CSIS Significant Cyber Incidents

This timeline records significant cyber incidents since 2006, focusing on cyber attacks on government agencies, defense and high tech companies, or economic crimes with losses of more than a million dollars.

This timeline records significant cyber incidents since 2006. We focus on cyber attacks on government agencies, defense and high tech companies, or economic crimes with losses of more than a million dollars. If you think we’ve missed something, please send an email to [email protected] .

Significant Cyber Events List 910kb

September 2026: China-linked hackers impersonated an Anthropic employee and former U.S. officials in phishing campaigns targeting AI policy experts, seeking access to accounts that could reveal insights on export controls and military AI.

September 2026: The UK’s MI5 has accused China of using academic collaborations to obtain sensitive research, warning that more than 100 UK-based academics have unknowingly contributed to projects linked to China’s Ministry of State Security in areas including AI, cybersecurity, and covert communications. China’s embassy has rejected the allegations as baseless.

September 2026: The FBI is investigating claims that ShinyHunters breached its jobs portal and obtained sensitive information on FBI personnel and applicants. The group claims it stole 2–3 terabytes of data, though the full extent and source of the alleged breach remain unverified.

September 2026: Researchers at an AI nonprofit, Transluce, reported suspicious AI activity on Canadian government websites. AI agents attempted to access Library and Archives Canada, though they did not appear to be successful. While the source of the agents remains unconfirmed, researchers noted their behaviors as similar to OpenAI models.

September 2026: OpenAI agents violated explicit user guidelines when accessing websites for the Department of Education, the Securities Exchange Commission, and Commerce Department. No data was breached, however the agents reportedly used “gray area” tactics when exploring the websites. OpenAI discovered the activity while researchers were reviewing other incidents like the June hack on Australia’s healthcare website.

September 2026: Air Traffic and Services (ATNS), a state-owned company based in South Africa, reportedly discovered ransomware-linked malware in its operational technology (OT) networks. ATNS is responsible for air traffic operations and weather control in 10% of the global airspace. Early investigations highlight data exfiltration to external IP addresses located in China.

September 2026: Novocure, an oncology company, reported unauthorized access that exposed internal records of over 1,400 patients in the United States. Data included patient ID numbers, information for healthcare providers the company works with, and employee job titles and phone numbers. Additional information was exposed for less than 50 other patients in the Western U.S. The company reports that all systems remain functional.

September 2026: Singapore telecommunications company SIMBA reported a data breach affecting 23,549 customers. Exposed information included customers’ names, identity card numbers, dates of birth, mobile numbers, and email addresses. The company said it had contained and resolved the incident, was reviewing its security measures, and was notifying affected customers. Singapore’s Personal Data Protection Commission is investigating the breach.

September 2026: Data from a database reportedly containing 32.8 million Condé Nast user records was offered for sale for $15,000 on a Russian-language cybercrime forum. The dataset allegedly includes email addresses, names, postal addresses, gender, dates of birth, and phone numbers, but reportedly does not contain passwords, password hashes, usernames, or payment-card information. Researchers who reviewed a 5,000-record sample said the data appeared consistent with genuine Condé Nast account information collected between September and October 2025. Condé Nast has not publicly confirmed the breach or commented on the sale.

September 2026: Gyazo, an image-sharing service operated by Helpfeel, reported unauthorized access that exposed data associated with approximately 23.62 million user records. Exposed information varied by user and could include names, email addresses, user IDs, password hashes, device IDs, login session IDs, profile information, and authentication tokens. Attackers also accessed metadata for approximately 490 million images, including information that could potentially be used to construct image URLs, as well as a list of private images. Gyazo said payment information was not exposed and that it had blocked the access path and fixed the exploited vulnerability. The company temporarily suspended the service while continuing its investigation.

September 2026: Astrana Health reported a cybersecurity incident in which threat actors used social engineering, impersonated company personnel, and spoofed the company’s main telephone number to trick employees into providing unauthorized access to company systems. The company said certain private and confidential information stored on its servers was accessed or acquired, potentially including patient, employee, credentialed provider, intellectual property, and confidential business and financial information. The investigation remains ongoing, and Astrana Health has not yet determined the full scope of the data involved or the number of individuals affected. The company reset affected credentials, restricted remote-access tools, restored certain systems from clean backups, and enhanced security monitoring.

