/s1igpbeyfx"
}
],
"checked": "2026-11-07",
"actor_ids": [
"attributed-to-iran-by-ynet"
],
"id": "5e3bf0d9"
},
{
"org": "Clalit Health Services",
"sector": "health",
"date": "2026-02-25",
"type": "data-leak",
"actor": "Handala",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "Handala said it breached Israel's largest healthcare network and released medical information on more than 10,000 patients.",
"sources": [
{
"name": "Times of Israel",
"url": "https://www.timesofisrael.com/iran-linked-hacker-group-claims-to-breach-data-of-israels-largest-healthcare-network/amp/"
}
],
"checked": "2026-11-07",
"domain": "clalit.co.il",
"logo": "clalit.co.il",
"actor_ids": [
"handala"
],
"id": "d353b2d7"
},
{
"org": "Unnamed Israeli food plant (refrigeration controls)",
"sector": "manufacturing",
"date": "2026-11-07",
"type": "intrusion",
"actor": "Cyber Isnaad Front",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "Israeli security firm Profero says attackers changed cold room controls in May, destroyed three compressors and planted wiper malware, and attributes the attack to Cyber Isnaad Front, which it links to the IRGC. No official confirmation was reported.",
"sources": [
{
"name": "Ynet",
"url": "https://www.ynetnews.com/tech-and-digital/article/hy0dwqnamg"
}
],
"checked": "2026-11-07",
"actor_ids": [
"cyber-isnaad-front"
],
"id": "cc341ede"
}
],
"since": "2026-01-01",
"stats": [
{
"label": "Hostile cyber incidents logged by the INCD",
"value": "about 4,800",
"period": "June 2026 (about 1,600 in June 2025)",
"source": {
"name": "Al-Monitor (Reuters)",
"url": "https://www.al-monitor.com/originals/2026/06/iran-cyberattacks-israel-surged-2026-israeli-cyber-chief-says"
}
},
{
"label": "Calls to the INCD emergency line",
"value": "4,019",
"period": "War period to 24 March 2026",
"source": {
"name": "Jerusalem Post",
"url": "https://www.jpost.com/israel-news/defense-news/article-891024"
}
},
{
"label": "Average INCD intervention time",
"value": "about 30 minutes (down from 6 hours 13 minutes)",
"period": "As of 24 March 2026",
"source": {
"name": "Jerusalem Post",
"url": "https://www.jpost.com/israel-news/defense-news/article-891024"
}
}
],
"rules": [],
"actors": [
{
"name": "Handala",
"kind": "state",
"seen": "Claimed the Clalit Health Services breach and leaks of former officials' data in 2026. The FBI has linked the persona to Iranian intelligence.",
"sources": [
{
"name": "Times of Israel",
"url": "https://www.timesofisrael.com/iran-linked-hacker-group-claims-to-breach-data-of-israels-largest-healthcare-network/amp/"
},
{
"name": "Insurance Journal (Bloomberg)",
"url": "https://www.insurancejournal.com/news/international/2026/03/25/863254.htm"
}
],
"actor_id": "handala"
},
{
"name": "Cyber Isnaad Front",
"kind": "state",
"seen": "Profero attributes a 2026 sabotage of an Israeli food plant's refrigeration controls to this group and links it to the IRGC.",
"sources": [
{
"name": "Ynet",
"url": "https://www.ynetnews.com/tech-and-digital/article/hy0dwqnamg"
}
],
"actor_id": "cyber-isnaad-front"
}
],
"slug": "israel",
"title": "Israel Cyber Incidents and Data Breaches 2026 · pwnsy",
"lede": "No public threat level. 4 incidents confirmed, 2 claims in 2026.",
"h1": "![\"\"](\"/tools/cyber-watch/flags/il.svg\")
Israel Cyber Watch",
"desc": "Israel cyber threat level: none published. 4 incidents confirmed and 2 claims in 2026, each sourced. Updated 7 Nov 2026.",
"upd": "2026-11-07"
},
"IR": {
"name": "Iran",
"subject": "Iran",
"region": "Middle East and Africa",
"posture": {
"level": "",
"summary": "Iran publishes no cyber threat level; it signals threat through state media statements and by cutting public internet access, as in the near total blackout from 28 February 2026.",
"agency": "Supreme Council of Cyberspace",
"source": {
"name": "The Guardian",
"url": "https://www.theguardian.com/technology/2026/apr/06/iran-internet-blackout-is-longest-national-shutdown-since-arab-spring"
},
"checked": "2026-11-07"
},
"timeline": [
{
"date": "2026-03-22",
"text": "Iran's energy minister, quoted by ISNA, accused the US and Israel of attacking electricity and water facilities.",
"url": "https://www.insurancejournal.com/news/international/2026/03/25/863254.htm",
"src": "Insurance Journal (Bloomberg)"
},
{
"date": "2026-05-25",
"text": "President Pezeshkian ordered the reopening of international internet access.",
"url": "https://www.thehindu.com/news/international/irans-president-orders-reopening-of-international-internet-access-state-media-reports/article71022650.ece",
"src": "The Hindu"
},
{
"date": "2026-06-14",
"text": "The banking coordination council said an attack on shared communications infrastructure temporarily affected services at four state banks.",
"url": "https://www.arabnews.pk/node/2647107/middle-east",
"src": "Arab News (AFP)"
}
],
"incidents": [
{
"org": "Nationwide internet and phone networks",
"sector": "telecom",
"date": "2026-01-08",
"type": "other",
"actor": "Iranian government",
"status": "confirmed",
"vendor": false,
"confirmed": "Monitors including NetBlocks recorded a nationwide blackout during protests, and Communications Minister Sattar Hashemi acknowledged it was costing the economy $35.7 million a day.",
"claimed": "",
"sources": [
{
"name": "New York Times",
"url": "https://www.nytimes.com/2026/01/08/world/middleeast/iran-protests-internet-shutdown.html"
},
{
"name": "IranWire",
"url": "https://iranwire.com/en/news/148305-357-million-a-day-the-hidden-cost-of-irans-internet-blackout/"
}
],
"checked": "2026-11-07",
"actor_ids": [],
"id": "714b1a9b"
},
{
"org": "Nationwide internet access",
"sector": "telecom",
"date": "2026-02-28",
"type": "other",
"actor": "Iranian government",
"status": "confirmed",
"vendor": false,
"confirmed": "After the Israeli and US strikes, NetBlocks reported connectivity falling to 4% of ordinary levels, and the shutdown ran until President Pezeshkian ordered access reopened on 25 May.",
"claimed": "",
"sources": [
{
"name": "NetBlocks",
"url": "https://mastodon.social/@netblocks/116147264437940657"
},
{
"name": "The Hindu",
"url": "https://www.thehindu.com/news/international/irans-president-orders-reopening-of-international-internet-access-state-media-reports/article71022650.ece"
}
],
"checked": "2026-11-07",
"actor_ids": [],
"id": "292ecae4"
},
{
"org": "Bank Melli and Bank Sepah",
"sector": "finance",
"date": "2026-03-10",
"type": "other",
"actor": "",
"status": "confirmed",
"vendor": false,
"confirmed": "IRGC-linked Fars and Tasnim reported outages of Bank Sepah mobile services and Bank Melli ATMs, and Bank Melli said fixes were underway; authorities did not say whether a cyberattack caused them.",
"claimed": "",
"sources": [
{
"name": "Jerusalem Post",
"url": "https://www.jpost.com/middle-east/iran-news/article-889474"
}
],
"checked": "2026-11-07",
"actor_ids": [],
"id": "10ad4b38"
},
{
"org": "Bank Melli, Bank Tejarat, Bank Saderat and Export Development Bank of Iran",
"sector": "finance",
"date": "2026-06-13",
"type": "intrusion",
"actor": "",
"status": "confirmed",
"vendor": false,
"confirmed": "Iran's banking coordination council said via state media that an attack on shared communications infrastructure temporarily affected some services at four banks and that no customer data was accessed or erased.",
"claimed": "",
"sources": [
{
"name": "Arab News (AFP)",
"url": "https://www.arabnews.pk/node/2647107/middle-east"
},
{
"name": "Iran International",
"url": "https://www.iranintl.com/en/202606136049"
}
],
"checked": "2026-11-07",
"actor_ids": [],
"id": "ee97a192"
}
],
"since": "2026-01-01",
"stats": [
{
"label": "Daily economic cost of the internet shutdown",
"value": "$35.7 million",
"period": "Reported 28 January 2026 (Communications Minister)",
"source": {
"name": "IranWire",
"url": "https://iranwire.com/en/news/148305-357-million-a-day-the-hidden-cost-of-irans-internet-blackout/"
}
},
{
"label": "Internet connectivity after the strikes",
"value": "4% of ordinary levels",
"period": "28 February 2026 (NetBlocks measurement)",
"source": {
"name": "NetBlocks",
"url": "https://mastodon.social/@netblocks/116147264437940657"
}
}
],
"rules": [
{
"date": "2026-05-25",
"title": "Presidential order to reopen international internet access",
"what": "President Masoud Pezeshkian ordered international internet access restored after a shutdown of almost three months; access returned partially with restrictions.",
"url": "https://www.thehindu.com/news/international/irans-president-orders-reopening-of-international-internet-access-state-media-reports/article71022650.ece"
}
],
"actors": [],
"slug": "iran",
"title": "Iran Cyber Incidents and Data Breaches 2026 · pwnsy",
"lede": "No public threat level. 4 incidents confirmed, 0 claims in 2026.",
"h1": "![\"\"](\"/tools/cyber-watch/flags/ir.svg\")
Iran Cyber Watch",
"desc": "Iran cyber threat level: none published. 4 incidents confirmed and 0 claims in 2026, each sourced. Updated 7 Nov 2026.",
"upd": "2026-11-07"
},
"AE": {
"name": "United Arab Emirates",
"subject": "The United Arab Emirates",
"region": "Middle East and Africa",
"posture": {
"level": "",
"summary": "The council publishes no threat level and signals threat by announcing foiled attacks and daily attack attempt counts.",
"agency": "UAE Cyber Security Council",
"source": {
"name": "The National",
"url": "https://www.thenationalnews.com/news/uae/2026/02/22/uae-foils-ai-powered-terrorist-cyberattacks-on-vital-sectors"
},
"checked": "2026-11-07"
},
"timeline": [
{
"date": "2026-02-21",
"text": "The Cyber Security Council said it thwarted organised cyberattacks of a terrorist nature aimed at disrupting essential services, built with AI tools.",
"url": "https://en.aletihad.ae/news/uae/4646467/javasxript:",
"src": "Aletihad"
},
{
"date": "2026-07-03",
"text": "The council said it thwarted attacks on several financial sector entities and urged entities to report suspicious activity through official channels.",
"url": "https://www.khaleejtimes.com/uae/foils-cyberattacks-entities-financial-sector",
"src": "Khaleej Times"
},
{
"date": "2026-09-16",
"text": "Council head Mohamed Al Kuwaiti told CNN the IRGC was behind many attacks on the UAE and that AI has accelerated cyberattacks.",
"url": "https://www.thenationalnews.com/news/uae/2026/09/16/irans-irgc-behind-many-cyberattacks-on-uae-says-security-chief/",
"src": "The National"
}
],
"incidents": [
{
"org": "UAE digital infrastructure and vital sectors",
"sector": "government",
"date": "2026-02-21",
"type": "intrusion",
"actor": "",
"status": "confirmed",
"vendor": false,
"confirmed": "The UAE Cyber Security Council said it thwarted organised attacks of a terrorist nature that used network intrusion attempts, ransomware and phishing against national platforms.",
"claimed": "",
"sources": [
{
"name": "Aletihad",
"url": "https://en.aletihad.ae/news/uae/4646467/javasxript:"
},
{
"name": "The National",
"url": "https://www.thenationalnews.com/news/uae/2026/02/22/uae-foils-ai-powered-terrorist-cyberattacks-on-vital-sectors"
}
],
"checked": "2026-11-07",
"actor_ids": [],
"id": "80f65b70"
},
{
"org": "Several UAE financial sector entities",
"sector": "finance",
"date": "2026-07-03",
"type": "intrusion",
"actor": "",
"status": "confirmed",
"vendor": false,
"confirmed": "The council said it thwarted sophisticated cyberattacks on several financial sector entities and kept financial services running.",
"claimed": "",
"sources": [
{
"name": "Khaleej Times",
"url": "https://www.khaleejtimes.com/uae/foils-cyberattacks-entities-financial-sector"
}
],
"checked": "2026-11-07",
"actor_ids": [],
"id": "011f13d8"
},
{
"org": "UAE aviation, energy and education sectors",
"sector": "other",
"date": "2026-09-16",
"type": "intrusion",
"actor": "",
"status": "confirmed",
"vendor": false,
"confirmed": "The council said national teams detected and contained advanced, organised attacks on the aviation, energy and education sectors in August 2026 before they disrupted vital systems.",
"claimed": "",
"sources": [
{
"name": "The National",
"url": "https://www.thenationalnews.com/news/uae/2026/09/16/irans-irgc-behind-many-cyberattacks-on-uae-says-security-chief/"
}
],
"checked": "2026-11-07",
"actor_ids": [],
"id": "9d5df863"
},
{
"org": "Abu Dhabi Finance Week",
"sector": "finance",
"date": "2026-02-17",
"type": "data-leak",
"actor": "",
"status": "confirmed",
"vendor": true,
"confirmed": "More than 700 passport and ID scans of conference attendees sat on an unprotected cloud server. ADFW blamed a vulnerability in a third-party vendor-managed storage environment and said it was secured once identified.",
"claimed": "",
"sources": [
{
"name": "Middle East Eye",
"url": "https://www.middleeasteye.net/news/business-executives-and-politicians-exposed-abu-dhabi-data-leak-report"
}
],
"checked": "2026-11-08",
"domain": "",
"actor_ids": [],
"id": "c0556c3f"
},
{
"org": "Sharjah National Oil Corporation",
"sector": "energy",
"date": "2026-03-03",
"type": "intrusion",
"actor": "Handala",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "Handala posted the company on its leak site and claimed to have taken 1.3 TB of financial data, oil contracts and project files.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/U2hhcmphaCBOYXRpb25hbCBPaWwgQ29ycG9yYXRpb25AaGFuZGFsYQ"
}
],
"checked": "2026-11-08",
"domain": "",
"actor_ids": [
"handala"
],
"id": "a8a33dce"
},
{
"org": "Dubai International Airport",
"sector": "transport",
"date": "2026-04-02",
"type": "data-leak",
"actor": "Nasir Security",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "The suspected Iran-linked group Nasir Security began leaking passport photos, luggage images and security scanner photos it said came from a months-long breach of the airport.",
"sources": [
{
"name": "SC Media",
"url": "https://www.scworld.com/brief/americans-passports-purportedly-stolen-in-hacktivist-attack-against-dubai-airport"
}
],
"checked": "2026-11-08",
"domain": "dubaiairports.ae",
"logo": "dubaiairports.ae",
"actor_ids": [
"nasir-security"
],
"id": "927beb5b"
},
{
"org": "Dubai Courts, Dubai Land Department and RTA",
"sector": "government",
"date": "2026-04-13",
"type": "intrusion",
"actor": "Handala",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "Handala claimed it breached the three Dubai government bodies, destroyed 6 PB of data and stole 149 TB. The claims are unverified.",
"sources": [
{
"name": "Security Affairs",
"url": "https://securityaffairs.com/190716/hacking/iran-linked-group-handala-claims-to-have-breached-three-major-uae-organizations.html"
}
],
"checked": "2026-11-08",
"domain": "",
"actor_ids": [
"handala"
],
"id": "dcb14736"
},
{
"org": "flydubai",
"sector": "transport",
"date": "2026-10-07",
"type": "ransomware",
"actor": "Everest",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "Everest listed the airline and claimed 4.36 GB of data, including records on 2,862 employees and pilot training material. No samples were published.",
"sources": [
{
"name": "Cybernews",
"url": "https://cybernews.com/security/flydubai-breach-pilot-data-leak/"
},
{
"name": "TechInformed",
"url": "https://techinformed.com/everest-threatens-to-leak-flydubai-data-boeing-source-code/"
}
],
"checked": "2026-11-08",
"domain": "flydubai.com",
"logo": "flydubai.com",
"actor_ids": [
"everest"
],
"id": "a1698991"
}
],
"since": "2026-01-01",
"stats": [
{
"label": "Daily breach attempts against the UAE",
"value": "90,000 to 200,000",
"period": "February 2026",
"source": {
"name": "The National",
"url": "https://www.thenationalnews.com/news/uae/2026/02/22/uae-foils-ai-powered-terrorist-cyberattacks-on-vital-sectors"
}
},
{
"label": "Daily cyberattack attempts against the UAE",
"value": "more than 800,000",
"period": "July 2026",
"source": {
"name": "Khaleej Times",
"url": "https://www.khaleejtimes.com/uae/foils-cyberattacks-entities-financial-sector"
}
},
{
"label": "Attacks in a single day",
"value": "640,000",
"period": "15 September 2026",
"source": {
"name": "The National",
"url": "https://www.thenationalnews.com/news/uae/2026/09/16/irans-irgc-behind-many-cyberattacks-on-uae-says-security-chief/"
}
}
],
"rules": [],
"actors": [
{
"name": "IRGC (Islamic Revolutionary Guard Corps)",
"kind": "state",
"seen": "Council head Mohamed Al Kuwaiti named Iran a main player in attacks on the UAE in September 2026 and said the IRGC was behind many of them.",
"sources": [
{
"name": "The National",
"url": "https://www.thenationalnews.com/news/uae/2026/09/16/irans-irgc-behind-many-cyberattacks-on-uae-says-security-chief/"
}
]
}
],
"slug": "united-arab-emirates",
"title": "United Arab Emirates Cyber Incidents and Data Breaches 2026 · pwnsy",
"lede": "No public threat level. 4 incidents confirmed, 4 claims in 2026.",
"h1": "![\"\"](\"/tools/cyber-watch/flags/ae.svg\")
United Arab Emirates Cyber Watch",
"desc": "United Arab Emirates cyber threat level: none published. 4 incidents confirmed and 4 claims in 2026, each sourced. Updated 8 Nov 2026.",
"upd": "2026-11-08"
},
"SA": {
"name": "Saudi Arabia",
"subject": "Saudi Arabia",
"region": "Middle East and Africa",
"posture": {
"level": "",
"summary": "The NCA publishes no public threat level and communicates through regulation, awareness campaigns and sector reports.",
"agency": "National Cybersecurity Authority (NCA)",
"source": {
"name": "National Cybersecurity Authority",
"url": "https://nca.gov.sa/en/news/"
},
"checked": "2026-11-07"
},
"timeline": [
{
"date": "2026-10-01",
"text": "The NCA launched the sixth edition of its national cybersecurity awareness campaign.",
"url": "https://nca.gov.sa/en/news/national-campaign/",
"src": "National Cybersecurity Authority"
},
{
"date": "2026-10-02",
"text": "The NCA repeated its call for providers of cybersecurity services, products and solutions to register through the Haseen portal.",
"url": "https://nca.gov.sa/en/news/registration/",
"src": "National Cybersecurity Authority"
},
{
"date": "2026-10-14",
"text": "The NCA reported the Saudi cybersecurity market reached SAR 16.3 billion in 2025.",
"url": "https://nca.gov.sa/en/news/report-on-key-economic-indicators-in-the-cybersecurity-sector-in-the-kingdom-2026/",
"src": "National Cybersecurity Authority"
}
],
"incidents": [
{
"org": "Budget Saudi (United International Transportation Co.)",
"sector": "transport",
"date": "2026-06-10",
"type": "data-leak",
"actor": "",
"status": "confirmed",
"vendor": false,
"confirmed": "The car rental company told the market that attackers gained unauthorised access to a limited portion of some customers' data through its mobile app. It said no financial or banking data was affected and operations continued normally.",
"claimed": "",
"sources": [
{
"name": "Mubasher",
"url": "https://english.mubasher.info/news/4625010/Budget-Saudi-confirms-limited-customer-data-breach/"
},
{
"name": "Eye of Riyadh",
"url": "https://www.eyeofriyadh.com/news/details/budget-saudi-detects-limited-customer-data-breach-on-app"
}
],
"checked": "2026-11-08",
"domain": "",
"actor_ids": [],
"id": "48c30f17"
},
{
"org": "BinDawood Holding",
"sector": "retail",
"date": "2026-05-31",
"type": "data-leak",
"actor": "",
"status": "confirmed",
"vendor": false,
"confirmed": "BinDawood Holding said it contained a limited intrusion that exposed part of the order data of some BinDawood Markets customers through its app. It fixed the vulnerability, brought in an NCA-registered security firm and notified regulators.",
"claimed": "",
"sources": [
{
"name": "Banker News",
"url": "https://banker.news/138604"
}
],
"checked": "2026-11-08",
"domain": "bindawoodholding.com",
"logo": "bindawoodholding.com",
"actor_ids": [],
"id": "13767e84"
},
{
"org": "Saudi Aramco",
"sector": "energy",
"date": "2026-03-03",
"type": "intrusion",
"actor": "Handala",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "The Iran-linked group Handala claimed a breach and posted watermarked engineering documents. TechJuice found the documents dated to about 2016 and saw no evidence of a fresh compromise. Aramco has not commented.",
"sources": [
{
"name": "TechJuice",
"url": "https://www.techjuice.pk/?p=223095"
},
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/QXJhbWNvQGhhbmRhbGE"
}
],
"checked": "2026-11-08",
"domain": "aramco.com",
"logo": "aramco.com",
"actor_ids": [
"handala"
],
"id": "c35a6fa6"
},
{
"org": "ACWA Power",
"sector": "energy",
"date": "2026-02-24",
"type": "ransomware",
"actor": "INC Ransom",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "INC Ransom listed ACWA Power on its leak site. The company has not commented.",
"sources": [
{
"name": "Breachsense",
"url": "https://www.breachsense.com/breaches/acwa-power-data-breach/"
}
],
"checked": "2026-11-08",
"domain": "acwapower.com",
"logo": "acwapower.com",
"actor_ids": [
"inc-ransom"
],
"id": "33dcfeb0"
},
{
"org": "NEOM Ports",
"sector": "transport",
"date": "2026-10-12",
"type": "ransomware",
"actor": "N0n",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "N0n listed NEOM Ports on its leak site and threatened to publish tariff and invoicing records. NEOM has not commented.",
"sources": [
{
"name": "DeXpose",
"url": "https://www.dexpose.io/n0n-ransomware-group-strikes-neom-ports/"
},
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/TkVPTSBQb3J0cyAoaW5kdXN0cmlhbCBwb3J0IG9wZXJhdGlvbnMpQE4wbg"
}
],
"checked": "2026-11-08",
"domain": "neom.com",
"logo": "neom.com",
"actor_ids": [
"n0n"
],
"id": "f51fea1e"
},
{
"org": "L'azurde",
"sector": "retail",
"date": "2026-07-14",
"type": "ransomware",
"actor": "BlackNevas",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "BlackNevas listed the Riyadh jewellery maker on its leak site and threatened to publish its data.",
"sources": [
{
"name": "DeXpose",
"url": "https://www.dexpose.io/blacknevas-ransomware-targets-lazurde-jewelry-company/"
},
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/TCdhenVyZGVAYmxhY2tuZXZhcw"
}
],
"checked": "2026-11-08",
"domain": "lazurde.com",
"logo": "lazurde.com",
"actor_ids": [
"blacknevas"
],
"id": "afe2118b"
},
{
"org": "Saudi Consulting Services (Saud Consult)",
"sector": "other",
"date": "2026-08-31",
"type": "ransomware",
"actor": "The Gentlemen",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "The Gentlemen listed the engineering consultancy on its leak site.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/U2F1ZGkgQ29uc3VsdGluZyBTZXJ2aWNlcyBTQVVEIENPTlNVTFRAdGhlZ2VudGxlbWVu"
}
],
"checked": "2026-11-08",
"domain": "saudconsult.com",
"logo": "saudconsult.com",
"actor_ids": [
"the-gentlemen"
],
"id": "c023a553"
}
],
"since": "2026-01-01",
"stats": [
{
"label": "Cybersecurity market size",
"value": "SAR 16.3 billion",
"period": "2025 (published 14 October 2026)",
"source": {
"name": "National Cybersecurity Authority",
"url": "https://nca.gov.sa/en/news/report-on-key-economic-indicators-in-the-cybersecurity-sector-in-the-kingdom-2026/"
}
},
{
"label": "Cybersecurity workforce",
"value": "more than 22,000 professionals (33% women)",
"period": "2025 (published 14 October 2026)",
"source": {
"name": "National Cybersecurity Authority",
"url": "https://nca.gov.sa/en/news/report-on-key-economic-indicators-in-the-cybersecurity-sector-in-the-kingdom-2026/"
}
}
],
"rules": [],
"actors": [],
"slug": "saudi-arabia",
"title": "Saudi Arabia Cyber Incidents and Data Breaches 2026 · pwnsy",
"lede": "No public threat level. 2 incidents confirmed, 5 claims in 2026.",
"h1": "![\"\"](\"/tools/cyber-watch/flags/sa.svg\")
Saudi Arabia Cyber Watch",
"desc": "Saudi Arabia cyber threat level: none published. 2 incidents confirmed and 5 claims in 2026, each sourced. Updated 8 Nov 2026.",
"upd": "2026-11-08"
},
"EG": {
"name": "Egypt",
"subject": "Egypt",
"region": "Middle East and Africa",
"posture": {
"level": "",
"summary": "Egypt publishes no public cyber threat level.",
"agency": "Egyptian Computer Emergency Readiness Team (EG-CERT)",
"source": {
"name": "EG-CERT",
"url": "https://www.egcert.eg/"
},
"checked": "2026-11-07"
},
"timeline": [],
"incidents": [
{
"org": "EgyptAir",
"sector": "transport",
"date": "2026-02-09",
"type": "data-leak",
"actor": "quellostanco",
"status": "disputed",
"vendor": false,
"confirmed": "EgyptAir denied any breach and said no signs of attack were found on employee systems.",
"claimed": "A forum seller offered about 104,000 records said to come from EgyptAir HR and recruitment systems, with passwords and national ID numbers.",
"sources": [
{
"name": "Egypt Independent",
"url": "https://www.egyptindependent.com/egyptair-refutes-allegations-of-employee-data-breach/"
},
{
"name": "Mediaterranee",
"url": "https://mediaterranee.com/1022026-egyptair-dement-le-piratage-de-donnees-personnelles-revendique-par-un-cybercriminel.html"
}
],
"checked": "2026-11-08",
"domain": "egyptair.com",
"logo": "egyptair.com",
"actor_ids": [
"quellostanco"
],
"id": "c9ef97f1"
},
{
"org": "Digital billboard, 26 July Corridor, Giza",
"sector": "media",
"date": "2026-10-29",
"type": "defacement",
"actor": "",
"status": "confirmed",
"vendor": true,
"confirmed": "Explicit footage ran on a highway billboard in Giza. The Interior Ministry said the website of the international firm that distributed the screen's ad content was hacked, and legal action began.",
"claimed": "",
"sources": [
{
"name": "Gulf News",
"url": "https://gulfnews.com/world/mena/hackers-broadcast-pornographic-footage-on-highway-billboard-1.500730781"
}
],
"checked": "2026-11-08",
"domain": "",
"actor_ids": [],
"id": "e8ae7059"
},
{
"org": "Ministry of Agriculture and Land Reclamation",
"sector": "government",
"date": "2026-02-23",
"type": "ransomware",
"actor": "LockBit 5",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "LockBit 5 listed moa.gov.eg on its leak site. The ministry has not commented.",
"sources": [
{
"name": "Breach House",
"url": "https://breach.house/ransomware-victim/lockbit5-moagoveg-TCxn9xOnFpT9"
},
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/bW9hLmdvdi5lZ0Bsb2NrYml0NQ"
}
],
"checked": "2026-11-08",
"domain": "moa.gov.eg",
"logo": "moa.gov.eg",
"actor_ids": [
"lockbit-5-0"
],
"id": "0a76596e"
},
{
"org": "Nile Air",
"sector": "transport",
"date": "2026-02-13",
"type": "ransomware",
"actor": "The Gentlemen",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "The Gentlemen listed the Egyptian airline on its leak site and threatened to release data.",
"sources": [
{
"name": "DeXpose",
"url": "https://www.dexpose.io/thegentlemen-launches-ransomware-attack-on-nile-air/"
},
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/TmlsZSBBaXIgSW5mb3JtYXRpb25AdGhlZ2VudGxlbWVu"
}
],
"checked": "2026-11-08",
"domain": "nileair.com",
"logo": "nileair.com",
"actor_ids": [
"the-gentlemen"
],
"id": "efd820ab"
},
{
"org": "SODIC",
"sector": "property",
"date": "2026-02-17",
"type": "ransomware",
"actor": "Payload",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "Payload listed the real estate developer and said the full leak would follow unless the company made contact.",
"sources": [
{
"name": "DeXpose",
"url": "https://www.dexpose.io/payload-ransomware-targets-real-estate-leader-sodic/"
},
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/c29kaWMuY29tQHBheWxvYWQ"
}
],
"checked": "2026-11-08",
"domain": "sodic.com",
"logo": "sodic.com",
"actor_ids": [
"payload"
],
"id": "10611c29"
},
{
"org": "United Finance Egypt",
"sector": "finance",
"date": "2026-04-03",
"type": "ransomware",
"actor": "Payload",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "Payload claimed access to the lender's whole infrastructure and said most of the data is customer information.",
"sources": [
{
"name": "DeXpose",
"url": "https://www.dexpose.io/payload-ransomware-strikes-united-finance-egypt/"
},
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/VW5pdGVkIEZpbmFuY2UgRWd5cHRAcGF5bG9hZA"
}
],
"checked": "2026-11-08",
"domain": "uf-eg.com",
"logo": "uf-eg.com",
"actor_ids": [
"payload"
],
"id": "708dd628"
}
],
"since": "2026-01-01",
"stats": [],
"rules": [],
"actors": [],
"slug": "egypt",
"title": "Egypt Cyber Incidents and Data Breaches 2026 · pwnsy",
"lede": "No public threat level. 1 incident confirmed, 4 claims in 2026.",
"h1": "![\"\"](\"/tools/cyber-watch/flags/eg.svg\")
Egypt Cyber Watch",
"desc": "Egypt cyber threat level: none published. 1 incident confirmed and 4 claims in 2026, each sourced. Updated 8 Nov 2026.",
"upd": "2026-11-08"
},
"ZA": {
"name": "South Africa",
"subject": "South Africa",
"region": "Middle East and Africa",
"posture": {
"level": "",
"summary": "South Africa publishes no cyber threat level; the Information Regulator signals risk through enforcement notices and fines under POPIA.",
"agency": "Information Regulator (data protection)",
"source": {
"name": "Information Regulator",
"url": "https://inforegulator.org.za/media-statements/"
},
"checked": "2026-11-07"
},
"timeline": [
{
"date": "2026-04-29",
"text": "The Information Regulator said the Polokwane High Court confirmed a POPIA fine on Blouberg Local Municipality, reduced to R250,000, for publishing a staff member's personal information online.",
"url": "https://inforegulator.org.za/wp-content/uploads/2026/04/INFORMATION-REGULATOR-TURNS-TO-THE-COURTS-TO-FINE-BLOUBERG-LOCAL-MUNICIPALITY-FOR-CONTRAVENTION-OF-POPIA_.pdf",
"src": "Information Regulator"
},
{
"date": "2026-10-26",
"text": "The Information Regulator fined FNB R1 million and Central Johannesburg TVET College R500,000 for POPIA contraventions.",
"url": "https://inforegulator.org.za/wp-content/uploads/2026/10/MEDIA-STATEMENT-REGULATOR-FINES-CJC-AND-FNB-FOR-POPIA-CONTRAVENTION.pdf",
"src": "Information Regulator"
}
],
"incidents": [
{
"org": "First National Bank (FNB)",
"sector": "finance",
"date": "2026-10-26",
"type": "data-leak",
"actor": "",
"status": "confirmed",
"vendor": false,
"confirmed": "The Information Regulator said FNB filed a security compromise notification after customer account numbers were exposed through its digital home loan application platform, and fined the bank R1 million for weak safeguards.",
"claimed": "",
"sources": [
{
"name": "Information Regulator",
"url": "https://inforegulator.org.za/wp-content/uploads/2026/10/MEDIA-STATEMENT-REGULATOR-FINES-CJC-AND-FNB-FOR-POPIA-CONTRAVENTION.pdf"
}
],
"checked": "2026-11-07",
"domain": "fnb.co.za",
"logo": "fnb.co.za",
"actor_ids": [],
"id": "d287b5d3"
},
{
"org": "Land Bank",
"sector": "finance",
"date": "2026-03-09",
"type": "ransomware",
"actor": "",
"status": "confirmed",
"vendor": false,
"confirmed": "Finance Minister Enoch Godongwana told Parliament that attackers entered through an internet-facing server on 12 January and encrypted part of the server environment. The bank refused a five Bitcoin ransom and said farmer data was not compromised.",
"claimed": "",
"sources": [
{
"name": "Briefly News",
"url": "https://briefly.co.za/south-africa/237092-ransomware-attack-land-bank-hackers-demand-r54-million-confirms-godongwana"
}
],
"checked": "2026-11-08",
"domain": "landbank.co.za",
"actor_ids": [],
"id": "bf9fe5d4"
},
{
"org": "Statistics South Africa",
"sector": "government",
"date": "2026-03-30",
"type": "ransomware",
"actor": "XP95",
"status": "confirmed",
"vendor": false,
"confirmed": "Stats SA confirmed a breach of the HR database used by job applicants and said it would not pay and would notify the Information Regulator.",
"claimed": "XP95 claimed 154GB from Stats SA and demanded about R1.7 million.",
"sources": [
{
"name": "ITWeb",
"url": "https://www.itweb.co.za/article/stats-sa-confirms-data-breach-as-hackers-demand-r17m-ransom/JBwErvn3wpo76Db2"
}
],
"checked": "2026-11-08",
"domain": "statssa.gov.za",
"logo": "statssa.gov.za",
"actor_ids": [
"xp95"
],
"id": "48e4c9f1"
},
{
"org": "Standard Bank",
"sector": "finance",
"date": "2026-03-23",
"type": "data-leak",
"actor": "Rootboy",
"status": "confirmed",
"vendor": false,
"confirmed": "Standard Bank disclosed unauthorised access to internal administrative and filing systems, and on 14 April said client data had been published online. Subsidiary Liberty disclosed its own breach a day after the first notice.",
"claimed": "An actor called Rootboy claimed 1.2TB of data on a dark web forum.",
"sources": [
{
"name": "Connecting Africa",
"url": "https://www.connectingafrica.com/cybersecurity/standard-bank-customer-data-leaked-online"
},
{
"name": "TimesLIVE",
"url": "https://www.timeslive.co.za/news/south-africa/2026-04-17-standard-bank-advises-customers-to-tighten-security-after-hack-attack/"
}
],
"checked": "2026-11-08",
"domain": "standardbank.co.za",
"logo": "standardbank.co.za",
"actor_ids": [
"rootboy"
],
"id": "6c8f15c0"
},
{
"org": "AVBOB",
"sector": "finance",
"date": "2026-06-08",
"type": "intrusion",
"actor": "",
"status": "confirmed",
"vendor": false,
"confirmed": "The funeral insurer confirmed that external attackers disrupted its digital platforms. Branches stayed open and worked manually.",
"claimed": "",
"sources": [
{
"name": "IOL",
"url": "https://iol.co.za/business/2026-06-08-cyber-attack-hits-avbob-as-systems-go-offline/"
}
],
"checked": "2026-11-08",
"domain": "avbob.co.za",
"logo": "avbob.co.za",
"actor_ids": [],
"id": "fb744ba9"
},
{
"org": "MIP Holdings",
"sector": "other",
"date": "2026-06-26",
"type": "data-leak",
"actor": "The Gentlemen",
"status": "confirmed",
"vendor": false,
"confirmed": "Insurance software supplier MIP confirmed attackers used reused staff credentials to reach a support platform and took about 400,000 records tied to some 45 insurers. MIP paid a ransom, and data was published anyway.",
"claimed": "",
"sources": [
{
"name": "TechCentral",
"url": "https://techcentral.co.za/ransomware-gang-south-african-client-data-legalwise-samwumed-edcon/286877/"
}
],
"checked": "2026-11-08",
"domain": "mip.co.za",
"logo": "mip.co.za",
"actor_ids": [
"the-gentlemen"
],
"id": "f4e96255",
"story": "mip-hollard-insurance-breach"
},
{
"org": "Hollard",
"sector": "finance",
"date": "2026-09-07",
"type": "data-leak",
"actor": "The Gentlemen",
"status": "confirmed",
"vendor": true,
"confirmed": "MIP linked the Hollard material to its June breach. Hollard refused to pay and says its own systems were not compromised.",
"claimed": "The Gentlemen listed Hollard and published funeral policyholders' details.",
"sources": [
{
"name": "TechCentral",
"url": "https://techcentral.co.za/ransomware-gang-south-african-client-data-legalwise-samwumed-edcon/286877/"
},
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/SG9sbGFyZCBJbnN1cmFuY2UgR3JvdXBAdGhlZ2VudGxlbWVu"
}
],
"checked": "2026-11-08",
"domain": "hollard.co.za",
"logo": "hollard.co.za",
"actor_ids": [
"the-gentlemen"
],
"id": "caada541",
"story": "mip-hollard-insurance-breach"
},
{
"org": "Rand Water",
"sector": "energy",
"date": "2026-09-03",
"type": "intrusion",
"actor": "",
"status": "confirmed",
"vendor": false,
"confirmed": "Rand Water told debt holders it was responding to an incident affecting some IT systems. It said water treatment and supply were unaffected and treasury ran from a disaster recovery environment.",
"claimed": "",
"sources": [
{
"name": "TechCentral",
"url": "https://techcentral.co.za/rand-water-cyberattack/285746/"
}
],
"checked": "2026-11-08",
"domain": "randwater.co.za",
"logo": "randwater.co.za",
"actor_ids": [],
"id": "e5b13459"
}
],
"since": "2026-01-01",
"stats": [
{
"label": "Data breach notifications received by the Information Regulator",
"value": "788",
"period": "January to March 2026",
"source": {
"name": "ITWeb, quoting the Information Regulator",
"url": "https://www.itweb.co.za/article/inforeg-raises-alarm-as-data-breaches-hit-788-in-q1/Pero3MZ3wzoqQb6m"
}
}
],
"rules": [],
"actors": [],
"slug": "south-africa",
"title": "South Africa Cyber Incidents and Data Breaches 2026 · pwnsy",
"lede": "No public threat level. 8 incidents confirmed, 0 claims in 2026.",
"h1": "![\"\"](\"/tools/cyber-watch/flags/za.svg\")
South Africa Cyber Watch",
"desc": "South Africa cyber threat level: none published. 8 incidents confirmed and 0 claims in 2026, each sourced. Updated 8 Nov 2026.",
"upd": "2026-11-08"
},
"NG": {
"name": "Nigeria",
"subject": "Nigeria",
"region": "Middle East and Africa",
"posture": {
"level": "",
"summary": "Nigeria publishes no public cyber threat level; ngCERT issues advisories and the Nigeria Data Protection Commission oversees data protection.",
"agency": "Nigeria Computer Emergency Response Team (ngCERT)",
"source": {
"name": "ngCERT",
"url": "https://cert.gov.ng/advisories"
},
"checked": "2026-11-07"
},
"timeline": [
{
"date": "2026-10-16",
"text": "The Nigeria Data Protection Commission set privacy benchmarks for public sector websites in the 2026 BPSR scorecard.",
"url": "https://ndpc.gov.ng/ndp-act-compliance-ndpc-sets-privacy-benchmarks-for-public-sector-websites-at-2026-bpsr-scorecard/",
"src": "Nigeria Data Protection Commission"
}
],
"incidents": [
{
"org": "Zenith Bank",
"sector": "finance",
"date": "2026-08-04",
"type": "data-leak",
"actor": "Exfilsquad",
"status": "confirmed",
"vendor": false,
"confirmed": "Zenith Bank told customers that hackers accessed a limited set of customer data, including email addresses and phone numbers, as part of a wider global attack. It said core systems were not affected.",
"claimed": "Exfilsquad listed Zenith Bank on its leak site on 26 July.",
"sources": [
{
"name": "Techeconomy",
"url": "https://www.techeconomy.ng/zenith-bank-confirms-data-breach-as-cyberattacks-on-nigerian-banks-intensify"
},
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/WmVuaXRoIEJhbmsgUGxjQEV4ZmlsU3F1YWQ"
}
],
"checked": "2026-11-08",
"domain": "zenithbank.com",
"logo": "zenithbank.com",
"actor_ids": [
"exfilsquad"
],
"id": "1754ec71"
},
{
"org": "Corporate Affairs Commission (CAC)",
"sector": "government",
"date": "2026-04-17",
"type": "data-leak",
"actor": "",
"status": "confirmed",
"vendor": false,
"confirmed": "The CAC confirmed unauthorised access to limited aspects of its systems and is working with NITDA. The NDPC opened an investigation.",
"claimed": "Online claims said about 25 million documents were taken.",
"sources": [
{
"name": "Nairametrics",
"url": "https://nairametrics.com/2026/04/17/ndpc-probes-alleged-data-breach-at-corporate-affairs-commission/"
},
{
"name": "Leadership",
"url": "https://leadership.ng/cac-confirms-cyber-breach-triggers-system-review/"
}
],
"checked": "2026-11-08",
"domain": "cac.gov.ng",
"logo": "cac.gov.ng",
"actor_ids": [],
"id": "5d16875b"
},
{
"org": "Sterling Bank",
"sector": "finance",
"date": "2026-03-27",
"type": "data-leak",
"actor": "ByteToBreach",
"status": "claimed",
"vendor": false,
"confirmed": "The NDPC served notices on Sterling Bank and Remita on 1 April and opened a formal probe.",
"claimed": "ByteToBreach claimed about 900,000 customer accounts and over 3,000 staff records, part of about 3TB taken with Remita data.",
"sources": [
{
"name": "ITWeb Africa",
"url": "https://itweb.africa/article/nigerian-regulator-opens-a-probe-into-possible-data-leak/raYAyMorwoL7J38N"
},
{
"name": "WeeTracker",
"url": "https://weetracker.com/2026/04/09/sterling-bank-ceo-hack/"
}
],
"checked": "2026-11-08",
"domain": "sterling.ng",
"logo": "sterling.ng",
"actor_ids": [
"bytetobreach"
],
"id": "0220ce43"
},
{
"org": "Fidelity Pension Managers",
"sector": "finance",
"date": "2026-06-16",
"type": "ransomware",
"actor": "DeadLock",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "DeadLock listed the pension fund administrator on its leak site.",
"sources": [
{
"name": "Breachsense",
"url": "https://www.breachsense.com/breaches/fidelity-pension-managers-data-breach/"
},
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/RmlkZWxpdHkgUGVuc2lvbiBNYW5hZ2Vyc0BEZWFkbG9jaw"
}
],
"checked": "2026-11-08",
"domain": "fidelitypensionmanagers.com",
"logo": "fidelitypensionmanagers.com",
"actor_ids": [
"deadlock"
],
"id": "7d80bc98"
},
{
"org": "Daily Trust",
"sector": "media",
"date": "2026-08-08",
"type": "ransomware",
"actor": "Panzer",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "Panzer listed the newspaper and threatened to publish data unless it made contact.",
"sources": [
{
"name": "DeXpose",
"url": "https://www.dexpose.io/panzer-ransomware-group-targets-nigerian-news-outlet-daily-trust/"
},
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/RGFpbHkgVHJ1c3RAUGFuemVy"
}
],
"checked": "2026-11-08",
"domain": "dailytrust.com",
"logo": "dailytrust.com",
"actor_ids": [
"panzer"
],
"id": "946c1ed2"
}
],
"since": "2026-01-01",
"stats": [
{
"label": "Cyberattacks per week, as stated by the NDPC National Commissioner",
"value": "4,000+",
"period": "2026 (stated May 2026)",
"source": {
"name": "Vanguard, quoting NDPC",
"url": "https://www.vanguardngr.com/2026/05/ndpc-4000-weekly-cyberattacks-push-data-localisation-stricter-compliance/"
}
}
],
"rules": [],
"actors": [],
"slug": "nigeria",
"title": "Nigeria Cyber Incidents and Data Breaches 2026 · pwnsy",
"lede": "No public threat level. 2 incidents confirmed, 3 claims in 2026.",
"h1": "![\"\"](\"/tools/cyber-watch/flags/ng.svg\")
Nigeria Cyber Watch",
"desc": "Nigeria cyber threat level: none published. 2 incidents confirmed and 3 claims in 2026, each sourced. Updated 8 Nov 2026.",
"upd": "2026-11-08"
},
"KE": {
"name": "Kenya",
"subject": "Kenya",
"region": "Middle East and Africa",
"posture": {
"level": "",
"summary": "Kenya publishes no cyber threat level and reports cyber threats detected and advisories issued in quarterly sector statistics.",
"agency": "Communications Authority of Kenya (National KE-CIRT/CC)",
"source": {
"name": "Communications Authority of Kenya",
"url": "https://www.ca.go.ke/statistics"
},
"checked": "2026-11-07"
},
"timeline": [
{
"date": "2026-09-11",
"text": "The Office of the Data Protection Commissioner published a draft notice adding categories of sensitive personal data under section 47 of the Data Protection Act.",
"url": "https://www.odpc.go.ke/draft-additional-categories-of-sensitive-personal-data/",
"src": "Office of the Data Protection Commissioner"
}
],
"incidents": [
{
"org": "State House (Presidency) website",
"sector": "government",
"date": "2026-07-18",
"type": "defacement",
"actor": "",
"status": "confirmed",
"vendor": false,
"confirmed": "ICT Cabinet Secretary William Kabogo confirmed the attack and said access to the presidential website was restricted for containment and forensics. He said there was no evidence of sensitive data being accessed or stolen.",
"claimed": "The defaced homepage showed a bitcoin wallet and demanded 5 BTC, threatening to publish information about President Ruto.",
"sources": [
{
"name": "The Record",
"url": "https://therecord.media/kenya-probes-hack-of-presidents-website-after-ransom-demand"
},
{
"name": "Techweez",
"url": "https://techweez.com/2026/07/18/state-house-website-hacked/"
}
],
"checked": "2026-11-08",
"domain": "president.go.ke",
"logo": "president.go.ke",
"actor_ids": [],
"id": "44f6a150"
},
{
"org": "Kenya National Highways Authority (KeNHA)",
"sector": "transport",
"date": "2026-07-25",
"type": "ransomware",
"actor": "Deadlock",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "The Deadlock ransomware group listed KeNHA on its leak site. KeNHA has not commented publicly.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/S2VOSEFARGVhZGxvY2s"
},
{
"name": "GalaxyWarden",
"url": "https://www.galaxywarden.com/blog/breach/kenha-deadlock-2026-07"
}
],
"checked": "2026-11-08",
"domain": "kenha.co.ke",
"logo": "kenha.co.ke",
"actor_ids": [
"deadlock"
],
"id": "6f13d332"
},
{
"org": "National Mining Corporation (NAMICO)",
"sector": "government",
"date": "2026-01-26",
"type": "ransomware",
"actor": "Tengu",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "The Tengu group listed the state mining corporation on its leak site.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/bmFtaWNvLmdvLmtlQHRlbmd1"
}
],
"checked": "2026-11-08",
"domain": "namico.go.ke",
"logo": "namico.go.ke",
"actor_ids": [
"tengu"
],
"id": "ae174726"
},
{
"org": "IFMIS, National Treasury",
"sector": "government",
"date": "2026-04-14",
"type": "data-leak",
"actor": "Bashe (APT73)",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "The Bashe group, also tracked as APT73, listed the Treasury's financial management system ifmis.go.ke on its leak site. Leak size is unknown.",
"sources": [
{
"name": "Breachsense",
"url": "https://www.breachsense.com/breaches/ifmis-kenya-data-breach/"
},
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/aWZtaXMuZ28ua2VAYXB0NzM"
}
],
"checked": "2026-11-08",
"domain": "ifmis.go.ke",
"actor_ids": [
"apt73"
],
"id": "4e29bd3b"
},
{
"org": "Bomu Hospital",
"sector": "health",
"date": "2026-05-01",
"type": "ransomware",
"actor": "Krybit",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "The Krybit group listed the Mombasa hospital on its leak site.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/Ym9tdWhvc3BpdGFsLm9yZ0BrcnliaXQ"
}
],
"checked": "2026-11-08",
"domain": "bomuhospital.org",
"actor_ids": [
"krybit"
],
"id": "482d651a"
},
{
