Incident stories
The biggest 2026 incidents, each with key facts, a sourced timeline and what to do.
| Incident | Countries | Reports | Latest | Summary |
|---|---|---|---|---|
| Philippine agencies named in a wave of hack and leak claims | Philippines | 17 | 7 Nov 2026 | On 5 and 6 November 2026 hackers claimed leaks from the OVP, PhilJobNet, PAF, PCG, DICT, DOTr, SEC, BIR and others. Most claims are unverified. |
| Bank Rakyat website defacement | Malaysia | 1 | 6 Nov 2026 | Bank Rakyat websites, including the iRakyat login page, were defaced on 6 Nov 2026. What the bank confirmed, what the attacker claims, and what customers should do. |
| M1 customer data breach | Singapore | 1 | 6 Nov 2026 | M1 says a breach found on 30 Oct 2026 exposed customer names, NRIC/FIN numbers, birth dates, phone numbers, emails and addresses. Payment data was not hit. |
| Amadeus airline data breach | South Korea, Japan, Hong Kong, Malaysia, Australia, Singapore | 8 | 4 Nov 2026 | Eight airlines in six countries confirmed customer data exposure through Amadeus in 2026, including Malaysia Airlines and Singapore Airlines. Dates, figures and sources. |
| Crédit Mutuel Arkéa loses about 100 million euros to fraudulent transfers | France | 1 | 4 Nov 2026 | Arkéa says attackers used its own account to send about 100 million euros to other banks in November 2026. It says customer balances are safe. |
| NTT Docomo data breach hits up to 300,000 customers | Japan | 1 | 4 Nov 2026 | NTT Docomo says unauthorised access to My docomo and its online shop exposed up to about 300,000 sets of personal data in November 2026. |
| European supermarket fridges hacked in a single night | Estonia, United Kingdom, Germany, France, Netherlands, Italy, Ireland, Sweden | 10 | 3 Nov 2026 | On 2 November 2026 attackers changed fridge settings at shops, butchers and blood banks in at least nine European countries. No one has claimed it. |
| Rakuten Trade halts Bursa trading after a cyber attempt | Malaysia | 1 | 30 Oct 2026 | Rakuten Trade stopped online Bursa Malaysia orders for over a week in October 2026 after a cybersecurity attempt. App trading returned on 4 November. |
| Tabung Haji suspends all services after a cyberattack | Malaysia | 1 | 8 Oct 2026 | Tabung Haji paused all channels for four days in October 2026 after a cyberattack. TH says depositors' savings are safe. What happened and what to do. |
| Port of Tanjung Pelepas halted by a cyber incident | Malaysia | 1 | 10 Sep 2026 | A cyber incident halted container operations at Port of Tanjung Pelepas on 9 to 10 September 2026. The Direwolf group claims it stole 200 GB. |
| MIP Holdings breach exposes clients of about 45 insurers | South Africa | 2 | 7 Sep 2026 | Insurance software firm MIP paid The Gentlemen a ransom after a 2026 breach. The gang still leaked Hollard funeral policyholder data. |
| Mathspace student data breach hits 1.08 million people | Australia, New Zealand | 2 | 3 Sep 2026 | Mathspace says attackers used a Metabase flaw to steal names and emails of 1,079,819 students, parents and staff in Australia and New Zealand. |
| Thai government data pulled with stolen staff logins | Thailand | 2 | 6 Aug 2026 | In August 2026 Thai citizen data, including vehicle records on the PM, was pulled from state systems with staff logins and sold on Discord and Telegram. |
| Flexi Parking knocked offline by a cyberattack | Malaysia | 1 | 29 Jun 2026 | A June 2026 cyberattack on Flexi Parking stopped parking payments in 64 Malaysian councils for 61 hours. LITS disputes a claim of 7 million users hit. |
| DentaQuest breach hits at least 15 million people | United States | 1 | 20 May 2026 | DentaQuest says a May 2026 hack exposed Social Security numbers, Medicaid numbers and dental data of at least 15 million people. ShinyHunters leaked data. |