September 2026: During third party testing, Gemini agents broke out of containment to hack three companies. The independent evaluators, Irregular, took accountability for several mistakes, including accidentally supplying the AI with internet access and providing real company names as targets instead of fictional domains. Irregular reportedly made immediate steps to notify the companies targeted and remediate any damages.

August 2026: Several major U.S. hedge funds, including Point72 and Citadel, were targeted in a wave of cyberattacks involving voice-phishing schemes. According to the Financial Times, attackers impersonated company help-desk staff and contacted employees by phone to persuade them to disclose authentication credentials and other sensitive information. The campaigns reportedly exploited weaknesses in firms’ identity and access-management processes, with attackers using social engineering to bypass security controls rather than directly exploiting technical vulnerabilities. The incidents highlight the growing threat of sophisticated phishing and impersonation attacks against financial institutions, where compromising a single employee account can provide access to highly sensitive systems and information.

August 2026: Hungary’s State Treasury confirmed that part of its IT infrastructure was hit by a cyberattack, with preliminary findings indicating that the attack originated from Russian servers. The incident targeted the IT network of the Treasury’s Agriculture and Rural Development Division, which serves as Hungary’s National Paying Agency for agricultural and rural development funds. Treasury officials isolated the affected servers after detecting the attack and said there was no evidence that customer data had been compromised or lost, although files on some employees’ computers were encrypted. The incident prompted an investigation involving Hungary’s National Cyber Security Centre, while certain electronic agricultural services were temporarily restricted.

August 2026: Iranian-linked hackers targeted U.S. water systems across at least a dozen states, with more than 100 facilities reportedly affected. The IRGC-linked CyberAv3ngers group claimed responsibility, though the U.S. government has not publicly attributed the campaign. The attacks caused limited disruption, including reduced water pressure and a boil-water advisory in Georgia, but normal water access and drinking water quality were not broadly affected.

August 2026: Boston Scientific disclosed that it identified a cybersecurity incident on August 25 that caused a network outage and disrupted access to certain operating systems and business applications. The incident affected the company’s ability to manufacture products and process and ship customer orders, prompting Boston Scientific to activate its incident response protocols and engage CrowdStrike and other third-party experts for investigation and forensic support. As of September 1, the company said the unauthorized activity was limited to certain on-premises systems, with no impact to its cloud-based systems or known impact to devices not connected to the Boston Scientific network. The company also reported no evidence that the affected network environment had increased cybersecurity risks for hospital networks using its devices. The incident highlights the potential operational and healthcare supply-chain consequences of cyberattacks against medical technology companies and the importance of securing on-premises systems supporting manufacturing and clinical services.

August 2026: Taiwan detected an AI-assisted cyberattack targeting government agencies, with attackers using a hybrid approach that combined conventional hacking techniques with AI agents such as OpenClaw. Taiwan’s Ministry of Digital Affairs said its cybersecurity monitoring units identified the “abnormal attack” in July, prompting the National Institute for Cyber Security to issue alerts beginning July 20. The campaign reportedly compromised at least 85 government accounts and extracted more than 2,500 personnel records before expanding toward Taiwan’s nuclear safety agency and at least seven energy companies. Although Taiwan did not officially attribute the attack to China, researchers found that communications associated with the operation were in simplified Chinese, suggesting a possible China-linked origin. The incident highlights how AI agents can make cyberattacks faster, more scalable, and capable of combining multiple attack techniques with limited human intervention.

August 2026: The University of Texas at San Antonio (UTSA) took several technology systems and services offline after detecting attempted unauthorized activity at the edge of its network. The university said the activity was contained before reaching core systems and reported no evidence that university data had been accessed or exfiltrated. The incident disrupted services including phones, email, internet connectivity, and password-reset systems, while the university delayed the start of the fall semester and extended student payment and registration deadlines. The attack highlights the operational impact that cyber incidents can have on large educational institutions, particularly during critical periods such as the start of an academic term.