"org": "Wells Fargo Kenya (courier and security)",
"sector": "transport",
"date": "2026-02-06",
"type": "ransomware",
"actor": "The Gentlemen",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "The Gentlemen ransomware group listed fargo.co.ke on its leak site.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/V2VsbHMgRmFyZ29AdGhlZ2VudGxlbWVu"
}
],
"checked": "2026-11-08",
"domain": "fargo.co.ke",
"actor_ids": [
"the-gentlemen"
],
"id": "8c1e5096"
},
{
"org": "East African Gasoil",
"sector": "energy",
"date": "2026-07-06",
"type": "ransomware",
"actor": "Arcusmedia",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "The Arcusmedia group listed the fuel importer on its leak site.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/RWFzdCBBZnJpY2FuIEdhc29pbEBhcmN1c21lZGlh"
}
],
"checked": "2026-11-08",
"domain": "eastafricangasoil.com",
"logo": "eastafricangasoil.com",
"actor_ids": [
"arcusmedia"
],
"id": "36e9deb2"
}
],
"since": "2026-01-01",
"stats": [
{
"label": "Cyber threats detected",
"value": "2,355,938,192",
"period": "April to June 2026",
"source": {
"name": "Communications Authority of Kenya",
"url": "https://ca.go.ke/sites/default/files/2026-09/Sector%20Statistics%20Report%20Q4%202025-2026_0.pdf"
}
},
{
"label": "Cyber threats detected",
"value": "11,124,632,684 (up 29.0%)",
"period": "Financial year 2025/26",
"source": {
"name": "Communications Authority of Kenya",
"url": "https://ca.go.ke/sites/default/files/2026-09/Sector%20Statistics%20Report%20Q4%202025-2026_0.pdf"
}
},
{
"label": "Cyber advisories issued",
"value": "83.1 million (up 60.8%)",
"period": "Financial year 2025/26",
"source": {
"name": "Communications Authority of Kenya",
"url": "https://ca.go.ke/sites/default/files/2026-09/Sector%20Statistics%20Report%20Q4%202025-2026_0.pdf"
}
},
{
"label": "DDoS attacks detected",
"value": "72,164,664 (up 114.3%)",
"period": "Financial year 2025/26",
"source": {
"name": "Communications Authority of Kenya",
"url": "https://ca.go.ke/sites/default/files/2026-09/Sector%20Statistics%20Report%20Q4%202025-2026_0.pdf"
}
}
],
"rules": [],
"actors": [],
"slug": "kenya",
"title": "Kenya Cyber Incidents and Data Breaches 2026 · pwnsy",
"lede": "No public threat level. 1 incident confirmed, 6 claims in 2026.",
"h1": "![\"\"](\"/tools/cyber-watch/flags/ke.svg\")
Kenya Cyber Watch",
"desc": "Kenya cyber threat level: none published. 1 incident confirmed and 6 claims in 2026, each sourced. Updated 8 Nov 2026.",
"upd": "2026-11-08"
},
"IN": {
"name": "India",
"subject": "India",
"region": "Asia-Pacific",
"posture": {
"level": "",
"summary": "India publishes no national cyber threat level; CERT-In signals risk through dated alerts, advisories and vulnerability notes.",
"agency": "CERT-In",
"source": {
"name": "CERT-In",
"url": "https://www.cert-in.org.in/"
},
"checked": "2026-11-07"
},
"timeline": [
{
"date": "2026-01-23",
"text": "Government said CERT-In handled 29.44 lakh cyber incidents in 2025 and issued 1,530 alerts.",
"url": "https://www.bizzbuzz.news/technology/cert-in-handled-over-29l-cyber-events-in-2025-gets-global-focus-1384425",
"src": "BizzBuzz"
},
{
"date": "2026-04-28",
"text": "CERT-In issued a high-severity advisory on frontier AI driven cyber risks and urged faster patching and log retention.",
"url": "https://www.freepressjournal.in/tech/cert-in-flags-high-risk-ai-threats-reshaping-cybersecurity-landscape",
"src": "Free Press Journal"
}
],
"incidents": [
{
"org": "Tata Electronics",
"sector": "manufacturing",
"date": "2026-06-22",
"type": "ransomware",
"actor": "World Leaks",
"status": "confirmed",
"vendor": true,
"confirmed": "Tata Electronics said it detected a cybersecurity incident on some systems and that its operations were unaffected.",
"claimed": "World Leaks posted files it said included Apple and Tesla component designs, over 630 GB in total.",
"sources": [
{
"name": "Business Recorder (Reuters)",
"url": "https://www.brecorder.com/news/amp/40426794"
},
{
"name": "Gujarat Samachar",
"url": "https://english.gujaratsamachar.com/news/science-technology/tata-electronics-confirms-cyber-apple-tesla-data-reportedly-leaked-66361146467.html"
}
],
"checked": "2026-11-07",
"domain": "tataelectronics.com",
"logo": "tataelectronics.com",
"actor_ids": [
"world-leaks"
],
"id": "0020e148"
},
{
"org": "Bajaj Auto",
"sector": "manufacturing",
"date": "2026-06-23",
"type": "ransomware",
"actor": "",
"status": "confirmed",
"vendor": false,
"confirmed": "Bajaj Auto told the stock exchanges that ransomware hit IT systems at its subsidiary Bajaj Auto Technology Limited and that it notified CERT-In.",
"claimed": "",
"sources": [
{
"name": "Whalesbook",
"url": "https://www.whalesbook.com/corporate-news/English/technology/Bajaj-Auto-Confirms-Ransomware-Attack-Systems-Restored/6a3a8d097465030c38b59be8"
}
],
"checked": "2026-11-07",
"domain": "bajajauto.com",
"logo": "bajajauto.com",
"actor_ids": [],
"id": "4089e735"
},
{
"org": "Reliance Group",
"sector": "other",
"date": "2026-06-11",
"type": "ransomware",
"actor": "World Leaks",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "World Leaks listed Reliance Group on its leak site and said critical data had been encrypted.",
"sources": [
{
"name": "DeXpose",
"url": "https://www.dexpose.io/worldleaks-targets-indian-conglomerate-reliance-group/"
}
],
"checked": "2026-11-07",
"actor_ids": [
"world-leaks"
],
"id": "a1560ebd"
},
{
"org": "ApexHospitals",
"sector": "health",
"date": "2026-02-24",
"type": "data-leak",
"actor": "Vect",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "Vect said it stole and leaked employee payroll records and patient medical records.",
"sources": [
{
"name": "DeXpose",
"url": "https://www.dexpose.io/vect-ransomware-breach-at-apexhospitals-in-india/"
}
],
"checked": "2026-11-07",
"actor_ids": [
"vect"
],
"id": "b5547af0"
},
{
"org": "Kopran",
"sector": "manufacturing",
"date": "2026-02-20",
"type": "intrusion",
"actor": "",
"status": "confirmed",
"vendor": false,
"confirmed": "The listed drugmaker told BSE and NSE that an unauthorised person accessed computer server data at its Khopoli factory. It restricted access and brought in cyber security experts.",
"claimed": "",
"sources": [
{
"name": "NSE filing",
"url": "https://nsearchives.nseindia.com/corporate/KOPRAN_20022026164147_Disclosure_Cyberattack20022026.pdf"
}
],
"checked": "2026-11-08",
"domain": "kopran.com",
"logo": "kopran.com",
"actor_ids": [],
"id": "99ca86f6"
},
{
"org": "Omax Autos",
"sector": "manufacturing",
"date": "2026-03-27",
"type": "ransomware",
"actor": "",
"status": "confirmed",
"vendor": false,
"confirmed": "The auto parts maker told the exchanges a suspected incident on 26 March was confirmed as a ransomware attack on its IT infrastructure. It said core systems and operations were not affected.",
"claimed": "",
"sources": [
{
"name": "NSE filing",
"url": "https://nsearchives.nseindia.com/corporate/OMAXAUTO_27032026164635_Intimation-Cyber_Security.pdf"
}
],
"checked": "2026-11-08",
"domain": "omaxauto.com",
"logo": "omaxauto.com",
"actor_ids": [],
"id": "8d4e237e"
},
{
"org": "HDFC Asset Management Company",
"sector": "finance",
"date": "2026-05-18",
"type": "intrusion",
"actor": "",
"status": "confirmed",
"vendor": false,
"confirmed": "HDFC AMC disclosed a cyber security incident on 16 May after an anonymous source claimed access to parts of its IT infrastructure. It activated containment and hired a specialist firm, and said operations were unlikely to be affected.",
"claimed": "",
"sources": [
{
"name": "Free Press Journal (IANS)",
"url": "https://www.freepressjournal.in/tech/hdfc-amc-reports-cybersecurity-incident-after-anonymous-claim-of-it-system-access-initiates-containment-expert-probe"
}
],
"checked": "2026-11-08",
"domain": "hdfcfund.com",
"logo": "hdfcfund.com",
"actor_ids": [],
"id": "f8670bde"
},
{
"org": "Ultrahuman",
"sector": "health",
"date": "2026-06-04",
"type": "data-leak",
"actor": "",
"status": "confirmed",
"vendor": false,
"confirmed": "The Bengaluru wearables maker said an attacker used credentials stolen from an employee's device to reach an internal analytics system on 27 March. About 0.1 per cent of users were affected; passwords and payment data were not.",
"claimed": "",
"sources": [
{
"name": "Digit",
"url": "https://www.digit.in/news/general/ultrahuman-suffers-data-breach-hackers-access-customer-wellness-information.html"
},
{
"name": "GSMArena",
"url": "https://gsmarena.com/ultrahuman_informs_users_of_breach_but_passwords_and_payment_info_are_safe-news-73149.php"
}
],
"checked": "2026-11-08",
"domain": "ultrahuman.com",
"logo": "ultrahuman.com",
"actor_ids": [],
"id": "9abd467c"
},
{
"org": "Bank of Baroda",
"sector": "finance",
"date": "2026-07-27",
"type": "data-leak",
"actor": "",
"status": "confirmed",
"vendor": false,
"confirmed": "The state-owned bank said a business email compromise gave unauthorised access to certain data through an employee's email account. It said core banking systems were not accessed and ordered a forensic probe.",
"claimed": "A threat actor claimed to have published about 1 TB of the bank's data on the dark web.",
"sources": [
{
"name": "Business Today",
"url": "https://businesstoday.in/technology/news/story/bank-of-baroda-hit-by-cyberattack-1tb-of-sensitive-data-allegedly-leaked-545389-2026-07-27"
},
{
"name": "Moneylife",
"url": "https://www.moneylife.in/article/bank-of-baroda-says-cyber-incident-stemmed-from-business-email-compromise-probe-underway-amid-claims-of-1tb-data-leak/81176.html"
}
],
"checked": "2026-11-08",
"domain": "bankofbaroda.in",
"actor_ids": [],
"id": "062ddd49"
},
{
"org": "Intellect Design Arena",
"sector": "finance",
"date": "2026-10-28",
"type": "intrusion",
"actor": "",
"status": "confirmed",
"vendor": false,
"confirmed": "The banking software company told the exchanges that an employee email account at its Canadian subsidiary was compromised and used to send fake payment instructions to a customer. It reported no impact on its products or operations.",
"claimed": "",
"sources": [
{
"name": "NSE filing",
"url": "https://nsearchives.nseindia.com/corporate/INTELLECT_28102026162052_Cybersecurity_incident.pdf"
}
],
"checked": "2026-11-08",
"domain": "intellectdesign.com",
"logo": "intellectdesign.com",
"actor_ids": [],
"id": "00a87a3b"
},
{
"org": "Kamalnayan Bajaj Hospital",
"sector": "health",
"date": "2026-10-28",
"type": "ransomware",
"actor": "Crypto24",
"status": "confirmed",
"vendor": false,
"confirmed": "A ransomware attack detected on 18 October hit all nine servers at the Chhatrapati Sambhajinagar hospital, forcing staff onto manual processes. Police registered a case.",
"claimed": "A ransom note attributed to Crypto24 Group said hospital files were encrypted.",
"sources": [
{
"name": "Medical Dialogues",
"url": "https://medicaldialogues.in/amp/news/health/hospital-diagnostics/cyberattack-hits-9-servers-at-chhatrapati-sambhajinagar-hospital-fir-registered-182158"
}
],
"checked": "2026-11-08",
"domain": "",
"actor_ids": [
"crypto24"
],
"id": "00c5a5f1"
}
],
"since": "2026-01-01",
"stats": [
{
"label": "Cyber incidents handled by CERT-In",
"value": "29.44 lakh (about 2.94 million)",
"period": "2025",
"source": {
"name": "BizzBuzz, citing government statement of 23 Jan 2026",
"url": "https://www.bizzbuzz.news/technology/cert-in-handled-over-29l-cyber-events-in-2025-gets-global-focus-1384425"
}
},
{
"label": "Alerts issued by CERT-In",
"value": "1,530",
"period": "2025",
"source": {
"name": "BizzBuzz, citing government statement of 23 Jan 2026",
"url": "https://www.bizzbuzz.news/technology/cert-in-handled-over-29l-cyber-events-in-2025-gets-global-focus-1384425"
}
},
{
"label": "Vulnerability notes issued by CERT-In",
"value": "390",
"period": "2025",
"source": {
"name": "BizzBuzz, citing government statement of 23 Jan 2026",
"url": "https://www.bizzbuzz.news/technology/cert-in-handled-over-29l-cyber-events-in-2025-gets-global-focus-1384425"
}
}
],
"rules": [
{
"date": "2026-11-13",
"title": "DPDP Rules 2025, second phase",
"what": "Section 6(9) and section 27(1)(d) of the DPDP Act take effect one year after the Rules were notified, covering Consent Manager provisions; remaining duties follow on 13 May 2027.",
"url": "https://www.meity.gov.in/static/uploads/2025/11/c56ceae6c383460ca69577428d36828b.pdf"
}
],
"actors": [
{
"name": "World Leaks",
"kind": "extortion",
"seen": "Claimed Reliance Group in June 2026 and posted Tata Electronics files the same month.",
"sources": [
{
"name": "Business Recorder (Reuters)",
"url": "https://www.brecorder.com/news/amp/40426794"
},
{
"name": "DeXpose",
"url": "https://www.dexpose.io/worldleaks-targets-indian-conglomerate-reliance-group/"
}
],
"actor_id": "world-leaks"
},
{
"name": "Vect",
"kind": "ransomware",
"seen": "Claimed ApexHospitals in February 2026.",
"sources": [
{
"name": "DeXpose",
"url": "https://www.dexpose.io/vect-ransomware-breach-at-apexhospitals-in-india/"
}
],
"actor_id": "vect"
}
],
"slug": "india",
"title": "India Cyber Incidents and Data Breaches 2026 · pwnsy",
"lede": "No public threat level. 9 incidents confirmed, 2 claims in 2026.",
"h1": "![\"\"](\"/tools/cyber-watch/flags/in.svg\")
India Cyber Watch",
"desc": "India cyber threat level: none published. 9 incidents confirmed and 2 claims in 2026, each sourced. Updated 8 Nov 2026.",
"upd": "2026-11-08"
},
"PK": {
"name": "Pakistan",
"subject": "Pakistan",
"region": "Asia-Pacific",
"posture": {
"level": "",
"summary": "Pakistan publishes no cyber threat level; National CERT issues high-priority advisories and directives to government bodies during regional tension.",
"agency": "PKCERT (National CERT)",
"source": {
"name": "PKCERT",
"url": "https://www.pkcert.gov.pk/"
},
"checked": "2026-11-07"
},
"timeline": [
{
"date": "2026-03-03",
"text": "National CERT issued an alert to government departments after attacks on PakSat and TV channels.",
"url": "https://www.dawn.com/news/1977705/cert-investigates-cyberattacks-on-tv-channels-websites",
"src": "Dawn"
},
{
"date": "2026-03-24",
"text": "National CERT warned hostile actors could exploit supply chains to reach power, banking and defence systems.",
"url": "https://www.dawn.com/news/1984857",
"src": "Dawn"
},
{
"date": "2026-05-08",
"text": "National CERT told all government websites to switch to read-only mode amid a surge in hacktivist activity.",
"url": "https://cwpakistan.com/pakistan-government-websites-shift-to-read-only-mode-amid-rising-cyber-threats/",
"src": "CW Pakistan"
},
{
"date": "2026-05-23",
"text": "The NCCIA arrested four people in Punjab accused of selling call records, CNICs and passports of key officials to foreign entities.",
"url": "https://www.dawn.com/news/2002437",
"src": "Dawn"
}
],
"incidents": [
{
"org": "PakSat and private TV channels",
"sector": "media",
"date": "2026-03-01",
"type": "intrusion",
"actor": "",
"status": "confirmed",
"vendor": false,
"confirmed": "National CERT opened an investigation after attacks disrupted PakSat transmissions and two private TV channels and one mobile app reported breaches; IT Minister Shaza Fatima chaired the review.",
"claimed": "",
"sources": [
{
"name": "Dawn",
"url": "https://www.dawn.com/news/1977705/cert-investigates-cyberattacks-on-tv-channels-websites"
}
],
"checked": "2026-11-07",
"actor_ids": [],
"id": "409896d5"
},
{
"org": "Ministry of Defence, Ministry of Finance and NEPRA staff",
"sector": "government",
"date": "2026-04-02",
"type": "other",
"actor": "SideWinder",
"status": "confirmed",
"vendor": false,
"confirmed": "National CERT warned of a phishing campaign using fake sites that imitate the Defence and Finance ministries, NEPRA and National CERT to steal staff credentials.",
"claimed": "",
"sources": [
{
"name": "TechJuice",
"url": "https://www.techjuice.pk/?p=228132"
}
],
"checked": "2026-11-07",
"actor_ids": [
"sidewinder"
],
"id": "b94eae12"
},
{
"org": "Unnamed federal government entity",
"sector": "government",
"date": "2026-07-01",
"type": "ransomware",
"actor": "",
"status": "confirmed",
"vendor": false,
"confirmed": "PKCERT Director General Haider Abbas said a government entity was hit by ransomware the week before. Its data was encrypted and restored from backups.",
"claimed": "",
"sources": [
{
"name": "TechJuice",
"url": "https://www.techjuice.pk/govt-body-hacked-as-pakistan-logs-253-cyberattacks-in-2026/"
}
],
"checked": "2026-11-08",
"domain": "",
"actor_ids": [],
"id": "71917e32"
},
{
"org": "National Disaster Management Authority (NEOC)",
"sector": "government",
"date": "2026-04-04",
"type": "data-leak",
"actor": "h4xorvats",
"status": "disputed",
"vendor": false,
"confirmed": "An NDMA official called the claim fabricated and said NDMA and NEOC hold no CNIC or bank data.",
"claimed": "h4xorvats claimed full access to the National Emergency Operations Centre and leaked 13,000 files.",
"sources": [
{
"name": "The Pakistan Connect",
"url": "https://thepakistanconnect.com/neoc-hacked-pakistan-ndma-clarifies/"
}
],
"checked": "2026-11-08",
"domain": "ndma.gov.pk",
"logo": "ndma.gov.pk",
"actor_ids": [
"h4xorvats"
],
"id": "9dd89eaa"
},
{
"org": "EFU Life Assurance",
"sector": "finance",
"date": "2026-07-22",
"type": "ransomware",
"actor": "Qilin",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "Qilin listed the insurer on its leak site and threatened to publish data unless it negotiated.",
"sources": [
{
"name": "DeXpose",
"url": "https://www.dexpose.io/qilin-ransomware-strikes-efu-life-assurance/"
},
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/RUZVIExpZmUgQXNzdXJhbmNlQHFpbGlu"
}
],
"checked": "2026-11-08",
"domain": "efulife.com",
"logo": "efulife.com",
"actor_ids": [
"qilin"
],
"id": "537d9687"
},
{
"org": "Beaconhouse School System",
"sector": "education",
"date": "2026-05-06",
"type": "ransomware",
"actor": "The Gentlemen",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "The Gentlemen listed the school group and said the full leak would follow unless it made contact.",
"sources": [
{
"name": "DeXpose",
"url": "https://www.dexpose.io/the-gentlemen-ransomware-attack-on-beaconhouse-school-system/"
},
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/QmVhY29uaG91c2UgU2Nob29sIFN5c3RlbUB0aGVnZW50bGVtZW4"
}
],
"checked": "2026-11-08",
"domain": "beaconhouse.net",
"logo": "beaconhouse.net",
"actor_ids": [
"the-gentlemen"
],
"id": "6444772d"
},
{
"org": "Treet Corporation",
"sector": "manufacturing",
"date": "2026-07-02",
"type": "data-leak",
"actor": "World Leaks",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "World Leaks named the consumer goods group on its leak site.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/VHJlZXQgR3JvdXAgb2YgQ29tcGFuaWVzQHdvcmxkbGVha3M"
}
],
"checked": "2026-11-08",
"domain": "treetcorp.com",
"logo": "treetcorp.com",
"actor_ids": [
"world-leaks"
],
"id": "05ba8526"
}
],
"since": "2026-01-01",
"stats": [
{
"label": "Cyberattacks recorded in Pakistan, per PKCERT Director General",
"value": "253",
"period": "January to 1 July 2026",
"source": {
"name": "TechJuice, quoting PKCERT",
"url": "https://www.techjuice.pk/govt-body-hacked-as-pakistan-logs-253-cyberattacks-in-2026/"
}
}
],
"rules": [],
"actors": [
{
"name": "SideWinder",
"kind": "state",
"seen": "National CERT tied an April 2026 phishing campaign against ministry staff to this India-origin APT group.",
"sources": [
{
"name": "TechJuice",
"url": "https://www.techjuice.pk/?p=228132"
}
],
"actor_id": "sidewinder"
}
],
"slug": "pakistan",
"title": "Pakistan Cyber Incidents and Data Breaches 2026 · pwnsy",
"lede": "No public threat level. 3 incidents confirmed, 3 claims in 2026.",
"h1": "![\"\"](\"/tools/cyber-watch/flags/pk.svg\")
Pakistan Cyber Watch",
"desc": "Pakistan cyber threat level: none published. 3 incidents confirmed and 3 claims in 2026, each sourced. Updated 8 Nov 2026.",
"upd": "2026-11-08"
},
"BD": {
"name": "Bangladesh",
"subject": "Bangladesh",
"region": "Asia-Pacific",
"posture": {
"level": "",
"summary": "Bangladesh publishes no cyber threat level; BGD e-GOV CIRT issues alerts, advisories and holiday situational-awareness notices.",
"agency": "BGD e-GOV CIRT",
"source": {
"name": "BGD e-GOV CIRT",
"url": "https://www.cirt.gov.bd/"
},
"checked": "2026-11-07"
},
"timeline": [
{
"date": "2026-09-17",
"text": "BGD e-GOV CIRT warned of a SideWinder-associated campaign aimed at South Asian government and financial infrastructure.",
"url": "https://www.cirt.gov.bd/advisories/sidewinder-associated-campaign",
"src": "BGD e-GOV CIRT"
},
{
"date": "2026-10-25",
"text": "BGD e-GOV CIRT said many Bangladesh web apps still run outdated PHP and some notified owners have not fixed them.",
"url": "https://www.cirt.gov.bd/alerts/unresolved-php-security-bangladesh",
"src": "BGD e-GOV CIRT"
}
],
"incidents": [
{
"org": "Shwapno (ACI Logistics)",
"sector": "retail",
"date": "2026-03-28",
"type": "ransomware",
"actor": "Qilin",
"status": "confirmed",
"vendor": false,
"confirmed": "Shwapno said hackers breached its customer database and demanded $1.5 million. It is working with forensic experts and the police CTTC unit.",
"claimed": "Qilin listed Shwapno on its leak site on 17 March 2026.",
"sources": [
{
"name": "The Business Standard",
"url": "https://www.tbsnews.net/node/1396081"
},
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/U2h3YXBub0BxaWxpbg"
}
],
"checked": "2026-11-08",
"domain": "shwapno.com",
"logo": "shwapno.com",
"actor_ids": [
"qilin"
],
"id": "78ad23b3"
},
{
"org": "Bangladesh Election Commission",
"sector": "government",
"date": "2026-01-31",
"type": "data-leak",
"actor": "",
"status": "disputed",
"vendor": false,
"confirmed": "The EC conceded that applicants' names and NID details were briefly viewable on its journalist accreditation site, but said there was no download option and no misuse.",
"claimed": "Press reports said a URL flaw exposed the NID details, photos and signatures of about 14,000 journalists for around two hours on 31 January.",
"sources": [
{
"name": "Views Bangladesh",
"url": "https://viewsbangladesh.com/ecs-explanation-over-information-leak-of-14000-journalists"
},
{
"name": "The Business Standard",
"url": "https://www.tbsnews.net/node/1349126"
}
],
"checked": "2026-11-08",
"domain": "ecs.gov.bd",
"logo": "ecs.gov.bd",
"actor_ids": [],
"id": "c594203f"
},
{
"org": "Labaid Cancer Hospital and Super Speciality Centre",
"sector": "health",
"date": "2026-10-23",
"type": "ransomware",
"actor": "Qilin",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "Qilin listed the hospital on its leak site. No statement from the hospital was found.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/TGFiYWlkIENhbmNlciBIb3NwaXRhbCBBbmQgU3VwZXIgU3BlY2lhbGl0eSBDZW50ZXJAcWlsaW4"
}
],
"checked": "2026-11-08",
"domain": "labaidgroup.com",
"logo": "labaidgroup.com",
"actor_ids": [
"qilin"
],
"id": "3bd87574"
},
{
"org": "BRAC",
"sector": "other",
"date": "2026-07-16",
"type": "ransomware",
"actor": "The Gentlemen",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "The Gentlemen listed BRAC on its leak site and threatened to publish data. BRAC has not commented.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/QlJBQ0B0aGVnZW50bGVtZW4"
}
],
"checked": "2026-11-08",
"domain": "brac.net",
"logo": "brac.net",
"actor_ids": [
"the-gentlemen"
],
"id": "7b34758d"
},
{
"org": "Palli Karma-Sahayak Foundation (PKSF)",
"sector": "finance",
"date": "2026-09-28",
"type": "ransomware",
"actor": "MedusaLocker",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "MedusaLocker listed the state-backed microfinance apex body on its leak site.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/UEtTRiDigJQgUGFsbGkgS2FybWEtU2FoYXlhayBGb3VuZGF0aW9uQG1lZHVzYWxvY2tlcg"
}
],
"checked": "2026-11-08",
"domain": "pksf.org.bd",
"logo": "pksf.org.bd",
"actor_ids": [
"medusalocker"
],
"id": "b4cc4691"
},
{
"org": "Bank Asia",
"sector": "finance",
"date": "2026-04-27",
"type": "data-leak",
"actor": "APT73",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "APT73 listed bankasia-bd.com on its leak site. No statement from the bank was found.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/YmFua2FzaWEtYmQuY29tQGFwdDcz"
}
],
"checked": "2026-11-08",
"domain": "bankasia-bd.com",
"logo": "bankasia-bd.com",
"actor_ids": [
"apt73"
],
"id": "a3485e62"
},
{
"org": "NOVOAIR",
"sector": "transport",
"date": "2026-04-27",
"type": "data-leak",
"actor": "APT73",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "APT73 listed the private airline's domain novoair-bd.com on its leak site the same day as Bank Asia.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/bm92b2Fpci1iZC5jb21AYXB0NzM"
}
],
"checked": "2026-11-08",
"domain": "novoair-bd.com",
"actor_ids": [
"apt73"
],
"id": "7065aabc"
}
],
"since": "2026-01-01",
"stats": [],
"rules": [],
"actors": [
{
"name": "SideWinder-associated cluster",
"kind": "state",
"seen": "BGD e-GOV CIRT found Bangladesh government systems on target lists in September 2026 and said attribution is not conclusive.",
"sources": [
{
"name": "BGD e-GOV CIRT",
"url": "https://www.cirt.gov.bd/advisories/sidewinder-associated-campaign"
}
]
},
{
"name": "SideCopy",
"kind": "state",
"seen": "BGD e-GOV CIRT issued a September 2026 advisory on a SideCopy campaign using weaponised LNK files and a fileless RAT.",
"sources": [
{
"name": "BGD e-GOV CIRT",
"url": "https://www.cirt.gov.bd/advisories/sidecopy-campaign-sep-26"
}
]
}
],
"slug": "bangladesh",
"title": "Bangladesh Cyber Incidents and Data Breaches 2026 · pwnsy",
"lede": "No public threat level. 1 incident confirmed, 5 claims in 2026.",
"h1": "![\"\"](\"/tools/cyber-watch/flags/bd.svg\")
Bangladesh Cyber Watch",
"desc": "Bangladesh cyber threat level: none published. 1 incident confirmed and 5 claims in 2026, each sourced. Updated 8 Nov 2026.",
"upd": "2026-11-08"
},
"LK": {
"name": "Sri Lanka",
"subject": "Sri Lanka",
"region": "Asia-Pacific",
"posture": {
"level": "",
"summary": "Sri Lanka publishes no cyber threat level; Sri Lanka CERT issues alerts and security advisories.",
"agency": "Sri Lanka CERT",
"source": {
"name": "Sri Lanka CERT",
"url": "https://www.cert.gov.lk/"
},
"checked": "2026-11-07"
},
"timeline": [
{
"date": "2026-04-22",
"text": "The Finance Ministry said cyber hackers had breached its systems and caused a US$2.5 million loss.",
"url": "https://www.ft.lk/front-page/Treasury-officially-responds-Claims-hackers-behind-theft-of-funds/44-791018",
"src": "Daily FT"
},
{
"date": "2026-04-25",
"text": "Deputy Minister Eranga Weeraratne said the Treasury loss looked like phishing and impersonation, with Sri Lanka CERT among the investigators.",
"url": "https://www.ft.lk/front-page/Digital-Economy-Ministry-says-2-5-m-Treasury-breach-not-system-hack/44-791129",
"src": "Daily FT"
},
{
"date": "2026-10-21",
"text": "Sri Lanka CERT issued a PHP security advisory.",
"url": "https://www.cert.gov.lk/",
"src": "Sri Lanka CERT"
},
{
"date": "2026-05-07",
"text": "Police arrested 30 Chinese and Vietnamese nationals over cyberscams, bringing the total detained to 261.",
"url": "https://www.straitstimes.com/asia/south-asia/sri-lanka-arrests-more-than-260-foreigners-over-cyberscams",
"src": "The Straits Times",
"kind": "enforcement"
}
],
"incidents": [
{
"org": "Ministry of Finance (Treasury)",
"sector": "government",
"date": "2026-04-22",
"type": "other",
"actor": "",
"status": "confirmed",
"vendor": false,
"confirmed": "The Finance Ministry said hackers diverted about US$2.5 million of a debt payment to Australia; the Deputy Minister of Digital Economy later called it a phishing and impersonation scam.",
"claimed": "",
"sources": [
{
"name": "Daily FT",
"url": "https://www.ft.lk/front-page/Treasury-officially-responds-Claims-hackers-behind-theft-of-funds/44-791018"
},
{
"name": "Daily FT",
"url": "https://www.ft.lk/front-page/Digital-Economy-Ministry-says-2-5-m-Treasury-breach-not-system-hack/44-791129"
}
],
"checked": "2026-11-07",
"domain": "treasury.gov.lk",
"logo": "treasury.gov.lk",
"actor_ids": [],
"id": "8a69bedb"
},
{
"org": "SriLankan Airlines",
"sector": "transport",
"date": "2026-05-16",
"type": "other",
"actor": "",
"status": "confirmed",
"vendor": true,
"confirmed": "SriLankan Airlines said AED 974,000 went to a fraudster after a Dubai service provider's email account was compromised and bank details were changed.",
"claimed": "",
"sources": [
{
"name": "Daily Mirror",
"url": "https://www.dailymirror.lk/breaking-news/SriLankan-clarifies-UAE-fraud-Chennai-fund-misuse-cases/108-340430"
}
],
"checked": "2026-11-07",
"domain": "srilankan.com",
"logo": "srilankan.com",
"actor_ids": [],
"id": "88ecad35"
},
{
"org": "Ministry of Public Security",
"sector": "government",
"date": "2026-01-13",
"type": "intrusion",
"actor": "",
"status": "confirmed",
"vendor": false,
"confirmed": "Police said the CID is probing unauthorised access to the ministry's website. Sri Lanka CERT and ICTA restored the site.",
"claimed": "",
"sources": [
{
"name": "Daily FT",
"url": "https://www.ft.lk/news/CID-probes-suspected-cyber-breach-of-Public-Security-Ministry-website/56-786884"
}
],
"checked": "2026-11-08",
"domain": "",
"actor_ids": [],
"id": "a098312d"
},
{
"org": "Sri Lanka Railways",
"sector": "transport",
"date": "2026-06-14",
"type": "intrusion",
"actor": "",
"status": "confirmed",
"vendor": false,
"confirmed": "Railway officials said a cyberattack hit the online timetable system, which was taken offline as a precaution. The rest of the site was unaffected.",
"claimed": "",
"sources": [
{
"name": "Newswire",
"url": "https://www.newswire.lk/z3cd"
},
{
"name": "Daily FT",
"url": "https://www.ft.lk/news/Railways-website-bombarded-with-cyberattacks-hours-after-launch-Minister/56-793411"
}
],
"checked": "2026-11-08",
"domain": "railway.gov.lk",
"logo": "railway.gov.lk",
"actor_ids": [],
"id": "21fb11d7"
},
{
"org": "Abans Group",
"sector": "retail",
"date": "2026-07-01",
"type": "ransomware",
"actor": "BlackNevas",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "BlackNevas listed the retail and services group on its leak site. No statement from Abans was found.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/QWJhbnMgR3JvdXBAYmxhY2tuZXZhcw"
}
],
"checked": "2026-11-08",
"domain": "abansgroup.com",
"logo": "abansgroup.com",
"actor_ids": [
"blacknevas"
],
"id": "98298ef9"
},
{
"org": "Synex International",
"sector": "other",
"date": "2026-06-01",
"type": "ransomware",
"actor": "DragonForce",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "DragonForce listed Synex International on its leak site.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/U3luZXggSW50ZXJuYXRpb25hbCBQdnQgTHRkQGRyYWdvbmZvcmNl"
}
],
"checked": "2026-11-08",
"domain": "",
"actor_ids": [
"dragonforce"
],
"id": "fc8d347b"
},
{
"org": "Ceywater Consultants",
"sector": "other",
"date": "2026-05-01",
"type": "data-leak",
"actor": "World Leaks",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "World Leaks listed the engineering consultancy on its leak site.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/Q2V5d2F0ZXIgQ29uc3VsdGFudHNAd29ybGRsZWFrcw"
}
],
"checked": "2026-11-08",
"domain": "ceywater.com",
"logo": "ceywater.com",
"actor_ids": [
"world-leaks"
],
"id": "2b01eae5"
}
],
"since": "2026-01-01",
"stats": [
{
"label": "Cyber-related financial fraud complaints to SLCERT",
"value": "360",
"period": "January to early June 2026",
"source": {
"name": "Daily FT",
"url": "https://www.ft.lk/front-page/SLCERT-warns-of-AI-deepfake-investment-scams-as-cyber-fraud-cases-reach-360/44-792954"
}
}
],
"rules": [],
"actors": [],
"slug": "sri-lanka",
"title": "Sri Lanka Cyber Incidents and Data Breaches 2026 · pwnsy",
"lede": "No public threat level. 4 incidents confirmed, 3 claims in 2026.",
"h1": "![\"\"](\"/tools/cyber-watch/flags/lk.svg\")
Sri Lanka Cyber Watch",
"desc": "Sri Lanka cyber threat level: none published. 4 incidents confirmed and 3 claims in 2026, each sourced. Updated 8 Nov 2026.",
"upd": "2026-11-08"
},
"KH": {
"name": "Cambodia",
"subject": "Cambodia",
"region": "Southeast Asia",
"posture": {
"level": "",
"summary": "Cambodia publishes no cyber threat level; CamCERT issues numbered CamSA security alerts and runs scam prevention training.",
"agency": "CamCERT",
"source": {
"name": "CamCERT",
"url": "https://www.camcert.gov.kh/"
},
"checked": "2026-11-07"
},
"timeline": [
{
"date": "2026-01-08",
"text": "The National Bank of Cambodia ordered Prince Bank liquidated.",
"url": "https://www.france24.com/en/live-news/20260108-cambodia-to-liquidate-bank-founded-by-accused-scam-boss",
"src": "France 24"
},
{
"date": "2026-07-06",
"text": "CamCERT trained about 80 Kampot officials on digital security and online scam prevention.",
"url": "https://www.camcert.gov.kh/online-scam-prevention-kp/",
"src": "CamCERT"
},
{
"date": "2026-10-23",
"text": "CamCERT issued alert CamSA26-39 on critical PHP vulnerabilities.",
"url": "https://www.camcert.gov.kh/php-vl-oct-26/",
"src": "CamCERT"
},
{
"date": "2026-01-06",
"text": "Cambodian authorities said they arrested Prince Group founder Chen Zhi and two other Chinese nationals and extradited them to China, which confirmed the handover.",
"url": "https://www.france24.com/en/live-news/20260108-cambodia-to-liquidate-bank-founded-by-accused-scam-boss",
"src": "France 24 (AFP)",
"kind": "enforcement"
},
{
"date": "2026-01-08",
"text": "The National Bank of Cambodia placed Prince Bank into liquidation and suspended new deposits and lending.",
"url": "https://www.france24.com/en/live-news/20260108-cambodia-to-liquidate-bank-founded-by-accused-scam-boss",
"src": "France 24 (AFP)",
"kind": "enforcement"
}
],
"incidents": [
{
"org": "Ministry of National Defence (Information Collection Bureau) and Ministry of Public Works and Transport",
"sector": "government",
"date": "2026-06-10",
"type": "intrusion",
"actor": "Khmer Shadow",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "Acronis reported two espionage campaigns using government-themed lures aimed at the ICB and the public works ministry. The government has not commented.",
"sources": [
{
"name": "Acronis TRU",
"url": "https://www.acronis.com/en/tru/posts/behind-khmer-shadow-targeted-espionage-against-cambodian-government-entities/"
}
],
"checked": "2026-11-08",
"domain": "",
"actor_ids": [
"khmer-shadow"
],
"id": "86de05d3"
},
{
"org": "ChokChey Finance",
"sector": "finance",
"date": "2026-02-02",
"type": "ransomware",
"actor": "INC Ransom",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "INC Ransom listed the microfinance lender on its leak site.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/Q2hva0NoZXkgRmluYW5jZUBpbmNyYW5zb20"
}
],
"checked": "2026-11-08",
"domain": "chokchey.com.kh",
"logo": "chokchey.com.kh",
"actor_ids": [
"inc-ransom"
],
"id": "b3203a6f"
},
{
"org": "First Cambodia",
"sector": "other",
"date": "2026-04-17",
"type": "ransomware",
"actor": "SafePay",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "SafePay listed firstcambodia.com.kh on its leak site.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/Zmlyc3RjYW1ib2RpYS5jb20ua2hAc2FmZXBheQ"
}
],
"checked": "2026-11-08",
"domain": "firstcambodia.com.kh",
"logo": "firstcambodia.com.kh",
"actor_ids": [
"safepay"
],
"id": "072ea409"
}
],
"since": "2026-01-01",
"stats": [],
"rules": [],
"actors": [
{
"name": "Prince Group",
"kind": "scam-syndicate",
"seen": "Founder Chen Zhi was extradited to China in January 2026; Taiwan indicted 62 people tied to its Cambodian scam centres in March.",
"sources": [
{
"name": "France 24 (AFP)",
"url": "https://www.france24.com/en/live-news/20260108-cambodia-to-liquidate-bank-founded-by-accused-scam-boss"
},
{
"name": "DW",
"url": "https://www.dw.com/en/taiwan-indicts-62-linked-to-alleged-scam-center-in-cambodia/a-76207992"
}
]
}
],
"slug": "cambodia",
"title": "Cambodia Cyber Incidents and Data Breaches 2026 · pwnsy",
"lede": "No public threat level. 0 incidents confirmed, 3 claims in 2026.",
"h1": "![\"\"](\"/tools/cyber-watch/flags/kh.svg\")
Cambodia Cyber Watch",
"desc": "Cambodia cyber threat level: none published. 0 incidents confirmed and 3 claims in 2026, each sourced. Updated 8 Nov 2026.",
"upd": "2026-11-08"
},
"MM": {
"name": "Myanmar",
"subject": "Myanmar",
"region": "Southeast Asia",
"posture": {
"level": "",
"summary": "Myanmar publishes no cyber threat level; mmCERT posts Burmese-language alerts on vulnerabilities and phishing campaigns.",
"agency": "mmCERT",
"source": {
"name": "mmCERT",
"url": "https://www.mmcert.org.mm/"
},
"checked": "2026-11-07"
},
"timeline": [
{
"date": "2026-05-15",
"text": "mmCERT warned of a high-severity Apache HTTP Server vulnerability.",
"url": "https://www.mmcert.org.mm/en/services/alerts/2026-05-27t2114170630",
"src": "mmCERT"
},
{
"date": "2026-08-28",
"text": "mmCERT warned that Operation QUICSILVER spear-phishing with disguised LNK files targets government ministries.",
"url": "https://www.mmcert.org.mm/mm/services/alerts/2026-10-05t1054220630",
"src": "mmCERT"
},
{
"date": "2026-10-11",
"text": "Authorities said a man arrested on 10 September attacked a college, a job site, a telecom site, a digital payment system and a government online service.",
"url": "https://www.thestar.com.my/aseanplus/aseanplus-news/2026/10/11/myanmar-arrests-man-for-cyberattacks-on-government-networks-private-online-services-and-digital-payment-systems",
"src": "The Star (Eleven Media/ANN)"
}
],
"incidents": [
{
"org": "AYA Bank",
"sector": "finance",
"date": "2026-06-25",
"type": "data-leak",
"actor": "Lapsus$",
"status": "confirmed",
"vendor": false,
"confirmed": "AYA Bank said non-financial data from an old application portal was exposed. It said core banking, AYA Pay and cards were not affected.",
"claimed": "Lapsus$ claimed on 23 June to hold over 120 GB of bank data and demanded a ransom.",
"sources": [
{
"name": "The Star",
"url": "https://www.thestar.com.my/aseanplus/aseanplus-news/2026/06/26/old-aya-bank-application-portal-suffers-limited-data-leak-in-myanmar-core-banking-systems-unaffected"
},
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/QVlBIEJBTktAbGFwc3VzJA"
}
],
"checked": "2026-11-08",
"domain": "ayabank.com",
"logo": "ayabank.com",
"actor_ids": [
"lapsus"
],
"id": "2fc10d81"
},
{
"org": "Ooredoo Myanmar (Nine Communications)",
"sector": "telecom",
"date": "2026-10-25",
"type": "ransomware",
"actor": "Qilin",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "Qilin listed Ooredoo Myanmar on its leak site.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/T29yZWRvbyBNeWFubWFyQHFpbGlu"
}
],
"checked": "2026-11-08",
"domain": "",
"actor_ids": [
"qilin"
],
"id": "e23598f1"
},
{
"org": "Myanmar Broadband Telecom (MBT)",
"sector": "telecom",
"date": "2026-09-04",
"type": "data-leak",
"actor": "DYSPHOR1A",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "DYSPHOR1A claimed a full database compromise and threatened to leak about 210,000 user records.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/TUJUIFRlbGVjb21ARFlTUEhPUjFB"
},
{
"name": "DeXpose",
"url": "https://www.dexpose.io/dysphor1a-strikes-myanmars-mbt-telecom/"
}
],
"checked": "2026-11-08",
"domain": "",
"actor_ids": [
"dysphor1a"
],
"id": "3d812847"
},
{
"org": "CitizensPay",
"sector": "finance",
"date": "2026-09-05",
"type": "data-leak",
"actor": "DYSPHOR1A",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "DYSPHOR1A listed the digital payment provider on its leak site.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/Q2l0aXplbnNQYXlARFlTUEhPUjFB"
}
],
"checked": "2026-11-08",
"domain": "",
"actor_ids": [
"dysphor1a"
],
"id": "967a5d0e"
},
{
"org": "Road Transport Administration Department",
"sector": "government",
"date": "2026-09-06",
"type": "data-leak",
"actor": "DYSPHOR1A",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "DYSPHOR1A listed RTAD, the vehicle registration authority, on its leak site.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/UlRBRCBHT1YgTU1ARFlTUEhPUjFB"
}
],
"checked": "2026-11-08",
"domain": "",
"actor_ids": [
"dysphor1a"
],
"id": "2ce9dfa1"
},
{
"org": "Yoma Fleet",
"sector": "transport",
"date": "2026-08-21",
"type": "data-leak",
"actor": "DYSPHOR1A",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "DYSPHOR1A listed the vehicle leasing and rental firm on its leak site.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/WW9tYSBGbGVldEBEWVNQSE9SMUE"
}
],
"checked": "2026-11-08",
"domain": "yomafleet.com",
"logo": "yomafleet.com",
"actor_ids": [
"dysphor1a"
],
"id": "ef388910"
}
],
"since": "2026-01-01",
"stats": [],
"rules": [],
"actors": [],
"slug": "myanmar",
"title": "Myanmar Cyber Incidents and Data Breaches 2026 · pwnsy",
"lede": "No public threat level. 1 incident confirmed, 5 claims in 2026.",
"h1": "![\"\"](\"/tools/cyber-watch/flags/mm.svg\")
Myanmar Cyber Watch",
"desc": "Myanmar cyber threat level: none published. 1 incident confirmed and 5 claims in 2026, each sourced. Updated 8 Nov 2026.",
"upd": "2026-11-08"
},
"BN": {
"name": "Brunei",
"subject": "Brunei",
"region": "Southeast Asia",
"posture": {
"level": "",
"summary": "Brunei publishes no cyber threat level; Cyber Security Brunei issues BruCERT alerts and annual incident statistics.",
"agency": "Cyber Security Brunei (BruCERT)",
"source": {
"name": "Cyber Security Brunei",
"url": "https://www.csb.gov.bn/"
},
"checked": "2026-11-07"
},
"timeline": [
{
"date": "2026-09-14",
"text": "Cyber Security Brunei released version 2.0 of the CII Code of Practice.",
"url": "https://www.csb.gov.bn/cyber-security-brunei-updates-code-practice-cii-and-issues-new-ai-secure-design-guidelines",
"src": "Cyber Security Brunei"
},
{
"date": "2026-10-22",
"text": "BruCERT issued an advisory on the PHP2Shell remote code execution flaws.",
"url": "https://www.brucert.org.bn/brucert-advisory-critical-remote-code-execution-vulnerabilities-php-php2shell-cve-2026-109618-and",
"src": "BruCERT"
},
{
"date": "2026-11-03",
"text": "BruCERT warned of fake invoice attachments.",
"url": "https://www.brucert.org.bn/brucert-alert-fake-invoice-attachments",
"src": "BruCERT"
}
],
"incidents": [],
"since": "2026-01-01",
"stats": [
{
"label": "Phishing websites recorded",
"value": "623",
"period": "2025",
"source": {
"name": "BruCERT NCIS 2025",
"url": "https://www.brucert.org.bn/national-cyber-incident-statistics-ncis-2025"
}
},
{
"label": "Phishing domains recorded",
"value": "221",
"period": "2025",
"source": {
"name": "BruCERT NCIS 2025",
"url": "https://www.brucert.org.bn/national-cyber-incident-statistics-ncis-2025"
}
}
],
"rules": [
{
"date": "2026-09-14",
"title": "Code of Practice for Critical Information Infrastructure v2.0",
"what": "Adds clauses on secure AI use and Secure by Design under the Cybersecurity Act (Chapter 272), with new AI Security and Secure by Design guidelines.",
"url": "https://www.csb.gov.bn/cyber-security-brunei-updates-code-practice-cii-and-issues-new-ai-secure-design-guidelines"
}
],
"actors": [],
"slug": "brunei",
"title": "Brunei Cyber Incidents and Data Breaches 2026 · pwnsy",
"lede": "No public threat level. 0 incidents confirmed, 0 claims in 2026.",
"h1": "![\"\"](\"/tools/cyber-watch/flags/bn.svg\")
Brunei Cyber Watch",
"desc": "Brunei cyber threat level: none published. 0 incidents confirmed and 0 claims in 2026, each sourced. Updated 7 Nov 2026.",
"upd": "2026-11-07"
},
"PL": {
"name": "Poland",
"subject": "Poland's cyber alert level and 2026 incidents",
"region": "Europe",
"posture": {
"level": "BRAVO-CRP",
"summary": "The Prime Minister sets one of four CRP cyberspace alert levels by order; Order No. 34 of 25 May 2026 kept BRAVO-CRP in force nationwide from 1 June to 31 August 2026.",
"agency": "Ministry of Digital Affairs and CERT Polska (NASK)",
"source": {
"name": "Statistics Poland (GUS), Krakow office notice",
"url": "https://krakow.new.stat.gov.pl/en/news/extension-bravo-and-bravo-crp-security-alert-levels"
},
"prev": "",
"since": "",
"scale": [
"ALFA-CRP",
"BRAVO-CRP",
"CHARLIE-CRP",
"DELTA-CRP"
],
"checked": "2026-11-07"
},
"timeline": [
{
"date": "2026-01-15",
"text": "PM Donald Tusk said end-of-2025 attacks on two heat and power plants and renewable sites could not cause a blackout and pointed to Russian services.",
"url": "https://www.polskieradio.pl/395/7784/Artykul/3634276",
"src": "Polskie Radio"
},
{
"date": "2026-05-07",
"text": "The Internal Security Agency (ABW) reported breaches at five water treatment stations.",
"url": "https://therecord.media/polish-intelligence-warns-hackers-attacked-water-treatment",
"src": "The Record"
},
{
"date": "2026-07-13",
"text": "The EU and UK formally blamed FSB Center 16 for the attack on Poland's energy grid and imposed sanctions.",
"url": "https://therecord.media/russia-blamed-for-poland-grid-cyberattack-in-joint-uk-eu-sanctions-package",
"src": "The Record"
},
{
"date": "2026-08-08",
"text": "CERT Polska said the attacker reached a second heat plant's OT network through a misconfigured private APN.",
"url": "https://cert.pl/en/posts/2026/08/incident-follow-up-report-energy-sector-2025/",
"src": "CERT Polska"
}
],
"incidents": [
{
"org": "Zabka",
"sector": "retail",
"date": "2026-08-04",
"type": "intrusion",
"actor": "",
"status": "confirmed",
"vendor": true,
"confirmed": "Zabka confirmed unauthorised access to technical systems through a third-party provider's account, and Digital Affairs Minister Krzysztof Gawkowski said customer and payment data were not affected.",
"claimed": "Unidentified sellers offered allegedly stolen internal data, including source code and credentials, for 5,000 euros on a cybercrime forum.",
"sources": [
{
"name": "The Record",
"url": "https://therecord.media/poland-convenience-store-chain-zabka-cyberattack"
}
],
"checked": "2026-11-07",
"domain": "zabka.pl",
"logo": "zabka.pl",
"actor_ids": [],
"id": "58e08ee0"
},
{
"org": "MyDr",
"sector": "health",
"date": "2026-08-17",
"type": "data-leak",
"actor": "Fingerprint",
"status": "confirmed",
"vendor": true,
"confirmed": "MyDr, a software supplier to clinics, confirmed external criminal access to historical data, and Minister Gawkowski said P1 connection certificates were being replaced as a precaution.",
"claimed": "People claiming responsibility sent alleged samples of patient data to Zaufana Trzecia Strona; the claims are unverified.",
"sources": [
{
"name": "The Record",
"url": "https://therecord.media/poland-probes-mydr-healthcare-software-breach"
}
],
"checked": "2026-11-07",
"domain": "mydr.pl",
"logo": "mydr.pl",
"actor_ids": [
"fingerprint"
],
"id": "9352c1f3"
},
{
"org": "Medyc (Qbusoft) medical records platform",
"sector": "health",
"date": "2026-09-09",
"type": "data-leak",
"actor": "Fingerprint",
"status": "confirmed",
"vendor": true,
"confirmed": "Medyc confirmed theft of patient identity data after an SQL injection, Minister Gawkowski said the cybercrime bureau is investigating, and the data protection authority ordered an audit.",
"claimed": "An actor called Fingerprint claimed records on 5 million patients and 8 million photos.",
"sources": [
{
"name": "The Record",
"url": "https://therecord.media/poland-cyberattack-medical-medyc"
}
],
"checked": "2026-11-07",
"domain": "medyc.pl",
"logo": "medyc.pl",
"actor_ids": [
"fingerprint"
],
"id": "04f9e1ca"
},
{
"org": "Fakturownia",
"sector": "other",
"date": "2026-10-01",
"type": "data-leak",
"actor": "Fingerprint",
"status": "confirmed",
"vendor": true,
"confirmed": "Fakturownia, an invoicing platform used by over 600,000 businesses, confirmed unauthorised server access, and the Finance Ministry said the national e-invoicing system KSeF was not breached.",
"claimed": "Fingerprint claimed to have stolen 6 TB of invoices.",
"sources": [
{
"name": "The Record",
"url": "https://therecord.media/poland-cyberattack-invoice-software"
}
],
"checked": "2026-11-07",
"domain": "fakturownia.pl",
"logo": "fakturownia.pl",
"actor_ids": [
"fingerprint"
],
"id": "728ba2de"
},
{
"org": "Personal Gmail users in Poland",
"sector": "other",
"date": "2026-06-12",
"type": "other",
"actor": "UNC1151 (Ghostwriter)",
"status": "confirmed",
"vendor": false,
"confirmed": "CERT Polska reported a high-intensity UNC1151 phishing campaign against Polish Gmail users, active since March 2026.",
"claimed": "",
"sources": [
{
"name": "CERT Polska",
"url": "https://cert.pl/en/posts/2026/06/UNC1151-gmail-campaign/"
}
],
"checked": "2026-11-07",
"actor_ids": [
"unc1151"
],
"id": "825673f1"
}
],
"since": "2026-01-01",
"stats": [
{
"label": "Cyberattacks recorded in Poland",
"value": "270,000",
"period": "2025",
"source": {
"name": "The Star (AFP), citing Deputy Digital Affairs Minister Pawel Olszewski",
"url": "https://www.thestar.com.my/tech/tech-news/2026/03/25/poland-faced-a-surge-in-cyberattacks-in-2025-including-a-major-assault-on-the-energy-sector"
}
},
{
"label": "Energy facilities hit in the 29 December 2025 campaign",
"value": "At least 32",
"period": "December 2025, reported August 2026",
"source": {
"name": "CERT Polska follow-up report",
"url": "https://cert.pl/en/posts/2026/08/incident-follow-up-report-energy-sector-2025/"
}
},
{
"label": "Water treatment stations breached, per ABW report",
"value": "5",
"period": "2025, reported May 2026",
"source": {
"name": "The Record",
"url": "https://therecord.media/polish-intelligence-warns-hackers-attacked-water-treatment"
}
}
],
"rules": [
{
"date": "2026-04-03",
"title": "Amendment to the Act on the National Cybersecurity System (KSC)",
"what": "Transposes the EU NIS2 Directive; signed by President Nawrocki on 19 February 2026 and in force from 3 April 2026.",
"url": "https://www.osborneclarke.com/insights/polands-amendment-national-cybersecurity-system-act-has-been-signed-president"
}
],
"actors": [
{
"name": "UNC1151 (Ghostwriter)",
"kind": "state",
"seen": "Phishing Polish public figures and Gmail users through 2026, per CERT Polska.",
"sources": [
{
"name": "CERT Polska",
"url": "https://cert.pl/en/posts/2026/06/UNC1151-gmail-campaign/"
}
],
"actor_id": "unc1151"
},
{
"name": "FSB Center 16",
"kind": "state",
"seen": "Named by the EU and UK in July 2026 for the December 2025 attack on Poland's energy grid and attempted sabotage of water facilities.",
"sources": [
{
"name": "The Record",
"url": "https://therecord.media/russia-blamed-for-poland-grid-cyberattack-in-joint-uk-eu-sanctions-package"
}
]
},
{
"name": "Fingerprint",
"kind": "extortion",
"seen": "Claimed the MyDr, Medyc and Fakturownia breaches in August to October 2026.",
"sources": [
{
"name": "The Record",
"url": "https://therecord.media/poland-cyberattack-invoice-software"
}
],
"actor_id": "fingerprint"
}
],
"slug": "poland",
"title": "Poland Cyber Threat Level: BRAVO-CRP, 2026 Incidents · pwnsy",
"lede": "Threat level BRAVO-CRP (latest order). 5 incidents confirmed, 0 claims in 2026.",
"h1": "![\"\"](\"/tools/cyber-watch/flags/pl.svg\")
Poland Cyber Watch",
"desc": "Poland cyber threat level: BRAVO-CRP. 5 incidents confirmed and 0 claims in 2026, each sourced. Updated 7 Nov 2026.",
"upd": "2026-11-07"
},
"UA": {
"name": "Ukraine",
"subject": "Ukraine's cyber threat posture and 2026 incidents",
"region": "Europe",
"posture": {
"level": "",
"summary": "Ukraine publishes no national cyber alert level; CERT-UA signals threats through dated alerts that name tracked clusters such as UAC-0001 (APT28).",
"agency": "CERT-UA, under the State Service of Special Communications and Information Protection (SSSCIP)",
"source": {
"name": "CERT-UA",
"url": "https://cert.gov.ua/article/6287250"
},
"checked": "2026-11-07"
},
"timeline": [
{
"date": "2026-02-01",
"text": "CERT-UA warned that APT28 was exploiting Office flaw CVE-2026-21509 against Ukraine and EU states.",
"url": "https://cert.gov.ua/article/6287250",
"src": "CERT-UA"
},
{
"date": "2026-04-03",
"text": "CERT-UA said Russian hackers were revisiting past breaches where root causes were not fixed.",
"url": "https://therecord.media/ukraine-warns-russian-hackers-revisiting-old-attacks",
"src": "The Record"
},
{
"date": "2026-04-15",
"text": "CERT-UA reported a surge of attacks on hospitals and local authorities.",
"url": "https://cert.gov.ua/article/6288271",
"src": "CERT-UA"
},
{
"date": "2026-09-15",
"text": "President Zelensky appointed Ihor Klymenko to head the National Cybersecurity Coordination Center.",
"url": "https://therecord.media/ukraine-cyber-coordination-center-ihor-klymenko",
"src": "The Record"
}
],
"incidents": [
{
"org": "National Bank of Ukraine online coin store",
"sector": "finance",
"date": "2026-02-19",
"type": "supply-chain",
"actor": "",
"status": "confirmed",
"vendor": true,
"confirmed": "The National Bank of Ukraine said attackers breached a contractor supporting its numismatic store and may have accessed customer registration data, with no payment data affected.",
"claimed": "",
"sources": [
{
"name": "The Record",
"url": "https://therecord.media/hackers-breach-ukraine-national-bank-contractor"
}
],
"checked": "2026-11-07",
"domain": "bank.gov.ua",
"logo": "bank.gov.ua",
"actor_ids": [],
"id": "3c849b30"
},
{
"org": "Prosecutors and anti-corruption bodies (SAP, ARMA)",
"sector": "government",
"date": "2026-04-17",
"type": "intrusion",
"actor": "APT28",
"status": "confirmed",
"vendor": false,
"confirmed": "SSSCIP official Taras Dzyuba confirmed attacks on prosecutors' email accounts, and ARMA's acting head said staff were targeted without access to internal systems.",
"claimed": "Researchers attributed the campaign to APT28, and Dzyuba said all indications point to that group.",
"sources": [
{
"name": "The Record",
"url": "https://therecord.media/ukraine-confirms-suspected-apt28-campaign-targeting-prosecutors"
}
],
"checked": "2026-11-07",
"actor_ids": [
"apt28"
],
"id": "3e974e2d"
},
{
"org": "Municipal hospitals and local authorities",
"sector": "health",
"date": "2026-04-15",
"type": "intrusion",
"actor": "UAC-0244 (merged with UAC-0247)",
"status": "confirmed",
"vendor": false,
"confirmed": "CERT-UA reported intensified attacks on local government bodies and municipal hospitals, including emergency care hospitals, in March and April 2026.",
"claimed": "",
"sources": [
{
"name": "CERT-UA",
"url": "https://cert.gov.ua/article/6288271"
}
],
"checked": "2026-11-07",
"actor_ids": [
"uac-0244"
],
"id": "7d138bc1"
},
{
"org": "Ukrposhta",
"sector": "other",
"date": "2026-06-25",
"type": "intrusion",
"actor": "IT Army of Russia",
"status": "confirmed",
"vendor": false,
"confirmed": "Ukrposhta said an enemy cyberattack on its IT systems temporarily disrupted its mobile app.",
"claimed": "IT Army of Russia claimed on Telegram that it had exfiltrated a user database weeks earlier.",
"sources": [
{
"name": "The Record",
"url": "https://therecord.media/ukraine-state-postal-operator-reports-disruption"
}
],
"checked": "2026-11-07",
"domain": "ukrposhta.ua",
"logo": "ukrposhta.ua",
"actor_ids": [
"it-army-of-russia"
],
"id": "402326a3"
},
{
"org": "ATB",
"sector": "retail",
"date": "2026-10-05",
"type": "intrusion",
"actor": "DataSuckers",
"status": "confirmed",
"vendor": false,
"confirmed": "ATB, Ukraine's largest grocery chain, confirmed a cyberattack and denied that customer data was compromised.",
"claimed": "DataSuckers claimed data on 7.9 million customers and demanded 400,000 dollars.",
"sources": [
{
"name": "The Record",
"url": "https://therecord.media/atb-ukraine-cyberattack-ransomware"
}
],
"checked": "2026-11-07",
"domain": "atbmarket.com",
"logo": "atbmarket.com",
"actor_ids": [
"datasuckers"
],
"id": "c84a32ac"
},
{
"org": "Air Alert app",
"sector": "other",
"date": "2026-11-01",
"type": "intrusion",
"actor": "Hitcore Corp",
"status": "confirmed",
"vendor": false,
"confirmed": "The app's developers said unauthorised individuals interfered with it, and Ukraine's Air Force said it was likely compromised by the enemy after fake nuclear and chemical alerts went out.",
"claimed": "A group calling itself Hitcore Corp claimed responsibility.",
"sources": [
{
"name": "The Record",
"url": "https://therecord.media/ukraine-hackers-russia-alert-system"
}
],
"checked": "2026-11-07",
"actor_ids": [
"hitcore-corp"
],
"id": "be00e20b"
},
{
"org": "The Kyiv Independent",
"sector": "media",
"date": "2026-11-04",
"type": "intrusion",
"actor": "",
"status": "confirmed",
"vendor": false,
"confirmed": "Editor-in-chief Olga Rudenko confirmed attackers took over the website management and newsletter systems to send fake messages; the outlet suspects Russia.",
"claimed": "",
"sources": [
{
"name": "The Record",
"url": "https://therecord.media/ukraine-kyiv-independent-cyberattack"
}
],
"checked": "2026-11-07",
"domain": "kyivindependent.com",
"logo": "kyivindependent.com",
"actor_ids": [],
"id": "e25b4cc9"
}
],
"since": "2026-01-01",
"stats": [
{
"label": "Government email addresses sent one APT28 phishing lure exploiting CVE-2026-21509",
"value": "More than 60",
"period": "January 2026",
"source": {
"name": "CERT-UA",
"url": "https://cert.gov.ua/article/6287250"
}
}
],
"rules": [
{
"date": "2026-06-17",
"title": "Ukraine admitted to the EU Cybersecurity Reserve",
"what": "EU member states approved Ukraine's access to the ENISA-managed pool of incident responders for large-scale cyberattacks.",
"url": "https://therecord.media/ukraine-access-eu-cybersecurity-reserve"
}
],
"actors": [
{
"name": "APT28 (UAC-0001)",
"kind": "state",
"seen": "CERT-UA reported Office exploit attacks in January 2026; prosecutors were targeted in April 2026.",
"sources": [
{
"name": "CERT-UA",
"url": "https://cert.gov.ua/article/6287250"
},
{
"name": "The Record",
"url": "https://therecord.media/ukraine-confirms-suspected-apt28-campaign-targeting-prosecutors"
}
],
"actor_id": "apt28"
},
{
"name": "UAC-0244",
"kind": "unknown",
"seen": "Targeted hospitals and local authorities in March and April 2026, per CERT-UA.",
"sources": [
{
"name": "CERT-UA",
"url": "https://cert.gov.ua/article/6288271"
}
],
"actor_id": "uac-0244"
},
{
"name": "IT Army of Russia",
"kind": "hacktivist",
"seen": "Claimed the Ukrposhta breach in June 2026.",
"sources": [
{
"name": "The Record",
"url": "https://therecord.media/ukraine-state-postal-operator-reports-disruption"
}
],
"actor_id": "it-army-of-russia"
}
],
"slug": "ukraine",
"title": "Ukraine Cyber Incidents and Data Breaches 2026 · pwnsy",
"lede": "No public threat level. 7 incidents confirmed, 0 claims in 2026.",
"h1": "![\"\"](\"/tools/cyber-watch/flags/ua.svg\")
Ukraine Cyber Watch",
"desc": "Ukraine cyber threat level: none published. 7 incidents confirmed and 0 claims in 2026, each sourced. Updated 7 Nov 2026.",
"upd": "2026-11-07"
},
"RU": {
"name": "Russia",
"subject": "Russia's cyber threat posture and 2026 incidents",
"region": "Europe",
"posture": {
"level": "",
"summary": "Russia publishes no cyber alert level; officials report blocked attack counts and usually blame foreign states, often without public evidence.",
"agency": "Roskomnadzor and the Ministry of Digital Development (public statements); FSB-run NKTsKI coordinates incident response",
"source": {
"name": "The Record",
"url": "https://therecord.media/russia-reports-cyberattacks-during-election"
},
"checked": "2026-11-07"
},
"timeline": [
{
"date": "2026-02-27",
"text": "Roskomnadzor said a DDoS attack hit its own sites and the Defense Ministry's, with traffic mainly from botnets inside Russia.",
"url": "https://therecord.media/cyberattack-briefly-takes-down-russian-government-websites",
"src": "The Record"
},
{
"date": "2026-06-04",
"text": "Russia's Supreme Court agreed to consider labelling Belarusian Cyber Partisans and Silent Crow extremist organisations.",
"url": "https://therecord.media/russia-seeks-extremist-label-for-hacker-groups",
"src": "The Record"
},
{
"date": "2026-09-20",
"text": "CEC chair Ella Pamfilova said election attacks came mainly from abroad and none compromised voting systems.",
"url": "https://therecord.media/russia-reports-cyberattacks-during-election",
"src": "The Record"
}
],
"incidents": [
{
"org": "Delta (alarm and security systems)",
"sector": "other",
"date": "2026-01-26",
"type": "intrusion",
"actor": "",
"status": "confirmed",
"vendor": false,
"confirmed": "Marketing director Valery Ushkov confirmed a cyberattack that the company blamed on a hostile foreign state.",
"claimed": "A Telegram channel claiming to be the attackers posted an archive of allegedly stolen data.",
"sources": [
{
"name": "The Record",
"url": "https://therecord.media/russia-delta-security-alarm-company-cyberattack"
}
],
"checked": "2026-11-07",
"domain": "delta.ru",
"actor_ids": [],
"id": "46af9dfb"
},
{
"org": "Roskomnadzor, Defense Ministry and Main Radio Frequency Center",
"sector": "government",
"date": "2026-02-27",
"type": "ddos",
"actor": "",
"status": "confirmed",
"vendor": false,
"confirmed": "Roskomnadzor said a complex multi-vector DDoS attack briefly disrupted access to its sites and those of the Defense Ministry and GRFC.",
"claimed": "",
"sources": [
{
"name": "The Record",
"url": "https://therecord.media/cyberattack-briefly-takes-down-russian-government-websites"
}
],
"checked": "2026-11-07",
"actor_ids": [],
"id": "bf76deb4"
},
{
"org": "Rostelecom",
"sector": "telecom",
"date": "2026-04-06",
"type": "ddos",
"actor": "",
"status": "confirmed",
"vendor": false,
"confirmed": "Rostelecom told TASS that a large-scale DDoS attack and its emergency filtering disrupted home internet in about 30 cities.",
"claimed": "",
"sources": [
{
"name": "The Record",
"url": "https://therecord.media/rostelecom-cyberattack-disrupts-russian-internet-access"
}
],
"checked": "2026-11-07",
"domain": "rt.ru",
"logo": "rt.ru",
"actor_ids": [],
"id": "707dd32a"
},
{
"org": "Kaluga Astral",
"sector": "other",
"date": "2026-06-15",
"type": "intrusion",
"actor": "",
"status": "confirmed",
"vendor": true,
"confirmed": "Kaluga Astral confirmed a cyberattack that disrupted tax reporting, cash register and certificate services for about a week.",
"claimed": "",
"sources": [
{
"name": "The Record",
"url": "https://therecord.media/cyberattack-on-russian-tech-firm-astral-disrupts-business-government-services"
}
],
"checked": "2026-11-07",
"domain": "astral.ru",
"logo": "astral.ru",
"actor_ids": [],
"id": "7b14d4b1"
},
{
"org": "Wildberries",
"sector": "retail",
"date": "2026-09-10",
"type": "ddos",
"actor": "Cyber Corps",
"status": "confirmed",
"vendor": false,
"confirmed": "Wildberries said a DDoS attack triggered security measures that delayed seller payouts.",
"claimed": "Ukraine's HUR intelligence agency claimed it ran a wider cyber operation against Wildberries with the group Cyber Corps.",
"sources": [
{
"name": "The Record",
"url": "https://therecord.media/russian-e-commerce-giant-wildberries-says-payments-disrupted"
}
],
"checked": "2026-11-07",
"domain": "wildberries.ru",
"logo": "wildberries.ru",
"actor_ids": [
"cyber-corps"
],
"id": "b0da45b9"
},
{
"org": "Dodo Pizza",
"sector": "retail",
"date": "2026-09-29",
"type": "data-leak",
"actor": "DataSuckers",
"status": "confirmed",
"vendor": false,
"confirmed": "Dodo Pizza confirmed attackers accessed customer personal data and said it notified Roskomnadzor.",
"claimed": "DataSuckers claimed records on 68 million customers and offered them for about 100,000 dollars.",
"sources": [
{
"name": "The Record",
"url": "https://therecord.media/russian-pizza-chain-dodo-confirms-data-breach"
}
],
"checked": "2026-11-07",
"domain": "dodopizza.ru",
"logo": "dodopizza.ru",
"actor_ids": [
"datasuckers"
],
"id": "31a57a25"
},
{
"org": "Beget",
"sector": "other",
"date": "2026-11-01",
"type": "intrusion",
"actor": "",
"status": "confirmed",
"vendor": false,
"confirmed": "Beget said on Telegram that attackers wiped data across its cloud infrastructure, disrupting hundreds of websites.",
"claimed": "",
"sources": [
{
"name": "The Record",
"url": "https://therecord.media/russia-cyberattack-beget-cloud"
}
],
"checked": "2026-11-07",
"domain": "beget.com",
"logo": "beget.com",
"actor_ids": [],
"id": "3c696c8f"
}
],
"since": "2026-01-01",
"stats": [
{
"label": "DDoS waves against election and government systems, per the Central Election Commission",
"value": "More than 3,000",
"period": "18 to 20 September 2026 (State Duma election)",
"source": {
"name": "The Record",
"url": "https://therecord.media/russia-reports-cyberattacks-during-election"
}
},
{
"label": "DDoS attacks from outside Russia, per Roskomnadzor",
"value": "More than 1,500",
"period": "18 to 20 September 2026",
"source": {
"name": "The Record",
"url": "https://therecord.media/russia-reports-cyberattacks-during-election"
}
},
{
"label": "Attacks blocked on online voting and e-government, per Deputy Minister Oleg Kachanov",
"value": "About 2,000",
"period": "18 to 20 September 2026",
"source": {
"name": "The Record",
"url": "https://therecord.media/russia-reports-cyberattacks-during-election"
}
}
],
"rules": [
{
"date": "2026-06-08",
"title": "Updated SORM technical standards (Ministry of Digital Development)",
"what": "Sets how operators search, process and pass data to the SORM surveillance system and widens searchable fields to IDs, URLs, device IDs and geolocation; published in late May 2026.",
"url": "https://therecord.media/russia-upgrades-rules-for-digital-spy-system-sorm"
}
],
"actors": [
{
"name": "DataSuckers",
"kind": "extortion",
"seen": "Claimed Dodo Pizza and other breaches; Russian authorities detained three suspected members in October 2026.",
"sources": [
{
"name": "The Record",
"url": "https://therecord.media/russia-datasuckers-hackers-arrested"
}
],
"actor_id": "datasuckers"
},
{
"name": "Cyber Corps (with Ukraine's HUR)",
"kind": "state",
"seen": "HUR claimed a joint operation against Wildberries in August 2026.",
"sources": [
{
"name": "The Record",
"url": "https://therecord.media/russian-e-commerce-giant-wildberries-says-payments-disrupted"
}
],
"actor_id": "cyber-corps"
},
{
"name": "Black Spark",
"kind": "hacktivist",
"seen": "Claimed the August 2026 breach of network monitoring firm Microolap, which confirmed partial compromise.",
"sources": [
{
"name": "The Record",
"url": "https://therecord.media/russian-network-monitoring-firm-confirms-cyberattack-claimed-by-pro-ukraine-group"
}
]
}
],
"slug": "russia",
"title": "Russia Cyber Incidents and Data Breaches 2026 · pwnsy",
"lede": "No public threat level. 7 incidents confirmed, 0 claims in 2026.",
"h1": "![\"\"](\"/tools/cyber-watch/flags/ru.svg\")
Russia Cyber Watch",
"desc": "Russia cyber threat level: none published. 7 incidents confirmed and 0 claims in 2026, each sourced. Updated 7 Nov 2026.",
"upd": "2026-11-07"
},
"CZ": {
"name": "Czechia",
"subject": "Czechia's cyber threat posture and 2026 incidents",
"region": "Europe",
"posture": {
"level": "",
"summary": "Czechia publishes no national cyber alert level; NUKIB issues warnings and monthly incident counts.",
"agency": "National Cyber and Information Security Agency (NUKIB)",
"source": {
"name": "Radio Prague International",
"url": "https://english.radio.cz/cyber-incidents-czechia-above-average-february-8880159"
},
"checked": "2026-11-07"
},
"timeline": [
{
"date": "2026-03-10",
"text": "NUKIB counted 23 incidents in February 2026, above the 2025 monthly average of about 17.",
"url": "https://english.radio.cz/cyber-incidents-czechia-above-average-february-8880159",
"src": "Radio Prague International"
},
{
"date": "2026-08-10",
"text": "NUKIB joined an international advisory on a Russian campaign targeting Zimbra Collaboration Suite.",
"url": "https://nukib.gov.cz/en/infoservis-en/news/2448-nukib-joins-international-advisory-on-russian-cyber-campaign-targeting-zimbra-collaboration-suite",
"src": "NUKIB"
},
{
"date": "2026-10-13",
"text": "NUKIB published an analysis of Russian actors targeting Signal users, with hardening advice.",
"url": "https://nukib.gov.cz/en/infoservis-en/news/2465-russian-actors-are-targeting-signal-users-nukib-releases-an-analysis-and-recommendations-on-how-to-secure-the-app",
"src": "NUKIB"
}
],
"incidents": [
{
"org": "National Institute of Public Health (SZU)",
"sector": "health",
"date": "2026-08-01",
"type": "intrusion",
"actor": "",
"status": "confirmed",
"vendor": true,
"confirmed": "The institute said hackers targeted its externally hosted website, which was taken offline for forensic analysis, and that no sensitive data was compromised.",
"claimed": "",
"sources": [
{
"name": "Radio Prague International",
"url": "https://english.radio.cz/czech-public-health-institute-website-still-offline-after-weekend-cyberattack-8893710"
}
],
"checked": "2026-11-07",
"domain": "szu.cz",
"actor_ids": [],
"id": "4c8b37b8"
},
{
"org": "Czech Government Office",
"sector": "government",
"date": "2026-10-21",
"type": "other",
"actor": "",
"status": "confirmed",
"vendor": false,
"confirmed": "The Government Office took its website offline because of newly disclosed critical PHP vulnerabilities.",
"claimed": "",
"sources": [
{
"name": "Radio Prague International",
"url": "https://english.radio.cz/czech-technical-university-hit-cyberattack-8900752"
}
],
"checked": "2026-11-07",
"domain": "vlada.gov.cz",
"logo": "vlada.gov.cz",
"actor_ids": [],
"id": "bc440a9f"
},
{
"org": "Czech Technical University in Prague",
"sector": "education",
"date": "2026-10-22",
"type": "intrusion",
"actor": "",
"status": "confirmed",
"vendor": false,
"confirmed": "CTU said it stopped a cyberattack that forced some systems offline and linked it to a global wave of attacks on PHP-based sites.",
"claimed": "",
"sources": [
{
"name": "Radio Prague International",
"url": "https://english.radio.cz/czech-technical-university-hit-cyberattack-8900752"
}
],
"checked": "2026-11-07",
"domain": "cvut.cz",
"logo": "cvut.cz",
"actor_ids": [],
"id": "a65bf4cd"
}
],
"since": "2026-01-01",
"stats": [
{
"label": "Cyber incidents handled by NUKIB",
"value": "203",
"period": "2025",
"source": {
"name": "Radio Prague International",
"url": "https://english.radio.cz/cyber-incidents-czechia-above-average-february-8880159"
}
},
{
"label": "Cyber incidents handled by NUKIB",
"value": "32",
"period": "January 2026",
"source": {
"name": "Radio Prague International",
"url": "https://english.radio.cz/czechia-records-third-highest-number-cyber-incidents-a-year-8900179"
}
},
{
"label": "Cyber incidents handled by NUKIB",
"value": "26",
"period": "September 2026",
"source": {
"name": "Radio Prague International",
"url": "https://english.radio.cz/czechia-records-third-highest-number-cyber-incidents-a-year-8900179"
}
}
],
"rules": [],
"actors": [
{
"name": "Russia-linked actors targeting Signal accounts",
"kind": "state",
"seen": "NUKIB warned in 2026 of account takeovers aimed at politicians, officials and security experts.",
"sources": [
{
"name": "NUKIB",
"url": "https://nukib.gov.cz/en/infoservis-en/news/2465-russian-actors-are-targeting-signal-users-nukib-releases-an-analysis-and-recommendations-on-how-to-secure-the-app"
}
]
}
],
"slug": "czechia",
"title": "Czechia Cyber Incidents and Data Breaches 2026 · pwnsy",
"lede": "No public threat level. 3 incidents confirmed, 0 claims in 2026.",
"h1": "![\"\"](\"/tools/cyber-watch/flags/cz.svg\")
Czechia Cyber Watch",
"desc": "Czechia cyber threat level: none published. 3 incidents confirmed and 0 claims in 2026, each sourced. Updated 7 Nov 2026.",
"upd": "2026-11-07"
},
"RO": {
"name": "Romania",
"subject": "Romania's cyber threat posture and 2026 incidents",
"region": "Europe",
"posture": {
"level": "",
"summary": "Romania publishes no national cyber alert level; DNSC director Dan Cimpean and ministers describe the threat in public statements.",
"agency": "National Cyber Security Directorate (DNSC)",
"source": {
"name": "The Record",
"url": "https://therecord.media/romania-cyberattacks-russia-defense-minister"
},
"checked": "2026-11-07"
},
"timeline": [
{
"date": "2026-02-23",
"text": "DNSC head Dan Cimpean said ransomware attacks on critical infrastructure are likely part of a Russian hybrid operation.",
"url": "https://therecord.media/ransomware-gangs-advancing-moscow-geopolitical-interests-warns-romania",
"src": "The Record"
},
{
"date": "2026-04-01",
"text": "Defense Minister Radu Miruta said government institutions face more than 10,000 cyberattacks a day.",
"url": "https://therecord.media/romania-cyberattacks-russia-defense-minister",
"src": "The Record"
},
{
"date": "2026-07-20",
"text": "Dan Cimpean said the land registry attack was financially motivated and no land registry certificates were stolen.",
"url": "https://therecord.media/romania-cyberattack-land-registry",
"src": "The Record"
}
],
"incidents": [
{
"org": "Conpet",
"sector": "energy",
"date": "2026-02-04",
"type": "ransomware",
"actor": "Qilin",
"status": "confirmed",
"vendor": false,
"confirmed": "Conpet, the national oil pipeline operator, confirmed a cyberattack on parts of its IT and said oil transport and SCADA systems were not affected.",
"claimed": "Qilin listed Conpet on its leak site and claimed nearly 1 TB of data.",
"sources": [
{
"name": "The Record",
"url": "https://therecord.media/romania-conpet-oil-pipeline-ransomware-attack"
}
],
"checked": "2026-11-07",
"domain": "conpet.ro",
"actor_ids": [
"qilin"
],
"id": "9e87cbba"
},
{
"org": "National Agency for Cadastre and Land Registration (ANCPI)",
"sector": "government",
"date": "2026-07-14",
"type": "intrusion",
"actor": "ByteToBreach",
"status": "confirmed",
"vendor": false,
"confirmed": "ANCPI called it the most serious technical incident in its history, and DNSC director Dan Cimpean said the attack was financially motivated with limited data exfiltrated.",
"claimed": "ByteToBreach claimed the attack and advertised the data for sale.",
"sources": [
{
"name": "The Record",
"url": "https://therecord.media/romania-cyberattack-land-registry"
}
],
"checked": "2026-11-07",
"domain": "ancpi.ro",
"logo": "ancpi.ro",
"actor_ids": [
"bytetobreach"
],
"id": "72551891"
}
],
"since": "2026-01-01",
"stats": [
{
"label": "Cyberattacks on government institutions per day, per Defense Minister Radu Miruta",
"value": "More than 10,000",
"period": "2026",
"source": {
"name": "The Record",
"url": "https://therecord.media/romania-cyberattacks-russia-defense-minister"
}
},
{
"label": "Share of detected incidents linked to criminal actors, per DNSC",
"value": "About 80%",
"period": "As stated February 2026",
"source": {
"name": "The Record",
"url": "https://therecord.media/ransomware-gangs-advancing-moscow-geopolitical-interests-warns-romania"
}
}
],
"rules": [],
"actors": [
{
"name": "Qilin",
"kind": "ransomware",
"seen": "Claimed the Conpet attack in February 2026.",
"sources": [
{
"name": "The Record",
"url": "https://therecord.media/romania-conpet-oil-pipeline-ransomware-attack"
}
],
"actor_id": "qilin"
},
{
"name": "ByteToBreach",
"kind": "extortion",
"seen": "Claimed the ANCPI attack in July 2026; Romanian authorities call it an initial access broker.",
"sources": [
{
"name": "The Record",
"url": "https://therecord.media/romania-cyberattack-land-registry"
}
],
"actor_id": "bytetobreach"
}
],
"slug": "romania",
"title": "Romania Cyber Incidents and Data Breaches 2026 · pwnsy",
"lede": "No public threat level. 2 incidents confirmed, 0 claims in 2026.",
"h1": "![\"\"](\"/tools/cyber-watch/flags/ro.svg\")
Romania Cyber Watch",
"desc": "Romania cyber threat level: none published. 2 incidents confirmed and 0 claims in 2026, each sourced. Updated 7 Nov 2026.",
"upd": "2026-11-07"
},
"EE": {
"name": "Estonia",
"subject": "Estonia's cyber threat posture and 2026 incidents",
"region": "Europe",
"posture": {
"level": "",
"summary": "Estonia publishes no national cyber alert level; RIA posts a monthly cyberspace overview with incident counts and named incidents.",
"agency": "Information System Authority (RIA)",
"source": {
"name": "RIA",
"url": "https://www.ria.ee/en/news/october-cyberspace-disruptions-e-services-data-breaches-and-critical-security-vulnerabilities"
},
"checked": "2026-11-07"
},
"timeline": [
{
"date": "2026-06-15",
"text": "Minister Liisa Pakosta announced quarantine of .ru email to officials from 31 August.",
"url": "https://therecord.media/estonia-quarantine-russian-emails",
"src": "The Record"
},
{
"date": "2026-10-05",
"text": "RIA reported 964 incidents with impact in September, including the Innovaatik breach and a large DDoS on the authentication service.",
"url": "https://www.ria.ee/en/news/september-cyberspace-data-breaches-and-disruptions-government-e-services",
"src": "RIA"
},
{
"date": "2026-11-04",
"text": "RIA registered 837 cyber incidents in October, with repeat disruptions of the national authentication service.",
"url": "https://www.ria.ee/en/news/october-cyberspace-disruptions-e-services-data-breaches-and-critical-security-vulnerabilities",
"src": "RIA"
}
],
"incidents": [
{
"org": "Innovaatik (dental information system)",
"sector": "health",
"date": "2026-10-05",
"type": "data-leak",
"actor": "",
"status": "confirmed",
"vendor": true,
"confirmed": "Police and prosecutors said patient data from more than 300 healthcare providers was downloaded and a 45-year-old Estonian with past ties to the company was arrested.",
"claimed": "",
"sources": [
{
"name": "RIA",
"url": "https://www.ria.ee/en/news/september-cyberspace-data-breaches-and-disruptions-government-e-services"
},
{
"name": "ERR News",
"url": "https://news.err.ee/1610127079/patient-health-data-leaked-from-dentists-information-system"
}
],
"checked": "2026-11-07",
"domain": "innovaatik.ee",
"logo": "innovaatik.ee",
"actor_ids": [],
"id": "29f5eb63"
},
{
"org": "University of Tartu Library e-bookshop",
"sector": "education",
"date": "2026-09-11",
"type": "data-leak",
"actor": "",
"status": "confirmed",
"vendor": false,
"confirmed": "Library director Jaanika Anderson said an external attacker accessed the online store and most likely downloaded customer data.",
"claimed": "",
"sources": [
{
"name": "ERR News",
"url": "https://news.err.ee/1610149198/cyberattack-gains-access-to-university-of-tartu-library-s-online-store-customer-data"
}
],
"checked": "2026-11-07",
"domain": "ut.ee",
"logo": "ut.ee",
"actor_ids": [],
"id": "ee90db87"
},
{
"org": "National authentication service",
"sector": "government",
"date": "2026-09-11",
"type": "ddos",
"actor": "",
"status": "confirmed",
"vendor": false,
"confirmed": "RIA said a DDoS attack sent over 86 million queries to the national authentication service, more than 100 times normal volume.",
"claimed": "",
"sources": [
{
"name": "RIA",
"url": "https://www.ria.ee/en/news/september-cyberspace-data-breaches-and-disruptions-government-e-services"
}
],
"checked": "2026-11-07",
"domain": "ria.ee",
"logo": "ria.ee",
"actor_ids": [],
"id": "1f7a9bb5"
},
{
"org": "Accommodation booking solutions provider (unnamed)",
"sector": "other",
"date": "2026-11-04",
"type": "data-leak",
"actor": "",
"status": "confirmed",
"vendor": true,
"confirmed": "RIA said personal data and booking records of about 9,000 customers leaked in October 2026.",
"claimed": "",
"sources": [
{
"name": "RIA",
"url": "https://www.ria.ee/en/news/october-cyberspace-disruptions-e-services-data-breaches-and-critical-security-vulnerabilities"
}
],
"checked": "2026-11-07",
"actor_ids": [],
"id": "bc60bef8"
},
{
"org": "Selver",
"sector": "retail",
"date": "2026-11-02",
"type": "intrusion",
"actor": "",
"status": "confirmed",
"vendor": true,
"confirmed": "Selver and refrigeration contractor Kitman Coldtech confirmed hackers raised a store freezer to 50 C through an older Danfoss control system; staff reacted within ten minutes.",
"claimed": "",
"sources": [
{
"name": "ERR News",
"url": "https://news.err.ee/1610183296/hackers-raised-freezer-temperature-at-selver-supermarket-to-50-c"
}
],
"checked": "2026-11-07",
"domain": "selver.ee",
"logo": "selver.ee",
"actor_ids": [],
"id": "4942cf06",
"story": "europe-supermarket-refrigeration-cyberattacks"
}
],
"since": "2026-01-01",
"stats": [
{
"label": "Cyber incidents registered by RIA",
"value": "837",
"period": "October 2026",
"source": {
"name": "RIA",
"url": "https://www.ria.ee/en/news/october-cyberspace-disruptions-e-services-data-breaches-and-critical-security-vulnerabilities"
}
},
{
"label": "Cyber incidents with an impact registered by RIA",
"value": "964",
"period": "September 2026",
"source": {
"name": "RIA",
"url": "https://www.ria.ee/en/news/september-cyberspace-data-breaches-and-disruptions-government-e-services"
}
},
{
"label": "Vulnerable devices in Estonian cyberspace, per RIA",
"value": "More than 30,000",
"period": "November 2026",
"source": {
"name": "ERR News",
"url": "https://news.err.ee/1610184286/state-it-authority-spokesperson-motives-for-selver-fridge-hack-not-yet-known"
}
}
],
"rules": [
{
"date": "2026-08-31",
"title": "Quarantine of .ru email sent to government officials",
"what": "Emails from .ru addresses are held for extra screening before reaching Estonian officials; announced by Justice and Digital Affairs Minister Liisa Pakosta.",
"url": "https://therecord.media/estonia-quarantine-russian-emails"
}
],
"actors": [],
"slug": "estonia",
"title": "Estonia Cyber Incidents and Data Breaches 2026 · pwnsy",
"lede": "No public threat level. 5 incidents confirmed, 0 claims in 2026.",
"h1": "![\"\"](\"/tools/cyber-watch/flags/ee.svg\")
Estonia Cyber Watch",
"desc": "Estonia cyber threat level: none published. 5 incidents confirmed and 0 claims in 2026, each sourced. Updated 7 Nov 2026.",
"upd": "2026-11-07"
},
"TR": {
"name": "Turkey",
"subject": "Turkey's cyber threat posture and 2026 incidents",
"region": "Europe",
"posture": {
"level": "",
"summary": "Turkey publishes no national cyber alert level; the Cybersecurity Presidency and the Cybersecurity Board chaired by President Erdogan set priorities.",
"agency": "Cybersecurity Presidency (Siber Guvenlik Baskanligi)",
"source": {
"name": "Hurriyet Daily News",
"url": "https://www.hurriyetdailynews.com/erdogan-chairs-first-cybersecurity-board-meeting-221847"
},
"checked": "2026-11-07"
},
"timeline": [
{
"date": "2026-04-24",
"text": "Communications Director Burhanettin Duran said Turkey must assert its authority over cyberspace as a national security issue.",
"url": "https://www.hurriyetdailynews.com/communications-director-says-turkiye-must-assert-sovereignty-in-cyberspace-221464",
"src": "Hurriyet Daily News"
},
{
"date": "2026-05-06",
"text": "President Erdogan chaired the first Cybersecurity Board meeting, naming 15 critical infrastructure sectors.",
"url": "https://www.hurriyetdailynews.com/erdogan-chairs-first-cybersecurity-board-meeting-221847",
"src": "Hurriyet Daily News"
},
{
"date": "2026-09-16",
"text": "An MIT-led operation arrested five suspects over a data breach through trade union software.",
"url": "https://www.hurriyetdailynews.com/mit-led-operation-nets-five-suspects-over-trade-union-data-breach-226935",
"src": "Hurriyet Daily News"
}
],
"incidents": [
{
"org": "Izmir University of Economics",
"sector": "education",
"date": "2026-01-04",
"type": "data-leak",
"actor": "",
"status": "confirmed",
"vendor": false,
"confirmed": "The university linked leaked student ID photos to an old decommissioned student information system, and prosecutors detained three suspects.",
"claimed": "",
"sources": [
{
"name": "Hurriyet Daily News",
"url": "https://www.hurriyetdailynews.com/three-detained-over-leaked-student-photos-at-izmir-university-217633"
}
],
"checked": "2026-11-07",
"domain": "ieu.edu.tr",
"logo": "ieu.edu.tr",
"actor_ids": [],
"id": "7911f54e"
},
{
"org": "Public institution databases (unnamed)",
"sector": "government",
"date": "2026-03-27",
"type": "data-leak",
"actor": "",
"status": "confirmed",
"vendor": false,
"confirmed": "The Istanbul Chief Public Prosecutor's Office said seven suspects were detained for stealing and selling personal data of about 20 million people, partly from public institution databases.",
"claimed": "",
"sources": [
{
"name": "Hurriyet Daily News",
"url": "https://www.hurriyetdailynews.com/seven-suspects-detained-for-stealing-personal-data-of-20-mln-people-220357"
}
],
"checked": "2026-11-07",
"actor_ids": [],
"id": "e1347be3"
},
{
"org": "Aydo Yazilim (trade union software)",
"sector": "other",
"date": "2026-09-16",
"type": "data-leak",
"actor": "",
"status": "confirmed",
"vendor": true,
"confirmed": "An operation led by the National Intelligence Organization (MIT) with the Cybersecurity Directorate found leaked identity datasets could be queried through the firm's union software, and five suspects were arrested.",
"claimed": "",
"sources": [
{
"name": "Hurriyet Daily News",
"url": "https://www.hurriyetdailynews.com/mit-led-operation-nets-five-suspects-over-trade-union-data-breach-226935"
}
],
"checked": "2026-11-07",
"actor_ids": [],
"id": "41ef169a"
}
],
"since": "2026-01-01",
"stats": [
{
"label": "People whose personal data a hacking network allegedly stole",
"value": "About 20 million",
"period": "Reported March 2026",
"source": {
"name": "Hurriyet Daily News",
"url": "https://www.hurriyetdailynews.com/seven-suspects-detained-for-stealing-personal-data-of-20-mln-people-220357"
}
},
{
"label": "Suspects sought in a social media crime sweep, per Interior Minister Mustafa Ciftci",
"value": "1,008 in 48 provinces",
"period": "September 2026",
"source": {
"name": "Hurriyet Daily News",
"url": "https://www.hurriyetdailynews.com/turkiye-hunts-1-008-suspects-in-major-cyber-gang-sweep-226876"
}
},
{
"label": "Cyber drills planned by the Transport and Infrastructure Ministry",
"value": "12",
"period": "2026",
"source": {
"name": "Hurriyet Daily News",
"url": "https://www.hurriyetdailynews.com/turkiye-to-strengthen-cybersecurity-shield-with-new-drills-219197"
}
}
],
"rules": [],
"actors": [
{
"name": "JanaWare operators",
"kind": "ransomware",
"seen": "Acronis reported in April 2026 a ransomware campaign that runs only on systems in Turkey.",
"sources": [
{
"name": "The Record",
"url": "https://therecord.media/new-janaware-ransomware-targeting-turkey"
}
]
}
],
"slug": "turkey",
"title": "Turkey Cyber Incidents and Data Breaches 2026 · pwnsy",
"lede": "No public threat level. 3 incidents confirmed, 0 claims in 2026.",
"h1": "![\"\"](\"/tools/cyber-watch/flags/tr.svg\")
Turkey Cyber Watch",
"desc": "Turkey cyber threat level: none published. 3 incidents confirmed and 0 claims in 2026, each sourced. Updated 7 Nov 2026.",
"upd": "2026-11-07"
},
"GB": {
"name": "United Kingdom",
"subject": "The United Kingdom",
"region": "Europe",
"posture": {
"level": "",
"summary": "The NCSC publishes no public cyber threat level and signals threat through alerts, advisories and its Annual Review.",
"agency": "National Cyber Security Centre (NCSC)",
"source": {
"name": "NCSC",
"url": "https://www.ncsc.gov.uk/news/uk-experiencing-four-nationally-significant-cyber-attacks-weekly"
},
"checked": "2026-11-07"
},
"timeline": [
{
"date": "2026-04-22",
"text": "NCSC chief Richard Horne said the agency handles about four nationally significant incidents a week, most now traced to nation-state actors.",
"url": "https://therecord.media/UK-cyberattacks-ncsc-china",
"src": "The Record"
},
{
"date": "2026-11-03",
"text": "NCSC Annual Review reported 1,831 attack reports and 80 nationally significant incidents, and warned of an unprecedented rise in incidents.",
"url": "https://www.siliconrepublic.com/enterprise/uk-warns-weak-supply-chains-worsen-ai-led-cybersecurity-crisis",
"src": "Silicon Republic"
},
{
"date": "2026-11-03",
"text": "Richard Horne told the BBC the refrigeration attacks affected the whole food supply chain.",
"url": "https://www.thelocal.dk/20261103/fridge-cyberattack-on-supermarkets-across-europe-prompts-eu-warning",
"src": "The Local (AFP)"
}
],
"incidents": [
{
"org": "University of Nottingham",
"sector": "education",
"date": "2026-06-10",
"type": "data-leak",
"actor": "ShinyHunters",
"status": "confirmed",
"vendor": true,
"confirmed": "The university said a well-known cybercriminal group accessed a significant amount of data in its third-party student record system and reported it to the ICO.",
"claimed": "ShinyHunters claimed over 40GB of student finance and payment files as part of an Oracle PeopleSoft campaign; Have I Been Pwned lists 454,600 affected people.",
"sources": [
{
"name": "BleepingComputer",
"url": "https://www.bleepingcomputer.com/news/security/nottingham-university-data-breach-affects-over-450-000-students/"
}
],
"checked": "2026-11-07",
"domain": "nottingham.ac.uk",
"logo": "nottingham.ac.uk",
"actor_ids": [
"shinyhunters"
],
"id": "c76e3870"
},
{
"org": "University of Oxford",
"sector": "education",
"date": "2026-06-08",
"type": "data-leak",
"actor": "",
"status": "confirmed",
"vendor": true,
"confirmed": "Oxford disclosed a data breach after its third-party careers platform was hacked.",
"claimed": "",
"sources": [
{
"name": "BleepingComputer",
"url": "https://www.bleepingcomputer.com/news/security/oxford-university-discloses-data-breach-after-careerconnect-platform-hack/"
}
],
"checked": "2026-11-07",
"domain": "ox.ac.uk",
"logo": "ox.ac.uk",
"actor_ids": [],
"id": "f5707334"
},
{
"org": "Police National Legal Database (PNLD)",
"sector": "government",
"date": "2026-07-26",
"type": "data-leak",
"actor": "ExfilSquad",
"status": "confirmed",
"vendor": false,
"confirmed": "PNLD confirmed names, organisations and emails of police officers, staff and Ask the Police users were taken and published, and is working with the National Crime Agency.",
"claimed": "ExfilSquad claimed about 135,000 records, including 114,000 PNLD subscriber records.",
"sources": [
{
"name": "BleepingComputer",
"url": "https://www.bleepingcomputer.com/news/security/exfilsquad-hackers-leak-info-of-over-100-000-uk-police-officers-staff/"
}
],
"checked": "2026-11-07",
"domain": "pnld.co.uk",
"logo": "pnld.co.uk",
"actor_ids": [
"exfilsquad"
],
"id": "f2cd330f"
},
{
"org": "Housing Ombudsman Service",
"sector": "government",
"date": "2026-10-13",
"type": "intrusion",
"actor": "",
"status": "confirmed",
"vendor": true,
"confirmed": "The Ombudsman said a third-party IT security incident hit its case management system, was contained and was reported to the ICO.",
"claimed": "",
"sources": [
{