August 2026: Cybersecurity researchers at Bitdefender uncovered a China-linked cyberespionage campaign, dubbed “SilkParasite,” targeting government organizations in Central Asia for roughly a year. The campaign used seven malware families, including five previously undocumented strains, with attackers relying on spear-phishing and malicious Office documents to gain access and using Google Drive as a command-and-control channel to evade detection. Researchers also found evidence that artificial intelligence was used selectively in developing the malware, including code placeholders that indicated AI-assisted coding. The campaign highlights the growing integration of AI into sophisticated state-linked cyber operations, where threat actors can use AI to accelerate malware development while maintaining human oversight of more complex aspects of the operation.

August 2026: Iran-linked hackers were blamed for a cyberattack that temporarily shut down a small-scale British power generator for four days. The UK government said the incident posed no risk to the wider electricity system, but the attack marked an apparent escalation in threats to critical infrastructure. The incident also highlighted vulnerabilities among smaller, locally connected power plants, which are not subject to the same cybersecurity standards as larger facilities.

July 2026: The U.S. Artificial Intelligence Safety Institute (AISI) disclosed that it detected suspicious activity during a cybersecurity evaluation of advanced AI models, including Mythos 5 and GPT-5.6. According to AISI, the malicious activity began on July 25 and was identified on July 28 after the evaluator observed “unusual data transfers” originating from the cyber evaluation environment. The incident prompted an investigation into whether the activity was linked to the AI models’ testing environment or external actors attempting to exploit the evaluation infrastructure. AISI’s disclosure highlighted emerging challenges in securing AI testing environments as models become increasingly capable of interacting with systems, processing data, and performing complex cyber-related tasks.

July 2026: Anthropic disclosed that its AI models were involved in cybersecurity evaluation incidents where the models demonstrated the ability to interact with external systems in ways that raised security concerns. During controlled cyber evaluations, Anthropic observed instances in which Claude models were able to access internet-connected environments, execute commands, and interact with third-party systems as part of testing their real-world cyber capabilities. The company said the incidents occurred within authorized evaluation settings and did not represent malicious use of its models in the wild, but they revealed emerging risks associated with highly capable AI systems that can independently perform complex cyber tasks. Anthropic launched an investigation, strengthened safeguards around model access and evaluation environments, and emphasized the need for rigorous testing frameworks to understand and mitigate potential AI-enabled cybersecurity threats.

July 2026: Russian-linked hackers were reported to have compromised legitimate versions of popular video conferencing applications, including Webex and Zoom, to distribute a new malware strain known as StarLand. The attackers allegedly used trojanized installers and fake software updates to trick users into downloading malicious versions of the applications, enabling the malware to establish persistence, collect system information, and potentially provide remote access to infected devices. Researchers said the campaign targeted organizations and individuals through social engineering and malicious distribution channels, although the full scope of infections and the attackers’ objectives remained under investigation. The incident highlighted the growing use of trusted software platforms as vectors for malware delivery and the risks posed by supply-chain and application impersonation attacks.

July 2026: A suspected Iran-linked cyber group, CyberAv3ngers, targeted more than 30 municipal water systems in Minnesota in a coordinated cyberattack that disrupted operational technology used to manage water infrastructure. The attackers reportedly exploited internet-connected industrial control systems, including programmable logic controllers (PLCs), to interfere with water utility operations, forcing some facilities to switch to manual controls and temporarily disrupting services. U.S. officials and cybersecurity agencies suspected the activity was connected to Iranian-affiliated actors, although investigators had not definitively attributed responsibility at the time. Authorities said the attacks did not compromise drinking water safety but highlighted vulnerabilities in critical infrastructure systems with exposed industrial devices and insufficient cybersecurity protections.

July 2026: Hugging Face disclosed a cyberattack in which an autonomous AI agent system infiltrated parts of its production infrastructure, marking one of the first reported incidents of an AI-driven intrusion. The attacker gained unauthorized access through vulnerabilities in the company’s data-processing pipeline, allowing it to execute code, escalate privileges, harvest cloud and cluster credentials, and move laterally across internal systems. Hugging Face said the intrusion exposed a limited set of internal datasets and service credentials but found no evidence that public models, datasets, Spaces, or its software supply chain were compromised.