"name": "BleepingComputer",
"url": "https://www.bleepingcomputer.com/news/security/uk-housing-ombudsman-service-investigates-security-incident/"
}
],
"checked": "2026-11-07",
"domain": "housing-ombudsman.org.uk",
"logo": "housing-ombudsman.org.uk",
"actor_ids": [],
"id": "a1837e20"
},
{
"org": "Independent meat suppliers (AIMS members)",
"sector": "retail",
"date": "2026-11-02",
"type": "other",
"actor": "",
"status": "confirmed",
"vendor": false,
"confirmed": "The Association of Independent Meat Suppliers said fridges at two members defrosted and a third saw cold-unit temperatures rise during the Europe-wide refrigeration attack wave.",
"claimed": "",
"sources": [
{
"name": "The Local (AFP)",
"url": "https://www.thelocal.dk/20261103/fridge-cyberattack-on-supermarkets-across-europe-prompts-eu-warning"
}
],
"checked": "2026-11-07",
"actor_ids": [],
"id": "31e5f9f5",
"story": "europe-supermarket-refrigeration-cyberattacks"
},
{
"org": "England Hockey",
"sector": "other",
"date": "2026-03-12",
"type": "ransomware",
"actor": "",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "A ransomware gang listed England Hockey as a victim, and the governing body said it was investigating a possible breach.",
"sources": [
{
"name": "BleepingComputer",
"url": "https://www.bleepingcomputer.com/news/security/england-hockey-investigating-ransomware-data-breach/"
}
],
"checked": "2026-11-07",
"domain": "englandhockey.co.uk",
"logo": "englandhockey.co.uk",
"actor_ids": [],
"id": "37f223c7"
}
],
"since": "2026-01-01",
"stats": [
{
"label": "Nationally significant incidents",
"value": "80",
"period": "NCSC Annual Review 2026",
"source": {
"name": "Silicon Republic",
"url": "https://www.siliconrepublic.com/enterprise/uk-warns-weak-supply-chains-worsen-ai-led-cybersecurity-crisis"
}
},
{
"label": "Cyber attack reports received by NCSC",
"value": "1,831",
"period": "NCSC Annual Review 2026",
"source": {
"name": "Silicon Republic",
"url": "https://www.siliconrepublic.com/enterprise/uk-warns-weak-supply-chains-worsen-ai-led-cybersecurity-crisis"
}
},
{
"label": "Organisations notified of suspected attacks",
"value": "8,500",
"period": "NCSC Annual Review 2026",
"source": {
"name": "Silicon Republic",
"url": "https://www.siliconrepublic.com/enterprise/uk-warns-weak-supply-chains-worsen-ai-led-cybersecurity-crisis"
}
},
{
"label": "Nationally significant incidents (prior year)",
"value": "204",
"period": "12 months to August 2025",
"source": {
"name": "NCSC",
"url": "https://www.ncsc.gov.uk/news/uk-experiencing-four-nationally-significant-cyber-attacks-weekly"
}
}
],
"rules": [
{
"date": "2026-06-16",
"title": "Cyber Security and Resilience Bill passes Commons third reading",
"what": "Widens UK NIS rules to data centres and managed service providers, strengthens regulators and expands incident reporting; the bill moved to the House of Lords.",
"url": "https://bills.parliament.uk/bills/4035"
}
],
"actors": [
{
"name": "ShinyHunters",
"kind": "extortion",
"seen": "Claimed the University of Nottingham student records breach in June 2026.",
"sources": [
{
"name": "BleepingComputer",
"url": "https://www.bleepingcomputer.com/news/security/nottingham-university-data-breach-affects-over-450-000-students/"
}
],
"actor_id": "shinyhunters"
},
{
"name": "Russia, China and Iran state actors",
"kind": "state",
"seen": "The NCSC chief said nation-state actors now drive most nationally significant incidents, and the NCSC flagged GRU router compromises in April 2026.",
"sources": [
{
"name": "The Record",
"url": "https://therecord.media/UK-cyberattacks-ncsc-china"
}
]
}
],
"slug": "united-kingdom",
"title": "United Kingdom Cyber Incidents and Data Breaches 2026 · pwnsy",
"lede": "No public threat level. 5 incidents confirmed, 1 claim in 2026.",
"h1": "![\"\"](\"/tools/cyber-watch/flags/gb.svg\")
United Kingdom Cyber Watch",
"desc": "United Kingdom cyber threat level: none published. 5 incidents confirmed and 1 claim in 2026, each sourced. Updated 7 Nov 2026.",
"upd": "2026-11-07"
},
"DE": {
"name": "Germany",
"region": "Europe",
"posture": {
"level": "",
"summary": "The BSI publishes no standing national cyber threat level; it rates each cyber security warning by criticality and describes the overall picture in its annual Lagebericht.",
"agency": "Federal Office for Information Security (BSI)",
"source": {
"name": "BSI",
"url": "https://www.bsi.bund.de/DE/Themen/Unternehmen-und-Organisationen/Cyber-Sicherheitslage/Technische-Sicherheitshinweise-und-Warnungen/Cyber-Sicherheitswarnungen/cyber-sicherheitswarnungen_node.html"
},
"checked": "2026-11-07"
},
"timeline": [
{
"date": "2026-02-06",
"text": "Germany's domestic intelligence agency warned of suspected state-sponsored Signal account hijacking aimed at senior figures.",
"url": "https://www.bleepingcomputer.com/news/security/germany-warns-of-signal-account-hijacking-targeting-senior-figures/",
"src": "BleepingComputer"
},
{
"date": "2026-05-15",
"text": "BSI's Cybersicherheitsmonitor 2026 found one in ten Germans fell victim to cybercrime in the past year.",
"url": "https://euro-security.de/en/one-in-ten-germans-is-a-victim-of-cybercrime/",
"src": "Euro Security"
},
{
"date": "2026-10-22",
"text": "BSI issued a warning on critical PHP vulnerabilities rated at its highest criticality, 3 (very high).",
"url": "https://www.bsi.bund.de/DE/Themen/Unternehmen-und-Organisationen/Cyber-Sicherheitslage/Technische-Sicherheitshinweise-und-Warnungen/Cyber-Sicherheitswarnungen/cyber-sicherheitswarnungen_node.html",
"src": "BSI"
}
],
"incidents": [
{
"org": "Berlin Senate administration",
"sector": "government",
"date": "2026-08-14",
"type": "ransomware",
"actor": "Rhysida",
"status": "confirmed",
"vendor": false,
"confirmed": "Berlin confirmed extortion attempts after data theft, disconnected affected Senate departments on 14 August, and the mayor said the city will not pay.",
"claimed": "Rhysida claimed 5.79 TB of administrative files, including HR, financial and water-supply security documents.",
"sources": [
{
"name": "BleepingComputer",
"url": "https://www.bleepingcomputer.com/news/security/berlin-confirms-data-theft-after-rhysida-ransomware-attack-claims/"
}
],
"checked": "2026-11-07",
"domain": "berlin.de",
"logo": "berlin.de",
"actor_ids": [
"rhysida"
],
"id": "3b8b374a"
},
{
"org": "Die Linke",
"sector": "other",
"date": "2026-03-27",
"type": "ransomware",
"actor": "Qilin",
"status": "confirmed",
"vendor": false,
"confirmed": "The party disclosed a cyber incident, said attackers aimed to publish internal data and staff details, and filed a criminal complaint.",
"claimed": "Qilin listed Die Linke on its leak site on 1 April 2026.",
"sources": [
{
"name": "BleepingComputer",
"url": "https://www.bleepingcomputer.com/news/security/die-linke-german-political-party-confirms-data-stolen-by-qilin-ransomware/"
}
],
"checked": "2026-11-07",
"domain": "die-linke.de",
"logo": "die-linke.de",
"actor_ids": [
"qilin"
],
"id": "2d58bf54"
},
{
"org": "Flink",
"sector": "retail",
"date": "2026-09-25",
"type": "data-leak",
"actor": "LPG Group",
"status": "confirmed",
"vendor": false,
"confirmed": "Flink confirmed unauthorised access to an internal system holding customer contact data and reported it to the German data protection authority and police.",
"claimed": "LPG Group claimed data on one million customers and 13,000 workers and sent ransom notes to individuals.",
"sources": [
{
"name": "NL Times",
"url": "https://nltimes.nl/2026/09/25/individuals-sent-ransom-notes-cybercriminals-steal-flink-customer-worker-data"
}
],
"checked": "2026-11-07",
"domain": "goflink.com",
"logo": "goflink.com",
"actor_ids": [
"lpg-group"
],
"id": "ad928ab7"
},
{
"org": "Supermarkets including Edeka and CAP Markets",
"sector": "retail",
"date": "2026-11-02",
"type": "other",
"actor": "",
"status": "confirmed",
"vendor": true,
"confirmed": "Officials and company representatives confirmed four German supermarket outlets were hit in the 2 November refrigeration attack wave.",
"claimed": "",
"sources": [
{
"name": "The Local (AFP)",
"url": "https://www.thelocal.dk/20261103/fridge-cyberattack-on-supermarkets-across-europe-prompts-eu-warning"
},
{
"name": "Wikipedia",
"url": "https://en.wikipedia.org/wiki/2026_French_supermarket_refrigerator_hack"
}
],
"checked": "2026-11-07",
"actor_ids": [],
"id": "9047b552",
"story": "europe-supermarket-refrigeration-cyberattacks"
}
],
"since": "2026-01-01",
"stats": [
{
"label": "Germans who were cybercrime victims",
"value": "1 in 10",
"period": "Past year (Cybersicherheitsmonitor 2026)",
"source": {
"name": "Euro Security (BSI)",
"url": "https://euro-security.de/en/one-in-ten-germans-is-a-victim-of-cybercrime/"
}
},
{
"label": "Organisations BSI expects to supervise under NIS2",
"value": "About 29,500",
"period": "From NIS2 law, passed November 2025",
"source": {
"name": "Euro Security (BSI)",
"url": "https://euro-security.de/en/bsinis-2-implementation-bundestag-passes-cybersecurity-law"
}
}
],
"rules": [
{
"date": "2026-09-11",
"title": "EU Cyber Resilience Act reporting obligations apply",
"what": "Manufacturers of products with digital elements must report actively exploited vulnerabilities and severe incidents from this date; the main obligations follow on 11 December 2027.",
"url": "https://digital-strategy.ec.europa.eu/en/policies/cyber-resilience-act"
}
],
"actors": [
{
"name": "Qilin",
"kind": "ransomware",
"seen": "Claimed the March 2026 attack on Die Linke; Germany arrested a suspected core member in October 2026.",
"sources": [
{
"name": "BleepingComputer",
"url": "https://www.bleepingcomputer.com/news/security/die-linke-german-political-party-confirms-data-stolen-by-qilin-ransomware/"
}
],
"actor_id": "qilin"
},
{
"name": "Rhysida",
"kind": "ransomware",
"seen": "Claimed the August 2026 data theft from Berlin's city administration.",
"sources": [
{
"name": "BleepingComputer",
"url": "https://www.bleepingcomputer.com/news/security/berlin-confirms-data-theft-after-rhysida-ransomware-attack-claims/"
}
],
"actor_id": "rhysida"
}
],
"slug": "germany",
"title": "Germany Cyber Incidents and Data Breaches 2026 · pwnsy",
"lede": "No public threat level. 4 incidents confirmed, 0 claims in 2026.",
"h1": "![\"\"](\"/tools/cyber-watch/flags/de.svg\")
Germany Cyber Watch",
"desc": "Germany cyber threat level: none published. 4 incidents confirmed and 0 claims in 2026, each sourced. Updated 7 Nov 2026.",
"upd": "2026-11-07"
},
"FR": {
"name": "France",
"region": "Europe",
"posture": {
"level": "",
"summary": "France publishes no national cyber threat level; ANSSI's CERT-FR issues alerts and advisories, and the Vigipirate level covers terrorism.",
"agency": "ANSSI (National Cybersecurity Agency of France)",
"source": {
"name": "CERT-FR",
"url": "https://cert.cyber.gouv.fr/alerte/CERTFR-2026-ALE-012"
},
"checked": "2026-11-07"
},
"timeline": [
{
"date": "2026-10-12",
"text": "CERT-FR issued alert CERTFR-2026-ALE-012 on compromises of internet-exposed Danfoss, Copeland and Dixell refrigeration controllers.",
"url": "https://cert.cyber.gouv.fr/alerte/CERTFR-2026-ALE-012",
"src": "CERT-FR"
},
{
"date": "2026-11-03",
"text": "EFS said no health impact was identified after attackers altered settings at three plasma storage sites.",
"url": "https://ny1.com/nyc/all-boroughs/ap-top-news/2026/11/04/cyberattack-hits-french-blood-bank-site-but-no-blood-products-were-compromised",
"src": "AP"
}
],
"incidents": [
{
"org": "Intermarché, Coopérative U and other supermarket chains",
"sector": "retail",
"date": "2026-10-11",
"type": "other",
"actor": "",
"status": "confirmed",
"vendor": true,
"confirmed": "Intermarché said a cyberattack on a service provider put display units out of service and Coopérative U's president confirmed the attack; the Paris prosecutor opened an investigation.",
"claimed": "",
"sources": [
{
"name": "BleepingComputer",
"url": "https://www.bleepingcomputer.com/news/security/cyberattack-shuts-down-refrigerators-at-french-supermarkets/"
},
{
"name": "CERT-FR",
"url": "https://cert.cyber.gouv.fr/alerte/CERTFR-2026-ALE-012"
}
],
"checked": "2026-11-07",
"actor_ids": [],
"id": "526111ec"
},
{
"org": "Établissement français du sang (EFS)",
"sector": "health",
"date": "2026-11-02",
"type": "other",
"actor": "",
"status": "confirmed",
"vendor": true,
"confirmed": "EFS said attackers raised temperature and defrost thresholds at three plasma cold-storage sites through its refrigeration supplier, and no blood products were lost.",
"claimed": "",
"sources": [
{
"name": "BleepingComputer",
"url": "https://www.bleepingcomputer.com/news/security/cyberattack-disrupts-blood-storage-refrigeration-systems-in-france/"
},
{
"name": "NY1 (AP)",
"url": "https://ny1.com/nyc/all-boroughs/ap-top-news/2026/11/04/cyberattack-hits-french-blood-bank-site-but-no-blood-products-were-compromised"
}
],
"checked": "2026-11-07",
"domain": "efs.sante.fr",
"logo": "efs.sante.fr",
"actor_ids": [],
"id": "e401088d",
"story": "europe-supermarket-refrigeration-cyberattacks"
},
{
"org": "FICOBA bank account registry (DGFiP)",
"sector": "government",
"date": "2026-02-20",
"type": "data-leak",
"actor": "",
"status": "confirmed",
"vendor": false,
"confirmed": "The Ministry of Finance said an attacker used a civil servant's stolen credentials to reach part of FICOBA, exposing details of about 1.2 million bank accounts.",
"claimed": "",
"sources": [
{
"name": "BleepingComputer",
"url": "https://www.bleepingcomputer.com/news/security/data-breach-at-french-bank-registry-impacts-12-million-accounts/"
}
],
"checked": "2026-11-07",
"domain": "impots.gouv.fr",
"logo": "impots.gouv.fr",
"actor_ids": [],
"id": "a1ca5e10"
},
{
"org": "France Titres (ANTS)",
"sector": "government",
"date": "2026-04-15",
"type": "data-leak",
"actor": "breach3d",
"status": "confirmed",
"vendor": false,
"confirmed": "ANTS detected a security incident on its portal and later confirmed 11.7 million accounts were affected.",
"claimed": "An actor using the name breach3d offered up to 19 million records for sale on hacker forums.",
"sources": [
{
"name": "BleepingComputer",
"url": "https://www.bleepingcomputer.com/news/security/french-govt-agency-confirms-breach-as-hacker-offers-to-sell-data/"
}
],
"checked": "2026-11-07",
"domain": "ants.gouv.fr",
"logo": "ants.gouv.fr",
"actor_ids": [
"breach3d"
],
"id": "cbd38946"
},
{
"org": "Tchap government messenger (DINUM)",
"sector": "government",
"date": "2026-06-09",
"type": "data-leak",
"actor": "",
"status": "confirmed",
"vendor": false,
"confirmed": "DINUM said a compromised account was used to take data from public Tchap rooms, affecting 73,467 government agents.",
"claimed": "",
"sources": [
{
"name": "BleepingComputer",
"url": "https://www.bleepingcomputer.com/news/security/french-govt-says-tchap-breach-affected-over-73-000-accounts/"
}
],
"checked": "2026-11-07",
"domain": "numerique.gouv.fr",
"logo": "numerique.gouv.fr",
"actor_ids": [],
"id": "9ecb3aa2"
},
{
"org": "DGFiP tax administration",
"sector": "government",
"date": "2026-08-17",
"type": "data-leak",
"actor": "ZeroBytes",
"status": "confirmed",
"vendor": false,
"confirmed": "The Ministry of the Economy said an attacker accessed DGFiP systems and tax data on 678,000 people and professionals, and notified CNIL and ANSSI.",
"claimed": "ZeroBytes listed a cadastral database for sale on PwnForums, claiming data on over 2 million people.",
"sources": [
{
"name": "BleepingComputer",
"url": "https://www.bleepingcomputer.com/news/security/french-tax-authority-data-breach-affects-678-000-individuals/"
}
],
"checked": "2026-11-07",
"domain": "impots.gouv.fr",
"logo": "impots.gouv.fr",
"actor_ids": [
"zerobytes"
],
"id": "c72856ae"
},
{
"org": "Crédit Mutuel Arkéa",
"sector": "finance",
"date": "2026-11-04",
"type": "intrusion",
"actor": "",
"status": "confirmed",
"vendor": false,
"confirmed": "Arkéa disclosed a sophisticated outside attack that sent about 100 million euros from its own account to other banks and said customer assets were unaffected.",
"claimed": "",
"sources": [
{
"name": "Silicon Republic",
"url": "https://www.siliconrepublic.com/enterprise/hackers-steal-e100m-from-french-bank-credit-mutuel-arkea"
}
],
"checked": "2026-11-07",
"domain": "arkea.com",
"logo": "arkea.com",
"actor_ids": [],
"id": "5ec3017a",
"story": "credit-mutuel-arkea-fraud"
}
],
"since": "2026-01-01",
"stats": [
{
"label": "ANTS portal accounts affected",
"value": "11.7 million",
"period": "April 2026 breach",
"source": {
"name": "BleepingComputer",
"url": "https://www.bleepingcomputer.com/news/security/french-govt-agency-confirms-breach-as-hacker-offers-to-sell-data/"
}
},
{
"label": "Bank accounts exposed in FICOBA breach",
"value": "About 1.2 million",
"period": "January 2026 intrusion",
"source": {
"name": "BleepingComputer",
"url": "https://www.bleepingcomputer.com/news/security/data-breach-at-french-bank-registry-impacts-12-million-accounts/"
}
},
{
"label": "Taxpayers in DGFiP breach",
"value": "678,000",
"period": "August 2026 breach",
"source": {
"name": "BleepingComputer",
"url": "https://www.bleepingcomputer.com/news/security/french-tax-authority-data-breach-affects-678-000-individuals/"
}
}
],
"rules": [
{
"date": "2026-09-11",
"title": "EU Cyber Resilience Act reporting obligations apply",
"what": "Manufacturers of products with digital elements must report actively exploited vulnerabilities and severe incidents from this date; the main obligations follow on 11 December 2027.",
"url": "https://digital-strategy.ec.europa.eu/en/policies/cyber-resilience-act"
}
],
"actors": [],
"slug": "france",
"title": "France Cyber Incidents and Data Breaches 2026 · pwnsy",
"lede": "No public threat level. 7 incidents confirmed, 0 claims in 2026.",
"h1": "![\"\"](\"/tools/cyber-watch/flags/fr.svg\")
France Cyber Watch",
"desc": "France cyber threat level: none published. 7 incidents confirmed and 0 claims in 2026, each sourced. Updated 7 Nov 2026.",
"upd": "2026-11-07"
},
"NL": {
"name": "Netherlands",
"subject": "The Netherlands",
"region": "Europe",
"posture": {
"level": "",
"summary": "The Netherlands publishes no national cyber threat level; NCTV's threat level covers terrorism, and NCSC signals cyber threat through advisories and the annual Cybersecuritybeeld Nederland.",
"agency": "National Cyber Security Centre (NCSC-NL)",
"source": {
"name": "NCTV",
"url": "https://www.nctv.nl/documenten/2026/11/06/cybersecuritybeeld-nederland-2026"
},
"checked": "2026-11-07"
},
"timeline": [
{
"date": "2026-08-15",
"text": "The Cyberbeveiligingswet took effect.",
"url": "https://www.ncsc.nl/cyberbeveiligingswet",
"src": "NCSC-NL"
},
{
"date": "2026-11-06",
"text": "Cybersecuritybeeld Nederland 2026 said Dutch digital resilience is falling behind a growing state and criminal threat.",
"url": "https://www.nctv.nl/documenten/2026/11/06/cybersecuritybeeld-nederland-2026",
"src": "NCTV"
}
],
"incidents": [
{
"org": "Odido",
"sector": "telecom",
"date": "2026-02-12",
"type": "data-leak",
"actor": "ShinyHunters",
"status": "confirmed",
"vendor": false,
"confirmed": "Odido said a cyberattack on its customer contact system exposed data of 6.2 million customers and reported it to the Dutch Data Protection Authority.",
"claimed": "ShinyHunters claimed the breach and published the data after Odido refused to pay.",
"sources": [
{
"name": "BleepingComputer",
"url": "https://www.bleepingcomputer.com/news/security/odido-data-breach-exposes-personal-info-of-62-million-customers/"
},
{
"name": "NL Times",
"url": "https://nltimes.nl/2026/03/01/hackers-publish-full-cache-stolen-odido-customer-data-ransom-refusal"
}
],
"checked": "2026-11-07",
"domain": "odido.nl",
"logo": "odido.nl",
"actor_ids": [
"shinyhunters"
],
"id": "d6f57697"
},
{
"org": "Albert Heijn (Ahold Delhaize)",
"sector": "retail",
"date": "2026-10-11",
"type": "intrusion",
"actor": "",
"status": "confirmed",
"vendor": false,
"confirmed": "Ahold Delhaize called the outage of Albert Heijn, Etos and Gall & Gall websites, apps and deliveries a cybersecurity incident; deliveries restarted nearly two weeks later.",
"claimed": "",
"sources": [
{
"name": "NOS",
"url": "https://nos.nl/artikel/2634644-geen-bezorging-en-verkeerde-winkelprijzen-na-cyberveiligheidsincident-bij-albert-heijn"
},
{
"name": "NL Times",
"url": "https://nltimes.nl/2026/10/23/albert-heijn-restarts-grocery-deliveries-nearly-two-weeks-cyberattack"
}
],
"checked": "2026-11-07",
"domain": "ah.nl",
"logo": "ah.nl",
"actor_ids": [],
"id": "d25508cf"
},
{
"org": "Thialf ice stadium",
"sector": "other",
"date": "2026-07-24",
"type": "ransomware",
"actor": "The Gentlemen",
"status": "confirmed",
"vendor": false,
"confirmed": "Thialf confirmed to RTL Nieuws that it was hit by a cyberattack and was in talks with the criminals.",
"claimed": "RTL Nieuws attributed the attack to The Gentlemen, which claims internal documents and staff data.",
"sources": [
{
"name": "NL Times",
"url": "https://nltimes.nl/2026/07/24/thialf-ice-skating-stadium-hit-ransomware-attack"
}
],
"checked": "2026-11-07",
"domain": "thialf.nl",
"logo": "thialf.nl",
"actor_ids": [
"the-gentlemen"
],
"id": "2c77d75c"
},
{
"org": "17 Dutch food businesses",
"sector": "retail",
"date": "2026-11-02",
"type": "other",
"actor": "",
"status": "confirmed",
"vendor": true,
"confirmed": "Danfoss confirmed to NOS that refrigeration systems at 17 Dutch businesses, mainly butchers and small grocers, were attacked.",
"claimed": "",
"sources": [
{
"name": "NL Times",
"url": "https://nltimes.nl/2026/11/02/fridges-freezers-17-dutch-businesses-attacked-large-supermarkets-unaffected"
}
],
"checked": "2026-11-07",
"actor_ids": [],
"id": "fb49ccc7",
"story": "europe-supermarket-refrigeration-cyberattacks"
},
{
"org": "Bitonic",
"sector": "finance",
"date": "2026-10-27",
"type": "intrusion",
"actor": "",
"status": "confirmed",
"vendor": false,
"confirmed": "Bitonic said an attacker exploited a vulnerability, changed login data and took bitcoin from three customer accounts, which it reimbursed.",
"claimed": "",
"sources": [
{
"name": "NL Times",
"url": "https://nltimes.nl/2026/10/27/dutch-bitcoin-company-bitonic-hacked-cryptocurrency-3-clients-stolen"
}
],
"checked": "2026-11-07",
"domain": "bitonic.nl",
"logo": "bitonic.nl",
"actor_ids": [],
"id": "9020da6f"
},
{
"org": "Shell and Philips",
"sector": "energy",
"date": "2026-10-08",
"type": "data-leak",
"actor": "Clop",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "Clop published 89 GB it says came from Shell and Philips, including engineering drawings; neither company confirmed.",
"sources": [
{
"name": "NL Times",
"url": "https://nltimes.nl/2026/10/08/russian-hackers-publish-stolen-shell-philips-data-dark-web"
}
],
"checked": "2026-11-07",
"actor_ids": [
"clop"
],
"id": "0f31ff34"
}
],
"since": "2026-01-01",
"stats": [
{
"label": "Odido customers affected",
"value": "6.2 million",
"period": "February 2026 breach",
"source": {
"name": "BleepingComputer",
"url": "https://www.bleepingcomputer.com/news/security/odido-data-breach-exposes-personal-info-of-62-million-customers/"
}
},
{
"label": "Dutch businesses hit in fridge attack",
"value": "17",
"period": "2 November 2026",
"source": {
"name": "NL Times",
"url": "https://nltimes.nl/2026/11/02/fridges-freezers-17-dutch-businesses-attacked-large-supermarkets-unaffected"
}
}
],
"rules": [
{
"date": "2026-08-15",
"title": "Cyberbeveiligingswet (NIS2) enters into force",
"what": "The Dutch NIS2 law sets security and incident reporting duties for essential and important entities.",
"url": "https://www.ncsc.nl/cyberbeveiligingswet"
},
{
"date": "2026-09-11",
"title": "EU Cyber Resilience Act reporting obligations apply",
"what": "Manufacturers of products with digital elements must report actively exploited vulnerabilities and severe incidents from this date; the main obligations follow on 11 December 2027.",
"url": "https://digital-strategy.ec.europa.eu/en/policies/cyber-resilience-act"
}
],
"actors": [
{
"name": "ShinyHunters",
"kind": "extortion",
"seen": "Breached Odido and leaked 6.5 million customer records in March 2026.",
"sources": [
{
"name": "NL Times",
"url": "https://nltimes.nl/2026/03/01/hackers-publish-full-cache-stolen-odido-customer-data-ransom-refusal"
}
],
"actor_id": "shinyhunters"
},
{
"name": "The Gentlemen",
"kind": "ransomware",
"seen": "Thialf was the group's eighth Dutch victim, according to RTL Nieuws.",
"sources": [
{
"name": "NL Times",
"url": "https://nltimes.nl/2026/07/24/thialf-ice-skating-stadium-hit-ransomware-attack"
}
],
"actor_id": "the-gentlemen"
},
{
"name": "Clop",
"kind": "extortion",
"seen": "Published data it says was taken from Shell and Philips in October 2026.",
"sources": [
{
"name": "NL Times",
"url": "https://nltimes.nl/2026/10/08/russian-hackers-publish-stolen-shell-philips-data-dark-web"
}
],
"actor_id": "clop"
}
],
"slug": "netherlands",
"title": "Netherlands Cyber Incidents and Data Breaches 2026 · pwnsy",
"lede": "No public threat level. 5 incidents confirmed, 1 claim in 2026.",
"h1": "![\"\"](\"/tools/cyber-watch/flags/nl.svg\")
Netherlands Cyber Watch",
"desc": "Netherlands cyber threat level: none published. 5 incidents confirmed and 1 claim in 2026, each sourced. Updated 7 Nov 2026.",
"upd": "2026-11-07"
},
"IT": {
"name": "Italy",
"region": "Europe",
"posture": {
"level": "",
"summary": "Italy publishes no national cyber threat level; ACN and CSIRT Italia issue alerts and a monthly Operational Summary of threat data.",
"agency": "National Cybersecurity Agency (ACN)",
"source": {
"name": "ACN",
"url": "https://www.acn.gov.it/portale/web/guest/-/online-l-operational-summary-di-acn-con-i-dati-e-gli-indicatori-della-minaccia-cyber-in-italia-1"
},
"checked": "2026-11-07"
},
"timeline": [
{
"date": "2026-10-23",
"text": "ACN reported 485 cyber events and 235 incidents for September 2026.",
"url": "https://www.acn.gov.it/portale/web/guest/-/online-l-operational-summary-di-acn-con-i-dati-e-gli-indicatori-della-minaccia-cyber-in-italia-1",
"src": "ACN"
},
{
"date": "2026-11-03",
"text": "ACN urged food retail, logistics and refrigeration firms to isolate exposed control systems after the cold-chain attacks.",
"url": "https://www.acn.gov.it/portale/web/guest/-/cybersicurezza-allerta-sulla-filiera-alimentare-e-della-catena-del-freddo-acn-richiama-gli-operatori-della-grande-distribuzione-e-della-logistica-alimentare-alle-misure-di-sicurezza-gia-indicate-dopo-gli-incidenti-in-francia",
"src": "ACN"
}
],
"incidents": [
{
"org": "Sapienza University of Rome",
"sector": "education",
"date": "2026-02-05",
"type": "ransomware",
"actor": "",
"status": "confirmed",
"vendor": false,
"confirmed": "Sapienza said its IT infrastructure was the target of a cyberattack, shut down its network and is restoring with ACN and the Postal Police.",
"claimed": "Corriere della Sera reported a pro-Russian group called Femwar02 was behind it.",
"sources": [
{
"name": "BleepingComputer",
"url": "https://www.bleepingcomputer.com/news/security/italian-university-la-sapienza-goes-offline-after-cyberattack/"
}
],
"checked": "2026-11-07",
"domain": "uniroma1.it",
"logo": "uniroma1.it",
"actor_ids": [],
"id": "e8fd0e7b"
},
{
"org": "Milan Cortina 2026 Winter Olympics",
"sector": "other",
"date": "2026-02-05",
"type": "other",
"actor": "Russia-linked",
"status": "confirmed",
"vendor": false,
"confirmed": "Italian officials said they foiled Russian cyberattacks aimed at disrupting the Games days before the opening ceremony.",
"claimed": "",
"sources": [
{
"name": "BBC Sport",
"url": "https://www.bbc.com/sport/articles/cqj25wyjx1no"
}
],
"checked": "2026-11-07",
"domain": "milanocortina2026.org",
"logo": "milanocortina2026.org",
"actor_ids": [],
"id": "219dabf8"
},
{
"org": "Coop supermarkets in Sicily",
"sector": "retail",
"date": "2026-11-02",
"type": "other",
"actor": "",
"status": "confirmed",
"vendor": false,
"confirmed": "Coop said four of its 300 Sicilian stores were hit in the refrigeration attack wave, and the government called the impact highly limited.",
"claimed": "",
"sources": [
{
"name": "The Local (AFP)",
"url": "https://www.thelocal.dk/20261103/fridge-cyberattack-on-supermarkets-across-europe-prompts-eu-warning"
},
{
"name": "New Straits Times (AFP)",
"url": "https://www.nst.com.my/amp/business/corporate/2026/11/1569503/fridge-cyberattack-hits-supermarkets-across-europe"
}
],
"checked": "2026-11-07",
"actor_ids": [],
"id": "891980fa",
"story": "europe-supermarket-refrigeration-cyberattacks"
},
{
"org": "Tuscan collective catering company",
"sector": "other",
"date": "2026-11-03",
"type": "other",
"actor": "",
"status": "confirmed",
"vendor": false,
"confirmed": "ACN said it received a NIS incident notification from a Tuscan catering firm hit in the cold-chain attacks.",
"claimed": "",
"sources": [
{
"name": "ACN",
"url": "https://www.acn.gov.it/portale/web/guest/-/cybersicurezza-allerta-sulla-filiera-alimentare-e-della-catena-del-freddo-acn-richiama-gli-operatori-della-grande-distribuzione-e-della-logistica-alimentare-alle-misure-di-sicurezza-gia-indicate-dopo-gli-incidenti-in-francia"
}
],
"checked": "2026-11-07",
"actor_ids": [],
"id": "4ce2c4a0",
"story": "europe-supermarket-refrigeration-cyberattacks"
},
{
"org": "Foreign Minister Antonio Tajani",
"sector": "government",
"date": "2026-11-07",
"type": "data-leak",
"actor": "Pro-Russian hackers",
"status": "confirmed",
"vendor": false,
"confirmed": "Tajani said pro-Russian hackers exposed his private information on the dark web over Italy's support for Ukraine.",
"claimed": "",
"sources": [
{
"name": "The Straits Times (Reuters)",
"url": "https://www.straitstimes.com/world/europe/italy-foreign-minister-says-he-has-been-targeted-by-pro-russian-hackers-over-ukraine-backing"
}
],
"checked": "2026-11-07",
"actor_ids": [
"pro-russian-hackers"
],
"id": "382488b0"
}
],
"since": "2026-01-01",
"stats": [
{
"label": "Cyber events handled",
"value": "485",
"period": "September 2026",
"source": {
"name": "ACN",
"url": "https://www.acn.gov.it/portale/web/guest/-/online-l-operational-summary-di-acn-con-i-dati-e-gli-indicatori-della-minaccia-cyber-in-italia-1"
}
},
{
"label": "Incidents",
"value": "235",
"period": "September 2026",
"source": {
"name": "ACN",
"url": "https://www.acn.gov.it/portale/web/guest/-/online-l-operational-summary-di-acn-con-i-dati-e-gli-indicatori-della-minaccia-cyber-in-italia-1"
}
},
{
"label": "CSIRT Italia alert notifications",
"value": "10,839",
"period": "September 2026",
"source": {
"name": "ACN",
"url": "https://www.acn.gov.it/portale/web/guest/-/online-l-operational-summary-di-acn-con-i-dati-e-gli-indicatori-della-minaccia-cyber-in-italia-1"
}
}
],
"rules": [
{
"date": "2026-01-01",
"title": "NIS2 incident notification duty starts (Legislative Decree 138/2024)",
"what": "NIS entities must notify ACN of significant incidents from January 2026 and adopt required security measures by October 2026.",
"url": "https://www.acn.gov.it/portale/nis"
},
{
"date": "2026-09-11",
"title": "EU Cyber Resilience Act reporting obligations apply",
"what": "Manufacturers of products with digital elements must report actively exploited vulnerabilities and severe incidents from this date; the main obligations follow on 11 December 2027.",
"url": "https://digital-strategy.ec.europa.eu/en/policies/cyber-resilience-act"
}
],
"actors": [
{
"name": "Pro-Russian hacktivists",
"kind": "hacktivist",
"seen": "ACN linked a 57% rise in September 2026 cyber events mainly to renewed hacktivist DDoS attacks.",
"sources": [
{
"name": "ACN",
"url": "https://www.acn.gov.it/portale/web/guest/-/online-l-operational-summary-di-acn-con-i-dati-e-gli-indicatori-della-minaccia-cyber-in-italia-1"
}
]
}
],
"slug": "italy",
"title": "Italy Cyber Incidents and Data Breaches 2026 · pwnsy",
"lede": "No public threat level. 5 incidents confirmed, 0 claims in 2026.",
"h1": "![\"\"](\"/tools/cyber-watch/flags/it.svg\")
Italy Cyber Watch",
"desc": "Italy cyber threat level: none published. 5 incidents confirmed and 0 claims in 2026, each sourced. Updated 7 Nov 2026.",
"upd": "2026-11-07"
},
"ES": {
"name": "Spain",
"region": "Europe",
"posture": {
"level": "",
"summary": "Spain publishes no national cyber threat level; INCIBE-CERT and CCN-CERT issue warnings and advisories.",
"agency": "INCIBE and CCN-CERT",
"source": {
"name": "INCIBE",
"url": "https://www.incibe.es/incibe/sala-de-prensa"
},
"checked": "2026-11-07"
},
"timeline": [
{
"date": "2026-02-23",
"text": "Police arrested four suspected Anonymous Fénix hacktivists over DDoS attacks on government sites.",
"url": "https://www.bleepingcomputer.com/news/security/spain-arrests-suspected-anonymous-fenix-hacktivists-for-ddosing-govt-sites/",
"src": "BleepingComputer"
},
{
"date": "2026-09-16",
"text": "The Spanish Data Protection Agency published its first breach notification describing an attack said to be run by an AI agent.",
"url": "https://www.bleepingcomputer.com/news/security/spains-data-agency-gets-first-report-of-ai-powered-data-breach/",
"src": "BleepingComputer"
}
],
"incidents": [
{
"org": "Endesa (Energía XXI)",
"sector": "energy",
"date": "2026-01-12",
"type": "data-leak",
"actor": "",
"status": "confirmed",
"vendor": false,
"confirmed": "Endesa told customers of unauthorised access to personal, contract and IBAN data and notified the Spanish Data Protection Agency.",
"claimed": "Attackers offered a sample they say comes from 20 million records for sale.",
"sources": [
{
"name": "BleepingComputer",
"url": "https://www.bleepingcomputer.com/news/security/spanish-energy-giant-endesa-discloses-data-breach-affecting-customers/"
}
],
"checked": "2026-11-07",
"domain": "endesa.com",
"logo": "endesa.com",
"actor_ids": [],
"id": "aea3555a"
},
{
"org": "PcComponentes",
"sector": "retail",
"date": "2026-01-21",
"type": "other",
"actor": "",
"status": "confirmed",
"vendor": false,
"confirmed": "PcComponentes confirmed a credential stuffing attack on customer accounts and denied a wider breach.",
"claimed": "An actor claimed data on 16 million customers, which the retailer called fake.",
"sources": [
{
"name": "BleepingComputer",
"url": "https://www.bleepingcomputer.com/news/security/online-retailer-pccomponentes-says-data-breach-claims-are-fake/"
}
],
"checked": "2026-11-07",
"domain": "pccomponentes.com",
"logo": "pccomponentes.com",
"actor_ids": [],
"id": "8494d477"
},
{
"org": "Ministry of Science, Innovation and Universities",
"sector": "government",
"date": "2026-02-05",
"type": "intrusion",
"actor": "GordonFreeman",
"status": "confirmed",
"vendor": false,
"confirmed": "The ministry partially closed its electronic office over a technical incident, and a spokesperson told Spanish media it was a cyberattack.",
"claimed": "GordonFreeman claimed admin-level access through an IDOR flaw and offered the data for sale.",
"sources": [
{
"name": "BleepingComputer",
"url": "https://www.bleepingcomputer.com/news/security/spains-ministry-of-science-shuts-down-systems-after-breach-claims/"
}
],
"checked": "2026-11-07",
"domain": "ciencia.gob.es",
"logo": "ciencia.gob.es",
"actor_ids": [
"gordonfreeman"
],
"id": "c3602b22"
}
],
"since": "2026-01-01",
"stats": [],
"rules": [
{
"date": "2026-09-11",
"title": "EU Cyber Resilience Act reporting obligations apply",
"what": "Manufacturers of products with digital elements must report actively exploited vulnerabilities and severe incidents from this date; the main obligations follow on 11 December 2027.",
"url": "https://digital-strategy.ec.europa.eu/en/policies/cyber-resilience-act"
}
],
"actors": [
{
"name": "Anonymous Fénix",
"kind": "hacktivist",
"seen": "Spanish police arrested four suspected members in February 2026 over DDoS attacks on ministries and parties.",
"sources": [
{
"name": "BleepingComputer",
"url": "https://www.bleepingcomputer.com/news/security/spain-arrests-suspected-anonymous-fenix-hacktivists-for-ddosing-govt-sites/"
}
]
}
],
"slug": "spain",
"title": "Spain Cyber Incidents and Data Breaches 2026 · pwnsy",
"lede": "No public threat level. 3 incidents confirmed, 0 claims in 2026.",
"h1": "![\"\"](\"/tools/cyber-watch/flags/es.svg\")
Spain Cyber Watch",
"desc": "Spain cyber threat level: none published. 3 incidents confirmed and 0 claims in 2026, each sourced. Updated 7 Nov 2026.",
"upd": "2026-11-07"
},
"IE": {
"name": "Ireland",
"region": "Europe",
"posture": {
"level": "",
"summary": "Ireland publishes no national cyber threat level; the NCSC and its CSIRT-IE team issue advisories on critical vulnerabilities and incidents.",
"agency": "National Cyber Security Centre (NCSC Ireland)",
"source": {
"name": "NCSC Ireland",
"url": "https://www.ncsc.gov.ie/news/"
},
"checked": "2026-11-07"
},
"timeline": [
{
"date": "2026-06-18",
"text": "NCSC Ireland warned of global targeting of Fortinet firewalls and VPN gateways (Fortibleed).",
"url": "https://www.ncsc.gov.ie/pdfs/Fortinet-Fortibleed-180626.pdf",
"src": "NCSC Ireland"
},
{
"date": "2026-11-03",
"text": "NCSC Ireland issued a refrigeration security advisory on Danfoss controllers.",
"url": "https://www.ncsc.gov.ie/pdfs/2611020249_Danfoss-Advisory.pdf",
"src": "NCSC Ireland"
}
],
"incidents": [
{
"org": "Musgrave (SuperValu)",
"sector": "retail",
"date": "2026-11-02",
"type": "other",
"actor": "",
"status": "confirmed",
"vendor": false,
"confirmed": "Musgrave said a cyber incident hit refrigeration in 13 SuperValu stores, its monitoring flagged it, and the issue was fully resolved the same day.",
"claimed": "",
"sources": [
{
"name": "The Irish Times",
"url": "https://www.irishtimes.com/technology/data-security/2026/11/02/supervalu-removes-frozen-and-chilled-food-from-13-stores-after-cyber-attack-on-fridges/"
},
{
"name": "New Straits Times (AFP)",
"url": "https://www.nst.com.my/amp/business/corporate/2026/11/1569503/fridge-cyberattack-hits-supermarkets-across-europe"
}
],
"checked": "2026-11-07",
"domain": "musgravegroup.com",
"logo": "musgravegroup.com",
"actor_ids": [],
"id": "89cb8e9f",
"story": "europe-supermarket-refrigeration-cyberattacks"
},
{
"org": "Stryker (Cork operations)",
"sector": "health",
"date": "2026-03-11",
"type": "other",
"actor": "Handala",
"status": "confirmed",
"vendor": false,
"confirmed": "A global disruption to Stryker's Windows environment hit its Cork base. The NCSC said it was aware of the incident and was liaising with international partners.",
"claimed": "Iran-linked Handala said it wiped over 200,000 systems and took 50 TB of data. AFP could not verify this.",
"sources": [
{
"name": "RTÉ",
"url": "https://www.rte.ie/news/business/2026/0311/1562906-strykers-cork-base-impacted-by-global-cyber-attack/"
}
],
"checked": "2026-11-08",
"domain": "stryker.com",
"logo": "stryker.com",
"actor_ids": [
"handala"
],
"id": "f081cb9e"
},
{
"org": "Healthdaq",
"sector": "health",
"date": "2026-04-11",
"type": "intrusion",
"actor": "",
"status": "confirmed",
"vendor": false,
"confirmed": "The healthcare recruitment firm, with offices in Dublin and Belfast, said it was the victim of a cyber security incident. It was reported to the Garda National Cyber Crime Bureau and is under criminal investigation.",
"claimed": "",
"sources": [
{
"name": "The Irish Times",
"url": "https://www.irishtimes.com/crime-law/2026/04/11/healthcare-recruitment-company-says-gardai-probing-cyber-security-incident/"
}
],
"checked": "2026-11-08",
"domain": "healthdaq.com",
"actor_ids": [],
"id": "7b38b2f3"
},
{
"org": "Smartply Europe",
"sector": "manufacturing",
"date": "2026-02-10",
"type": "ransomware",
"actor": "TheGentlemen",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "TheGentlemen listed the Coillte-owned panel maker on its leak site. No company statement found.",
"sources": [
{
"name": "ransomware.live",
"url": "https://ransomware.live/id/U21hcnRwbHkgRXVyb3BlQHRoZWdlbnRsZW1lbg"
}
],
"checked": "2026-11-08",
"domain": "smartply.com",
"logo": "smartply.com",
"actor_ids": [
"the-gentlemen"
],
"id": "536268b8"
},
{
"org": "Philip Lee",
"sector": "other",
"date": "2026-04-19",
"type": "ransomware",
"actor": "TheGentlemen",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "TheGentlemen listed the Dublin corporate law firm on its leak site. No firm statement found.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/UGhpbGlwIExlZUB0aGVnZW50bGVtZW4"
}
],
"checked": "2026-11-08",
"domain": "philiplee.ie",
"actor_ids": [
"the-gentlemen"
],
"id": "a2009c7b"
},
{
"org": "Gorey Community School",
"sector": "education",
"date": "2026-05-13",
"type": "ransomware",
"actor": "Payload",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "Payload listed the Wexford school on its leak site and threatened to publish data. No school statement found.",
"sources": [
{
"name": "DeXpose",
"url": "https://www.dexpose.io/payload-ransomware-group-targets-gorey-community-school/"
}
],
"checked": "2026-11-08",
"domain": "goreycs.ie",
"actor_ids": [
"payload"
],
"id": "17b38c99"
},
{
"org": "Engineers Ireland",
"sector": "other",
"date": "2026-10-16",
"type": "ransomware",
"actor": "TheGentlemen",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "TheGentlemen listed the national engineering body on its leak site and threatened a full leak. No statement from Engineers Ireland found.",
"sources": [
{
"name": "DeXpose",
"url": "https://www.dexpose.io/thegentlemen-ransomware-attack-on-engineers-ireland/"
}
],
"checked": "2026-11-08",
"domain": "engineersireland.ie",
"logo": "engineersireland.ie",
"actor_ids": [
"the-gentlemen"
],
"id": "8a2d6a2a"
}
],
"since": "2026-01-01",
"stats": [],
"rules": [
{
"date": "2026-09-11",
"title": "EU Cyber Resilience Act reporting obligations apply",
"what": "Manufacturers of products with digital elements must report actively exploited vulnerabilities and severe incidents from this date; the main obligations follow on 11 December 2027.",
"url": "https://digital-strategy.ec.europa.eu/en/policies/cyber-resilience-act"
}
],
"actors": [],
"slug": "ireland",
"title": "Ireland Cyber Incidents and Data Breaches 2026 · pwnsy",
"lede": "No public threat level. 3 incidents confirmed, 4 claims in 2026.",
"h1": "![\"\"](\"/tools/cyber-watch/flags/ie.svg\")
Ireland Cyber Watch",
"desc": "Ireland cyber threat level: none published. 3 incidents confirmed and 4 claims in 2026, each sourced. Updated 8 Nov 2026.",
"upd": "2026-11-08"
},
"SE": {
"name": "Sweden",
"region": "Europe",
"posture": {
"level": "",
"summary": "Sweden publishes no national cyber threat level; the NCSC issues warnings and news on incidents and vulnerabilities.",
"agency": "National Cyber Security Centre (Nationellt cybersäkerhetscenter, NCSC)",
"source": {
"name": "NCSC Sweden",
"url": "https://www.ncsc.se/sv/aktuellt/cyberangrepp-mot-kylsystem/"
},
"checked": "2026-11-07"
},
"timeline": [
{
"date": "2026-11-02",
"text": "NCSC said it is following incidents hitting grocery refrigeration systems and is in contact with affected organisations.",
"url": "https://www.ncsc.se/sv/aktuellt/cyberangrepp-mot-kylsystem/",
"src": "NCSC Sweden"
},
{
"date": "2026-11-05",
"text": "NCSC relayed EU coordination on refrigeration incidents since 11 October and urged firms to patch connected control systems.",
"url": "https://www.ncsc.se/sv/aktuellt/eu-varnar-for-cyberincidenter/",
"src": "NCSC Sweden"
}
],
"incidents": [
{
"org": "Coop",
"sector": "retail",
"date": "2026-11-02",
"type": "other",
"actor": "",
"status": "confirmed",
"vendor": false,
"confirmed": "Coop confirmed a cyber incident hit cooling at seven stores in Gävle and Sundsvall, which were on older 4G connections.",
"claimed": "",
"sources": [
{
"name": "New Straits Times (AFP)",
"url": "https://www.nst.com.my/amp/business/corporate/2026/11/1569503/fridge-cyberattack-hits-supermarkets-across-europe"
},
{
"name": "Sweden Herald",
"url": "https://swedenherald.com/article/several-ica-stores-affected-by-overnight-refrigeration-and-freezer-problems"
}
],
"checked": "2026-11-07",
"domain": "coop.se",
"logo": "coop.se",
"actor_ids": [],
"id": "8aa73fce",
"story": "europe-supermarket-refrigeration-cyberattacks"
},
{
"org": "ICA stores",
"sector": "retail",
"date": "2026-11-02",
"type": "other",
"actor": "",
"status": "confirmed",
"vendor": true,
"confirmed": "Ica Kvantum Sjöbo said a cyberattack caused its cooling failure, and ICA Group said the affected stores were those using Danfoss systems.",
"claimed": "",
"sources": [
{
"name": "Sweden Herald",
"url": "https://swedenherald.com/article/several-ica-stores-affected-by-overnight-refrigeration-and-freezer-problems"
}
],
"checked": "2026-11-07",
"domain": "ica.se",
"logo": "ica.se",
"actor_ids": [],
"id": "ddf7c97a",
"story": "europe-supermarket-refrigeration-cyberattacks"
},
{
"org": "CGI Sverige",
"sector": "government",
"date": "2026-03-13",
"type": "data-leak",
"actor": "ByteToBreach",
"status": "confirmed",
"vendor": true,
"confirmed": "CGI said two internal test servers in Sweden were accessed and an older application version and its source code were exposed. Civil defence minister Carl-Oskar Bohlin confirmed the leak and said CERT-SE and the NCSC were involved.",
"claimed": "ByteToBreach said it leaked source code from e-government platforms used by Swedish agencies.",
"sources": [
{
"name": "Cointelegraph",
"url": "https://cointelegraph.com/news/sweden-e-government-source-code-leak-cgi-sverige"
}
],
"checked": "2026-11-08",
"domain": "cgi.com",
"logo": "cgi.com",
"actor_ids": [
"bytetobreach"
],
"id": "47d1a5ea"
},
{
"org": "Dorotea and Vilhelmina municipalities",
"sector": "government",
"date": "2026-04-09",
"type": "ransomware",
"actor": "INC Ransom",
"status": "confirmed",
"vendor": false,
"confirmed": "An attack found on 9 April took down IT systems in both Västerbotten municipalities. Dorotea warned that personal data may have leaked.",
"claimed": "INC Ransom listed Dorotea on its leak site on 24 April.",
"sources": [
{
"name": "SVT",
"url": "https://www.svt.se/nyheter/lokalt/vasterbotten/sa-skapar-it-attacken-problem-i-vilhelmina-och-dorotea"
},
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/RG9yb3RlYSBTd2VkZW5AaW5jcmFuc29t"
}
],
"checked": "2026-11-08",
"domain": "",
"actor_ids": [
"inc-ransom"
],
"id": "adb1e30c"
},
{
"org": "Thermal power plant in western Sweden",
"sector": "energy",
"date": "2026-04-15",
"type": "intrusion",
"actor": "Pro-Russian group linked to Russian intelligence",
"status": "confirmed",
"vendor": false,
"confirmed": "Civil defence minister Carl-Oskar Bohlin disclosed a failed destructive attack on a heating plant in 2025. A built-in protection mechanism blocked it.",
"claimed": "",
"sources": [
{
"name": "TechCrunch",
"url": "https://techcrunch.com/2026/04/15/sweden-blames-russian-hackers-for-attempting-destructive-cyberattack-on-thermal-plant/"
}
],
"checked": "2026-11-08",
"domain": "",
"actor_ids": [],
"id": "d3a5b0e9"
},
{
"org": "Ingka Group (IKEA)",
"sector": "retail",
"date": "2026-06-02",
"type": "data-leak",
"actor": "Lapsus$",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "Lapsus$ said it stole 180 GB of internal data including source code and architecture documents. The sample could not be independently verified.",
"sources": [
{
"name": "RetailDetail",
"url": "https://www.retaildetail.eu/news/home/hackers-claim-ikea-has-been-the-victim-of-a-major-data-breach/"
}
],
"checked": "2026-11-08",
"domain": "ingka.com",
"logo": "ingka.com",
"actor_ids": [
"lapsus"
],
"id": "1b5e3089"
},
{
"org": "Electrolux",
"sector": "manufacturing",
"date": "2026-09-19",
"type": "data-leak",
"actor": "Emperador",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "Emperador said it exported about 41 GB from an Electrolux Azure database and threatened to leak it. No company statement found.",
"sources": [
{
"name": "DeXpose",
"url": "https://www.dexpose.io/emperador-ransomware-strikes-electrolux-group/"
}
],
"checked": "2026-11-08",
"domain": "electroluxgroup.com",
"logo": "electroluxgroup.com",
"actor_ids": [
"emperador"
],
"id": "61d43ab9"
},
{
"org": "Securitas",
"sector": "other",
"date": "2026-09-25",
"type": "ransomware",
"actor": "Everest",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "Everest listed Securitas Group on its leak site, said all company data was encrypted and threatened a leak.",
"sources": [
{
"name": "DeXpose",
"url": "https://www.dexpose.io/everest-ransomware-group-strikes-securitas-group/"
}
],
"checked": "2026-11-08",
"domain": "securitas.com",
"logo": "securitas.com",
"actor_ids": [
"everest"
],
"id": "de0c408c"
}
],
"since": "2026-01-01",
"stats": [],
"rules": [
{
"date": "2026-01-15",
"title": "Cybersäkerhetslagen (NIS2) enters into force",
"what": "Sweden's NIS2 law and ordinance took effect, with incident reporting rules from 1 July 2026 and security measure rules from 1 October 2026.",
"url": "https://www.ncsc.se/sv/radgivning-och-stod/cybersakerhetslagen-nis2/tidsplan-for-inforandet-av-cybersakerhetslagen-i-sverige/"
},
{
"date": "2026-09-11",
"title": "EU Cyber Resilience Act reporting obligations apply",
"what": "Manufacturers of products with digital elements must report actively exploited vulnerabilities and severe incidents from this date; the main obligations follow on 11 December 2027.",
"url": "https://digital-strategy.ec.europa.eu/en/policies/cyber-resilience-act"
}
],
"actors": [],
"slug": "sweden",
"title": "Sweden Cyber Incidents and Data Breaches 2026 · pwnsy",
"lede": "No public threat level. 5 incidents confirmed, 3 claims in 2026.",
"h1": "![\"\"](\"/tools/cyber-watch/flags/se.svg\")
Sweden Cyber Watch",
"desc": "Sweden cyber threat level: none published. 5 incidents confirmed and 3 claims in 2026, each sourced. Updated 8 Nov 2026.",
"upd": "2026-11-08"
},
"US": {
"name": "United States",
"subject": "The United States",
"region": "Americas",
"posture": {
"level": "",
"summary": "The United States publishes no national cyber threat level; CISA signals threats through joint advisories with the FBI and partners, emergency directives and its exploited-vulnerabilities catalog.",
"agency": "Cybersecurity and Infrastructure Security Agency (CISA)",
"source": {
"name": "CISA News",
"url": "https://www.cisa.gov/news-events/news"
},
"checked": "2026-11-07"
},
"timeline": [
{
"date": "2026-04-06",
"text": "The FBI's IC3 released its 2025 report, with over one million complaints for the first time.",
"url": "https://therecord.media/cyber-fraud-surges-to-17-billion-fbi-ic3",
"src": "The Record"
},
{
"date": "2026-10-08",
"text": "CISA, FBI, NSA and partners warned that a China-based cybersecurity company was enabling attacks on critical infrastructure.",
"url": "https://www.cisa.gov/news-events/news/cisa-fbi-nsa-and-international-partners-warn-china-based-cybersecurity-company-enabling-threat",
"src": "CISA"
},
{
"date": "2026-10-21",
"text": "CISA, FBI and partners warned that SafePay ransomware actors were targeting several critical infrastructure sectors.",
"url": "https://www.cisa.gov/news-events/news/cisa-fbi-and-partners-warn-organizations-safepay-ransomware-actors-targeting-multiple-critical",
"src": "CISA"
},
{
"date": "2026-10-26",
"text": "CISA released its CISA 2030 strategy, built on cyber defense, hardening infrastructure and national resilience.",
"url": "https://www.cisa.gov/news-events/news/cisa-unveils-new-strategy-strengthen-national-cyber-defense-and-critical-infrastructure-security",
"src": "CISA"
}
],
"incidents": [
{
"org": "Wynn Resorts",
"sector": "other",
"date": "2026-02-24",
"type": "data-leak",
"actor": "ShinyHunters",
"status": "confirmed",
"vendor": false,
"confirmed": "Wynn said an unauthorized third party acquired certain employee data, after ShinyHunters listed the company on its leak site.",
"claimed": "ShinyHunters claimed over 800,000 records including Social Security numbers.",
"sources": [
{
"name": "BleepingComputer",
"url": "https://www.bleepingcomputer.com/news/security/wynn-resorts-confirms-employee-data-breach-after-extortion-threat/"
}
],
"checked": "2026-11-07",
"domain": "wynnresorts.com",
"logo": "wynnresorts.com",
"actor_ids": [
"shinyhunters"
],
"id": "2d45570b"
},
{
"org": "LexisNexis Legal & Professional",
"sector": "other",
"date": "2026-03-03",
"type": "intrusion",
"actor": "FulcrumSec",
"status": "confirmed",
"vendor": false,
"confirmed": "LexisNexis said an unauthorized party accessed a limited number of servers holding mostly legacy customer data.",
"claimed": "FulcrumSec leaked about 2 GB of files and claimed about 400,000 cloud user profiles, including .gov addresses.",
"sources": [
{
"name": "BleepingComputer",
"url": "https://bleepingcomputer.com/news/security/lexisnexis-confirms-data-breach-as-hackers-leak-stolen-files"
}
],
"checked": "2026-11-07",
"domain": "lexisnexis.com",
"logo": "lexisnexis.com",
"actor_ids": [
"fulcrumsec"
],
"id": "df2e11b3"
},
{
"org": "DentaQuest",
"sector": "health",
"date": "2026-05-20",
"type": "data-leak",
"actor": "ShinyHunters",
"status": "confirmed",
"vendor": false,
"confirmed": "DentaQuest found unauthorized network access between 17 and 20 May 2026 and is notifying at least 15 million people.",
"claimed": "ShinyHunters claimed 234 GB of stolen data and leaked it after talks failed.",
"sources": [
{
"name": "HIPAA Journal",
"url": "https://www.hipaajournal.com/dentaquest-data-breach/"
}
],
"checked": "2026-11-07",
"domain": "dentaquest.com",
"logo": "dentaquest.com",
"actor_ids": [
"shinyhunters"
],
"id": "2d394d64",
"story": "dentaquest-data-breach"
},
{
"org": "Amgen",
"sector": "health",
"date": "2026-08-03",
"type": "data-leak",
"actor": "",
"status": "confirmed",
"vendor": true,
"confirmed": "Amgen told the SEC that attackers took proprietary information and patient health data from cloud environments run by outside providers.",
"claimed": "",
"sources": [
{
"name": "The Record",
"url": "https://therecord.media/amgen-hackers-cyberattack-sec"
}
],
"checked": "2026-11-07",
"domain": "amgen.com",
"logo": "amgen.com",
"actor_ids": [],
"id": "075399d4"
},
{
"org": "North Carolina Ports Authority",
"sector": "transport",
"date": "2026-08-04",
"type": "intrusion",
"actor": "",
"status": "confirmed",
"vendor": false,
"confirmed": "A ports spokesperson said the IT system was hacked by an outside actor and the Wilmington, Morehead City and Charlotte sites moved to manual processing.",
"claimed": "",
"sources": [
{
"name": "The Record",
"url": "https://therecord.media/cyberattack-north-carolina-ports"
}
],
"checked": "2026-11-07",
"domain": "ncports.com",
"logo": "ncports.com",
"actor_ids": [],
"id": "c20073f2"
},
{
"org": "McKesson",
"sector": "health",
"date": "2026-08-28",
"type": "supply-chain",
"actor": "ShinyHunters",
"status": "confirmed",
"vendor": true,
"confirmed": "McKesson disclosed in SEC filings that attackers used a third-party application to take data on oncology and surgical customers.",
"claimed": "ShinyHunters claimed the attack and threatened to leak the data.",
"sources": [
{
"name": "The Record",
"url": "https://therecord.media/mckesson-cyberattack-ransomware-pharma"
}
],
"checked": "2026-11-07",
"domain": "mckesson.com",
"logo": "mckesson.com",
"actor_ids": [
"shinyhunters"
],
"id": "5ddd721c"
}
],
"since": "2026-01-01",
"stats": [
{
"label": "Reported cybercrime losses (FBI IC3)",
"value": "$20.877 billion",
"period": "2025",
"source": {
"name": "Help Net Security on the FBI IC3 2025 report",
"url": "https://www.helpnetsecurity.com/?p=365202"
}
},
{
"label": "Complaints received by FBI IC3",
"value": "1,008,597",
"period": "2025",
"source": {
"name": "FBI IC3 2025 Internet Crime Report",
"url": "https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf"
}
},
{
"label": "Cyber-enabled fraud losses (FBI IC3)",
"value": "$17.7 billion",
"period": "2025",
"source": {
"name": "Help Net Security on the FBI IC3 2025 report",
"url": "https://www.helpnetsecurity.com/?p=365202"
}
},
{
"label": "Ransomware complaints to FBI IC3",
"value": "3,611",
"period": "2025",
"source": {
"name": "The Record",
"url": "https://therecord.media/cyber-fraud-surges-to-17-billion-fbi-ic3"
}
}
],
"rules": [],
"actors": [
{
"name": "ShinyHunters",
"kind": "extortion",
"seen": "Claimed data theft from Wynn Resorts, DentaQuest and McKesson in 2026.",
"sources": [
{
"name": "HIPAA Journal",
"url": "https://www.hipaajournal.com/dentaquest-data-breach/"
},
{
"name": "The Record",
"url": "https://therecord.media/mckesson-cyberattack-ransomware-pharma"
}
],
"actor_id": "shinyhunters"
},
{
"name": "SafePay",
"kind": "ransomware",
"seen": "Subject of an October 2026 CISA and FBI advisory linking it to about 600 victims across critical infrastructure.",
"sources": [
{
"name": "CISA",
"url": "https://www.cisa.gov/news-events/news/cisa-fbi-and-partners-warn-organizations-safepay-ransomware-actors-targeting-multiple-critical"
}
],
"actor_id": "safepay"
}
],
"slug": "united-states",
"title": "United States Cyber Incidents and Data Breaches 2026 · pwnsy",
"lede": "No public threat level. 6 incidents confirmed, 0 claims in 2026.",
"h1": "![\"\"](\"/tools/cyber-watch/flags/us.svg\")
United States Cyber Watch",
"desc": "United States cyber threat level: none published. 6 incidents confirmed and 0 claims in 2026, each sourced. Updated 7 Nov 2026.",
"upd": "2026-11-07"
},
"CA": {
"name": "Canada",
"region": "Americas",
"posture": {
"level": "",
"summary": "Canada publishes no national cyber threat level; the Cyber Centre issues alerts, advisories and a biennial National Cyber Threat Assessment.",
"agency": "Canadian Centre for Cyber Security (Communications Security Establishment)",
"source": {
"name": "Canadian Centre for Cyber Security alerts and advisories",
"url": "https://www.cyber.gc.ca/en/alerts-advisories"
},
"checked": "2026-11-07"
},
"timeline": [
{
"date": "2026-03-26",
"text": "The House of Commons passed Bill C-8 on cyber security at third reading.",
"url": "https://www.parl.ca/legisinfo/en/bill/45-1/c-8",
"src": "Parliament of Canada"
},
{
"date": "2026-06-15",
"text": "Bill C-8 received Royal Assent.",
"url": "https://www.parl.ca/legisinfo/en/bill/45-1/c-8",
"src": "Parliament of Canada"
},
{
"date": "2026-06-29",
"text": "CSE released its 2025-2026 annual report, citing more than 3,200 incidents handled and action against 10 ransomware groups.",
"url": "https://www.canada.ca/en/communications-security/news/2026/06/communications-security-establishment-canada-releases-its-2025-2026-annual-report.html",
"src": "Communications Security Establishment"
}
],
"incidents": [
{
"org": "Loblaw Companies",
"sector": "retail",
"date": "2026-03-10",
"type": "data-leak",
"actor": "",
"status": "confirmed",
"vendor": false,
"confirmed": "Loblaw said a criminal third party accessed basic customer data such as names, phone numbers and email addresses and logged all customers out.",
"claimed": "",
"sources": [
{
"name": "BleepingComputer",
"url": "https://www.bleepingcomputer.com/news/security/canadian-retail-giant-loblaw-notifies-customers-of-data-breach/"
},
{
"name": "Cyber Daily",
"url": "https://www.cyberdaily.au/security/13325-canadas-largest-food-and-pharmacy-retailer-discloses-cyber-attack"
}
],
"checked": "2026-11-07",
"domain": "loblaw.ca",
"logo": "loblaw.ca",
"actor_ids": [],
"id": "d33d0e87"
},
{
"org": "Telus Digital",
"sector": "telecom",
"date": "2026-03-12",
"type": "data-leak",
"actor": "ShinyHunters",
"status": "confirmed",
"vendor": false,
"confirmed": "Telus confirmed unauthorized access to a limited number of its systems and said operations continued.",
"claimed": "ShinyHunters claimed close to 1 petabyte of data and a $65 million demand.",
"sources": [
{
"name": "BleepingComputer",
"url": "https://www.bleepingcomputer.com/news/security/telus-digital-confirms-breach-after-hacker-claims-1-petabyte-data-theft/"
}
],
"checked": "2026-11-07",
"domain": "telusdigital.com",
"logo": "telusdigital.com",
"actor_ids": [
"shinyhunters"
],
"id": "4172737e"
},
{
"org": "Loyalist College",
"sector": "education",
"date": "2026-07-09",
"type": "ransomware",
"actor": "",
"status": "confirmed",
"vendor": false,
"confirmed": "The college said a ransomware actor accessed files with personal information and disrupted email, online classes and financial aid systems.",
"claimed": "",
"sources": [
{
"name": "Quinte News",
"url": "https://www.quintenews.com/2026/07/31/loyalist-college-returns-to-normal-following-cyber-attack/"
}
],
"checked": "2026-11-07",
"domain": "loyalistcollege.com",
"logo": "loyalistcollege.com",
"actor_ids": [],
"id": "5828f5c3"
},
{
"org": "SickKids (Hospital for Sick Children)",
"sector": "health",
"date": "2026-08-21",
"type": "data-leak",
"actor": "",
"status": "confirmed",
"vendor": true,
"confirmed": "SickKids said a flaw in third-party software exposed data on staff and job applicants, with clinical systems unaffected.",
"claimed": "",
"sources": [
{
"name": "BleepingComputer",
"url": "https://www.bleepingcomputer.com/news/security/sickkids-data-breach-exposes-employee-and-job-applicant-info/"
}
],
"checked": "2026-11-07",
"domain": "sickkids.ca",
"logo": "sickkids.ca",
"actor_ids": [],
"id": "611ba07c"
},
{
"org": "Saskatoon Tribal Council",
"sector": "government",
"date": "2026-08-21",
"type": "intrusion",
"actor": "The Gentlemen",
"status": "confirmed",
"vendor": false,
"confirmed": "The council said an incident found on 21 August may have exposed health, child and family service, HR and financial records.",
"claimed": "The Gentlemen ransomware group listed the council as a victim.",
"sources": [
{
"name": "Saskatoon Tribal Council",
"url": "https://sktc.sk.ca/saskatoon-tribal-council-affected-by-cybersecurity-incident/"
},
{
"name": "BlackFog, State of Ransomware October 2026",
"url": "https://www.blackfog.com/the-state-of-ransomware-october-2026/"
}
],
"checked": "2026-11-07",
"domain": "sktc.sk.ca",
"logo": "sktc.sk.ca",
"actor_ids": [
"the-gentlemen"
],
"id": "bff51014"
}
],
"since": "2026-01-01",
"stats": [
{
"label": "Cyber incidents the Cyber Centre responded to (federal and critical infrastructure)",
"value": "more than 3,200",
"period": "April 2025 to March 2026",
"source": {
"name": "CSE Annual Report 2025-2026",
"url": "https://www.canada.ca/en/communications-security/news/2026/06/communications-security-establishment-canada-releases-its-2025-2026-annual-report.html"
}
},
{
"label": "Alerts and advisories published by the Cyber Centre",
"value": "25 alerts, 995 advisories",
"period": "April 2025 to March 2026",
"source": {
"name": "CSE Annual Report 2025-2026",
"url": "https://www.canada.ca/en/communications-security/news/2026/06/communications-security-establishment-canada-releases-its-2025-2026-annual-report.html"
}
},
{
"label": "National Cyber Threat Notification System alerts sent",
"value": "over 97,000",
"period": "April 2025 to March 2026",
"source": {
"name": "CSE Annual Report 2025-2026",
"url": "https://www.canada.ca/en/communications-security/news/2026/06/communications-security-establishment-canada-releases-its-2025-2026-annual-report.html"
}
}
],
"rules": [
{
"date": "2026-06-15",
"title": "Bill C-8, An Act respecting cyber security (S.C. 2026, c. 9)",
"what": "Received Royal Assent; it amends the Telecommunications Act and sets cyber security duties for federally regulated critical systems.",
"url": "https://www.parl.ca/legisinfo/en/bill/45-1/c-8"
}
],
"actors": [
{
"name": "ShinyHunters",
"kind": "extortion",
"seen": "Claimed the Telus Digital breach and a multi-month theft of BPO and telecom data.",
"sources": [
{
"name": "BleepingComputer",
"url": "https://www.bleepingcomputer.com/news/security/telus-digital-confirms-breach-after-hacker-claims-1-petabyte-data-theft/"
}
],
"actor_id": "shinyhunters"
}
],
"slug": "canada",
"title": "Canada Cyber Incidents and Data Breaches 2026 · pwnsy",
"lede": "No public threat level. 5 incidents confirmed, 0 claims in 2026.",
"h1": "![\"\"](\"/tools/cyber-watch/flags/ca.svg\")
Canada Cyber Watch",
"desc": "Canada cyber threat level: none published. 5 incidents confirmed and 0 claims in 2026, each sourced. Updated 7 Nov 2026.",
"upd": "2026-11-07"
},
"MX": {
"name": "Mexico",
"region": "Americas",
"posture": {
"level": "",
"summary": "Mexico publishes no national cyber threat level, and no single agency issues public national cyber alerts.",
"agency": "Agencia de Transformación Digital y Telecomunicaciones (ATDT)",
"source": {
"name": "ATDT",
"url": "https://www.gob.mx/atdt"
},
"checked": "2026-11-07"
},
"timeline": [],
"incidents": [
{
"org": "Municipio de Chihuahua",
"sector": "government",
"date": "2026-02-07",
"type": "ransomware",
"actor": "Qilin",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "Qilin listed the Chihuahua municipal government on its leak site.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/country/MX"
}
],
"checked": "2026-11-07",
"domain": "municipiochihuahua.gob.mx",
"logo": "municipiochihuahua.gob.mx",
"actor_ids": [
"qilin"
],
"id": "18f3e7da"
},
{
"org": "Cinépolis",
"sector": "other",
"date": "2026-08-21",
"type": "ransomware",
"actor": "Qilin",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "Qilin listed the cinema chain on its leak site.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/country/MX"
}
],
"checked": "2026-11-07",
"domain": "cinepolis.com",
"logo": "cinepolis.com",
"actor_ids": [
"qilin"
],
"id": "5a09bc10"
},
{
"org": "UNAM",
"sector": "education",
"date": "2026-01-07",
"type": "intrusion",
"actor": "ByteToBreach",
"status": "confirmed",
"vendor": false,
"confirmed": "UNAM confirmed an unauthorised intrusion into 5 of its roughly 100,000 systems over the holidays. It disabled them and said there was no sign that student or staff personal data was extracted.",
"claimed": "A journalist reported the attacker, ByteToBreach, reached data on over 380,000 students and staff and confidential rector's office mail.",
"sources": [
{
"name": "El Financiero",
"url": "https://www.elfinanciero.com.mx/nacional/2026/01/07/unam-confirma-hackeo-de-sistemas-informaticos-descarta-robo-de-informacion-de-datos-personales-de-alumnos/"
},
{
"name": "Xataka",
"url": "https://www.xataka.com/seguridad/hackeo-a-unam-a-brecha-telcel-ciberseguridad-mexico-pasa-uno-sus-peores-momentos"
}
],
"checked": "2026-11-08",
"domain": "unam.mx",
"logo": "unam.mx",
"actor_ids": [
"bytetobreach"
],
"id": "c445c56e"
},
{
"org": "Telcel",
"sector": "telecom",
"date": "2026-01-12",
"type": "data-leak",
"actor": "",
"status": "confirmed",
"vendor": false,
"confirmed": "Telcel said it found and fixed a technical vulnerability in its new line registration portal. It denied a mass data breach.",
"claimed": "Users reported that entering any Telcel number returned the holder's name, CURP, birth date and email.",
"sources": [
{
"name": "La Crónica de Hoy",
"url": "https://www.cronica.com.mx/nacional/2026/01/12/fue-vulnerabilidad-tecnica-telcel-responde-por-supuesta-filtracion-de-datos-personales/"
},
{
"name": "Expansión",
"url": "https://expansion.mx/empresas/2026/01/12/telcel-niega-filtracion-masiva-de-datos"
}
],
"checked": "2026-11-08",
"domain": "telcel.com",
"logo": "telcel.com",
"actor_ids": [],
"id": "617f45ca"
},
{
"org": "IMSS-Bienestar and other public bodies",
"sector": "government",
"date": "2026-01-30",
"type": "data-leak",
"actor": "Chronus",
"status": "disputed",
"vendor": true,
"confirmed": "The Digital Transformation Agency (ATDT) said valid usernames and passwords found during the incident were disabled. It said it detected no breach of federal infrastructure and that old systems run by private vendors for states were mainly affected.",
"claimed": "Chronus said it leaked 2.3 TB from about 25 institutions, including 1.8 TB from the IMSS-Bienestar register.",
"sources": [
{
"name": "Infobae",
"url": "https://www.infobae.com/mexico/2026/01/31/gobierno-de-mexico-reacciona-a-supuesto-hackeo-al-sat-imss-bienestar-y-otras-instituciones/"
}
],
"checked": "2026-11-08",
"domain": "",
"actor_ids": [
"chronus"
],
"id": "1249051d"
},
{
"org": "Farmacia San Pablo",
"sector": "retail",
"date": "2026-01-02",
"type": "ransomware",
"actor": "Qilin",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "Qilin listed the pharmacy chain on its leak site with no proof attached. No company statement found.",
"sources": [
{
"name": "Botcrawl",
"url": "https://botcrawl.com/farmacia-san-pablo-data-breach/"
}
],
"checked": "2026-11-08",
"domain": "farmaciasanpablo.com.mx",
"logo": "farmaciasanpablo.com.mx",
"actor_ids": [
"qilin"
],
"id": "63e19c22"
},
{
"org": "Sears México (Grupo Sanborns)",
"sector": "retail",
"date": "2026-08-15",
"type": "ransomware",
"actor": "SpaceBears",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "SpaceBears listed Sears México on its leak site and promised sample files ahead of a full release. No company statement found.",
"sources": [
{
"name": "ransomware.live",
"url": "https://ransomware.live/id/U0VBUlMgKEdydXBvIFNhbmJvcm5zKUBzcGFjZWJlYXJz"
}
],
"checked": "2026-11-08",
"domain": "sears.com.mx",
"logo": "sears.com.mx",
"actor_ids": [
"spacebears"
],
"id": "1c51af7c"
}
],
"since": "2026-01-01",
"stats": [],
"rules": [],
"actors": [
{
"name": "Qilin",
"kind": "ransomware",
"seen": "The most frequent group on leak-site posts naming Mexican victims in 2026.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/country/MX"
}
],
"actor_id": "qilin"
},
{
"name": "The Gentlemen",
"kind": "ransomware",
"seen": "Posted many Mexican manufacturing, retail and hospitality victims through 2026.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/country/MX"
}
],
"actor_id": "the-gentlemen"
}
],
"slug": "mexico",
"title": "Mexico Cyber Incidents and Data Breaches 2026 · pwnsy",
"lede": "No public threat level. 2 incidents confirmed, 4 claims in 2026.",
"h1": "![\"\"](\"/tools/cyber-watch/flags/mx.svg\")
Mexico Cyber Watch",
"desc": "Mexico cyber threat level: none published. 2 incidents confirmed and 4 claims in 2026, each sourced. Updated 8 Nov 2026.",
"upd": "2026-11-08"
},
"BR": {
"name": "Brazil",
"region": "Americas",
"posture": {
"level": "",
"summary": "Brazil publishes no national cyber threat level; CTIR Gov handles federal incidents and issues alerts, and CERT.br serves the wider internet.",
"agency": "Gabinete de Segurança Institucional (GSI), CTIR Gov",
"source": {
"name": "CTIR Gov",
"url": "https://www.gov.br/gsi/pt-br/assuntos/ctir/"
},
"checked": "2026-11-07"
},
"timeline": [
{
"date": "2026-06-20",
"text": "National Secretary Wolnei Wolff said the false alert case was being handled with the utmost technical rigor.",
"url": "https://therecord.media/suspected-cyberattack-triggers-false-emergency-alerts-brazil",
"src": "The Record"
},
{
"date": "2026-08-14",
"text": "Federal Police Operation Klonen arrested four people over a 30 million euro bank fraud that exploited a payment system flaw.",
"url": "https://www.bleepingcomputer.com/news/security/hackers-arrested-over-30m-bank-fraud-exploiting-service-provider-flaw/",
"src": "BleepingComputer"
}
],
"incidents": [
{
"org": "Defesa Civil national emergency alert system",
"sector": "government",
"date": "2026-06-20",
"type": "intrusion",
"actor": "",
"status": "confirmed",
"vendor": false,
"confirmed": "The National Civil Defense Secretariat said unauthorized access sent false alerts in several states, and the Federal Police opened an investigation.",
"claimed": "",
"sources": [
{
"name": "The Record",
"url": "https://therecord.media/suspected-cyberattack-triggers-false-emergency-alerts-brazil"
},
{
"name": "GIGAZINE",
"url": "https://gigazine.net/gsc_news/en/20260622-alien-invasion-alerts"
}
],
"checked": "2026-11-07",
"actor_ids": [],
"id": "b3326ace"
},
{
"org": "Mercado Bitcoin",
"sector": "finance",
"date": "2026-11-02",
"type": "intrusion",
"actor": "",
"status": "confirmed",
"vendor": false,
"confirmed": "Brazil's largest crypto exchange confirmed a cybersecurity incident and suspended deposits and withdrawals.",
"claimed": "Blockchain security firms said more than $46 million left the platform.",
"sources": [
{
"name": "The Record",
"url": "https://therecord.media/mercado-bitcoin-brazil-cryptocurrency-heist"
}
],
"checked": "2026-11-07",
"domain": "mercadobitcoin.com.br",
"logo": "mercadobitcoin.com.br",
"actor_ids": [],
"id": "f28f28da"
},
{
"org": "Fundação Getulio Vargas (FGV)",
"sector": "education",
"date": "2026-03-02",
"type": "ransomware",
"actor": "DragonForce",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "DragonForce claimed about 1.52 TB of FGV data; FGV had not confirmed.",
"sources": [
{
"name": "Capital Digital",
"url": "https://capitaldigital.com.br/grupo-de-ransomware-dragonforce-afirma-ter-invadido-a-fundacao-getulio-vargas/"
}
],
"checked": "2026-11-07",
"domain": "fgv.br",
"logo": "fgv.br",
"actor_ids": [
"dragonforce"
],
"id": "b128e942"
},
{
"org": "Receita Federal do Brasil",
"sector": "government",
"date": "2026-09-23",
"type": "ransomware",
"actor": "Emperador",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "The Emperador group listed the federal tax authority on its leak site.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/country/BR"
}
],
"checked": "2026-11-07",
"domain": "receita.fazenda.gov.br",
"logo": "receita.fazenda.gov.br",
"actor_ids": [
"emperador"
],
"id": "2a06cd6b"
}
],
"since": "2026-01-01",
"stats": [
{
"label": "Notifications received by CTIR Gov (incidents plus vulnerabilities)",
"value": "61,378",
"period": "2026 to date (as shown 2026-11-07)",
"source": {
"name": "CTIR Gov",
"url": "https://www.gov.br/gsi/pt-br/assuntos/ctir/"
}
}
],
"rules": [],
"actors": [
{
"name": "The Gentlemen",
"kind": "ransomware",
"seen": "The most frequent group on leak-site posts naming Brazilian victims in 2026.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/country/BR"
}
],
"actor_id": "the-gentlemen"
}
],
"slug": "brazil",
"title": "Brazil Cyber Incidents and Data Breaches 2026 · pwnsy",
"lede": "No public threat level. 2 incidents confirmed, 2 claims in 2026.",
"h1": "![\"\"](\"/tools/cyber-watch/flags/br.svg\")
Brazil Cyber Watch",
"desc": "Brazil cyber threat level: none published. 2 incidents confirmed and 2 claims in 2026, each sourced. Updated 7 Nov 2026.",
"upd": "2026-11-07"
},
"AR": {
"name": "Argentina",
"region": "Americas",
"posture": {
"level": "",
"summary": "Argentina publishes no national cyber threat level; CERT.ar handles incidents in the national public sector and publishes guidance and annual reports.",
"agency": "Centro Nacional de Ciberseguridad, CERT.ar",
"source": {
"name": "CERT.ar",
"url": "https://www.argentina.gob.ar/ciberseguridad/certar"
},
"checked": "2026-11-07"
},
"timeline": [],
"incidents": [
{
"org": "Oleoductos del Valle (Oldelval)",
"sector": "energy",
"date": "2026-08-04",
"type": "ransomware",
"actor": "",
"status": "confirmed",
"vendor": false,
"confirmed": "The pipeline operator said an attack hit its administrative systems while oil transport continued.",
"claimed": "Leak-site trackers attribute the claim to a ransomware group, with sources differing on which one.",
"sources": [
{
"name": "BlackFog, State of Ransomware September 2026",
"url": "https://www.blackfog.com/the-state-of-ransomware-september-2026/"
},
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/country/AR"
}
],
"checked": "2026-11-07",
"domain": "oldelval.com",
"logo": "oldelval.com",
"actor_ids": [],
"id": "d8d9ef6b"
},
{
"org": "Mercado Libre",
"sector": "retail",
"date": "2026-07-08",
"type": "ransomware",
"actor": "The Gentlemen",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "The Gentlemen listed Mercado Libre on its leak site; the company reported no disruption and did not confirm a breach.",
"sources": [
{
"name": "Escudo Digital",
"url": "https://www.escudodigital.com/en/cybersecurity/mercado-libre-hit-by-ransomware-attack.html"
},
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/country/AR"
}
],
"checked": "2026-11-07",
"domain": "mercadolibre.com.ar",
"logo": "mercadolibre.com.ar",
"actor_ids": [
"the-gentlemen"
],
"id": "dafd2f13"
},
{
"org": "Ejército Argentino",
"sector": "government",
"date": "2026-07-24",
"type": "ransomware",
"actor": "Qilin",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "Qilin listed the Argentine Army on its leak site.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/country/AR"
}
],
"checked": "2026-11-07",
"domain": "ejercito.mil.ar",
"logo": "ejercito.mil.ar",
"actor_ids": [
"qilin"
],
"id": "e80bb398"
}
],
"since": "2026-01-01",
"stats": [],
"rules": [],
"actors": [
{
"name": "Qilin",
"kind": "ransomware",
"seen": "The most frequent group on leak-site posts naming Argentine victims in 2026.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/country/AR"
}
],
"actor_id": "qilin"
},
{
"name": "The Gentlemen",
"kind": "ransomware",
"seen": "Claimed Mercado Libre and Transportadora de Gas del Norte in 2026.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/country/AR"
}
],
"actor_id": "the-gentlemen"
}
],
"slug": "argentina",
"title": "Argentina Cyber Incidents and Data Breaches 2026 · pwnsy",
"lede": "No public threat level. 1 incident confirmed, 2 claims in 2026.",
"h1": "![\"\"](\"/tools/cyber-watch/flags/ar.svg\")
Argentina Cyber Watch",
"desc": "Argentina cyber threat level: none published. 1 incident confirmed and 2 claims in 2026, each sourced. Updated 7 Nov 2026.",
"upd": "2026-11-07"
},
"CL": {
"name": "Chile",
"region": "Americas",
"posture": {
"level": "",
"summary": "Chile publishes no national cyber threat level; the ANCI and its national CSIRT publish alerts and indicators and receive mandatory incident reports.",
"agency": "Agencia Nacional de Ciberseguridad (ANCI), CSIRT Nacional",
"source": {
"name": "ANCI",
"url": "https://anci.gob.cl/"
},
"checked": "2026-11-07"
},
"timeline": [],
"incidents": [
{
"org": "Copec",
"sector": "energy",
"date": "2026-01-14",
"type": "ransomware",
"actor": "Anubis",
"status": "confirmed",
"vendor": false,
"confirmed": "Copec acknowledged the incident and said it was contained without affecting operations.",
"claimed": "Anubis claimed exfiltration of about 6 TB of data.",
"sources": [
{
"name": "BlackFog, State of Ransomware January 2026",
"url": "https://www.blackfog.com/the-state-of-ransomware-january-2026/"
},
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/country/CL"
}
],
"checked": "2026-11-07",
"domain": "copec.cl",
"actor_ids": [
"anubis"
],
"id": "41b6c0c1"
},
{
"org": "Hospital Clínico Universidad de Chile",
"sector": "health",
"date": "2026-08-30",
"type": "ransomware",
"actor": "DireWolf",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "DireWolf listed the university hospital on its leak site.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/country/CL"
}
],
"checked": "2026-11-07",
"domain": "redclinica.cl",
"logo": "redclinica.cl",
"actor_ids": [
"direwolf"
],
"id": "68a1950b"
},
{
"org": "Isapre Consalud",
"sector": "health",
"date": "2026-11-02",
"type": "ransomware",
"actor": "Qilin",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "Qilin listed the health insurer on its leak site.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/country/CL"
}
],
"checked": "2026-11-07",
"domain": "consalud.cl",
"logo": "consalud.cl",
"actor_ids": [
"qilin"
],
"id": "1c07884c"
}
],
"since": "2026-01-01",
"stats": [],
"rules": [],
"actors": [
{
"name": "Qilin",
"kind": "ransomware",
"seen": "The most frequent group on leak-site posts naming Chilean victims in 2026.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/country/CL"
}
],
"actor_id": "qilin"
},
{
"name": "The Gentlemen",
"kind": "ransomware",
"seen": "Claimed Chilean victims including the national human rights institute (INDH) in 2026.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/country/CL"
}
],
"actor_id": "the-gentlemen"
}
],
"slug": "chile",
"title": "Chile Cyber Incidents and Data Breaches 2026 · pwnsy",
"lede": "No public threat level. 1 incident confirmed, 2 claims in 2026.",
"h1": "![\"\"](\"/tools/cyber-watch/flags/cl.svg\")
Chile Cyber Watch",
"desc": "Chile cyber threat level: none published. 1 incident confirmed and 2 claims in 2026, each sourced. Updated 7 Nov 2026.",
"upd": "2026-11-07"
},
"CO": {
"name": "Colombia",
"region": "Americas",
"posture": {
"level": "",
"summary": "Colombia publishes no national cyber threat level; ColCERT coordinates incident response and issues alerts.",
"agency": "ColCERT (Ministry of ICT)",
"source": {
"name": "ColCERT",
"url": "https://www.colcert.gov.co/"
},
"checked": "2026-11-07"
},
"timeline": [],
"incidents": [
{
"org": "Ecopetrol",
"sector": "energy",
"date": "2026-07-19",
"type": "data-leak",
"actor": "The Gentlemen",
"status": "confirmed",
"vendor": false,
"confirmed": "Ecopetrol said unauthorized access to its cloud file storage exposed data tied to about 3,300 user accounts and production was not disrupted.",
"claimed": "The Gentlemen claimed the attack and up to 1 TB of data.",
"sources": [
{
"name": "TechRadar",
"url": "https://www.techradar.com/pro/security/colombian-energy-giant-ecopetrol-says-thousands-of-user-accounts-hit-in-cyberattack"
},
{
"name": "BlackFog, State of Ransomware July 2026",
"url": "https://www.blackfog.com/the-state-of-ransomware-july-2026/"
},
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/country/CO"
}
],
"checked": "2026-11-07",
"domain": "ecopetrol.com.co",
"logo": "ecopetrol.com.co",
"actor_ids": [
"the-gentlemen"
],
"id": "878ca5e9"
},
{
"org": "Empresas Públicas de Medellín (EPM)",
"sector": "energy",
"date": "2026-08-05",
"type": "data-leak",
"actor": "Everest",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "Everest listed the Medellín utility on its leak site.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/country/CO"
}
],
"checked": "2026-11-07",
"domain": "epm.com.co",
"logo": "epm.com.co",
"actor_ids": [
"everest"
],
"id": "192b5df2"
},
{
"org": "DIAN (tax authority)",
"sector": "government",
"date": "2026-11-04",
"type": "ransomware",
"actor": "MedusaLocker",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "MedusaLocker listed the national tax authority on its leak site.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/country/CO"
}
],
"checked": "2026-11-07",
"domain": "dian.gov.co",
"logo": "dian.gov.co",
"actor_ids": [
"medusalocker"
],
"id": "d3554d84"
}
],
"since": "2026-01-01",
"stats": [],
"rules": [],
"actors": [
{
"name": "Qilin",
"kind": "ransomware",
"seen": "The most frequent group on leak-site posts naming Colombian victims in 2026.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/country/CO"
}
],
"actor_id": "qilin"
},
{
"name": "The Gentlemen",
"kind": "ransomware",
"seen": "Claimed the Ecopetrol attack in July 2026.",
"sources": [
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/country/CO"
}
],
"actor_id": "the-gentlemen"
}
],
"slug": "colombia",
"title": "Colombia Cyber Incidents and Data Breaches 2026 · pwnsy",
"lede": "No public threat level. 1 incident confirmed, 2 claims in 2026.",
"h1": "![\"\"](\"/tools/cyber-watch/flags/co.svg\")
Colombia Cyber Watch",
"desc": "Colombia cyber threat level: none published. 1 incident confirmed and 2 claims in 2026, each sourced. Updated 7 Nov 2026.",
"upd": "2026-11-07"
},
"JP": {
"name": "Japan",
"subject": "Japan",
"region": "Asia-Pacific",
"posture": {
"level": "",
"summary": "Japan publishes no national cyber threat level; the National Cybersecurity Office coordinates response and the National Police Agency reports threat statistics twice a year.",
"agency": "National Cybersecurity Office (NCO), Cabinet Secretariat",
"source": {
"name": "Recorded Future: Japan's proactive cyber defense strategy",
"url": "https://www.recordedfuture.com/research/japan-cyber-defense-strategy"
},
"checked": "2026-11-07"
},
"timeline": [
{
"date": "2026-09-10",
"text": "National Police Agency reported 123 ransomware cases in the first half of 2026, the highest half-year total since 2020.",
"url": "https://www.npa.go.jp/publications/statistics/cybersecurity/index.html",
"src": "National Police Agency"
},
{
"date": "2026-10-26",
"text": "Prime Minister Sanae Takaichi promised emergency measures against cyberattacks, calling the situation serious.",
"url": "https://therecord.media/japan-airlines-warns-of-breach-country-grapples-with-incidents",
"src": "The Record"
},
{
"date": "2026-11-06",
"text": "National Police Agency set up a nationwide joint investigation headquarters for cyberattacks since January 2026 that caused large data breaches.",
"url": "https://english.adnkronos.com/2026/11/06/japan-police-agency-launches-nationwide-data-breach-probe-hq/",
"src": "Jiji Press via Adnkronos"
}
],
"incidents": [
{
"org": "NTT Docomo",
"sector": "telecom",
"date": "2026-11-04",
"type": "intrusion",
"actor": "",
"status": "confirmed",
"vendor": false,
"confirmed": "President Yoshiaki Maeda said unauthorized access breached up to about 300,000 sets of personal information, including names, addresses, ID document numbers and bank account numbers, and the My docomo service was suspended.",
"claimed": "",
"sources": [
{
"name": "Jiji Press via Adnkronos",
"url": "https://english.adnkronos.com/2026/11/06/ntt-docomo-chief-says-personal-info-breached-in-cyberattack/"
}
],
"checked": "2026-11-07",
"domain": "docomo.ne.jp",
"logo": "docomo.ne.jp",
"actor_ids": [],
"id": "b34ead30",
"story": "ntt-docomo-data-breach"
},
{
"org": "Japan Airlines (Amadeus)",
"sector": "transport",
"date": "2026-10-28",
"type": "supply-chain",
"actor": "",
"status": "confirmed",
"vendor": true,
"confirmed": "JAL said unauthorized access to the Amadeus passenger service system exposed reservation data of about 92,000 JAL and Japan Transocean Air customers, about 2,000 of them with passport numbers.",
"claimed": "",
"sources": [
{
"name": "BleepingComputer",
"url": "https://www.bleepingcomputer.com/news/security/japan-airlines-suffers-third-party-data-breach-exposing-passenger-info/"
},
{
"name": "The Record",
"url": "https://therecord.media/japan-airlines-warns-of-breach-country-grapples-with-incidents"
}
],
"checked": "2026-11-07",
"domain": "jal.co.jp",
"logo": "jal.co.jp",
"actor_ids": [],
"id": "ae94812c",
"story": "amadeus-airline-data-breach"
},
{
"org": "All Nippon Airways (Amadeus)",
"sector": "transport",
"date": "2026-10-29",
"type": "supply-chain",
"actor": "",
"status": "confirmed",
"vendor": true,
"confirmed": "ANA said unauthorized access at its reservation contractor Amadeus may have exposed customer personal information.",
"claimed": "",
"sources": [
{
"name": "VisaVerge",
"url": "https://www.visaverge.com/travel/amadeus-cyberattack-exposes-passenger-data-at-four-asian-carriers/"
},
{
"name": "BleepingComputer",
"url": "https://www.bleepingcomputer.com/news/security/japan-airlines-suffers-third-party-data-breach-exposing-passenger-info/"
}
],
"checked": "2026-11-07",
"domain": "ana.co.jp",
"logo": "ana.co.jp",
"actor_ids": [],
"id": "ce071adf",
"story": "amadeus-airline-data-breach"
},
{
"org": "IDC Frontier (IDCF Cloud)",
"sector": "other",
"date": "2026-10-07",
"type": "ransomware",
"actor": "",
"status": "confirmed",
"vendor": true,
"confirmed": "The SoftBank cloud subsidiary said a third-party ransomware attack hit its East Japan Region 1, affecting 495 companies and local governments that use the service.",
"claimed": "",
"sources": [
{
"name": "BleepingComputer",
"url": "https://www.bleepingcomputer.com/news/security/ransomware-attack-disrupts-japans-idcf-cloud-used-by-govt-clients/"
}
],
"checked": "2026-11-07",
"domain": "idcf.jp",
"logo": "idcf.jp",
"actor_ids": [],
"id": "6d5c5750"
},
{
"org": "Keio Corporation",
"sector": "transport",
"date": "2026-09-26",
"type": "ransomware",
"actor": "",
"status": "confirmed",
"vendor": false,
"confirmed": "Keio confirmed a ransomware attack on its group servers that disrupted business systems, mainly in its hotel business, and reported it to police.",
"claimed": "",
"sources": [
{
"name": "BleepingComputer",
"url": "https://www.bleepingcomputer.com/news/security/japans-keio-confirms-ransomware-attack-disrupted-business-systems/"
}
],
"checked": "2026-11-07",
"domain": "keio.co.jp",
"logo": "keio.co.jp",
"actor_ids": [],
"id": "e69294d4"
},
{
"org": "Digital Agency (Government Solution Service)",
"sector": "government",
"date": "2026-09-11",
"type": "intrusion",
"actor": "",
"status": "confirmed",
"vendor": false,
"confirmed": "The Digital Agency said a third party used a VPN flaw to access its staff system, possibly exposing about 246,000 records on government employees and related contacts.",
"claimed": "",
"sources": [
{
"name": "BleepingComputer",
"url": "https://www.bleepingcomputer.com/news/security/japans-digital-agency-says-vpn-flaw-exposed-246-000-personnel-records/"
}
],
"checked": "2026-11-07",
"domain": "digital.go.jp",
"actor_ids": [],
"id": "0b17f16b"
},
{
"org": "Nihon Kotsu",
"sector": "transport",
"date": "2026-07-11",
"type": "ransomware",
"actor": "AiLock",
"status": "confirmed",
"vendor": false,
"confirmed": "Japan's largest taxi operator said its internal systems suffered unauthorized external access through a malware infection, taking dispatch and booking systems offline.",
"claimed": "The AiLock group claimed the attack and threatened to leak stolen data.",
"sources": [
{
"name": "BleepingComputer",
"url": "https://www.bleepingcomputer.com/news/security/japans-largest-taxi-operator-shuts-systems-after-cyberattack/"
}
],
"checked": "2026-11-07",
"domain": "nihon-kotsu.co.jp",
"logo": "nihon-kotsu.co.jp",
"actor_ids": [
"ailock"
],
"id": "f9025320"
},
{
"org": "KDDI (shared ISP email platform)",
"sector": "telecom",
"date": "2026-06-17",
"type": "data-leak",
"actor": "",
"status": "confirmed",
"vendor": true,
"confirmed": "KDDI said attackers used a zero-day in third-party software to breach an email platform serving five ISPs, exposing 12,233,087 email addresses and 7,616,173 passwords.",
"claimed": "",
"sources": [
{
"name": "BleepingComputer",
"url": "https://www.bleepingcomputer.com/news/security/japanese-telecom-giant-kddi-says-data-breach-affects-12-million-people/"
}
],
"checked": "2026-11-07",
"domain": "kddi.com",
"logo": "kddi.com",
"actor_ids": [],