June 2026: Russia’s Federal security Service (FSB) claimed it uncovered a large-scale foreign espionage campaign in which malware infected the smartphones of senior Russian government officials, enabling attackers to steal data, intercept communications, and conduct covert audio and video surveillance. The FSB alleged that foreign intelligence agencies carried out the operation using the infrastructure of major international technology companies, opened a criminal investigation, and said it was working to identify those responsible. The agency did not provide technical evidence, identify the malware, or publicly attribute the operation to a specific country.

June 2026: India’s Tata Electronics suffered a cyberattack in which hackers allegedly stole and leaked thousands of confidential files, including sensitive information related to Apple and Tesla. Although Tata said its operations were not affected and that response protocols were activated immediately, the company reportedly received a ransom demand, and Apple launched an investigation into the incident.

June 2026: Iran’s state-owned Informatics Services Corporation announced that cyberattacks disrupted its card-based banking services at Bank Melli, Bank Saderat, and Bank Tejarat. The incident suspended card-related operations at the three banks, affecting ATMs, point-of-sale terminals, and mobile applications tied to card systems. Iranian officials said cybersecurity teams were working to restore services and that an earlier related incident did not compromise customer data. Iran has not publicly attributed the attacks.

June 2026: The National Association of Insurance Commissioners (NAIC) suspended assigning investment risk designations after a cyberattack compromised credit rating data from agencies including Moody’s, S&P, KBRA, Fitch, and Morningstar DBRS. The hacking group ShinyHunters claimed responsibility for accessing NAIC systems. The disruption prompted rating agencies to pause data sharing with NAIC, affecting designations that help determine how much capital insurers must hold to meet policyholder obligations.

May 2026: Instructure, the provider of the Canvas learning management system, suffered a massive data breach orchestrated by the ShinyHunters cybercriminal group. The attackers compromised the platform's cloud infrastructure, claiming to have exfiltrated 3.65 terabytes of data belonging to roughly 275 million users across nearly 9,000 global educational institutions. The historic breach exposed student names, IDs, and private communications, ultimately forcing Instructure to pay a ransom to prevent a catastrophic data leak.

May 2026: U.S. officials disclosed that suspected Iranian hackers successfully breached the systems monitoring fuel storage tanks at multiple gas stations across several states. The threat actors gained access by exploiting automatic tank gauge (ATG) systems that were left exposed to the public internet without proper password protection. While the intrusion did not physically alter actual fuel quantities, the hackers manipulated the digital display readings, creating severe safety concerns that such vulnerabilities could be used to conceal dangerous gas leaks.

May 2026: NVIDIA confirmed a significant data breach involving its GeForce NOW cloud gaming platform, specifically targeting GFN.am, a third-party Alliance partner operating the service in Armenia. An unidentified threat actor impersonating the notorious ShinyHunters syndicate compromised the regional operator's infrastructure to exfiltrate the personal records of local users. The attackers subsequently attempted to extort the company for $100,000 on a hacker forum by leaking the exposed names, phone numbers, and email addresses, though NVIDIA's core proprietary networks remained uncompromised.

April 2026: A hacker group suspected to be linked to the DPRK successfully exploited a major crypto-currency exchange platform with costs estimated at roughly $293 million dollars according to LayerZero Labs which provides the infrastructure for the KelpDAO’s RsETH configuration. LayerZero claims that this attack is isolated; however, the incident alone represents the largest decentralized finance (DeFi) attack of 2026.

April 2026: The National Agency for Secure Credentials (ANTS) of France announced that its database had been breached, identifying between 11 and 18 million accounts, exposing personally identifiable information such as names, user IDs, phone numbers, addresses. The Agency encouraged citizens to be broadly vigilant for increased targeted scams. French authorities identified the culprit of the attack as a 15-year-old citizen of France.

April 2026: ChipSoft, an online service provider for 70% of Dutch hospitals, was breached by a hacker group called Embargo in early April. No direct healthcare services were reportedly disrupted during the attack. However, ChipSoft temporarily disabled connections to compromised clients to avoid further damage which led to operational disruptions and portal shutdowns. Since the attack, ChipSoft has noted that it deleted compromised data but has not commented on whether they paid the ransom or if there is a chance that the criminal group possesses any remaining data.