"id": "fbdbd56c"
},
{
"org": "Docomo Hikari plala (S course) customers, via So-net",
"sector": "telecom",
"date": "2026-10-27",
"type": "supply-chain",
"actor": "",
"status": "confirmed",
"vendor": true,
"confirmed": "NTT Docomo said unauthorised access to a member database server at contractor Sony Network Communications (So-net) exposed 443,495 records of current and former plala (S course) customers: names, phone numbers, birth dates, gender, So-net email addresses and login IDs. Passwords, cards and bank details were not included.",
"claimed": "",
"sources": [
{
"name": "Sumahoan",
"url": "https://smhn.info/202610-docomo-hikari-plala-s-course-sonet-data-breach"
},
{
"name": "Selectra",
"url": "https://selectra.jp/money/news/docomo-hikari-rouei-20261029"
}
],
"checked": "2026-11-08",
"domain": "docomo.ne.jp",
"logo": "docomo.ne.jp",
"actor_ids": [],
"id": "8fcdaf3a"
}
],
"since": "2026-01-01",
"stats": [
{
"label": "Ransomware cases reported to police",
"value": "123",
"period": "January to June 2026",
"source": {
"name": "National Police Agency",
"url": "https://www.npa.go.jp/publications/statistics/cybersecurity/data/R8kami/R08_kami_cyber_jousei.pdf"
}
},
{
"label": "Ransomware cases reported to police",
"value": "226",
"period": "2025",
"source": {
"name": "National Police Agency",
"url": "https://www.npa.go.jp/publications/statistics/cybersecurity/data/R7/R07_cyber_jousei_eng.pdf"
}
}
],
"rules": [
{
"date": "2026-10-01",
"title": "Active Cyber Defense law: reporting and neutralization provisions",
"what": "Critical infrastructure operators must report incidents to the government, and authorities gain powers to access and neutralize attacking servers; communications-data provisions follow on 2027-11-23.",
"url": "https://www.recordedfuture.com/research/japan-cyber-defense-strategy"
},
{
"date": "2026-04-01",
"title": "Active Cyber Defense Oversight Commission established",
"what": "An independent commission now authorizes data acquisition and neutralization measures under the 2025 law.",
"url": "https://www.recordedfuture.com/research/japan-cyber-defense-strategy"
}
],
"actors": [
{
"name": "AiLock",
"kind": "ransomware",
"seen": "Claimed the July 2026 attack on taxi operator Nihon Kotsu.",
"sources": [
{
"name": "BleepingComputer",
"url": "https://www.bleepingcomputer.com/news/security/japans-largest-taxi-operator-shuts-systems-after-cyberattack/"
}
],
"actor_id": "ailock"
}
],
"slug": "japan",
"title": "Japan Cyber Incidents and Data Breaches 2026 · pwnsy",
"lede": "No public threat level. 9 incidents confirmed, 0 claims in 2026.",
"h1": "![\"\"](\"/tools/cyber-watch/flags/jp.svg\")
Japan Cyber Watch",
"desc": "Japan cyber threat level: none published. 9 incidents confirmed and 0 claims in 2026, each sourced. Updated 8 Nov 2026.",
"upd": "2026-11-08"
},
"KR": {
"name": "South Korea",
"subject": "South Korea",
"region": "Asia-Pacific",
"posture": {
"level": "Caution",
"summary": "KISA publishes a five-step internet intrusion alert level on its Boho site and raised it from Attention to Caution on 22 October 2026.",
"agency": "Korea Internet & Security Agency (KISA, KrCERT/CC)",
"source": {
"name": "KISA Boho alert level notices",
"url": "https://www.boho.or.kr/kr/bbs/list.do?menuNo=205024&bbsId=B0000342"
},
"prev": "Attention",
"since": "2026-10-22",
"scale": [
"Normal",
"Attention",
"Caution",
"Alert",
"Serious"
],
"checked": "2026-11-07"
},
"timeline": [
{
"date": "2026-06-11",
"text": "PIPC fined Coupang KRW 624.6 billion over the leak of about 37.55 million people's data.",
"url": "https://www.bleepingcomputer.com/news/security/south-korea-hits-coupang-with-record-409-million-fine-over-data-breach/",
"src": "BleepingComputer"
},
{
"date": "2026-07-30",
"text": "PIPC fined KT KRW 53.979 billion over the femtocell intrusion.",
"url": "https://www.bleepingcomputer.com/news/security/south-korea-fines-telco-giant-kt-39-million-for-customer-data-breach/",
"src": "BleepingComputer"
},
{
"date": "2026-10-22",
"text": "KISA raised the internet intrusion alert level from attention to caution.",
"url": "https://www.boho.or.kr/kr/bbs/list.do?menuNo=205024&bbsId=B0000342",
"src": "KISA"
}
],
"incidents": [
{
"org": "Shinhan Bank",
"sector": "finance",
"date": "2026-10-05",
"type": "data-leak",
"actor": "",
"status": "confirmed",
"vendor": false,
"confirmed": "Officials confirmed a data breach at Shinhan Bank, one of several bank incidents that led the Financial Services Commission to hold an emergency meeting and order on-site checks.",
"claimed": "",
"sources": [
{
"name": "BleepingComputer",
"url": "https://www.bleepingcomputer.com/news/security/south-korea-probes-bank-breaches-amid-suspected-ai-powered-attacks/"
}
],
"checked": "2026-11-07",
"domain": "shinhan.com",
"logo": "shinhan.com",
"actor_ids": [],
"id": "a639fec6"
},
{
"org": "Korean Air (Amadeus)",
"sector": "transport",
"date": "2026-10-20",
"type": "supply-chain",
"actor": "",
"status": "confirmed",
"vendor": true,
"confirmed": "Korean Air said Amadeus notified it on 20 October that customer data including reservation numbers may have leaked, with no intrusion into its own systems.",
"claimed": "",
"sources": [
{
"name": "VisaVerge",
"url": "https://www.visaverge.com/travel/amadeus-cyberattack-exposes-passenger-data-at-four-asian-carriers/"
}
],
"checked": "2026-11-07",
"domain": "koreanair.com",
"logo": "koreanair.com",
"actor_ids": [],
"id": "e2e1e991",
"story": "amadeus-airline-data-breach"
},
{
"org": "Asiana Airlines (Amadeus)",
"sector": "transport",
"date": "2026-10-29",
"type": "supply-chain",
"actor": "",
"status": "confirmed",
"vendor": true,
"confirmed": "Asiana said booking-related customer information was exposed through Amadeus and that payment data, held on a separate system, was not affected.",
"claimed": "",
"sources": [
{
"name": "VisaVerge",
"url": "https://www.visaverge.com/travel/amadeus-cyberattack-exposes-passenger-data-at-four-asian-carriers/"
}
],
"checked": "2026-11-07",
"domain": "flyasiana.com",
"actor_ids": [],
"id": "da36b2ac",
"story": "amadeus-airline-data-breach"
},
{
"org": "Ministry of Foreign Affairs (National Diplomatic Academy)",
"sector": "government",
"date": "2026-07-22",
"type": "data-leak",
"actor": "",
"status": "confirmed",
"vendor": false,
"confirmed": "The ministry disclosed that a breach of the academy's online education server, found in February, exposed IDs, names and emails of at least 6,000 people including diplomats abroad.",
"claimed": "",
"sources": [
{
"name": "BleepingComputer",
"url": "https://www.bleepingcomputer.com/news/security/south-korea-discloses-data-breach-impacting-diplomats-worldwide/"
}
],
"checked": "2026-11-07",
"domain": "mofa.go.kr",
"logo": "mofa.go.kr",
"actor_ids": [],
"id": "95416a4d"
},
{
"org": "National Tax Service",
"sector": "government",
"date": "2026-02-28",
"type": "other",
"actor": "",
"status": "confirmed",
"vendor": false,
"confirmed": "About $4.8 million in seized crypto tokens was moved out after an NTS press release showed an unredacted wallet recovery phrase; the release was then removed.",
"claimed": "",
"sources": [
{
"name": "BleepingComputer",
"url": "https://www.bleepingcomputer.com/news/security/48m-in-crypto-stolen-after-korean-tax-agency-exposes-wallet-seed/"
}
],
"checked": "2026-11-07",
"domain": "nts.go.kr",
"actor_ids": [],
"id": "92ac9239"
},
{
"org": "Kyowon Group",
"sector": "education",
"date": "2026-01-14",
"type": "ransomware",
"actor": "",
"status": "confirmed",
"vendor": false,
"confirmed": "Kyowon confirmed a ransomware attack with an external data leak and reported it to KISA; Korean media put possible exposure at 9.6 million accounts.",
"claimed": "",
"sources": [
{
"name": "BleepingComputer",
"url": "https://www.bleepingcomputer.com/news/security/south-korean-giant-kyowon-confirms-data-theft-in-ransomware-attack/"
}
],
"checked": "2026-11-07",
"domain": "kyowon.co.kr",
"logo": "kyowon.co.kr",
"actor_ids": [],
"id": "3c9905af"
}
],
"since": "2026-01-01",
"stats": [
{
"label": "PIPC fine on Coupang for a breach of about 37.55 million people",
"value": "KRW 624.6 billion",
"period": "June 2026",
"source": {
"name": "BleepingComputer (PIPC decision)",
"url": "https://www.bleepingcomputer.com/news/security/south-korea-hits-coupang-with-record-409-million-fine-over-data-breach/"
}
},
{
"label": "PIPC fine on KT for the femtocell breach of 16,647 subscribers",
"value": "KRW 53.979 billion",
"period": "July 2026",
"source": {
"name": "BleepingComputer (PIPC decision)",
"url": "https://www.bleepingcomputer.com/news/security/south-korea-fines-telco-giant-kt-39-million-for-customer-data-breach/"
}
}
],
"rules": [],
"actors": [
{
"name": "Lazarus Group",
"kind": "state",
"seen": "Kaspersky tied a FlashHole campaign against at least three South Korean firms in software, construction and telecom equipment to Lazarus.",
"sources": [
{
"name": "BleepingComputer",
"url": "https://www.bleepingcomputer.com/news/security/lazarus-hackers-use-post-quantum-cryptography-for-malware-delivery/"
}
]
},
{
"name": "Gunra",
"kind": "ransomware",
"seen": "Subject of an August 2026 joint advisory co-authored by South Korean police with US agencies on attacks against government and critical infrastructure.",
"sources": [
{
"name": "BleepingComputer",
"url": "https://www.bleepingcomputer.com/news/security/us-warns-of-gunra-ransomware-attacks-against-government-critical-infrastructure/"
}
]
}
],
"slug": "south-korea",
"title": "South Korea Cyber Threat Level: Caution, 2026 Incidents · pwnsy",
"lede": "Threat level Caution since 22 Oct 2026. 6 incidents confirmed, 0 claims in 2026.",
"h1": "![\"\"](\"/tools/cyber-watch/flags/kr.svg\")
South Korea Cyber Watch",
"desc": "South Korea cyber threat level: Caution. 6 incidents confirmed and 0 claims in 2026, each sourced. Updated 7 Nov 2026.",
"upd": "2026-11-07"
},
"CN": {
"name": "China",
"subject": "China",
"region": "Asia-Pacific",
"posture": {
"level": "",
"summary": "China publishes no public cyber threat level; CVERC issues malware and ransomware warnings and the CAC publishes enforcement notices.",
"agency": "Cyberspace Administration of China (CAC); National Computer Virus Emergency Response Center (CVERC)",
"source": {
"name": "CVERC",
"url": "https://www.cverc.org.cn/"
},
"checked": "2026-11-07"
},
"timeline": [
{
"date": "2026-05-21",
"text": "CVERC warned of new Silver Fox remote-access trojan variants disguised as HR documents.",
"url": "https://www.cverc.org.cn/head/zhaiyao/news20260521-yhyj.htm",
"src": "CVERC"
},
{
"date": "2026-10-22",
"text": "CVERC warned that Weaxor ransomware remains active in China and has hit multiple Chinese users.",
"url": "https://www.cverc.org.cn/head/zhaiyao/news20261022-Weaxor.htm",
"src": "CVERC"
},
{
"date": "2026-11-06",
"text": "The CAC and the financial regulator launched a campaign against online financial black and grey market information.",
"url": "https://www.cac.gov.cn/2026-11/06/c_1795719632109055.htm",
"src": "CAC"
},
{
"date": "2026-06-16",
"text": "The Ministry of Public Security said Jilin police detained 27 suspects who built a Silver Fox Trojan variant, phished company finance staff and stole corporate data. Losses topped 7 million yuan.",
"url": "https://www.chinadailyhk.com/article/635049",
"src": "China Daily"
}
],
"incidents": [
{
"org": "National Supercomputing Center in Tianjin",
"sector": "government",
"date": "2026-02-06",
"type": "data-leak",
"actor": "FlamingChina",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "FlamingChina said it took over 10 PB including defence related files and offered it for sale. CNN could not verify the claim, though experts judged samples genuine.",
"sources": [
{
"name": "CNN (via KEYT)",
"url": "https://keyt.com/news/national-world/cnn-world/2026/04/07/a-hacker-has-allegedly-breached-one-of-chinas-supercomputers-and-is-attempting-to-sell-a-trove-of-stolen-data"
}
],
"checked": "2026-11-08",
"domain": "",
"actor_ids": [
"flamingchina"
],
"id": "4cebbb27"
},
{
"org": "SAIC Motor",
"sector": "manufacturing",
"date": "2026-02-24",
"type": "ransomware",
"actor": "Beast",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "Beast listed the state-owned carmaker on its leak site and threatened a full leak. No company statement found.",
"sources": [
{
"name": "DeXpose",
"url": "https://www.dexpose.io/beast-ransomware-attack-on-saic-motor-corporation/"
}
],
"checked": "2026-11-08",
"domain": "saicmotor.com",
"logo": "saicmotor.com",
"actor_ids": [
"beast"
],
"id": "4633b2a8"
},
{
"org": "Hikvision",
"sector": "manufacturing",
"date": "2026-03-21",
"type": "ransomware",
"actor": "ALP-001",
"status": "disputed",
"vendor": false,
"confirmed": "Hikvision said it was investigating and had seen no evidence of ransomware or operational disruption.",
"claimed": "ALP-001 said it stole 19.9 TB and would release it in 200 GB parts.",
"sources": [
{
"name": "Cyber Daily",
"url": "https://www.cyberdaily.au/security/13383-exclusive-ransomware-newcomer-claims-breach-of-security-camera-firm-hikvision"
}
],
"checked": "2026-11-08",
"domain": "hikvision.com",
"logo": "hikvision.com",
"actor_ids": [
"alp-001"
],
"id": "188b7591"
},
{
"org": "Mindray",
"sector": "health",
"date": "2026-08-07",
"type": "data-leak",
"actor": "Clop",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "Clop listed the medical device maker on its leak site and threatened to publish data. No company statement found.",
"sources": [
{
"name": "DeXpose",
"url": "https://www.dexpose.io/clop-ransomware-breaches-mindray-medical-international/"
}
],
"checked": "2026-11-08",
"domain": "mindray.com",
"logo": "mindray.com",
"actor_ids": [
"clop"
],
"id": "e352ed94"
}
],
"since": "2026-01-01",
"stats": [
{
"label": "Mobile apps CVERC found collecting personal information unlawfully",
"value": "84",
"period": "Notice of 26 October 2026",
"source": {
"name": "CVERC",
"url": "https://www.cverc.org.cn/zxdt/report20261026.htm"
}
},
{
"label": "Chinese organisations hit by ransomware gangs",
"value": "164",
"period": "July 2025 to June 2026",
"source": {
"name": "National Computer Virus Emergency Response Center, via Xinhua",
"url": "https://www.news.cn/world/20260902/96ef5572cb224033bf74183b2347a0df/c.html"
}
}
],
"rules": [],
"actors": [
{
"name": "Silver Fox (Yinhu)",
"kind": "unknown",
"seen": "CVERC warned of new Silver Fox trojan variants aimed at HR staff in Chinese organisations to steal data for extortion or fraud.",
"sources": [
{
"name": "CVERC",
"url": "https://www.cverc.org.cn/head/zhaiyao/news20260521-yhyj.htm"
}
]
},
{
"name": "Weaxor",
"kind": "ransomware",
"seen": "CVERC said it found multiple Weaxor attacks on Chinese users targeting enterprise databases and office systems.",
"sources": [
{
"name": "CVERC",
"url": "https://www.cverc.org.cn/head/zhaiyao/news20261022-Weaxor.htm"
}
]
}
],
"slug": "china",
"title": "China Cyber Incidents and Data Breaches 2026 · pwnsy",
"lede": "No public threat level. 0 incidents confirmed, 3 claims in 2026.",
"h1": "![\"\"](\"/tools/cyber-watch/flags/cn.svg\")
China Cyber Watch",
"desc": "China cyber threat level: none published. 0 incidents confirmed and 3 claims in 2026, each sourced. Updated 8 Nov 2026.",
"upd": "2026-11-08"
},
"TW": {
"name": "Taiwan",
"subject": "Taiwan",
"region": "Asia-Pacific",
"posture": {
"level": "",
"summary": "Taiwan publishes no cyber threat level; the National Security Bureau releases annual analyses of Chinese cyber activity against critical infrastructure.",
"agency": "National Security Bureau (threat reporting); Administration for Cyber Security, Ministry of Digital Affairs",
"source": {
"name": "National Security Bureau",
"url": "https://www.nsb.gov.tw/en/#/%E5%85%AC%E5%91%8A%E8%B3%87%E8%A8%8A/%E6%96%B0%E8%81%9E%E7%A8%BF%E6%9A%A8%E6%96%B0%E8%81%9E%E5%8F%83%E8%80%83%E8%B3%87%E6%96%99/2026-01-04/Analysis%20on%20China%E2%80%99s%20Cyber%20Threats%20to%20Taiwan%E2%80%99s%20Critical%20Infrastructure%20in%202025"
},
"checked": "2026-11-07"
},
"timeline": [
{
"date": "2026-01-04",
"text": "National Security Bureau said China-linked attacks on Taiwan's energy sector rose tenfold in 2025.",
"url": "https://www.bleepingcomputer.com/news/security/taiwan-says-chinas-attacks-on-its-energy-sector-increased-tenfold/",
"src": "National Security Bureau"
},
{
"date": "2026-04-28",
"text": "Police arrested a student accused of triggering emergency brakes on the high-speed rail through its radio network.",
"url": "https://www.bleepingcomputer.com/news/security/student-hacked-taiwan-high-speed-rail-to-trigger-emergency-brakes/",
"src": "BleepingComputer"
}
],
"incidents": [
{
"org": "Taiwan High Speed Rail",
"sector": "transport",
"date": "2026-04-05",
"type": "other",
"actor": "",
"status": "confirmed",
"vendor": false,
"confirmed": "THSR traced a false General Alarm on its TETRA radio network, which halted four trains for 48 minutes, to a cloned beacon, and police arrested a 23-year-old student on 28 April.",
"claimed": "",
"sources": [
{
"name": "BleepingComputer",
"url": "https://www.bleepingcomputer.com/news/security/student-hacked-taiwan-high-speed-rail-to-trigger-emergency-brakes/"
}
],
"checked": "2026-11-07",
"domain": "thsrc.com.tw",
"logo": "thsrc.com.tw",
"actor_ids": [],
"id": "ccbd0ac5"
},
{
"org": "昭輝實業 (auto plastic parts maker)",
"sector": "manufacturing",
"date": "2026-01-18",
"type": "ransomware",
"actor": "",
"status": "confirmed",
"vendor": false,
"confirmed": "The company filed a material disclosure saying some computers were intruded on by unknown hackers and some server data was encrypted. It started defence and recovery.",
"claimed": "",
"sources": [
{
"name": "iThome",
"url": "https://www.ithome.com.tw/news/173574"
}
],
"checked": "2026-11-08",
"domain": "",
"actor_ids": [],
"id": "61b97206"
},
{
"org": "Everlight subsidiary 億力光電",
"sector": "manufacturing",
"date": "2026-01-19",
"type": "intrusion",
"actor": "",
"status": "confirmed",
"vendor": false,
"confirmed": "LED maker Everlight disclosed on behalf of its subsidiary that some information systems were hit by a cyberattack and recovery had started.",
"claimed": "",
"sources": [
{
"name": "iThome",
"url": "https://www.ithome.com.tw/news/173574"
}
],
"checked": "2026-11-08",
"domain": "",
"actor_ids": [],
"id": "b4d674b8"
},
{
"org": "ASRock Rack (永擎電子)",
"sector": "manufacturing",
"date": "2026-01-20",
"type": "intrusion",
"actor": "Everest",
"status": "confirmed",
"vendor": true,
"confirmed": "The listed company disclosed that an outsourced vendor's credentials leaked. It said affected access covered only website data and specific production test programs.",
"claimed": "The Everest ransomware group claimed the company on 20 January.",
"sources": [
{
"name": "iThome",
"url": "https://www.ithome.com.tw/news/173574"
}
],
"checked": "2026-11-08",
"domain": "asrockrack.com",
"logo": "asrockrack.com",
"actor_ids": [
"everest"
],
"id": "e8f642dc"
},
{
"org": "Teamplus (互動資通), EVERY8D SMS platform",
"sector": "telecom",
"date": "2026-05-26",
"type": "intrusion",
"actor": "",
"status": "confirmed",
"vendor": false,
"confirmed": "The EVERY8D enterprise SMS and OTP platform was down for days after a suspected ransomware attack; the technical cause was still under investigation. F-ISAC issued a yellow alert to financial institutions on 26 May.",
"claimed": "On 21 May a seller on a hacker forum offered the company's domain controller accounts and EVERY8D data, including SMS logs.",
"sources": [
{
"name": "iThome",
"url": "https://www.ithome.com.tw/news/176159"
},
{
"name": "iThome",
"url": "https://www.ithome.com.tw/news/176215"
}
],
"checked": "2026-11-08",
"domain": "every8d.com",
"actor_ids": [],
"id": "7120fb7d"
},
{
"org": "Government agencies (AI agent campaign)",
"sector": "government",
"date": "2026-08-13",
"type": "intrusion",
"actor": "",
"status": "confirmed",
"vendor": false,
"confirmed": "The Ministry of Digital Affairs said overseas hackers used AI agents such as OpenClaw against government agencies in July, with alerts issued from 20 July. Affected agencies completed their response.",
"claimed": "Researchers at Dream, cited by the Financial Times, said the tool compromised at least 85 government accounts and took over 2,500 personnel records, then moved to the nuclear safety agency and seven energy firms.",
"sources": [
{
"name": "Focus Taiwan (CNA)",
"url": "https://focustaiwan.tw/society/202608130011"
}
],
"checked": "2026-11-08",
"domain": "",
"actor_ids": [],
"id": "57e956df"
},
{
"org": "Zeabur",
"sector": "other",
"date": "2026-08-28",
"type": "data-leak",
"actor": "",
"status": "confirmed",
"vendor": false,
"confirmed": "The cloud deployment platform said an internal service credential was misused and customer environment variables, including AI service API keys, were exposed. It told users to rotate keys.",
"claimed": "",
"sources": [
{
"name": "iThome",
"url": "https://www.ithome.com.tw/news/178534"
}
],
"checked": "2026-11-08",
"domain": "zeabur.com",
"logo": "zeabur.com",
"actor_ids": [],
"id": "38137aa6"
},
{
"org": "91APP",
"sector": "retail",
"date": "2026-10-16",
"type": "data-leak",
"actor": "",
"status": "confirmed",
"vendor": false,
"confirmed": "The e-commerce platform disclosed that a Commerce Cloud order database was accessed through an unpatched Appsmith tool, with traces of the ARTEX attack tool. Names, phones and addresses of shoppers at up to 1,329 brands may be affected, including MUJI Taiwan.",
"claimed": "",
"sources": [
{
"name": "iThome",
"url": "https://www.ithome.com.tw/news/179923"
},
{
"name": "iThome",
"url": "https://www.ithome.com.tw/news/180124"
}
],
"checked": "2026-11-08",
"domain": "91app.com",
"logo": "91app.com",
"actor_ids": [],
"id": "a93d7ff0"
},
{
"org": "Bank SinoPac",
"sector": "finance",
"date": "2026-11-03",
"type": "intrusion",
"actor": "",
"status": "confirmed",
"vendor": true,
"confirmed": "The bank confirmed that hackers abused a security setting flaw at its new online banking system's foreign vendor to make unauthorised transfers from over 400 accounts. All funds were returned on 3 November.",
"claimed": "",
"sources": [
{
"name": "iThome",
"url": "https://www.ithome.com.tw/news/180233"
}
],
"checked": "2026-11-08",
"domain": "bank.sinopac.com",
"actor_ids": [],
"id": "b948afb3"
}
],
"since": "2026-01-01",
"stats": [
{
"label": "Rise in China-linked attacks on the energy sector",
"value": "Tenfold",
"period": "2025 versus 2024",
"source": {
"name": "National Security Bureau",
"url": "https://www.bleepingcomputer.com/news/security/taiwan-says-chinas-attacks-on-its-energy-sector-increased-tenfold/"
}
},
{
"label": "Rise in China-linked incidents against critical infrastructure overall",
"value": "6%",
"period": "2025 versus 2024",
"source": {
"name": "National Security Bureau",
"url": "https://www.bleepingcomputer.com/news/security/taiwan-says-chinas-attacks-on-its-energy-sector-increased-tenfold/"
}
}
],
"rules": [],
"actors": [
{
"name": "BlackTech, Flax Typhoon, Mustang Panda, APT41, UNC3886",
"kind": "state",
"seen": "Taiwan's National Security Bureau named these China-linked groups as active against its critical infrastructure.",
"sources": [
{
"name": "BleepingComputer",
"url": "https://www.bleepingcomputer.com/news/security/taiwan-says-chinas-attacks-on-its-energy-sector-increased-tenfold/"
}
]
},
{
"name": "UAT-10362",
"kind": "unknown",
"seen": "Cisco Talos says this group used LucidRook malware against Taiwanese NGOs and universities.",
"sources": [
{
"name": "BleepingComputer",
"url": "https://www.bleepingcomputer.com/news/security/new-lucidrook-malware-used-in-targeted-attacks-on-ngos-universities/"
}
]
}
],
"slug": "taiwan",
"title": "Taiwan Cyber Incidents and Data Breaches 2026 · pwnsy",
"lede": "No public threat level. 9 incidents confirmed, 0 claims in 2026.",
"h1": "![\"\"](\"/tools/cyber-watch/flags/tw.svg\")
Taiwan Cyber Watch",
"desc": "Taiwan cyber threat level: none published. 9 incidents confirmed and 0 claims in 2026, each sourced. Updated 8 Nov 2026.",
"upd": "2026-11-08"
},
"HK": {
"name": "Hong Kong",
"subject": "Hong Kong",
"region": "Asia-Pacific",
"posture": {
"level": "",
"summary": "Hong Kong publishes no cyber threat level; since 1 January 2026 a Commissioner designates critical infrastructure operators and oversees their security duties.",
"agency": "Commissioner's Office for Critical Infrastructure (Computer-system Security), Security Bureau",
"source": {
"name": "HKSAR Government press release",
"url": "https://www.info.gov.hk/gia/general/202601/01/P2025123100215.htm"
},
"checked": "2026-11-07"
},
"timeline": [
{
"date": "2026-01-01",
"text": "Francis Chan Wing-on began a three-year term as Commissioner of Critical Infrastructure (Computer-system Security) as the ordinance took effect.",
"url": "https://www.info.gov.hk/gia/general/202601/01/P2025123100215.htm",
"src": "HKSAR Government"
},
{
"date": "2026-10-30",
"text": "Hospital Authority accepted PCPD findings on the April patient data theft in Kowloon East Cluster.",
"url": "https://www.info.gov.hk/gia/general/202610/30/P2026103000353.htm",
"src": "HKSAR Government"
}
],
"incidents": [
{
"org": "Cathay Pacific (Amadeus)",
"sector": "transport",
"date": "2026-10-30",
"type": "supply-chain",
"actor": "",
"status": "confirmed",
"vendor": true,
"confirmed": "Cathay said about 53,000 bookings were affected by unauthorized access to reservation data held by Amadeus between August 2023 and September 2026.",
"claimed": "",
"sources": [
{
"name": "AeroCorner",
"url": "https://aerocorner.com/news/cathay-pacific-amadeus-breach-53000-bookings/"
}
],
"checked": "2026-11-07",
"domain": "cathaypacific.com",
"logo": "cathaypacific.com",
"actor_ids": [],
"id": "27d2a847",
"story": "amadeus-airline-data-breach"
},
{
"org": "Hospital Authority (Kowloon East Cluster)",
"sector": "health",
"date": "2026-10-30",
"type": "data-leak",
"actor": "",
"status": "confirmed",
"vendor": true,
"confirmed": "Responding to a PCPD report, the Hospital Authority said patient data was stolen in April 2026 through a contractor's access during maintenance, and police arrested a contractor staff member.",
"claimed": "",
"sources": [
{
"name": "HKSAR Government press release",
"url": "https://www.info.gov.hk/gia/general/202610/30/P2026103000353.htm"
}
],
"checked": "2026-11-07",
"domain": "ha.org.hk",
"actor_ids": [],
"id": "69a4f1e1"
},
{
"org": "SoFi Securities (Hong Kong)",
"sector": "finance",
"date": "2026-04-30",
"type": "supply-chain",
"actor": "",
"status": "confirmed",
"vendor": true,
"confirmed": "SoFi confirmed unauthorized access to a SoFi Hong Kong database through one of its vendors, with the scope still under investigation.",
"claimed": "",
"sources": [
{
"name": "BleepingComputer",
"url": "https://www.bleepingcomputer.com/news/security/sofi-confirms-third-party-data-breach-at-hong-kong-subsidiary/"
}
],
"checked": "2026-11-07",
"domain": "sofi.hk",
"logo": "sofi.hk",
"actor_ids": [],
"id": "17d81f39"
}
],
"since": "2026-01-01",
"stats": [],
"rules": [
{
"date": "2026-01-01",
"title": "Protection of Critical Infrastructures (Computer Systems) Ordinance (Cap. 653)",
"what": "The ordinance took effect, creating a Commissioner who designates critical infrastructure operators and critical computer systems and monitors their statutory security obligations.",
"url": "https://www.info.gov.hk/gia/general/202601/01/P2025123100215.htm"
}
],
"actors": [],
"slug": "hong-kong",
"title": "Hong Kong Cyber Incidents and Data Breaches 2026 · pwnsy",
"lede": "No public threat level. 3 incidents confirmed, 0 claims in 2026.",
"h1": "![\"\"](\"/tools/cyber-watch/flags/hk.svg\")
Hong Kong Cyber Watch",
"desc": "Hong Kong cyber threat level: none published. 3 incidents confirmed and 0 claims in 2026, each sourced. Updated 7 Nov 2026.",
"upd": "2026-11-07"
},
"AU": {
"name": "Australia",
"subject": "Australia",
"region": "Asia-Pacific",
"posture": {
"level": "",
"summary": "Australia publishes no cyber threat level; ASD's ACSC issues alerts and an annual cyber threat report, and the OAIC publishes data breach statistics twice a year.",
"agency": "Australian Signals Directorate's Australian Cyber Security Centre (ASD's ACSC)",
"source": {
"name": "cyber.gov.au",
"url": "https://www.cyber.gov.au/"
},
"checked": "2026-11-07"
},
"timeline": [
{
"date": "2026-09-24",
"text": "Prime Minister Albanese confirmed OpenAI agents gained unauthorized access to a Medicare statistics portal and ordered checks of other systems.",
"url": "https://www.bleepingcomputer.com/news/security/openai-hacked-australian-medicare-govt-site-probed-data-providers/",
"src": "BleepingComputer"
},
{
"date": "2026-10-26",
"text": "OAIC reported 667 breach notifications for January to June 2026, with breaches over 1 million people rising from 4 to 11.",
"url": "https://www.oaic.gov.au/news/media-centre/large-scale-data-breaches-on-the-rise,-latest-oaic-statistics-reveal",
"src": "OAIC"
}
],
"incidents": [
{
"org": "Qantas (Amadeus)",
"sector": "transport",
"date": "2026-11-02",
"type": "supply-chain",
"actor": "",
"status": "confirmed",
"vendor": true,
"confirmed": "Qantas confirmed its booking data was among the Amadeus exposure, said its own systems remain secure, and notified Australian cyber authorities.",
"claimed": "",
"sources": [
{
"name": "Beinsure",
"url": "https://beinsure.com/news/qantas-and-major-asian-airlines-affected-by-amadeus-data-breach/"
}
],
"checked": "2026-11-07",
"domain": "qantas.com",
"logo": "qantas.com",
"actor_ids": [],
"id": "6a28f8ee",
"story": "amadeus-airline-data-breach"
},
{
"org": "Services Australia (Medicare statistics portal)",
"sector": "government",
"date": "2026-06-18",
"type": "intrusion",
"actor": "OpenAI research agents",
"status": "confirmed",
"vendor": false,
"confirmed": "Prime Minister Albanese confirmed unauthorized access by OpenAI agents to a Medicare statistics portal; OpenAI said no patient records were accessed.",
"claimed": "",
"sources": [
{
"name": "BleepingComputer",
"url": "https://www.bleepingcomputer.com/news/security/openai-hacked-australian-medicare-govt-site-probed-data-providers/"
}
],
"checked": "2026-11-07",
"domain": "servicesaustralia.gov.au",
"logo": "servicesaustralia.gov.au",
"actor_ids": [
"openai-research-agents"
],
"id": "82f26e1a"
},
{
"org": "Mathspace",
"sector": "education",
"date": "2026-09-03",
"type": "data-leak",
"actor": "",
"status": "confirmed",
"vendor": false,
"confirmed": "Mathspace said attackers exploited its self-hosted Metabase system and stole data on 1,079,819 students, parents and staff in Australia and New Zealand.",
"claimed": "",
"sources": [
{
"name": "BleepingComputer",
"url": "https://www.bleepingcomputer.com/news/security/mathspace-discloses-data-breach-affecting-over-1-million-people/"
}
],
"checked": "2026-11-07",
"domain": "mathspace.co",
"logo": "mathspace.co",
"actor_ids": [],
"id": "8dc45221",
"story": "mathspace-data-breach"
},
{
"org": "Origin Energy",
"sector": "energy",
"date": "2026-07-22",
"type": "data-leak",
"actor": "John Doe",
"status": "confirmed",
"vendor": false,
"confirmed": "Origin confirmed an unknown actor exposed customer names, addresses, birth dates and partial payment details, and reported it to the AFP, ACSC and OAIC.",
"claimed": "An actor calling themselves John Doe claimed data on 2 million customers and threatened to leak it.",
"sources": [
{
"name": "BleepingComputer",
"url": "https://www.bleepingcomputer.com/news/security/australian-energy-provider-origin-says-data-breach-exposes-client-data/"
}
],
"checked": "2026-11-07",
"domain": "originenergy.com.au",
"logo": "originenergy.com.au",
"actor_ids": [
"john-doe"
],
"id": "93d63dce"
},
{
"org": "Victorian Department of Education",
"sector": "education",
"date": "2026-01-14",
"type": "data-leak",
"actor": "",
"status": "confirmed",
"vendor": false,
"confirmed": "The department said an unauthorized third party accessed a database of current and former students' names, schools, year levels and school emails, and reset all student passwords.",
"claimed": "",
"sources": [
{
"name": "BleepingComputer",
"url": "https://www.bleepingcomputer.com/news/security/victorian-department-of-education-notifies-parents-of-data-breach/"
}
],
"checked": "2026-11-07",
"domain": "education.vic.gov.au",
"logo": "education.vic.gov.au",
"actor_ids": [],
"id": "2681c9cf"
}
],
"since": "2026-01-01",
"stats": [
{
"label": "Data breach notifications to the OAIC",
"value": "667",
"period": "January to June 2026",
"source": {
"name": "OAIC",
"url": "https://www.oaic.gov.au/news/media-centre/large-scale-data-breaches-on-the-rise,-latest-oaic-statistics-reveal"
}
},
{
"label": "Breaches affecting over 1 million people",
"value": "11",
"period": "January to June 2026",
"source": {
"name": "OAIC",
"url": "https://www.oaic.gov.au/news/media-centre/large-scale-data-breaches-on-the-rise,-latest-oaic-statistics-reveal"
}
},
{
"label": "Notifications from health service providers",
"value": "149",
"period": "January to June 2026",
"source": {
"name": "OAIC",
"url": "https://www.oaic.gov.au/news/media-centre/large-scale-data-breaches-on-the-rise,-latest-oaic-statistics-reveal"
}
}
],
"rules": [],
"actors": [],
"slug": "australia",
"title": "Australia Cyber Incidents and Data Breaches 2026 · pwnsy",
"lede": "No public threat level. 5 incidents confirmed, 0 claims in 2026.",
"h1": "![\"\"](\"/tools/cyber-watch/flags/au.svg\")
Australia Cyber Watch",
"desc": "Australia cyber threat level: none published. 5 incidents confirmed and 0 claims in 2026, each sourced. Updated 7 Nov 2026.",
"upd": "2026-11-07"
},
"NZ": {
"name": "New Zealand",
"subject": "New Zealand",
"region": "Asia-Pacific",
"posture": {
"level": "",
"summary": "New Zealand publishes no cyber threat level; the NCSC grades incidents from C1 to C6 and publishes quarterly insights and an annual threat report.",
"agency": "National Cyber Security Centre (NCSC), part of the GCSB",
"source": {
"name": "NCSC Quarter One Cyber Security Insights 2026",
"url": "https://www.ncsc.govt.nz/insights-and-research/insights-reports/quarter-one-cyber-security-insights-2/"
},
"checked": "2026-11-07"
},
"timeline": [
{
"date": "2026-01-21",
"text": "Privacy Commissioner announced an inquiry into the Manage My Health breach.",
"url": "https://www.privacy.org.nz/tuhono-connect/statements-media-releases/statement-on-manage-my-health-cyber-incident/",
"src": "Office of the Privacy Commissioner"
},
{
"date": "2026-05-27",
"text": "Privacy Commissioner found Manage My Health and Health NZ breached the Health Information Privacy Code.",
"url": "https://www.privacy.org.nz/tuhono-connect/statements-media-releases/privacy-commissioner-finds-manage-my-health-and-health-nz-breached-privacy-act/",
"src": "Office of the Privacy Commissioner"
},
{
"date": "2026-09-23",
"text": "Privacy Commissioner issued compliance notices to Manage My Health and Health NZ.",
"url": "https://www.privacy.org.nz/tuhono-connect/statements-media-releases/privacy-commissioner-issues-compliance-notices-to-manage-my-health-and-health-nz/",
"src": "Office of the Privacy Commissioner"
},
{
"date": "2026-10-09",
"text": "NCSC joined an international advisory on Chinese government-linked actors combining automated and hands-on hacking tools.",
"url": "https://www.ncsc.govt.nz/alerts/chinese-government-linked-cyber-threat-actors-combine-automated-and-hands-on-hacking-tools-to-steal-sensitive-data/",
"src": "NCSC"
}
],
"incidents": [
{
"org": "Manage My Health",
"sector": "health",
"date": "2026-01-01",
"type": "data-leak",
"actor": "",
"status": "confirmed",
"vendor": true,
"confirmed": "Manage My Health notified the Privacy Commissioner on 1 January of a serious breach from December 2025; the Commissioner later found patient data of nearly 100,000 people was stolen and put up for sale.",
"claimed": "",
"sources": [
{
"name": "Office of the Privacy Commissioner",
"url": "https://www.privacy.org.nz/tuhono-connect/statements-media-releases/statement-on-manage-my-health-cyber-incident/"
},
{
"name": "Office of the Privacy Commissioner",
"url": "https://www.privacy.org.nz/tuhono-connect/statements-media-releases/privacy-commissioner-finds-manage-my-health-and-health-nz-breached-privacy-act/"
}
],
"checked": "2026-11-07",
"domain": "managemyhealth.co.nz",
"logo": "managemyhealth.co.nz",
"actor_ids": [],
"id": "28d1f116"
},
{
"org": "Mathspace (NZ users)",
"sector": "education",
"date": "2026-09-03",
"type": "data-leak",
"actor": "",
"status": "confirmed",
"vendor": false,
"confirmed": "Mathspace said stolen data covered students, parents and staff in Australia and New Zealand, 1,079,819 people in total.",
"claimed": "",
"sources": [
{
"name": "BleepingComputer",
"url": "https://www.bleepingcomputer.com/news/security/mathspace-discloses-data-breach-affecting-over-1-million-people/"
}
],
"checked": "2026-11-07",
"domain": "mathspace.co",
"logo": "mathspace.co",
"actor_ids": [],
"id": "ad05acb6",
"story": "mathspace-data-breach"
},
{
"org": "Canopy Health",
"sector": "health",
"date": "2026-01-12",
"type": "intrusion",
"actor": "",
"status": "confirmed",
"vendor": false,
"confirmed": "Canopy Health, the largest private medical oncology provider, confirmed someone gained unauthorised access to part of its administration systems in July 2025 and some data may have been copied. Patients were told months later.",
"claimed": "",
"sources": [
{
"name": "RNZ",
"url": "https://www.rnz.co.nz/news/national/583813/second-health-provider-hit-in-major-cyber-attack"
}
],
"checked": "2026-11-08",
"domain": "",
"actor_ids": [],
"id": "9ae831eb"
},
{
"org": "Langley Twigg Law",
"sector": "other",
"date": "2026-01-26",
"type": "ransomware",
"actor": "Anubis",
"status": "confirmed",
"vendor": false,
"confirmed": "The Napier law firm said a malicious third party attacked its network on 11 January and extracted part of its file server, including client documents. Police and the Privacy Commissioner were notified.",
"claimed": "The Anubis ransomware group posted data it said was stolen from the firm.",
"sources": [
{
"name": "RNZ",
"url": "https://www.rnz.co.nz/news/national/585222/client-documents-caught-up-in-law-firm-cyber-attack"
},
{
"name": "BeyondMachines",
"url": "https://beyondmachines.net/event_details/anubis-ransomware-group-targets-new-zealand-law-firm-langley-twigg-y-v-p-s-p"
}
],
"checked": "2026-11-08",
"domain": "langleytwigg.co.nz",
"actor_ids": [
"anubis"
],
"id": "7c496dfe"
},
{
"org": "MediMap",
"sector": "health",
"date": "2026-02-24",
"type": "intrusion",
"actor": "",
"status": "confirmed",
"vendor": false,
"confirmed": "The medication management platform used by aged care and community providers confirmed unauthorised entry on 22 February. Some patient records were altered and the platform went offline while providers reverted to manual processes.",
"claimed": "",
"sources": [
{
"name": "RNZ",
"url": "https://www.rnz.co.nz/news/alert-nat/587773/patient-data-changed-as-major-nz-health-app-medimap-hacked"
}
],
"checked": "2026-11-08",
"domain": "medimap.co.nz",
"logo": "medimap.co.nz",
"actor_ids": [],
"id": "889fde62"
},
{
"org": "Hutt City Council",
"sector": "government",
"date": "2026-04-29",
"type": "intrusion",
"actor": "",
"status": "confirmed",
"vendor": false,
"confirmed": "The council said a March phishing attack gave unauthorised access to several staff email accounts. Five people had identity information compromised and 732 may have had financial information exposed.",
"claimed": "",
"sources": [
{
"name": "1News",
"url": "https://www.1news.co.nz/2026/04/29/financial-details-ids-leaked-in-lower-hutt-council-cyber-attack/"
}
],
"checked": "2026-11-08",
"domain": "huttcity.govt.nz",
"logo": "huttcity.govt.nz",
"actor_ids": [],
"id": "4a2df7fb"
},
{
"org": "McKay",
"sector": "other",
"date": "2026-04-30",
"type": "intrusion",
"actor": "Mnt6",
"status": "confirmed",
"vendor": false,
"confirmed": "The Whangarei electrical contractor confirmed on 4 May a January cyber attack involving unauthorised access to a single device.",
"claimed": "The Mnt6 group listed McKay on its leak site on 30 April.",
"sources": [
{
"name": "Cyber Daily",
"url": "https://www.cyberdaily.au/security/13537-exclusive-kiwi-electrical-contractor-confirms-cyber-attack"
}
],
"checked": "2026-11-08",
"domain": "mckay.co.nz",
"logo": "mckay.co.nz",
"actor_ids": [
"mnt6"
],
"id": "9b01e3e5"
},
{
"org": "Alpha Group Holdings",
"sector": "manufacturing",
"date": "2026-05-24",
"type": "ransomware",
"actor": "Qilin",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "Qilin listed the Auckland health supplements maker on its leak site on 24 May without publishing any data samples.",
"sources": [
{
"name": "Insurance Business NZ",
"url": "https://www.insurancebusinessmag.com/nz/news/cyber/ransomware-group-adds-new-zealand-health-company-to-its-leak-site-576765.aspx"
}
],
"checked": "2026-11-08",
"domain": "",
"actor_ids": [
"qilin"
],
"id": "4ea0840b"
},
{
"org": "Warwick Fabrics (NZ)",
"sector": "retail",
"date": "2026-07-03",
"type": "ransomware",
"actor": "Kairos",
"status": "claimed",
"vendor": false,
"confirmed": "",
"claimed": "Kairos listed the New Zealand arm of the textile wholesaler on 3 July and claimed to have stolen 386 GB of data.",
"sources": [
{
"name": "Cyber Daily",
"url": "https://www.cyberdaily.au/security/14023-exclusive-kairos-ransomware-lists-warwick-fabrics-nz-as-hack-victim"
}
],
"checked": "2026-11-08",
"domain": "warwick.co.nz",
"actor_ids": [
"kairos"
],
"id": "d96be252"
}
],
"since": "2026-01-01",
"stats": [
{
"label": "Incidents reported to NCSC",
"value": "1,164",
"period": "January to March 2026",
"source": {
"name": "NCSC",
"url": "https://www.ncsc.govt.nz/insights-and-research/insights-reports/quarter-one-cyber-security-insights-2/"
}
},
{
"label": "Incidents reported to NCSC",
"value": "1,129",
"period": "April to June 2026",
"source": {
"name": "NCSC",
"url": "https://www.ncsc.govt.nz/insights-and-research/insights-reports/quarter-two-cyber-security-insights-2026/"
}
},
{
"label": "Direct financial loss reported",
"value": "NZ$5.6 million",
"period": "January to March 2026",
"source": {
"name": "NCSC",
"url": "https://www.ncsc.govt.nz/insights-and-research/insights-reports/quarter-one-cyber-security-insights-2/"
}
},
{
"label": "Highly significant (C2) incidents, the first since 2021/22",
"value": "3",
"period": "January to March 2026",
"source": {
"name": "NCSC",
"url": "https://www.ncsc.govt.nz/insights-and-research/insights-reports/quarter-one-cyber-security-insights-2/"
}
}
],
"rules": [],
"actors": [
{
"name": "Chinese government-linked actors using Integrity Technology Group tools",
"kind": "state",
"seen": "NCSC joined partners in an advisory on these actors stealing data from government and healthcare victims.",
"sources": [
{
"name": "NCSC",
"url": "https://www.ncsc.govt.nz/alerts/chinese-government-linked-cyber-threat-actors-combine-automated-and-hands-on-hacking-tools-to-steal-sensitive-data/"
}
]
}
],
"slug": "new-zealand",
"title": "New Zealand Cyber Incidents and Data Breaches 2026 · pwnsy",
"lede": "No public threat level. 7 incidents confirmed, 2 claims in 2026.",
"h1": "![\"\"](\"/tools/cyber-watch/flags/nz.svg\")
New Zealand Cyber Watch",
"desc": "New Zealand cyber threat level: none published. 7 incidents confirmed and 2 claims in 2026, each sourced. Updated 8 Nov 2026.",
"upd": "2026-11-08"
}
},
"actorPages": {
"marlanwg": "marlanwg",
"direwolf": "direwolf",
"rhysida": "rhysida",
"qilin": "qilin",
"orova": "orova",
"inc-ransom": "inc-ransom",
"shinyhunters": "shinyhunters",
"the-gentlemen": "the-gentlemen",
"payload": "payload",
"lockbit-5-0": "lockbit-5-0",
"n0n": "n0n",
"everest": "everest",
"eclipse": "eclipse",
"krybit": "krybit",
"ransomhouse": "ransomhouse",
"panzer": "panzer",
"nova": "nova",
"coinbase-cartel": "coinbase-cartel",
"dysphor1a": "dysphor1a",
"world-leaks": "world-leaks",
"apt73": "apt73",
"dragonforce": "dragonforce",
"deathnote-hackers": "deathnote-hackers",
"core849": "core849",
"emperador": "emperador",
"deadlock": "deadlock",
"handala": "handala",
"bytetobreach": "bytetobreach",
"fingerprint": "fingerprint"
},
"stories": [
{
"slug": "bank-rakyat-website-defacement",
"country": "MY",
"incidents": [
"3e79be0b"
],
"logo": "bankrakyat.com.my",
"title": "Bank Rakyat Website Defacement, November 2026 · pwnsy",
"h1": "Bank Rakyat website defacement",
"desc": "Bank Rakyat websites, including the iRakyat login page, were defaced on 6 Nov 2026. What the bank confirmed, what the attacker claims, and what customers should do.",
"lede": "Bank Rakyat websites were defaced on the night of 6 November 2026. The bank says a third-party provider was at fault and that deposits, data and banking services were unaffected.",
"facts": [
[
"Organisation",
"Bank Rakyat (Bank Kerjasama Rakyat Malaysia), Kuala Lumpur"
],
[
"What happened",
"Website defacement. Several pages, including the iRakyat online banking login page, showed a MARLANWG message."