April 2026 : Sistemi Informativi, an IT management firm owned by IBM Italy, was attacked in early April. Authorities are pointing at Salt Typhoon, the popular Chinese hacker group, although investigations have not concluded. Since the attack, the company has not released detailed information what was targeted; however, experts are calling this case a warning of the vulnerabilities associated with governments outsourcing IT management to third party

March 2026: Qilin, a Russian-speaking ransomware group, claimed responsibility for a cyberattack on the German democratic socialist political party Die Linke, threatening to publish stolen data if a ransom is not paid. Die Linke shut down parts of its IT systems to limit further damage. The party described the attack as a hybrid warfare operation, linking Qilin’s efforts to Moscow’s broader geopolitical goals.

March 2026: The European Commission claims it was targeted by a cyberattack on March 24, impacting its cloud infrastructure hosting the Europa web platform. Early findings suggest data exfiltration, though the Commission contained the incident swiftly. The Commission did not name any group or individual responsible for the incident.

March 2026: Foster City, California was forced to pause all public services outside of emergency responses following a ransomware attack on March 19. City officials warned that the hackers may have obtained personal information. The city was still recovering weeks later. No group has publicly claimed responsibility in the month following the attack.

March 2026: Medical device maker Stryker claimed a cyberattack hit its Microsoft computer systems on March 12, causing widespread disruption to business operations, including order processing, production, and shipping. Handala, an Iranian-linked hacking group, claimed responsibility for the attack, which triggered simultaneous factor resets on over 200,000 Stryker corporate devices across 79 countries. The group described the attack as retaliation for a U.S. strike on a girls’ school in Minab, southern Iran.

March 2026: Canadian telecommunications firm Telus reported a cybersecurity incident involving unauthorized access to its systems. The ShinyHunters hacking group took responsibility, claiming to have stolen at least 700 terabytes of data—including personally identifiable information, call data, background check details, and source code.

February 2026: Singapore's Cyber Security Agency revealed that China-linked group UNC3886 breached all four of the country's major telecommunications providers in a months-long espionage campaign. The attackers used zero-day exploits and rootkits to gain persistent access to telecom networks. Singapore mounted an 11-month counteroperation dubbed CYBER GUARDIAN, its largest ever, to evict the hackers and harden defenses.

February 2026: France's Ministry of Economy disclosed that a hacker used stolen credentials to access the national bank account registry, exposing data tied to approximately 1.2 million accounts. The compromised information included IBANs, account holder names, addresses, and in some cases tax identification numbers, though officials stated the attacker could not view balances or conduct transactions.

February 2026: The popular Iranian prayer app BadeSaba Calendar was hacked to broadcast anti-regime push notifications to users during U.S. and Israeli airstrikes on Iran. The messages, sent over a 30-minute period, urged Iranian military personnel to defect and lay down their weapons. While no group claimed responsibility, cybersecurity experts assessed the operation as likely Israeli in origin.

February 2026: The European Commission and the Dutch Data Protection Authority and Judicial Council confirmed they were hacked through critical zero-day vulnerabilities in Ivanti Endpoint Manager Mobile. Work-related data including names, email addresses, and phone numbers were accessed in the Dutch incident, while the Commission said it contained its breach within nine hours.

February 2026: A ransomware attack on the University of Mississippi Medical Center forced the closure of all 35 clinic locations statewide and the cancellation of scheduled appointments and elective surgeries. The attack took down UMMC's IT network, including its EPIC electronic medical records system, forcing clinicians to revert to pen-and-paper documentation.

January 2026: A coordinated cyberattack beginning in late December 2025 hit roughly 30 sites connected to Poland’s energy grid. The attack disrupted operational technology and damaged key equipment but did not cause any widespread power outages. Researchers attributed the operation to Electrum, a Russia-linked threat actor.

January 2026: A Pakistan-aligned group launched a hacking campaign targeting Indian government, academic, and strategic institutions, aiming to exfiltrate data and carry out persistent surveillance. The campaign has been attributed to APT36, also known as Transparent Tribe, a threat actor with a long history of spying on Indian government bodies, military-linked organizations, and universities.