],
[
"Cause",
"The bank blames a technical problem at a third-party service provider, which it has not named."
],
[
"Not affected",
"Customer deposits, personal information and banking services, according to the bank."
],
[
"Claimed",
"MARLANWG claims internal access and a data sample. No sample has been published."
],
[
"Authorities",
"Communications Minister Fahmi Fadzil commented on 7 Nov 2026. No police report or NACSA statement on the bank itself has been reported as of 8 Nov 2026."
]
],
"timeline": [
[
"2026-11-06",
"10.45pm: a defaced Bank Rakyat page with a MARLANWG message is captured. The iRakyat login page is also defaced.",
[
{
"name": "Lowyat",
"url": "https://www.lowyat.net/2026/409395/bank-rakyat-takes-down-sites-after-suspected-cyber-attack/"
},
{
"name": "Screenshots on X",
"url": "https://x.com/Pelabur_Bijak/status/2118711569681105127"
}
]
],
[
"2026-11-06",
"About 11.30pm: the bank says its corporate website is temporarily inaccessible. Most of its sites are taken offline.",
[
{
"name": "Malay Mail",
"url": "https://www.malaymail.com/news/malaysia/2026/11/07/bank-rakyat-blames-third-party-glitch-for-website-outage-says-customer-funds-and-data-safe/242358"
},
{
"name": "Lowyat",
"url": "https://www.lowyat.net/2026/409395/bank-rakyat-takes-down-sites-after-suspected-cyber-attack/"
}
]
],
[
"2026-11-07",
"3.50am: search results still show the defaced text.",
[
{
"name": "Lowyat",
"url": "https://www.lowyat.net/2026/409395/bank-rakyat-takes-down-sites-after-suspected-cyber-attack/"
}
]
],
[
"2026-11-07",
"The bank's Facebook statement blames a third-party provider and says only the corporate website was disrupted.",
[
{
"name": "Malay Mail",
"url": "https://www.malaymail.com/news/malaysia/2026/11/07/bank-rakyat-blames-third-party-glitch-for-website-outage-says-customer-funds-and-data-safe/242358"
}
]
],
[
"2026-11-07",
"Communications Minister Fahmi Fadzil says the bank blocked the affected server, moved users to i-Rakyat and has found no data theft so far.",
[
{
"name": "Malay Mail",
"url": "https://www.malaymail.com/news/malaysia/2026/11/07/fahmi-says-online-banking-remains-safe-despite-cyberattacks-and-bank-rakyat-hack/242378"
}
]
]
],
"todo": [
"Type the bank's address or open the official iRakyat app. Avoid search result links until they refresh.",
"Ignore SMS, calls and emails about this incident. The bank will not ask for your password or TAC.",
"Check recent transactions and report anything unusual to Bank Rakyat at once.",
"If you lose money to a scam, call the National Scam Response Centre on 997."
],
"faq": [
[
"Was Bank Rakyat hacked?",
"Several Bank Rakyat web pages, including the iRakyat login page, were defaced on 6 November 2026. The bank blames a third-party service provider and has not called it a cyberattack."
],
[
"Is my money in Bank Rakyat safe?",
"The bank says customer deposits, personal information and banking services were not affected. Banking continued through iRakyat, BRICK, QR2E and i-bizRAKYAT."
],
[
"Who is MARLANWG?",
"The actor whose message appeared on the defaced pages. It claims internal access and a data sample, and has published no sample. It earlier claimed access to Royal Malaysian Customs Department databases, which is also unverified."
]
],
"ms": {
"title": "Pencemaran Laman Web Bank Rakyat, November 2026 · pwnsy",
"h1": "Laman web Bank Rakyat dicemari",
"desc": "Laman web Bank Rakyat, termasuk halaman log masuk iRakyat, dicemari pada 6 November 2026. Apa yang disahkan bank, dakwaan penyerang dan langkah pelanggan.",
"lede": "Laman web Bank Rakyat dicemari pada malam 6 November 2026. Bank itu berkata masalah berpunca daripada penyedia pihak ketiga, dan deposit, data serta perkhidmatan perbankan tidak terjejas.",
"facts": [
[
"Organisasi",
"Bank Rakyat (Bank Kerjasama Rakyat Malaysia), Kuala Lumpur"
],
[
"Apa yang berlaku",
"Pencemaran laman web. Beberapa halaman, termasuk halaman log masuk perbankan dalam talian iRakyat, memaparkan mesej MARLANWG."
],
[
"Punca",
"Bank itu menyalahkan masalah teknikal pada penyedia perkhidmatan pihak ketiga, yang tidak dinamakannya."
],
[
"Tidak terjejas",
"Deposit pelanggan, maklumat peribadi dan perkhidmatan perbankan, menurut bank itu."
],
[
"Dakwaan",
"MARLANWG mendakwa mempunyai akses dalaman dan sampel data. Tiada sampel telah diterbitkan."
],
[
"Pihak berkuasa",
"Menteri Komunikasi Fahmi Fadzil mengulas pada 7 November 2026. Tiada laporan polis atau kenyataan NACSA tentang bank itu dilaporkan setakat 8 November 2026."
]
],
"timeline": [
"10.45 malam: halaman Bank Rakyat yang dicemari dengan mesej MARLANWG dirakam. Halaman log masuk iRakyat turut dicemari.",
"Kira-kira 11.30 malam: bank itu berkata laman web korporatnya tidak dapat diakses buat sementara waktu. Kebanyakan lamannya ditutup.",
"3.50 pagi: hasil carian masih memaparkan teks yang dicemari.",
"Kenyataan bank itu di Facebook menyalahkan penyedia pihak ketiga dan berkata hanya laman web korporat terganggu.",
"Menteri Komunikasi Fahmi Fadzil berkata bank menyekat pelayan yang terjejas, memindahkan pengguna ke i-Rakyat dan tiada kecurian data dikesan setakat ini."
],
"todo": [
"Taip sendiri alamat bank itu atau buka aplikasi rasmi iRakyat. Elakkan pautan hasil carian sehingga ia dikemas kini.",
"Abaikan SMS, panggilan dan e-mel tentang insiden ini. Bank tidak akan meminta kata laluan atau TAC anda.",
"Semak transaksi terkini dan laporkan sebarang perkara luar biasa kepada Bank Rakyat dengan segera.",
"Jika anda kerugian wang akibat penipuan, hubungi Pusat Respons Scam Kebangsaan (NSRC) di talian 997."
],
"faq": [
[
"Adakah Bank Rakyat digodam?",
"Beberapa halaman web Bank Rakyat, termasuk halaman log masuk iRakyat, dicemari pada 6 November 2026. Bank itu menyalahkan penyedia perkhidmatan pihak ketiga dan tidak menyifatkannya sebagai serangan siber."
],
[
"Adakah wang saya di Bank Rakyat selamat?",
"Bank itu berkata deposit pelanggan, maklumat peribadi dan perkhidmatan perbankan tidak terjejas. Perkhidmatan perbankan diteruskan melalui iRakyat, BRICK, QR2E dan i-bizRAKYAT."
],
[
"Siapakah MARLANWG?",
"Pelaku yang mesejnya muncul pada halaman yang dicemari. Ia mendakwa mempunyai akses dalaman dan sampel data, tetapi belum menerbitkan sebarang sampel. Sebelum ini ia mendakwa mempunyai akses kepada pangkalan data Jabatan Kastam Diraja Malaysia, yang juga belum disahkan."
]
]
}
},
{
"slug": "amadeus-airline-data-breach",
"country": "MY",
"incidents": [
"6cb596f8",
"8636cd46",
"ae94812c",
"ce071adf",
"e2e1e991",
"da36b2ac",
"27d2a847",
"6a28f8ee"
],
"logo": "",
"title": "Amadeus Airline Data Breach 2026: Airlines Affected · pwnsy",
"h1": "Amadeus airline data breach",
"desc": "Eight airlines in six countries confirmed customer data exposure through Amadeus in 2026, including Malaysia Airlines and Singapore Airlines. Dates, figures and sources.",
"lede": "Unauthorised access to Amadeus passenger reservation systems exposed booking data from August 2023 to September 2026. Eight airlines have confirmed they were affected.",
"facts": [
[
"Provider",
"Amadeus, which runs reservation systems for many airlines."
],
[
"Cause",
"Amadeus reported unauthorised access through a vulnerability in a travel booking display environment."
],
[
"Exposed",
"Booking and contact data. Some airlines also report passport numbers or loyalty details. Figures differ by airline, see the table."
],
[
"Not affected",
"Every airline says its own systems were not breached. Asiana says payment data sits on a separate system and was not affected."
],
[
"Window",
"August 2023 to September 2026, per Malaysia Airlines and Cathay Pacific."
]
],
"timeline": [
[
"2026-10-20",
"Korean Air says Amadeus notified it of possible leaked customer data.",
[]
],
[
"2026-10-28",
"Japan Airlines reports about 92,000 customers affected, about 2,000 with passport numbers.",
[]
],
[
"2026-10-31",
"Malaysia Airlines warns customers that data processed through Amadeus may be exposed.",
[
{
"name": "Malay Mail",
"url": "https://www.malaymail.com/news/malaysia/2026/11/01/malaysia-airlines-warns-customers-of-data-exposure-in-amadeus-cybersecurity-breach/241516"
},
{
"name": "Lowyat",
"url": "https://www.lowyat.net/2026/408920/malaysia-airlines-amadeus-data-breach/"
}
]
],
[
"2026-11-04",
"Singapore Airlines says about 46,000 booking records were accessed.",
[]
]
],
"todo": [
"Treat calls, SMS and emails about your booking as suspect. Airlines do not ask for card numbers or OTPs by message.",
"Check bookings only through the airline's own app or by typing its address.",
"Watch for phishing that quotes your real booking reference or flight."
],
"faq": [
[
"Which airlines were affected by the Amadeus breach?",
"Malaysia Airlines, Singapore Airlines, Japan Airlines, All Nippon Airways, Korean Air, Asiana Airlines, Cathay Pacific and Qantas have confirmed exposure, as of 8 November 2026."
],
[
"Was Malaysia Airlines hacked?",
"Malaysia Airlines says its own systems were not breached. Customer data processed through Amadeus between August 2023 and September 2026 may be exposed, with no evidence that financial information was accessed."
],
[
"What data was exposed?",
"Booking and contact details. Japan Airlines says about 2,000 records included passport numbers, and Singapore Airlines says about 620 included contact, travel document or KrisFlyer details."
]
],
"unit": "airlines",
"ms": {
"title": "Kebocoran Data Syarikat Penerbangan Amadeus 2026 · pwnsy",
"h1": "Kebocoran data Amadeus melibatkan syarikat penerbangan",
"desc": "Lapan syarikat penerbangan di enam negara sahkan data pelanggan terdedah melalui Amadeus pada 2026, termasuk Malaysia Airlines. Tarikh, angka dan sumber.",
"lede": "Akses tanpa kebenaran ke sistem tempahan penumpang Amadeus mendedahkan data tempahan dari Ogos 2023 hingga September 2026. Lapan syarikat penerbangan telah mengesahkan mereka terjejas.",
"facts": [
[
"Penyedia",
"Amadeus, yang mengendalikan sistem tempahan untuk banyak syarikat penerbangan."
],
[
"Punca",
"Amadeus melaporkan akses tanpa kebenaran melalui satu kelemahan dalam persekitaran paparan tempahan perjalanan."
],
[
"Terdedah",
"Data tempahan dan maklumat perhubungan. Sesetengah syarikat penerbangan turut melaporkan nombor pasport atau butiran program kesetiaan. Angka berbeza mengikut syarikat penerbangan, lihat jadual."
],
[
"Tidak terjejas",
"Setiap syarikat penerbangan berkata sistemnya sendiri tidak diceroboh. Asiana berkata data pembayaran disimpan dalam sistem berasingan dan tidak terjejas."
],
[
"Tempoh",
"Ogos 2023 hingga September 2026, menurut Malaysia Airlines dan Cathay Pacific."
]
],
"timeline": [
"Korean Air berkata Amadeus memaklumkannya tentang kemungkinan kebocoran data pelanggan.",
"Japan Airlines melaporkan kira-kira 92,000 pelanggan terjejas, kira-kira 2,000 daripadanya melibatkan nombor pasport.",
"Malaysia Airlines memberi amaran kepada pelanggan bahawa data yang diproses melalui Amadeus mungkin terdedah.",
"Singapore Airlines berkata kira-kira 46,000 rekod tempahan telah diakses."
],
"todo": [
"Anggap panggilan, SMS dan e-mel tentang tempahan anda sebagai mencurigakan. Syarikat penerbangan tidak meminta nombor kad atau OTP melalui mesej.",
"Semak tempahan hanya melalui aplikasi rasmi syarikat penerbangan atau dengan menaip sendiri alamatnya.",
"Berwaspada terhadap pancingan data (phishing) yang menyebut nombor rujukan tempahan atau penerbangan sebenar anda."
],
"faq": [
[
"Syarikat penerbangan mana yang terjejas akibat kebocoran Amadeus?",
"Malaysia Airlines, Singapore Airlines, Japan Airlines, All Nippon Airways, Korean Air, Asiana Airlines, Cathay Pacific dan Qantas telah mengesahkan data terdedah, setakat 8 November 2026."
],
[
"Adakah Malaysia Airlines digodam?",
"Malaysia Airlines berkata sistemnya sendiri tidak diceroboh. Data pelanggan yang diproses melalui Amadeus antara Ogos 2023 dan September 2026 mungkin terdedah, tanpa bukti maklumat kewangan telah diakses."
],
[
"Data apa yang terdedah?",
"Butiran tempahan dan maklumat perhubungan. Japan Airlines berkata kira-kira 2,000 rekod mengandungi nombor pasport, dan Singapore Airlines berkata kira-kira 620 rekod mengandungi butiran perhubungan, dokumen perjalanan atau KrisFlyer."
]
]
}
},
{
"slug": "europe-supermarket-refrigeration-cyberattacks",
"country": "IE",
"incidents": [
"4942cf06",
"31e5f9f5",
"9047b552",
"e401088d",
"fb49ccc7",
"891980fa",
"4ce2c4a0",
"89cb8e9f",
"8aa73fce",
"ddf7c97a"
],
"logo": "",
"title": "Europe Supermarket Fridge Cyberattacks, Nov 2026 · pwnsy",
"h1": "European supermarket fridges hacked in a single night",
"desc": "On 2 November 2026 attackers changed fridge settings at shops, butchers and blood banks in at least nine European countries. No one has claimed it.",
"lede": "On 2 November 2026 attackers changed temperature and defrost settings on remote refrigeration controllers at supermarkets, butchers, caterers and French blood banks across Europe. Reports point to older internet-exposed controllers, much like the French supermarket attacks of October, and the culprit is still unknown.",
"facts": [
[
"Organisations",
"SuperValu (Musgrave) in Ireland, Coop and ICA stores in Sweden, Selver in Estonia, Coop Sicily, 17 small Dutch food firms, UK meat suppliers, German supermarkets and France's blood service EFS, among others. Reports also name Delhaize, Carrefour and Colruyt in Belgium and Luxembourg."
],
[
"What happened",
"Attackers raised temperature or defrost settings on refrigeration controllers. Musgrave pulled chilled and frozen food from 13 SuperValu stores, and Selver says a freezer was pushed towards 50 C before staff reacted within ten minutes."
],
[
"Not affected",
"EFS says no blood products were lost and collection continued. Musgrave says the stores stayed open and the issue was resolved the same day. Romania's cyber directorate says no other infrastructure was compromised."
],
[
"Cause or entry point",
"No single entry point is confirmed. Danfoss told NOS the Dutch systems sat on unsecured networks with default passwords, Kitman Coldtech says older Danfoss controllers were hit in Estonia, and Coop says its stores used old 4G links. EFS says its refrigeration supplier was the route in."
],
[
"Claimed",
"No group has claimed the attacks. The EU declined to name a culprit, and Romania's cyber directorate called the attack semi-amateurish with no sign of a state actor."
],
[
"Authorities",
"The EU food commissioner called it a deliberate attempt to disrupt the food supply chain. Belgian federal prosecutors opened an investigation, Gardaí are assisting Ireland's NCSC, Italy's ACN issued a sector alert, and EFS is working with France's ANSSI."
]
],
"timeline": [
[
"2026-10-12",
"CERT-FR warned that Danfoss AK-SC and AK-SM and Copeland and Dixell XWEB refrigeration controllers exposed to the internet were being compromised after attacks on French supermarkets.",
[
{
"name": "CERT-FR",
"url": "https://cert.cyber.gouv.fr/alerte/CERTFR-2026-ALE-012"
}
]
],
[
"2026-10-13",
"Danfoss advised Dutch customers to disconnect controllers from the internet or reconnect only through a secure network.",
[
{
"name": "NL Times",
"url": "https://nltimes.nl/2026/11/02/fridges-freezers-17-dutch-businesses-attacked-large-supermarkets-unaffected"
}
]
],
[
"2026-11-02",
"Refrigeration controllers were tampered with overnight across Europe. Musgrave removed chilled and frozen food from 13 SuperValu stores, Coop reported seven Swedish shops hit and Danfoss confirmed 17 Dutch businesses affected.",
[
{
"name": "The Irish Times",
"url": "https://www.irishtimes.com/technology/data-security/2026/11/02/supervalu-removes-frozen-and-chilled-food-from-13-stores-after-cyber-attack-on-fridges/"
},
{
"name": "New Straits Times (AFP)",
"url": "https://www.nst.com.my/amp/business/corporate/2026/11/1569503/fridge-cyberattack-hits-supermarkets-across-europe"
},
{
"name": "NL Times",
"url": "https://nltimes.nl/2026/11/02/fridges-freezers-17-dutch-businesses-attacked-large-supermarkets-unaffected"
}
]
],
[
"2026-11-02",
"Selver and Kitman Coldtech said a store freezer on an older Danfoss system was pushed towards 50 C. EFS saw temperature and defrost thresholds raised at three cold-storage sites.",
[
{
"name": "ERR News",
"url": "https://news.err.ee/1610183296/hackers-raised-freezer-temperature-at-selver-supermarket-to-50-c"
},
{
"name": "BleepingComputer",
"url": "https://www.bleepingcomputer.com/news/security/cyberattack-disrupts-blood-storage-refrigeration-systems-in-france/"
}
]
],
[
"2026-11-03",
"Italy's ACN reported a NIS notification from a Tuscan catering firm and urged operators to take controllers off the internet. The EU said the incidents were not isolated, and UK NCSC chief Richard Horne said vulnerable technology had been exploited in the UK.",
[
{
"name": "ACN (Italy)",
"url": "https://www.acn.gov.it/portale/web/guest/-/cybersicurezza-allerta-sulla-filiera-alimentare-e-della-catena-del-freddo-acn-richiama-gli-operatori-della-grande-distribuzione-e-della-logistica-alimentare-alle-misure-di-sicurezza-gia-indicate-dopo-gli-incidenti-in-francia"
},
{
"name": "The Local (AFP)",
"url": "https://www.thelocal.dk/20261103/fridge-cyberattack-on-supermarkets-across-europe-prompts-eu-warning"
}
]
],
[
"2026-11-04",
"EFS said no blood products were lost and that its refrigeration supplier was targeted. Coolworld Rentals confirmed an incident in its remote monitoring software, and Gardaí were reported to be assisting Ireland's NCSC.",
[
{
"name": "BleepingComputer",
"url": "https://www.bleepingcomputer.com/news/security/cyberattack-disrupts-blood-storage-refrigeration-systems-in-france/"
},
{
"name": "Irish Examiner",
"url": "https://www.irishexaminer.com/news/arid-41932833.html"
}
]
]
],
"todo": [
"If you run Danfoss AK-SM or AK-SC, or Copeland or Dixell XWEB controllers, take them off the public internet and follow CERT-FR alert CERTFR-2026-ALE-012.",
"Change default passwords on refrigeration controllers and allow remote access only through a VPN with multi-factor authentication, as Italy's ACN advises.",
"Check defrost schedules and temperature setpoints, and replace controllers the maker no longer supports.",
"Businesses in Ireland can report a cyber incident to the NCSC at ncsc.gov.ie and to An Garda Síochána."
],
"faq": [
[
"Which supermarkets were hit by the fridge cyberattack?",
"Reports name SuperValu in Ireland, Coop and ICA stores in Sweden, Selver in Estonia, Coop in Sicily, Delhaize, Carrefour and Colruyt in Belgium and Luxembourg, plus small Dutch shops, German supermarkets and UK meat suppliers."
],
[
"Was food at SuperValu safe?",
"Musgrave says it removed chilled and frozen food from 13 stores as a precaution after its monitoring raised an alert, and that the issue was fully resolved the same day."
],
[
"Who was behind the European fridge hacks?",
"Nobody knows yet. No group has claimed the attacks, the EU has not named a culprit, and Romania's cyber directorate said it does not suspect a state actor."
]
]
},
{
"slug": "thailand-government-data-leak",
"country": "TH",
"incidents": [
"9a1aebd8",
"6f428aa1"
],
"logo": "",
"title": "Thailand Government Data Leak, August 2026 · pwnsy",
"h1": "Thai government data pulled with stolen staff logins",
"desc": "In August 2026 Thai citizen data, including vehicle records on the PM, was pulled from state systems with staff logins and sold on Discord and Telegram.",
"lede": "In early August 2026 Thai officials confirmed that citizen data, including vehicle registration records on the prime minister and ministers, had been pulled from government systems using compromised staff accounts. The data was sold online, and the cabinet ordered password resets across more than 300 departments.",
"facts": [
[
"Organisation",
"The Department of Land Transport (DLT) and agencies across 19 ministries and the Office of the Prime Minister, according to Domecloud CEO Thanarat Kuawattanaphan. The Department of Provincial Administration was also named."
],
[
"What happened",
"Police say attackers logged in with compromised accounts of staff who had access rights, pulled data and sold it on the dark web, Telegram and Discord. Samples on prominent people were shown to prove the data was real."
],
[
"Data or systems affected",
"Vehicle registration records, including on the prime minister and ministers, plus ID card photos and household data according to Thanarat. The DLT says the vehicle data is basic and cannot be used to make transactions."
],
[
"Cause or entry point",
"The DLT says its main database was not hacked. Data was pulled through its read-only API, which 63 agencies use, with logins of three connected agencies, and Thanarat says most staff passwords were stolen by malware."
],
[
"Claimed",
"Thanarat says data on more than 500,000 people across about 20 agencies was exposed. The Nation reports Discord bots sold searches at 350 baht a day or 2,500 baht a month."
],
[
"Authorities",
"The DES Ministry, the Interior Ministry and the Department of Provincial Administration filed complaints with cyber police. ThaiCERT was sent to the DLT, and the cabinet ordered password resets, a 15-day clean-up of old systems and multi-factor login."
]
],
"timeline": [
[
"2026-08-04",
"An adviser to the opposition leader said vehicle records, including the prime minister's car, could be searched online. DES Minister Chaichanok Chidchob ordered ThaiCERT to investigate with the DLT.",
[
{
"name": "The Nation",
"url": "https://www.nationthailand.com/news/general/40069394"
}
]
],
[
"2026-08-06",
"Deputy Transport Minister Siripong Angkasakulkiat said data was pulled through the DLT API with logins of connected agencies. The DLT cut access for three agencies, reset all API passwords and filed Computer Crime Act complaints.",
[
{
"name": "Thai PBS",
"url": "https://www.thaipbs.or.th/news/content/509122"
},
{
"name": "The Nation",
"url": "https://www.nationthailand.com/news/general/40069456"
}
]
],
[
"2026-08-06",
"Cyber police questioned Domecloud CEO Thanarat Kuawattanaphan as a witness. Police said compromised staff accounts were used and the data was sold on the dark web, Telegram and Discord.",
[
{
"name": "Thairath",
"url": "https://www.thairath.co.th/news/crime/2951036"
}
]
],
[
"2026-08-11",
"The cabinet ordered officials in more than 300 departments to change passwords, a 15-day review of about 30,000 systems and multi-factor login through ThaID or similar.",
[
{
"name": "Thansettakij",
"url": "https://www.thansettakij.com/economy/666195"
}
]
],
[
"2026-08-13",
"Police searched two homes in Phrae and Pathum Thani and seized computers. A juvenile suspect was questioned without detention, and no charges were reported.",
[
{
"name": "Thairath English",
"url": "https://en.thairath.co.th/news/crime/2952572"
}
]
]
],
"todo": [
"Hang up on callers who claim to be from a government agency, even if they know your details, and call the agency back on its official number.",
"Ignore SMS messages with payment links that claim to be from the DLT or the Transport Ministry. Both say fines are sent only by post.",
"Do not download, test or share the leaked data. The PDPC warns this can break the law.",
"Report scam calls or messages to the police anti-online-scam hotline 1441 or at thaipoliceonline.go.th."
],
"faq": [
[
"Was the Department of Land Transport hacked?",
"The DLT says its main database was not hacked. Officials say the data was pulled through its read-only API using logins of three connected agencies, whose access was then cut."
],
[
"What Thai government data was leaked?",
"Vehicle registration records, including on the prime minister and ministers, and according to Domecloud's CEO also ID card photos and household data from agencies across 19 ministries."
],
[
"Has anyone been arrested over the Thai data leak?",
"No arrest had been reported by 13 August 2026. Police searched two homes, seized computers and questioned a juvenile without detaining him."
]
]
},
{
"slug": "tabung-haji-cyberattack",
"country": "MY",
"incidents": [
"9ebf6e36"
],
"logo": "",
"title": "Tabung Haji Cyberattack, October 2026 · pwnsy",
"h1": "Tabung Haji suspends all services after a cyberattack",
"desc": "Tabung Haji paused all channels for four days in October 2026 after a cyberattack. TH says depositors' savings are safe. What happened and what to do.",
"lede": "Lembaga Tabung Haji (TH) suspended its systems and services across all channels on 8 October 2026 after detecting suspicious cyber activity. Key services returned on 12 October, and TH says depositors' savings are safe.",
"facts": [
[
"Organisation",
"Lembaga Tabung Haji (TH), Malaysia's pilgrimage fund and savings body."
],
[
"What happened",
"TH detected suspicious cyber activity on 7 October and suspended services on all channels on 8 October as a precaution. TH later described the event as a cyberattack."
],
[
"Systems affected",
"Branches, services through partner banks and the THiJARI app were down. On 12 October, THiJARI password resets, new user registration and online account opening were still being restored."
],
[
"Not affected",
"TH says depositors' savings are safe. On 8 October it said savings and personal data remained safe and secure."
],
[
"Cause or entry point",
"TH has not said how the attackers got in or who they are. No group has publicly claimed the attack in the sources we checked."
],
[
"Authorities",
"TH lodged a police report and notified the National Cyber Security Agency (NACSA) and the Personal Data Protection Department (JPDP). It also worked with CyberSecurity Malaysia."
]
],
"timeline": [
[
"2026-10-07",
"TH detects suspicious cyber activity on its systems.",
[
{
"name": "The Star",
"url": "https://thestar.com.my/tech/tech-news/2026/10/08/tabung-haji-suspends-services-after-detecting-suspicious-cyber-activity"
}
]
],
[
"2026-10-08",
"TH suspends system and service operations across all channels and says savings and personal data remain safe.",
[
{
"name": "The Star",
"url": "https://thestar.com.my/tech/tech-news/2026/10/08/tabung-haji-suspends-services-after-detecting-suspicious-cyber-activity"
},
{
"name": "Malay Mail",
"url": "https://www.malaymail.com/news/malaysia/2026/10/12/tabung-haji-systems-resume-after-cyberattack-depositors-savings-confirmed-safe/238782"
}
]
],
[
"2026-10-11",
"Branches in Kedah, Terengganu and Kelantan reopen.",
[
{
"name": "Malay Mail",
"url": "https://www.malaymail.com/news/malaysia/2026/10/12/tabung-haji-systems-resume-after-cyberattack-depositors-savings-confirmed-safe/238782"
},
{
"name": "The Star",
"url": "https://www.thestar.com.my/news/nation/2026/10/12/th-depositors039-savings-safe-core-systems-services-restored-after-cyberattack"
}
]
],
[
"2026-10-12",
"Branches in other states reopen, partner bank services return and most THiJARI functions resume. Three THiJARI functions still need restoration work.",
[
{
"name": "Malay Mail",
"url": "https://www.malaymail.com/news/malaysia/2026/10/12/tabung-haji-systems-resume-after-cyberattack-depositors-savings-confirmed-safe/238782"
},
{
"name": "The Star",
"url": "https://www.thestar.com.my/news/nation/2026/10/12/th-depositors039-savings-safe-core-systems-services-restored-after-cyberattack"
}
]
]
],
"todo": [
"Check your TH balance and recent transactions in THiJARI or at a branch, and call the TH Contact Centre on 03-6207 1919 if anything looks wrong.",
"Take updates only from TH's official website and social media accounts. Do not act on calls or messages that claim to be from TH and ask for your login details or a transfer.",
"If you lose money to a scam call or message, call the NSRC hotline on 997 straight away and make a police report.",
"If you believe your personal data was misused, you can complain to the Personal Data Protection Department (JPDP)."
],
"faq": [
[
"Is my Tabung Haji money safe after the cyberattack?",
"TH says depositors' savings are safe. It asks anyone who sees an unusual transaction to call the TH Contact Centre on 03-6207 1919."
],
[
"Was Tabung Haji data stolen?",
"TH has not reported any data theft. On 8 October it said savings and personal data remained safe, and it notified the Personal Data Protection Department."
],
[
"Is THiJARI working again?",
"Most THiJARI functions resumed on 12 October 2026. Password resets, new user registration and online account opening still needed restoration work at that time, and TH said it would post updates on its official channels."
]
],
"ms": {
"title": "Serangan Siber Tabung Haji, Oktober 2026 · pwnsy",
"h1": "Tabung Haji gantung semua perkhidmatan selepas serangan siber",
"desc": "Tabung Haji menghentikan semua saluran selama empat hari pada Oktober 2026 selepas serangan siber. TH kata simpanan pendeposit selamat. Apa yang berlaku.",
"lede": "Lembaga Tabung Haji (TH) menggantung sistem dan perkhidmatannya di semua saluran pada 8 Oktober 2026 selepas mengesan aktiviti siber yang mencurigakan. Perkhidmatan utama pulih pada 12 Oktober, dan TH berkata simpanan pendeposit selamat.",
"facts": [
[
"Organisasi",
"Lembaga Tabung Haji (TH), badan dana haji dan simpanan Malaysia."
],
[
"Apa yang berlaku",
"TH mengesan aktiviti siber yang mencurigakan pada 7 Oktober dan menggantung perkhidmatan di semua saluran pada 8 Oktober sebagai langkah berjaga-jaga. TH kemudian menyifatkan kejadian itu sebagai serangan siber."
],
[
"Sistem terjejas",
"Cawangan, perkhidmatan melalui bank rakan dan aplikasi THiJARI tidak beroperasi. Pada 12 Oktober, tetapan semula kata laluan THiJARI, pendaftaran pengguna baharu dan pembukaan akaun dalam talian masih dalam proses pemulihan."
],
[
"Tidak terjejas",
"TH berkata simpanan pendeposit selamat. Pada 8 Oktober, ia berkata simpanan dan data peribadi kekal selamat dan terjamin."
],
[
"Punca atau titik masuk",
"TH tidak menyatakan bagaimana penyerang masuk atau siapa mereka. Tiada kumpulan yang mengaku bertanggungjawab secara terbuka dalam sumber yang kami semak."
],
[
"Pihak berkuasa",
"TH membuat laporan polis dan memaklumkan Agensi Keselamatan Siber Negara (NACSA) serta Jabatan Perlindungan Data Peribadi (JPDP). Ia juga bekerjasama dengan CyberSecurity Malaysia."
]
],
"timeline": [
"TH mengesan aktiviti siber yang mencurigakan pada sistemnya.",
"TH menggantung operasi sistem dan perkhidmatan di semua saluran dan berkata simpanan serta data peribadi kekal selamat.",
"Cawangan di Kedah, Terengganu dan Kelantan dibuka semula.",
"Cawangan di negeri lain dibuka semula, perkhidmatan bank rakan pulih dan kebanyakan fungsi THiJARI beroperasi semula. Tiga fungsi THiJARI masih memerlukan kerja pemulihan."
],
"todo": [
"Semak baki dan transaksi terkini TH anda dalam THiJARI atau di cawangan, dan hubungi Pusat Panggilan TH di 03-6207 1919 jika ada yang tidak kena.",
"Dapatkan maklumat terkini hanya daripada laman web dan akaun media sosial rasmi TH. Jangan bertindak atas panggilan atau mesej yang mendakwa daripada TH dan meminta butiran log masuk atau pemindahan wang.",
"Jika anda kerugian wang akibat panggilan atau mesej penipuan, hubungi talian NSRC 997 dengan segera dan buat laporan polis.",
"Jika anda percaya data peribadi anda disalah guna, anda boleh membuat aduan kepada Jabatan Perlindungan Data Peribadi (JPDP)."
],
"faq": [
[
"Adakah wang Tabung Haji saya selamat selepas serangan siber?",
"TH berkata simpanan pendeposit selamat. Ia meminta sesiapa yang melihat transaksi luar biasa menghubungi Pusat Panggilan TH di 03-6207 1919."
],
[
"Adakah data Tabung Haji dicuri?",
"TH tidak melaporkan sebarang kecurian data. Pada 8 Oktober, ia berkata simpanan dan data peribadi kekal selamat, dan ia telah memaklumkan Jabatan Perlindungan Data Peribadi."
],
[
"Adakah THiJARI sudah berfungsi semula?",
"Kebanyakan fungsi THiJARI kembali beroperasi pada 12 Oktober 2026. Tetapan semula kata laluan, pendaftaran pengguna baharu dan pembukaan akaun dalam talian masih memerlukan kerja pemulihan ketika itu, dan TH berkata ia akan menyiarkan maklumat terkini di saluran rasminya."
]
]
}
},
{
"slug": "port-of-tanjung-pelepas-cyberattack",
"country": "MY",
"incidents": [
"e2e721f4"
],
"logo": "",
"title": "Port of Tanjung Pelepas Cyberattack, September 2026 · pwnsy",
"h1": "Port of Tanjung Pelepas halted by a cyber incident",
"desc": "A cyber incident halted container operations at Port of Tanjung Pelepas on 9 to 10 September 2026. The Direwolf group claims it stole 200 GB.",
"lede": "Port of Tanjung Pelepas (PTP) in Johor paused terminal operations for several hours after a cyber incident shortly before midnight on 9 September 2026. The Direwolf ransomware group later listed the port on its leak site, a claim PTP has not confirmed.",
"facts": [
[
"Organisation",
"Port of Tanjung Pelepas (PTP) in Johor, run by AP Moller Maersk in a joint venture with MMC. It handled more than 14 million TEU in 2025."
],
[
"What happened",
"PTP confirmed a cybersecurity incident that affected operating systems and temporarily halted container terminal operations. A phased restart began on 10 September."
],
[
"Systems affected",
"Terminal operating systems. Maersk warned that some vessels may face delays."
],
[
"Not affected",
"PTP told shippers it had found no evidence of unauthorised access to customer data."
],
[
"Cause or entry point",
"PTP has not said how the attackers got in."
],
[
"Claimed",
"The Direwolf ransomware group listed PTP on its leak site on 11 September and claims to hold 200 GB of data. PTP has not confirmed the claim."
]
],
"timeline": [
[
"2026-09-09",
"Attackers hit PTP shortly before midnight, and terminal operations pause.",
[
{
"name": "The Loadstar",
"url": "https://theloadstar.com/cyber-attack-halts-operations-at-malaysias-tanjung-pelepas-port/"
}
]
],
[
"2026-09-10",
"PTP restores the affected system and begins a controlled, phased restart of terminal operations.",
[
{
"name": "Lloyd's List",
"url": "https://www.lloydslist.com/LL1158420/Cyber-attack-disrupts-operations-at-Malaysia%E2%80%99s-Port-of-Tanjung-Pelepas"
}
]
],
[
"2026-09-11",
"Maersk confirms a cybersecurity incident and says operations are progressively resuming, with some vessel delays possible.",
[
{
"name": "The Loadstar",
"url": "https://theloadstar.com/cyber-attack-halts-operations-at-malaysias-tanjung-pelepas-port/"
}
]
],
[
"2026-09-11",
"Direwolf lists the port on its leak site and claims 200 GB of data.",
[
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/UG9ydCBvZiBUYW5qdW5nIFBlbGVwYXNAZGlyZXdvbGY="
}
]
]
],
"todo": [
"Shippers and forwarders should check vessel and container status with their carrier or PTP's official customer channels before rebooking.",
"Treat any email about the incident that asks you to change bank details or open attachments as suspect, and confirm it by phone with a known contact.",
"Report suspicious emails or files linked to the incident to CyberSecurity Malaysia's Cyber999 service.",
"If you lose money to a payment scam, call the NSRC hotline on 997 straight away."
],
"faq": [
[
"What happened at Port of Tanjung Pelepas?",
"A cyber incident shortly before midnight on 9 September 2026 halted container terminal operations for several hours. PTP began a phased restart on 10 September."
],
[
"Was data stolen from PTP?",
"PTP said it found no evidence of unauthorised access to customer data. The Direwolf group claims to hold 200 GB of PTP data, and that claim is unverified."
],
[
"Who is behind the PTP cyberattack?",
"PTP has not named an attacker. The Direwolf ransomware group listed the port on its leak site on 11 September 2026."
]
],
"ms": {
"title": "Serangan Siber PTP Tanjung Pelepas, September 2026 · pwnsy",
"h1": "Port of Tanjung Pelepas terhenti akibat insiden siber",
"desc": "Insiden siber menghentikan operasi kontena di Port of Tanjung Pelepas pada 9 hingga 10 September 2026. Kumpulan Direwolf mendakwa mencuri 200 GB.",
"lede": "Port of Tanjung Pelepas (PTP) di Johor menghentikan operasi terminal selama beberapa jam selepas insiden siber sejurus sebelum tengah malam pada 9 September 2026. Kumpulan perisian tebusan Direwolf kemudian menyenaraikan pelabuhan itu di laman kebocorannya, dakwaan yang belum disahkan oleh PTP.",
"facts": [
[
"Organisasi",
"Port of Tanjung Pelepas (PTP) di Johor, dikendalikan oleh AP Moller Maersk melalui usaha sama dengan MMC. Ia mengendalikan lebih 14 juta TEU pada 2025."
],
[
"Apa yang berlaku",
"PTP mengesahkan insiden keselamatan siber yang menjejaskan sistem operasi dan menghentikan operasi terminal kontena buat sementara waktu. Operasi dimulakan semula secara berperingkat pada 10 September."
],
[
"Sistem terjejas",
"Sistem operasi terminal. Maersk memberi amaran bahawa sesetengah kapal mungkin mengalami kelewatan."
],
[
"Tidak terjejas",
"PTP memberitahu pengirim bahawa ia tidak menemui bukti akses tanpa kebenaran kepada data pelanggan."
],
[
"Punca atau titik masuk",
"PTP tidak menyatakan bagaimana penyerang masuk."
],
[
"Dakwaan",
"Kumpulan perisian tebusan Direwolf menyenaraikan PTP di laman kebocorannya pada 11 September dan mendakwa memiliki 200 GB data. PTP belum mengesahkan dakwaan itu."
]
],
"timeline": [
"Penyerang menyerang PTP sejurus sebelum tengah malam, dan operasi terminal terhenti.",
"PTP memulihkan sistem yang terjejas dan memulakan semula operasi terminal secara terkawal dan berperingkat.",
"Maersk mengesahkan insiden keselamatan siber dan berkata operasi beransur pulih, dengan kemungkinan kelewatan bagi sesetengah kapal.",
"Direwolf menyenaraikan pelabuhan itu di laman kebocorannya dan mendakwa memiliki 200 GB data."
],
"todo": [
"Pengirim dan ejen penghantaran perlu menyemak status kapal dan kontena dengan syarikat perkapalan masing-masing atau saluran pelanggan rasmi PTP sebelum membuat tempahan semula.",
"Anggap sebarang e-mel tentang insiden ini yang meminta anda menukar butiran bank atau membuka lampiran sebagai mencurigakan, dan sahkan melalui telefon dengan kenalan yang anda kenali.",
"Laporkan e-mel atau fail mencurigakan yang berkaitan dengan insiden ini kepada perkhidmatan Cyber999 CyberSecurity Malaysia.",
"Jika anda kerugian wang akibat penipuan pembayaran, hubungi talian NSRC 997 dengan segera."
],
"faq": [
[
"Apa yang berlaku di Port of Tanjung Pelepas?",
"Insiden siber sejurus sebelum tengah malam pada 9 September 2026 menghentikan operasi terminal kontena selama beberapa jam. PTP memulakan semula operasi secara berperingkat pada 10 September."
],
[
"Adakah data dicuri daripada PTP?",
"PTP berkata ia tidak menemui bukti akses tanpa kebenaran kepada data pelanggan. Kumpulan Direwolf mendakwa memiliki 200 GB data PTP, dan dakwaan itu belum disahkan."
],
[
"Siapa di sebalik serangan siber PTP?",
"PTP tidak menamakan penyerang. Kumpulan perisian tebusan Direwolf menyenaraikan pelabuhan itu di laman kebocorannya pada 11 September 2026."
]
]
}
},
{
"slug": "flexi-parking-cyberattack",
"country": "MY",
"incidents": [
"fe8b0e46"
],
"logo": "",
"title": "Flexi Parking Cyberattack, June 2026 · pwnsy",
"h1": "Flexi Parking knocked offline by a cyberattack",
"desc": "A June 2026 cyberattack on Flexi Parking stopped parking payments in 64 Malaysian councils for 61 hours. LITS disputes a claim of 7 million users hit.",
"lede": "An intruder reached a legacy Flexi Parking server on 29 June 2026, and payments and enforcement stopped for 61 hours in 64 local councils. The developer, LITS, rebuilt its systems and disputes the attacker's claim of data on seven million users.",
"facts": [
[
"Organisation",
"Leading Innovative Technologies & Systems Sdn Bhd (LITS), developer of Flexi Parking, Smart Selangor Parking and Sabah Smart Parking. The system is used by 64 local councils across Malaysia."
],
[
"What happened",
"An attacker reached a legacy server at about 9am on 29 June, sent unauthorised app notifications and defaced a council enforcement page. LITS saw databases being deleted and shut everything down."
],
[
"Data or systems affected",
"Parking payments, compound payments and enforcement stopped from 29 June to 2 July, a 61-hour outage. Preliminary log checks found attempts to delete databases and tables, says LITS."
],
[
"Cause or entry point",
"LITS says folder permissions were left open during a server migration on 28 June. It says credentials and a security key left on the server for file transfers probably let the intruder in."
],
[
"Claimed",
"The attacker claimed access to data on seven million users. LITS disputes this. It says the figure likely came from a login table of user IDs and timestamps, with no names, emails, IC numbers or passwords, and preliminary checks show no data was viewed or downloaded."
],
[
"Authorities",
"The incident was referred to NACSA and MCMC. CyberSecurity Malaysia is carrying out a post-mortem. Councils were told to hold off on parking summonses during the outage."
]
],
"timeline": [
[
"2026-06-29",
"An intruder reaches a legacy LITS server at about 9am. LITS shuts down its systems.",
[
{
"name": "The Star",
"url": "https://www.thestar.com.my/metro/metro-news/2026/07/30/cyberattack-triggers-parking-platform-rebuild"
}
]
],
[
"2026-06-30",
"Motorists cannot pay for parking through Flexi Parking and Smart Selangor Parking.",
[
{
"name": "The Star",
"url": "https://www.thestar.com.my/news/nation/2026/07/02/digital-parking-systems-in-selangor-sabah-fully-restored-after-cyberattacks"
},
{
"name": "Malay Mail",
"url": "https://www.malaymail.com/news/malaysia/2026/07/01/selangor-confirms-flexi-parking-cyberattack-suspends-parking-summons-during-outage/225930"
}
]
],
[
"2026-07-01",
"Selangor's local government chairman Ng Suee Lim confirms the system was hacked and asks councils not to issue parking compounds until it works again.",
[
{
"name": "Malay Mail",
"url": "https://www.malaymail.com/news/malaysia/2026/07/01/selangor-confirms-flexi-parking-cyberattack-suspends-parking-summons-during-outage/225930"
},
{
"name": "New Straits Times",
"url": "https://www.nst.com.my/amp/news/nation/2026/07/1477895/cyberattack-cripples-flexi-parking-app-across-64-local-councils"
}
]
],
[
"2026-07-02",
"Services in Selangor and Sabah are restored, with payments and enforcement back to normal.",
[
{
"name": "The Star",
"url": "https://www.thestar.com.my/news/nation/2026/07/02/digital-parking-systems-in-selangor-sabah-fully-restored-after-cyberattacks"
}
]
],
[
"2026-07-30",
"LITS explains the breach, says it rebuilt its servers and network, and disputes the seven million user claim.",
[
{
"name": "The Star",
"url": "https://www.thestar.com.my/metro/metro-news/2026/07/30/cyberattack-triggers-parking-platform-rebuild"
}
]
]
],
"todo": [
"Check your Flexi Parking or Smart Selangor Parking balance, and contact LITS through the app if credits are missing.",
"If you got a parking compound between 29 June and 2 July 2026, ask the issuing council whether it will be reviewed or cancelled.",
"Ignore unexpected notifications or links claiming to be from the parking app, and use only the official app.",
"If you lose money to a scam linked to the incident, call the NSRC hotline on 997. Report suspicious messages to CyberSecurity Malaysia's Cyber999."