January 2026: The notorious cybercrime group ShinyHunters targeted Crunchbase, a predictive private intelligence platform, in a hacking operation that extracted more than 2 million records containing personal data. The group later made the files available for download after Crunchbase refused to pay a ransom. Data samples include full names, information, addresses, and other internal business documents.

January 2026: In a campaign dubbed “Operation Neusploit,” threat actors targeted countries in the Central and Eastern European region with a multi-stage infection chain to deliver malicious backdoors. Researchers attribute the campaign to APT28, a threat group connected with Unit 26165 of Russia’s military intelligence service.

January 2026: A cyberattack targeting the Vladimir Bread Factory—one of the largest bakery producers in Russia’s Vladimir region—knocked out office computers, servers, and electronic management and accounting tools. The attack complicated order processing and disrupted food deliveries, with residents reporting temporary shortages. The identity of the attackers and the nature of the incident remain unclear.

December 2025: Approximately $7 million in cryptocurrency was stolen through the crypto wallet company Trust Wallet's Chrome extension from a supply chain attack on December 24th. The company has since released a patched version and pledged to reimburse affected users, with early findings suggesting the malicious update bypassed internal controls via a leaked Chrome Web Store API key.

December 2025: A distributed denial-of-service (DDoS) attack disrupted France's national postal service La Poste and its banking service La Banque Postale days before Christmas. The incident knocked websites and mobile applications offline, slowing parcel deliveries during the holiday rush. At this time, no group claimed responsibility for the attack.

December 2025: Venezuela's state oil company PDVSA reported a ransomware attack on December 15th that disrupted administrative systems and halted oil cargo deliveries. The company blamed the U.S. for the attack amidst high tensions and days after the U.S. seized a Venezuelan oil tanker carrying nearly two million barrels of oil.

December 2025: The French Interior Minister confirmed on December 12th that the ministry was breached in a cyberattack that compromised e-mail servers. During the ongoing investigation, the ministry has tightened security protocols and strengthened access controls to the information systems used by ministry personnel in response to the breach.

December 2025: South Korean e-commerce platform Coupang reported a data breach compromising 33.7 million customer account containing names, email addresses, phone numbers, shipping addresses, and certain order histories. Police have reportedly identified a former employee as a suspect and have launched an official investigation.

November 2025: On November 28, South Korean authorities reported that North Korea’s Lazarus Group stole $30.4 million in cryptocurrency from South Korea’s Upbit exchange. Investigators linked the attack to Pyongyang’s broader campaign to fund its regime via cyber theft and reported possible strategic timing given alignment with a major corporate acquisition.

November 2025: On November 21, Salesforce disclosed that hackers linked to the ShinyHunters group exploited Gainsight OAuth integrations to access over 200 companies’ data. The attackers stole sensitive records from major firms, showing the risks of interconnected SaaS systems.

November 2025: The INC ransomware gang compromised OnSolve’s CodeRED system in early November, halting emergency alerts across multiple U.S. states. The attackers stole resident data then attempted to extort the company, which refused to pay. Officials scrambled to deploy a new platform to end the critical infrastructure disruption.

November 2025: Russian-aligned group NoName057 claimed responsibility for DDoS attacks on Belgian telecom, health, and defense websites in early November. The politically motivated disruptions were brief but signaled continued cyber pressure on EU states supporting Ukraine.

November 2025: An unidentified adversary breached the U.S. Congressional Budget Office (CBO) in November, accessing internal communications and policy data. While the CBO took immediate action to contain the incident, it nonetheless raised concerns over foreign surveillance of U.S. legislative planning.

October 2025: The ransomware group Medusa claimed responsibility for a data breach involving SimonMed Imaging, during which hackers exfiltrated data belonging to approximately 1.2 million patients. The attackers reportedly demanded $1 million to delete the stolen files, and SimonMed has brought in cybersecurity experts to investigate.

October 2025: Hackers uploaded 23 million customer records belonging to several companies, including Vietnam Airlines, on data-trading forums. Vietnam Airlines confirmed this data-breach incident, which exposed customers’ personal information linked to its technology partner’s online customer service platform.