],
"faq": [
[
"Was Flexi Parking hacked?",
"Yes. The Selangor government confirmed the cyberattack, and LITS says an intruder reached a legacy server on 29 June 2026."
],
[
"Was my Flexi Parking data stolen?",
"The attacker claims data on seven million users. LITS disputes this and says preliminary checks found no evidence that user data was viewed or downloaded, pending CyberSecurity Malaysia's post-mortem."
],
[
"Do I have to pay parking compounds issued during the outage?",
"Selangor asked councils not to issue compounds while the system was down. Ask the council that issued yours whether it will be reviewed."
]
],
"ms": {
"title": "Serangan Siber Flexi Parking, Jun 2026 · pwnsy",
"h1": "Flexi Parking lumpuh akibat serangan siber",
"desc": "Serangan siber ke atas Flexi Parking pada Jun 2026 menghentikan bayaran parkir di 64 PBT selama 61 jam. LITS pertikai dakwaan 7 juta pengguna terjejas.",
"lede": "Seorang penceroboh mengakses pelayan lama Flexi Parking pada 29 Jun 2026, dan pembayaran serta penguatkuasaan terhenti selama 61 jam di 64 pihak berkuasa tempatan. Pemaju sistem itu, LITS, membina semula sistemnya dan mempertikaikan dakwaan penyerang bahawa ia memiliki data tujuh juta pengguna.",
"facts": [
[
"Organisasi",
"Leading Innovative Technologies & Systems Sdn Bhd (LITS), pemaju Flexi Parking, Smart Selangor Parking dan Sabah Smart Parking. Sistem ini digunakan oleh 64 pihak berkuasa tempatan di seluruh Malaysia."
],
[
"Apa yang berlaku",
"Seorang penyerang mengakses pelayan lama kira-kira jam 9 pagi pada 29 Jun, menghantar pemberitahuan aplikasi tanpa kebenaran dan mencemari halaman penguatkuasaan sebuah majlis. LITS mendapati pangkalan data sedang dipadam lalu menutup keseluruhan sistem."
],
[
"Data atau sistem terjejas",
"Pembayaran parkir, pembayaran kompaun dan penguatkuasaan terhenti dari 29 Jun hingga 2 Julai, gangguan selama 61 jam. Semakan log awal menemui cubaan memadam pangkalan data dan jadual, kata LITS."
],
[
"Punca atau titik masuk",
"LITS berkata kebenaran folder dibiarkan terbuka semasa migrasi pelayan pada 28 Jun. Menurutnya, bukti kelayakan dan kunci keselamatan yang ditinggalkan pada pelayan untuk pemindahan fail mungkin membolehkan penceroboh masuk."
],
[
"Dakwaan",
"Penyerang mendakwa mempunyai akses kepada data tujuh juta pengguna. LITS mempertikaikannya. Menurut LITS, angka itu mungkin datang daripada jadual log masuk yang mengandungi ID pengguna dan cap masa, tanpa nama, e-mel, nombor IC atau kata laluan, dan semakan awal menunjukkan tiada data dilihat atau dimuat turun."
],
[
"Pihak berkuasa",
"Insiden ini dirujuk kepada NACSA dan MCMC. CyberSecurity Malaysia sedang menjalankan analisis pasca insiden. Majlis diminta menangguhkan pengeluaran saman parkir sepanjang gangguan."
]
],
"timeline": [
"Seorang penceroboh mengakses pelayan lama LITS kira-kira jam 9 pagi. LITS menutup sistemnya.",
"Pemandu tidak dapat membayar parkir melalui Flexi Parking dan Smart Selangor Parking.",
"Pengerusi Jawatankuasa Kerajaan Tempatan Selangor, Ng Suee Lim, mengesahkan sistem itu digodam dan meminta majlis tidak mengeluarkan kompaun parkir sehingga sistem berfungsi semula.",
"Perkhidmatan di Selangor dan Sabah dipulihkan, dengan pembayaran dan penguatkuasaan kembali normal.",
"LITS menjelaskan pencerobohan itu, berkata ia telah membina semula pelayan dan rangkaiannya, dan mempertikaikan dakwaan tujuh juta pengguna."
],
"todo": [
"Semak baki Flexi Parking atau Smart Selangor Parking anda, dan hubungi LITS melalui aplikasi jika ada kredit yang hilang.",
"Jika anda menerima kompaun parkir antara 29 Jun dan 2 Julai 2026, tanya majlis yang mengeluarkannya sama ada kompaun itu akan disemak semula atau dibatalkan.",
"Abaikan pemberitahuan atau pautan luar jangka yang mendakwa daripada aplikasi parkir, dan gunakan aplikasi rasmi sahaja.",
"Jika anda kerugian wang akibat penipuan berkaitan insiden ini, hubungi talian NSRC 997. Laporkan mesej mencurigakan kepada Cyber999 CyberSecurity Malaysia."
],
"faq": [
[
"Adakah Flexi Parking digodam?",
"Ya. Kerajaan Selangor mengesahkan serangan siber itu, dan LITS berkata seorang penceroboh mengakses pelayan lama pada 29 Jun 2026."
],
[
"Adakah data Flexi Parking saya dicuri?",
"Penyerang mendakwa memiliki data tujuh juta pengguna. LITS mempertikaikannya dan berkata semakan awal tidak menemui bukti data pengguna dilihat atau dimuat turun, sementara menunggu analisis pasca insiden oleh CyberSecurity Malaysia."
],
[
"Perlukah saya membayar kompaun parkir yang dikeluarkan semasa gangguan?",
"Selangor meminta majlis tidak mengeluarkan kompaun semasa sistem tidak berfungsi. Tanya majlis yang mengeluarkan kompaun anda sama ada ia akan disemak semula."
]
]
}
},
{
"slug": "rakuten-trade-outage",
"country": "MY",
"incidents": [
"1311ba69"
],
"logo": "",
"title": "Rakuten Trade Cyber Outage, October 2026 · pwnsy",
"h1": "Rakuten Trade halts Bursa trading after a cyber attempt",
"desc": "Rakuten Trade stopped online Bursa Malaysia orders for over a week in October 2026 after a cybersecurity attempt. App trading returned on 4 November.",
"lede": "Malaysian broker Rakuten Trade limited online trading of Bursa Malaysia stocks for more than a week in October 2026 after detecting a cybersecurity attempt. App orders returned on 4 November, while its web platform stayed suspended.",
"facts": [
[
"Organisation",
"Rakuten Trade Sdn Bhd, an online stockbroker owned by Kenanga Investment Bank and Rakuten Securities of Japan, licensed by the Securities Commission Malaysia."
],
[
"What happened",
"The broker limited transactions as a precaution after detecting a cybersecurity attempt, says CEO Kazumasa Mise. By 30 October, online Bursa orders had been unavailable for more than a week."
],
[
"Systems affected",
"Online buy and sell orders for Malaysian stocks on the website and the iSPEED.my app. Customer service took manual sell orders. From 4 November, web trading was suspended for all markets."
],
[
"Not affected",
"US and Hong Kong trading, deposits, withdrawals and account access stayed available during the Bursa outage. The company says client funds and holdings are safe."
],
[
"Data",
"Mise says assessments so far found no evidence of data loss. He says the incident is unrelated to cyber incidents reported in Japan."
],
[
"Authorities",
"No statement from the Securities Commission or Bursa Malaysia on this incident appears in the reports we checked."
]
],
"timeline": [
[
"2026-10-28",
"A client notice says the broker is in the final stages of checks before restoring online orders.",
[
{
"name": "The Edge",
"url": "https://theedgemalaysia.com/node/823904"
}
]
],
[
"2026-10-30",
"Online Bursa trading has been down for more than a week with no restart date. The CEO says there is no evidence of data loss.",
[
{
"name": "The Edge",
"url": "https://theedgemalaysia.com/node/823904"
}
]
],
[
"2026-11-04",
"Bursa buy and sell orders return on the iSPEED.my app. Web trading is suspended for all markets as a precaution.",
[
{
"name": "The Edge",
"url": "https://theedgemalaysia.com/node/824498"
}
]
]
],
"todo": [
"Check your holdings, contract notes and cash balance in the iSPEED.my app, and raise any mismatch with Rakuten Trade customer service.",
"Place orders through the iSPEED.my app while the web platform is suspended, and follow Rakuten Trade's official notices for its return.",
"Be wary of calls or messages offering help with the outage or asking for your login or OTP. Rakuten Trade's official channels are the only place to act.",
"If you lose money to a scam, call the NSRC hotline on 997 straight away and report it to the police."
],
"faq": [
[
"Why was Rakuten Trade down?",
"Rakuten Trade limited transactions as a precaution after detecting a cybersecurity attempt, says its CEO. Online Bursa trading was unavailable for more than a week."
],
[
"Is my money safe with Rakuten Trade?",
"The company says client funds and stock holdings remain safe and unaffected. Its CEO says it has found no evidence of data loss so far."
],
[
"Can I trade on Rakuten Trade now?",
"Bursa orders returned on the iSPEED.my app on 4 November 2026. The web platform was suspended for all markets at that time as a precaution."
]
],
"ms": {
"title": "Gangguan Siber Rakuten Trade, Oktober 2026 · pwnsy",
"h1": "Rakuten Trade hentikan dagangan Bursa selepas cubaan siber",
"desc": "Rakuten Trade menghentikan pesanan dalam talian Bursa Malaysia lebih seminggu pada Oktober 2026 selepas cubaan siber. Dagangan aplikasi pulih 4 November.",
"lede": "Broker Malaysia Rakuten Trade mengehadkan dagangan dalam talian saham Bursa Malaysia selama lebih seminggu pada Oktober 2026 selepas mengesan cubaan keselamatan siber. Pesanan melalui aplikasi kembali pada 4 November, manakala platform webnya kekal digantung.",
"facts": [
[
"Organisasi",
"Rakuten Trade Sdn Bhd, broker saham dalam talian milik Kenanga Investment Bank dan Rakuten Securities dari Jepun, dilesenkan oleh Suruhanjaya Sekuriti Malaysia."
],
[
"Apa yang berlaku",
"Broker itu mengehadkan transaksi sebagai langkah berjaga-jaga selepas mengesan cubaan keselamatan siber, kata Ketua Pegawai Eksekutif Kazumasa Mise. Menjelang 30 Oktober, pesanan Bursa dalam talian tidak tersedia selama lebih seminggu."
],
[
"Sistem terjejas",
"Pesanan beli dan jual dalam talian bagi saham Malaysia di laman web dan aplikasi iSPEED.my. Khidmat pelanggan menerima pesanan jual secara manual. Mulai 4 November, dagangan web digantung bagi semua pasaran."
],
[
"Tidak terjejas",
"Dagangan AS dan Hong Kong, deposit, pengeluaran dan akses akaun kekal tersedia sepanjang gangguan Bursa. Syarikat itu berkata dana dan pegangan pelanggan selamat."
],
[
"Data",
"Mise berkata penilaian setakat ini tidak menemui bukti kehilangan data. Menurutnya, insiden ini tiada kaitan dengan insiden siber yang dilaporkan di Jepun."
],
[
"Pihak berkuasa",
"Tiada kenyataan daripada Suruhanjaya Sekuriti atau Bursa Malaysia tentang insiden ini dalam laporan yang kami semak."
]
],
"timeline": [
"Notis kepada pelanggan menyatakan broker itu berada di peringkat akhir semakan sebelum memulihkan pesanan dalam talian.",
"Dagangan Bursa dalam talian terhenti lebih seminggu tanpa tarikh mula semula. Ketua Pegawai Eksekutif berkata tiada bukti kehilangan data.",
"Pesanan beli dan jual Bursa kembali di aplikasi iSPEED.my. Dagangan web digantung bagi semua pasaran sebagai langkah berjaga-jaga."
],
"todo": [
"Semak pegangan, nota kontrak dan baki tunai anda dalam aplikasi iSPEED.my, dan laporkan sebarang percanggahan kepada khidmat pelanggan Rakuten Trade.",
"Buat pesanan melalui aplikasi iSPEED.my sementara platform web digantung, dan ikuti notis rasmi Rakuten Trade tentang pemulihannya.",
"Berwaspada terhadap panggilan atau mesej yang menawarkan bantuan berkaitan gangguan ini atau meminta butiran log masuk atau OTP anda. Ambil tindakan hanya melalui saluran rasmi Rakuten Trade.",
"Jika anda kerugian wang akibat penipuan, hubungi talian NSRC 997 dengan segera dan buat laporan polis."
],
"faq": [
[
"Kenapa Rakuten Trade tidak berfungsi?",
"Rakuten Trade mengehadkan transaksi sebagai langkah berjaga-jaga selepas mengesan cubaan keselamatan siber, kata Ketua Pegawai Eksekutifnya. Dagangan Bursa dalam talian tidak tersedia selama lebih seminggu."
],
[
"Adakah wang saya selamat dengan Rakuten Trade?",
"Syarikat itu berkata dana dan pegangan saham pelanggan kekal selamat dan tidak terjejas. Ketua Pegawai Eksekutifnya berkata setakat ini tiada bukti kehilangan data ditemui."
],
[
"Bolehkah saya berdagang di Rakuten Trade sekarang?",
"Pesanan Bursa kembali di aplikasi iSPEED.my pada 4 November 2026. Platform web digantung bagi semua pasaran pada ketika itu sebagai langkah berjaga-jaga."
]
]
}
},
{
"slug": "m1-data-breach",
"country": "SG",
"incidents": [
"03ae1e45"
],
"logo": "",
"title": "M1 Data Breach, November 2026 · pwnsy",
"h1": "M1 customer data breach",
"desc": "M1 says a breach found on 30 Oct 2026 exposed customer names, NRIC/FIN numbers, birth dates, phone numbers, emails and addresses. Payment data was not hit.",
"lede": "Singapore telco M1 says it found a data breach on 30 October 2026 and has contained it. Customer names, NRIC/FIN numbers and contact details were exposed, and M1 has not said how many people are affected.",
"facts": [
[
"Organisation",
"M1, a Singapore mobile and broadband operator."
],
[
"What happened",
"M1 identified a data breach on 30 October 2026 and disclosed it on 6 November. It says the breach is contained and services ran normally throughout."
],
[
"Data affected",
"Customer names, NRIC/FIN numbers, dates of birth, mobile numbers, email addresses and residential addresses."
],
[
"Not affected",
"M1 says payment card details, financial or banking information and customer account access were not compromised."
],
[
"Cause or entry point",
"M1 has not said how the attackers got in. It has not given a number of affected customers."
],
[
"Authorities",
"M1 says it is working with the relevant authorities and outside specialists. The PDPC told AsiaOne it is aware of the case and is investigating."
]
],
"timeline": [
[
"2026-10-30",
"M1 identifies the data breach.",
[
{
"name": "M1",
"url": "https://www.m1.com.sg/about-us/news-releases/2026/m1-discloses-data-breach"
}
]
],
[
"2026-11-06",
"M1 discloses the breach and says it is contained. It lists the data types exposed and says payment data is safe.",
[
{
"name": "M1",
"url": "https://www.m1.com.sg/about-us/news-releases/2026/m1-discloses-data-breach"
},
{
"name": "Mustsharenews",
"url": "https://mustsharenews.com/m1-data-breach/"
}
]
],
[
"2026-11-06",
"The PDPC says it is aware of the breach and is investigating. M1 starts emailing affected customers that evening.",
[
{
"name": "AsiaOne",
"url": "https://www.asiaone.com/singapore/m1-data-breach"
}
]
]
],
"todo": [
"Read any email or letter from M1 closely, and check it against M1's official website or app before acting on it.",
"Treat calls, SMS and emails that quote your NRIC, birth date or address as possible scams. Call the ScamShield Helpline on 1799 if unsure.",
"Never share Singpass details, OTPs or banking passwords with a caller, even one who knows your personal details.",
"If you lose money to a scam, report it to your bank at once and file a police report online."
],
"faq": [
[
"Was my M1 data leaked?",
"M1 says it will contact affected customers by email or letter. It has not published a total number of people affected."
],
[
"What data was exposed in the M1 breach?",
"Names, NRIC/FIN numbers, dates of birth, mobile numbers, email addresses and residential addresses. M1 says card, banking data and account access were not affected."
],
[
"Is anyone investigating the M1 breach?",
"M1 says it is working with the relevant authorities and outside specialists. The PDPC says it is investigating."
]
]
},
{
"slug": "credit-mutuel-arkea-fraud",
"country": "FR",
"incidents": [
"5ec3017a"
],
"logo": "",
"title": "Crédit Mutuel Arkéa Cyberattack, 2026 · pwnsy",
"h1": "Crédit Mutuel Arkéa loses about 100 million euros to fraudulent transfers",
"desc": "Arkéa says attackers used its own account to send about 100 million euros to other banks in November 2026. It says customer balances are safe.",
"lede": "French bank Crédit Mutuel Arkéa confirmed on 4 November 2026 that a cyberattack allowed fraudulent transactions. It says attackers sent roughly 100 million euros from the bank's own account, and that customers will bear no financial loss.",
"facts": [
[
"Organisation",
"Crédit Mutuel Arkéa, a banking group based in Brittany. Its brands include Crédit Mutuel de Bretagne, Crédit Mutuel du Sud-Ouest and Fortuneo."
],
[
"What happened",
"Arkéa says attackers used the bank's own account to send transfers to other banks. Reports say the money was then turned into cryptocurrency."
],
[
"Amount",
"Arkéa gave a provisional estimate of about 100 million euros, per AFP. Le Télégramme reported 118 million euros, a figure Arkéa has not confirmed."
],
[
"Customers",
"Arkéa says customer accounts were not the source of the funds and the incident has no financial consequence for customers. Some transfers were suspended and delayed."
],
[
"Cause or entry point",
"Arkéa says it was a sophisticated outside attack, with no internal human error. It says the attackers went through the platform of one of its service providers."
],
[
"Claimed",
"No group has claimed the attack."
],
[
"Authorities",
"Arkéa says it is working with French authorities on the investigation and is trying to recover the money."
]
],
"timeline": [
[
"2026-11-03",
"Blockchain investigator ZachXBT flags large crypto movements, later estimated above 133 million dollars.",
[
{
"name": "FrenchWeb",
"url": "https://www.frenchweb.fr/credit-mutuel-arkea-confirme-une-cyberattaque-le-montant-du-detournement-reste-a-etablir/900000019"
},
{
"name": "Le Monde Informatique",
"url": "https://www.lemondeinformatique.fr/actualites/lire-credit-mutuel-arkea-victime-d-un-piratage-de-118-meteuro-100910.html"
}
]
],
[
"2026-11-04",
"Arkéa confirms a cyberattack that allowed fraudulent transactions. It says the incident is under control and suspends some transfers.",
[
{
"name": "Le Monde Informatique",
"url": "https://www.lemondeinformatique.fr/actualites/lire-credit-mutuel-arkea-victime-d-un-piratage-de-118-meteuro-100910.html"
},
{
"name": "FrenchWeb",
"url": "https://www.frenchweb.fr/credit-mutuel-arkea-confirme-une-cyberattaque-le-montant-du-detournement-reste-a-etablir/900000019"
}
]
],
[
"2026-11-05",
"Arkéa says the attackers went through a service provider's platform and used the bank's own account. It puts the loss at about 100 million euros.",
[
{
"name": "AFP via DH",
"url": "https://www.dhnet.be/dernieres-depeches/2026/11/05/credit-mutuel-arkea-les-questions-en-suspens-apres-la-cyberattaque-67MPJWJ2UZBBHIKE46XTENGMGQ/"
},
{
"name": "Silicon Republic",
"url": "https://www.siliconrepublic.com/enterprise/hackers-steal-e100m-from-french-bank-credit-mutuel-arkea"
}
]
],
[
"2026-11-05",
"Arkéa denies reports that the attack came through its online bank Fortuneo.",
[
{
"name": "Silicon Republic",
"url": "https://www.siliconrepublic.com/enterprise/hackers-steal-e100m-from-french-bank-credit-mutuel-arkea"
}
]
]
],
"todo": [
"Check your accounts in the official app and contact your adviser if an expected transfer has not arrived.",
"Expect phishing that mentions the attack. Arkéa will not ask for passwords or security codes by phone, SMS or email.",
"Forward suspicious SMS to 33700 and get help from cybermalveillance.gouv.fr.",
"If you are the victim of a scam, call Info Escroqueries on 0 805 805 817 and file a complaint."
],
"faq": [
[
"How much was stolen from Crédit Mutuel Arkéa?",
"Arkéa gave a provisional estimate of about 100 million euros. Some media reported 118 million euros, which the bank has not confirmed."
],
[
"Is my money at Arkéa, CMB or Fortuneo safe?",
"Arkéa says the funds came from the bank's own account and the incident has no financial consequence for customers. Some transfers were delayed."
],
[
"How did the attackers get in?",
"Arkéa says they went through the platform of one of its service providers. It has not named the provider."
]
]
},
{
"slug": "ntt-docomo-data-breach",
"country": "JP",
"incidents": [
"b34ead30"
],
"logo": "",
"title": "NTT Docomo Data Breach, November 2026 · pwnsy",
"h1": "NTT Docomo data breach hits up to 300,000 customers",
"desc": "NTT Docomo says unauthorised access to My docomo and its online shop exposed up to about 300,000 sets of personal data in November 2026.",
"lede": "NTT Docomo detected unauthorised access to its online shop and My docomo on 4 November 2026. The company says up to about 300,000 sets of personal data were exposed, including bank account numbers.",
"facts": [
[
"Organisation",
"NTT Docomo, Japan's largest mobile operator."
],
[
"What happened",
"Docomo detected unauthorised access to the Docomo Online Shop and My docomo on 4 November. It suspended both services early on 5 November."
],
[
"Data affected",
"Docomo lists names, addresses, birth dates, mobile and contact numbers. President Yoshiaki Maeda said ID document numbers, bank account numbers and plan details were also involved, and former subscribers are affected."
],
[
"Not affected",
"Docomo says no credit card information was compromised."
],
[
"Cause or entry point",
"Docomo says the cause and entry route are under investigation. Maeda declined to say whether AI agents were used."
],
[
"Response",
"Docomo plans to compensate affected people and will contact them individually."
]
],
"timeline": [
[
"2026-11-04",
"Docomo detects unauthorised access to the Docomo Online Shop and My docomo.",
[
{
"name": "NTT Docomo",
"url": "https://www.docomo.ne.jp/info/notice/page/261105_03_m.html"
}
]
],
[
"2026-11-05",
"Docomo suspends procedures on both services from about 01:05 and says up to about 300,000 customers may be affected.",
[
{
"name": "NTT Docomo",
"url": "https://www.docomo.ne.jp/info/notice/page/261105_03_m.html"
}
]
],
[
"2026-11-06",
"President Yoshiaki Maeda apologises at a Tokyo press conference. He confirms bank account and ID document numbers were involved and says Docomo will pay compensation.",
[
{
"name": "Jiji Press via Adnkronos",
"url": "https://english.adnkronos.com/2026/11/06/ntt-docomo-chief-says-personal-info-breached-in-cyberattack/"
}
]
]
],
"todo": [
"Wait for Docomo to contact you individually. Check any message against the official docomo.ne.jp notice.",
"Ignore emails, SMS or calls claiming to be Docomo that ask you to click a link or give passwords or card details.",
"Call the Docomo Information Center on 151 from a Docomo phone, or 0120-800-000 from other phones (9:00 to 20:00, every day).",
"Watch your bank account for unknown debits. Consumer advice is available on 188."
],
"faq": [
[
"How many Docomo customers were affected?",
"Docomo says up to about 300,000 sets of personal information, including some former subscribers."
],
[
"Was my credit card data leaked?",
"Docomo says no credit card information was compromised. Bank account numbers and holder names were involved."
],
[
"When will My docomo be back?",
"Docomo says the restoration date is undecided while it investigates."
]
]
},
{
"slug": "dentaquest-data-breach",
"country": "US",
"incidents": [
"2d394d64"
],
"logo": "",
"title": "DentaQuest Data Breach, 15 Million · pwnsy",
"h1": "DentaQuest breach hits at least 15 million people",
"desc": "DentaQuest says a May 2026 hack exposed Social Security numbers, Medicaid numbers and dental data of at least 15 million people. ShinyHunters leaked data.",
"lede": "US dental benefits firm DentaQuest says attackers were in its network from 17 to 20 May 2026. It is notifying at least 15 million people, and the extortion group ShinyHunters has leaked data it says it stole.",
"facts": [
[
"Organisation",
"DentaQuest, a Massachusetts dental benefits company owned by Sun Life."
],
[
"What happened",
"DentaQuest says unauthorised access ran from 17 May and ended by 20 May 2026, when it discovered it. No malware was involved, it says."
],
[
"Data affected",
"Names, addresses, Social Security numbers, member, Medicaid and Medicare numbers, and dental or vision health details such as diagnosis, treatment and billing. Data varies by person."
],
[
"Scale",
"DentaQuest says at least 15 million people. An independent researcher's analysis cited by HIPAA Journal suggests the total could exceed 23.4 million."
],
[
"Claimed",
"ShinyHunters claims it took 234 GB relating to 2.6 million people and leaked it after talks failed. DentaQuest has not named the attackers."
],
[
"Authorities",
"The 15 million figure was posted to the Oregon attorney general's breach site. A notice also went to the California attorney general."
]
],
"timeline": [
[
"2026-05-17",
"Unauthorised access to parts of DentaQuest's network begins.",
[
{
"name": "BankInfoSecurity",
"url": "https://www.bankinfosecurity.com/dentaquest-data-theft-hack-affects-15m-patients-a-32390"
},
{
"name": "HIPAA Journal",
"url": "https://www.hipaajournal.com/dentaquest-data-breach/"
}
]
],
[
"2026-05-20",
"DentaQuest discovers the access, which ended by that day.",
[
{
"name": "BankInfoSecurity",
"url": "https://www.bankinfosecurity.com/dentaquest-data-theft-hack-affects-15m-patients-a-32390"
},
{
"name": "HIPAA Journal",
"url": "https://www.hipaajournal.com/dentaquest-data-breach/"
}
]
],
[
"2026-06-05",
"DentaQuest has publicly acknowledged the incident. ShinyHunters lists it on its leak site and later publishes 234 GB.",
[
{
"name": "HIPAA Journal",
"url": "https://www.hipaajournal.com/dentaquest-data-breach/"
}
]
],
[
"2026-07-17",
"DentaQuest begins mailing notification letters on a rolling basis.",
[
{
"name": "HIPAA Journal",
"url": "https://www.hipaajournal.com/dentaquest-data-breach/"
}
]
],
[
"2026-07-31",
"DentaQuest's count of 15 million appears on the Oregon attorney general's site.",
[
{
"name": "BankInfoSecurity",
"url": "https://www.bankinfosecurity.com/dentaquest-data-theft-hack-affects-15m-patients-a-32390"
}
]
]
],
"todo": [
"Enrol in the 24 months of free credit and identity monitoring offered in your DentaQuest letter.",
"Place a free credit freeze with Equifax, Experian and TransUnion, since Social Security numbers were exposed.",
"Check Medicaid, Medicare and dental benefit statements for care you did not receive.",
"Report identity theft at IdentityTheft.gov."
],
"faq": [
[
"How many people were affected by the DentaQuest breach?",
"DentaQuest says at least 15 million. A researcher's analysis of the leak suggests it could be over 23.4 million."
],
[
"Who hacked DentaQuest?",
"ShinyHunters claims responsibility and leaked data. DentaQuest has not publicly named the attackers."
],
[
"What is DentaQuest offering affected people?",
"24 months of free credit monitoring and identity theft protection."
]
]
},
{
"slug": "mathspace-data-breach",
"country": "AU",
"incidents": [
"8dc45221",
"ad05acb6"
],
"logo": "",
"title": "Mathspace Data Breach, September 2026 · pwnsy",
"h1": "Mathspace student data breach hits 1.08 million people",
"desc": "Mathspace says attackers used a Metabase flaw to steal names and emails of 1,079,819 students, parents and staff in Australia and New Zealand.",
"lede": "Maths learning platform Mathspace says attackers exploited its self-hosted Metabase reporting tool in August 2026. Data on 1,079,819 students, parents and staff in Australia and New Zealand was taken.",
"facts": [
[
"Organisation",
"Mathspace, an online maths platform founded in Sydney and used by schools."
],
[
"What happened",
"Attackers used a Metabase flaw to get administrator access to an internal reporting system from 10 August. They downloaded data on 27 August."
],
[
"Data affected",
"User IDs, usernames, first and last names, email addresses, country, time zone, user type and login dates. Not every field exists for every person."
],
[
"Not affected",
"Mathspace says passwords and hashes, SSO and API credentials, and academic records and results were not exposed."
],
[
"Cause or entry point",
"Metabase issued a critical advisory and patch on 6 August. Mathspace says its process did not escalate it and it patched on 29 August."
],
[
"Claimed",
"Mathspace calls the attackers unknown. BleepingComputer links the case to a wider Metabase campaign that ShinyHunters claimed, without confirming who hit Mathspace."
],
[
"Authorities",
"Mathspace notified the OAIC, ASD's ACSC, New Zealand's Privacy Commissioner and NCSC, and state education departments on 4 September."
]
],
"timeline": [
[
"2026-08-06",
"Metabase publishes a critical security advisory and patched versions.",
[
{
"name": "Mathspace",
"url": "https://blog.mathspace.co/mathspace-data-breach-what-happened-and-what-affected-users-should-know/"
}
]
],
[
"2026-08-10",
"Unauthorised access to Mathspace's internal reporting system begins.",
[
{
"name": "Mathspace",
"url": "https://blog.mathspace.co/mathspace-data-breach-what-happened-and-what-affected-users-should-know/"
},
{
"name": "BleepingComputer",
"url": "https://www.bleepingcomputer.com/news/security/mathspace-discloses-data-breach-affecting-over-1-million-people/"
}
]
],
[
"2026-08-27",
"Data is downloaded from the Australian reporting database.",
[
{
"name": "Mathspace",
"url": "https://blog.mathspace.co/mathspace-data-breach-what-happened-and-what-affected-users-should-know/"
},
{
"name": "BleepingComputer",
"url": "https://www.bleepingcomputer.com/news/security/mathspace-discloses-data-breach-affecting-over-1-million-people/"
}
]
],
[
"2026-09-03",
"Mathspace confirms the breach and takes Metabase offline.",
[
{
"name": "Mathspace",
"url": "https://blog.mathspace.co/mathspace-data-breach-what-happened-and-what-affected-users-should-know/"
},
{
"name": "BleepingComputer",
"url": "https://www.bleepingcomputer.com/news/security/mathspace-discloses-data-breach-affecting-over-1-million-people/"
}
]
],
[
"2026-09-04",
"Mathspace notifies schools, regulators and cyber security agencies in both countries.",
[
{
"name": "Mathspace",
"url": "https://blog.mathspace.co/mathspace-data-breach-what-happened-and-what-affected-users-should-know/"
}
]
],
[
"2026-09-06",
"Mathspace begins notifying affected people directly.",
[
{
"name": "Mathspace",
"url": "https://blog.mathspace.co/mathspace-data-breach-what-happened-and-what-affected-users-should-know/"
}
]
]
],
"todo": [
"Treat unexpected emails that use your or your child's name with care, even if they mention this breach.",
"Change any password you reused elsewhere. Mathspace says a Mathspace password reset is not required.",
"Ask data-breach-response@mathspace.co whether your details were included, including for old accounts.",
"Report scams to Scamwatch (scamwatch.gov.au) in Australia or the NCSC (ncsc.govt.nz) in New Zealand."
],
"faq": [
[
"Was my child's data in the Mathspace breach?",
"1,079,819 students, parents, teachers and staff in Australia and New Zealand were affected. Mathspace is notifying people and answers queries at data-breach-response@mathspace.co."
],
[
"Were Mathspace passwords or grades leaked?",
"Mathspace says passwords, login tokens and academic records were not exposed."
],
[
"How did the Mathspace breach happen?",
"Attackers exploited a known flaw in Mathspace's self-hosted Metabase reporting tool, which had not been patched in time."
]
]
},
{
"slug": "mip-hollard-insurance-breach",
"country": "ZA",
"incidents": [
"f4e96255",
"caada541"
],
"logo": "",
"title": "MIP Holdings and Hollard Data Leak, 2026 · pwnsy",
"h1": "MIP Holdings breach exposes clients of about 45 insurers",
"desc": "Insurance software firm MIP paid The Gentlemen a ransom after a 2026 breach. The gang still leaked Hollard funeral policyholder data.",
"lede": "South African insurance software supplier MIP Holdings lost about 400,000 support records in mid-2026, touching customers of some 45 insurers. MIP paid a ransom, and The Gentlemen later published Hollard funeral policyholder data anyway.",
"facts": [
[
"Organisation",
"MIP Holdings, which supplies administration software to South African insurers. Hollard is one affected client."
],
[
"What happened",
"Intruders got in around 25 May 2026 and MIP noticed in mid-June. They reached a Jira support platform MIP was retiring and took about 400,000 records."
],
[
"Data affected",
"ID numbers, email addresses and cellphone numbers pasted into support tickets. Leaked Hollard data includes funeral policyholders' names, their children's names, ID numbers and emails."
],
[
"Cause or entry point",
"An employee had reused credentials from an unrelated service that was itself breached, TechCentral reports."
],
[
"Not affected",
"Hollard says its forensic work found no compromise of its own systems. LegalWise says there is no sign its core systems were accessed."
],
[
"Claimed",
"The Gentlemen listed Hollard and later LegalWise, Samwumed, Edcon and Guardrisk. TechCentral could not verify a MIP link for all of them."
],
[
"Authorities",
"The Information Regulator says MIP's was the only notification it received and that each insurer must notify. It says a ransom payment does not settle POPIA duties."
]
],
"timeline": [
[
"2026-05-25",
"Intruders gain access to MIP's systems, around this date. MIP notices in mid-June.",
[
{
"name": "TechCentral",
"url": "https://techcentral.co.za/ransomware-gang-south-african-client-data-legalwise-samwumed-edcon/286877/"
}
]
],
[
"2026-06-26",
"LegalWise says MIP found unauthorised access to a legacy development and support system.",
[
{
"name": "TechCentral",
"url": "https://techcentral.co.za/ransomware-gang-south-african-client-data-legalwise-samwumed-edcon/286877/"
}
]
],
[
"2026-09-07",
"The Gentlemen list Hollard on their leak site. MIP links the material to its June breach.",
[
{
"name": "TechCentral",
"url": "https://techcentral.co.za/ransomware-gang-south-african-client-data-legalwise-samwumed-edcon/286877/"
},
{
"name": "ransomware.live",
"url": "https://www.ransomware.live/id/SG9sbGFyZCBJbnN1cmFuY2UgR3JvdXBAdGhlZ2VudGxlbWVu"
}
]
],
[
"2026-09-18",
"Hollard says the leaked funeral policyholder data came from the MIP incident. MIP's CEO says MIP paid a substantial ransom and about 45 insurers were affected.",
[
{
"name": "TechCentral",
"url": "https://techcentral.co.za/hackers-extort-insurers-mip-ransom-hollard/286251/"
},
{
"name": "ITWeb",
"url": "https://www.itweb.co.za/article/hollard-data-hits-dark-web-after-mip-hack/wbrpOqg2J5oMDLZn"
}
]
],
[
"2026-10-05",
"The Gentlemen add LegalWise, Samwumed and Edcon with countdowns to 9 October. The Information Regulator sets out insurers' duty to notify.",
[
{
"name": "TechCentral",
"url": "https://techcentral.co.za/ransomware-gang-south-african-client-data-legalwise-samwumed-edcon/286877/"
}
]
]
],
"todo": [
"If you hold a policy with a South African life or funeral insurer, ask it directly whether it uses MIP and whether you were notified.",
"Apply for free protective registration with the Southern African Fraud Prevention Service (safps.org.za) if your ID number was exposed.",
"Be wary of calls, SMS and emails about your policy that ask for banking or personal details. Call your insurer on its official number.",
"Complain to the Information Regulator (inforegulator.org.za) if your insurer has not told you what happened."
],
"faq": [
[
"Was Hollard hacked?",
"Hollard says its systems were not compromised and the leaked data came from the June 2026 breach at its software supplier MIP."
],
[
"Did MIP pay the ransom?",
"Yes. MIP's CEO says it paid a substantial ransom for a promise to destroy the data. The Gentlemen published client data anyway."
],
[
"Which insurers are affected by the MIP breach?",
"MIP says customers of about 45 insurers, mostly life insurers. Hollard and LegalWise are confirmed. Others listed by the gang are unverified."
]
]
},
{
"slug": "philippines-government-leak-claims-november-2026",
"country": "PH",
"incidents": [
"f8251b00",
"58563435",
"85457edc",
"c25eb5eb",
"55cd1ae6",
"b1cb7823",
"5bfaca10",
"8dd34ecc",
"de93887b",
"4e474b28",
"a9c63316",
"47e08580",
"633994d5",
"5db8fc76",
"c01d3d79",
"47db545a",
"c2e4daf8"
],
"logo": "",
"title": "Philippine Government Leak Claims, 5 Nov 2026 · pwnsy",
"h1": "Philippine agencies named in a wave of hack and leak claims",
"desc": "On 5 and 6 November 2026 hackers claimed leaks from the OVP, PhilJobNet, PAF, PCG, DICT, DOTr, SEC, BIR and others. Most claims are unverified.",
"lede": "On 5 November 2026 forum users and hacktivist groups claimed data leaks, defacements and a DDoS against Philippine agencies, universities and associations, with more claims on 6 November. Most remain unverified, and the privacy commission had received no breach notifications by 6 November.",
"facts": [
[
"Organisation",
"About a dozen Philippine government bodies, including the OVP, PhilJobNet (DOLE), PAF, PCG, PCGG, DICT, DILG, PAGCOR, DOTr, SEC and BIR, plus two universities and two associations."
],
[
"What happened",
"Deep Web Konek reported files from eight agencies posted to hacker forums on 5 November and three more on 6 November. Monitors also reported website defacements and a DOST website outage."
],
[
"Claimed",
"DeathNote Hackers claim about 19.2 million PhilJobNet records, about 10 GB from the OVP scheduling platform and about 1.35 GB from the PCG. HappyGoLuckyPH claims about 8 GB from the PCGG and a DILG system. Forum users claim PAF personnel files, DICT documents, NEUST student data, PAGCOR's restricted persons list, and DOTr, SEC and BIR files."
],
[
"Confirmed",
"BIR says it is investigating an alleged leak. The OVP says the platform is run by a third party and holds no confidential or classified files, without confirming or denying a breach. No other named body had commented in the reports."
],
[
"Defacements and outage",
"Nullsec Philippines defaced the Philippine Nurses Association site. Monitors also reported defacements of a Bataan government site and Alliance Graduate School, and the DOST website was down for several hours in what reports called a DDoS."
],
[
"Authorities",
"The National Privacy Commission says it will verify the reports and reminds agencies of the 72-hour breach notification rule. BIR is working with DICT, NCERT, CICC and the PNP Anti-Cybercrime Group."
]
],
"timeline": [
[
"2026-11-05",
"Deep Web Konek reports forum posts naming eight agencies, including the OVP, PhilJobNet, PCG, PCGG, DILG, PAF, DICT and PAGCOR. Philstar Tech counts seven alleged breaches plus two website incidents.",
[
{
"name": "Philstar Tech",
"url": "https://philstartech.com/news/2026/11/05/20296/philippines-nov-5-data-breach-government-agencies-2025/"
},
{
"name": "Radar PH",
"url": "https://radar.ph/govt-data-breach-claims-pile-up-npc-yet-to-receive-reports/"
}
]
],
[
"2026-11-05",
"Defacements are reported at the Philippine Nurses Association, a Bataan government site and Alliance Graduate School. The DOST website is unreachable for several hours.",
[
{
"name": "Philstar Tech",
"url": "https://philstartech.com/news/2026/11/05/20296/philippines-nov-5-data-breach-government-agencies-2025/"
},
{
"name": "Newsbytes.PH",
"url": "https://newsbytes.ph/2026/11/06/npc-checking-data-leaks-following-nov-5-cyberattack-reports/"
}
]
],
[
"2026-11-05",
"The OVP calls the claims unverified and possibly politically timed, and says the third-party scheduling platform holds no classified files.",
[
{
"name": "Politiko",
"url": "https://politiko.com.ph/hack-or-political-attack-sara-dutertes-ovp-cries-smear-over-alleged-data-leak/"
}
]
],
[
"2026-11-06",
"Deep Web Konek reports three more claims: forum user sinigangmixwithgabi posts SEC and BIR files and DOTr HRIS data on about 4,534 employees. Its tally reaches 11 agencies.",
[
{
"name": "Radar PH",
"url": "https://radar.ph/govt-data-breach-claims-pile-up-npc-yet-to-receive-reports/"
},
{
"name": "Astig.ph",
"url": "https://astig.ph/hacker-claims-dotr-payroll-biometric-data-4534-employees-2026/"
}
]
],
[
"2026-11-06",
"The NPC says it has received no breach notifications and that alleged leaks do not by themselves establish a breach. It will verify the reports with the agencies.",
[
{
"name": "Newsbytes.PH",
"url": "https://newsbytes.ph/2026/11/06/npc-checking-data-leaks-following-nov-5-cyberattack-reports/"
},
{
"name": "Radar PH",
"url": "https://radar.ph/govt-data-breach-claims-pile-up-npc-yet-to-receive-reports/"
}
]
],
[
"2026-11-07",
"BIR says it is investigating an alleged leak of its data with DICT, NCERT, CICC and the PNP Anti-Cybercrime Group. It gives no detail on the data involved.",
[
{
"name": "GMA News",
"url": "https://www.gmanetwork.com/news/topstories/nation/1008620/bir-data-leak-under-gov-t-probe/story/"
}
]
]
],
"todo": [
"If you think your data was exposed, file a complaint with the National Privacy Commission through privacy.gov.ph.",
"Report scams, hacking or misuse of your personal data to the CICC hotline 1326.",
"Expect phishing that quotes your name, employee ID or job application details. Verify any message claiming to be from DOLE, BIR, SEC or your employer through the agency's official website before clicking links.",
"Government employees named in the PAF, PCG or DOTr claims should watch for payroll or ID fraud and report anything odd to their HR office."
],
"faq": [
[
"Were Philippine government agencies hacked on 5 November 2026?",
"Hackers and forum users claimed leaks from about a dozen bodies, and several websites were defaced or knocked offline. Most leak claims are unverified, and the NPC had received no breach notifications by 6 November."
],
[
"Who claimed the attacks?",
"DeathNote Hackers claimed the OVP, PhilJobNet and PCG. HappyGoLuckyPH claimed the PCGG and a DILG system. Nullsec Philippines defaced the Philippine Nurses Association site. Other claims came from individual forum users such as core849, Porman2344 and sinigangmixwithgabi."
],
[
"Why 5 November?",
"BetterGov.PH noted the incidents fell on the annual Million Mask March, when protesters wear Guy Fawkes masks, and that similar incidents happened around that date in earlier years. No link to these attacks has been established. DICT recorded 38 incidents on 5 November 2025."
]
]
}
],
"actorNames": {
"marlanwg": "MARLANWG",
"leakers": "Leakers$",
"direwolf": "DireWolf",
"rhysida": "Rhysida",
"scarlettgroup": "Scarlettgroup",
"qilin": "Qilin",
"crypto24": "Crypto24",
"orova": "Orova",
"byod": "Byod",
"inc-ransom": "INC Ransom",
"tgr-sta-1030": "TGR-STA-1030",
"ashborn": "Ashborn",
"shinyhunters": "ShinyHunters",
"mushr00w": "Mushr00w",
"obscura": "Obscura",
"the-gentlemen": "The Gentlemen",
"0apt": "0APT",
"payload": "Payload",
"lockbit-5-0": "LockBit 5.0",
"n0n": "N0n",
"everest": "Everest",
"eclipse": "Eclipse",
"insomnia": "Insomnia",
"unc3886": "UNC3886",
"lamashtu": "Lamashtu",
"fulcrumsec": "FulcrumSec",
"nightspire": "Nightspire",
"krybit": "Krybit",
"killsec": "Killsec",
"ransomhouse": "RansomHouse",
"panzer": "Panzer",
"spacebears": "SpaceBears",
"petrusnism": "petrusnism",
"nova": "Nova",
"coinbase-cartel": "Coinbase Cartel",
"triplex": "TripleX",
"b4d0kahay": "B4d0kAhay",
"aak": "AAK",
"dysphor1a": "DYSPHOR1A",
"shadowbyt3": "ShadowByt3$",
"d00101": "d00101",
"online-gambling-advertising-network": "Online gambling advertising network",
"sim-registration-fraud-ring": "SIM registration fraud ring",
"likely-chinese-speaking-operators": "likely Chinese-speaking operators",
"world-leaks": "World Leaks",
"apt73": "APT73",
"dragonforce": "DragonForce",
"4hmdos4": "4HMDOS4",
"deathnote-hackers": "DeathNote Hackers",
"core849": "core849",
"nullsec-philippines": "Nullsec Philippines",
"sinigangmixwithgabi": "sinigangmixwithgabi",
"happygoluckyph": "HappyGoLuckyPH",
"porman2344": "Porman2344",
"suspected-chinese-speaking-operator": "Suspected Chinese-speaking operator",
"emperador": "Emperador",
"deadlock": "Deadlock",
"tengu": "Tengu",
"whitearmor": "Whitearmor",
"vexy": "Vexy",
"scam-ring": "Scam ring",
"scam-rings": "Scam rings",
"cipherforce": "Cipherforce",
"stormous": "Stormous",
"femboysec-intelligence-team-kurdfemboys": "FEMBOYSec Intelligence Team / KurdFemboys",
"threeam": "ThreeAM",
"ransomexx": "RansomEXX",
"l-group": "L Group",
"black-x": "Black X",
"unattributed-operator": "Unattributed operator",
"hyflock": "Hyflock",
"none": "None",
"attributed-to-iran-by-ynet": "Attributed to Iran by ynet",
"handala": "Handala",
"cyber-isnaad-front": "Cyber Isnaad Front",
"nasir-security": "Nasir Security",
"blacknevas": "BlackNevas",
"quellostanco": "quellostanco",
"xp95": "XP95",
"rootboy": "Rootboy",
"exfilsquad": "ExfilSquad",
"bytetobreach": "ByteToBreach",
"arcusmedia": "Arcusmedia",
"vect": "Vect",
"sidewinder": "SideWinder",
"h4xorvats": "h4xorvats",
"medusalocker": "MedusaLocker",
"khmer-shadow": "Khmer Shadow",
"safepay": "SafePay",
"lapsus": "Lapsus$",
"fingerprint": "Fingerprint",
"unc1151": "UNC1151",
"apt28": "APT28",
"uac-0244": "UAC-0244",
"it-army-of-russia": "IT Army of Russia",
"datasuckers": "DataSuckers",
"hitcore-corp": "Hitcore Corp",
"cyber-corps": "Cyber Corps",
"lpg-group": "LPG Group",
"breach3d": "breach3d",
"zerobytes": "ZeroBytes",
"clop": "Clop",
"pro-russian-hackers": "Pro-Russian hackers",
"gordonfreeman": "GordonFreeman",
"chronus": "Chronus",
"anubis": "Anubis",
"ailock": "AiLock",
"flamingchina": "FlamingChina",
"beast": "Beast",
"alp-001": "ALP-001",
"openai-research-agents": "OpenAI research agents",
"john-doe": "John Doe",
"mnt6": "Mnt6",
"kairos": "Kairos"
}
}