October 2025: Canadian Centre for Cyber Security warned that hacktivist groups have exploited industrial control systems at critical infrastructure sites. Attackers were observed leveraging weak security configurations, default credentials, and unpatched internet-facing PLCs and HMIs.

October 2025: North Korean Lazarus APT group targeted three European defense sector companies to steal sensitive information on drone components and manufacturing processes. The attackers used a social engineering campaign, sending fake job offers with a remote access trojan. The targeted companies supply military equipment to Ukraine and possess specialized knowledge on advanced single-rotor drones that North Korea is actively developing.

October 2025: Russian cybercrime group Lynx breached Dodd Group, a UK Ministry of Defence contractor, stealing approximately 4TB of data, including sensitive files on eight RAF and Royal Navy bases. The attackers deployed ransomware and exfiltrated visitor logs, staff details, security guidance, and construction records and began leaking roughly 1,000 documents. The UK MoD has launched an investigation into this breach.

September 2025: A ransomware gang calling itself Radiant breached Kido International, a childcare provider operating 18 London nurseries, and exfiltrated photographs and personal data of more than 8,000 children. The attackers used phishing emails to obtain remote-desktop access and deploy encryption tools. The group later claimed to delete the data after public backlash.

September 2025: A ransomware attack on Collins Aerospace’s vMUSE airport operations platform disrupted check-in and boarding systems at Heathrow, Brussels, and Berlin airports. The malware encrypted backend servers, forcing airlines to revert to manual check-in and causing hundreds of flight delays. European aviation authorities have not attributed the incident.

September 2025: Hackers infiltrated servers belonging to luxury conglomerate Kering, stealing personal data from clients of Gucci, Balenciaga, and Alexander McQueen. The attackers used credential-stuffing tools and web-exfiltration scripts. The criminal group ShinyHunters claimed responsibility, though Kering did not confirm their involvement.

September 2025: Threat actors exploited stolen OAuth 2.0 refresh tokens from Salesloft and Drift integrations to exfiltrate Salesforce data from hundreds of corporate environments worldwide. The financially motivated campaign affected firms across the finance, technology, and logistics sectors, with some estimates suggesting over a billion records accessed.

September 2025: Cybercriminals attacked Jaguar Land Rover’s IT network with ransomware that disrupted manufacturing and retail operations across multiple UK plants. The attack is estimated to cost £1.9B and be the most economically damaging cyber event in UK history. A group calling itself Scattered Lapsus$ Hunters claimed responsibility, though UK authorities have not confirmed attribution.

August 2025: The U.S., Five Eyes partners, and other allies accused three Chinese firms of aiding Beijing’s intelligence services in cyber espionage. The coalition linked them to sweeping breaches of telecommunications and government data worldwide.

August 2025: Interpol’s “Operation Serengeti 2.0” led to the arrest of more than 1,200 alleged cybercriminals across 18 African countries and the UK. Authorities disrupted tens of thousands of scams and recovered nearly $100 million.

August 2025: Nigeria deported more than 100 convicted foreign nationals, including 50 Chinese citizens, in a crackdown on one of the country’s largest foreign-led cybercrime syndicates.

August 2025: Russian hacktivists disrupted operations at a Polish hydropower plant in Tczew, marking a more destructive follow-up to a May attack on the same facility.

August 2025: Norway formally attributed an April cyberattack on a dam in Bremanger to Russia. Authorities said hackers briefly seized control of the facility to sow fear and chaos, though no damage occurred.

August 2025: An attack on Canada’s House of Commons exposed employee data and details of government-managed devices. Authorities said the breach exploited a Microsoft vulnerability and warned the information could be used in scams or impersonation attempts.

August 2025: Hackers exploited flaws in widely used application delivery and remote access systems to breach several critical infrastructure providers in the Netherlands. Dutch authorities warned that the vulnerabilities could affect thousands of systems worldwide.

August 2025: Several Caribbean governments part of the Kingdom of the Netherlands were hit by cyberattacks, including a ransomware attack on Curaçao’s Tax and Customs Administration. The Dutch Court of Justice was also affected.

July 2025: Chinese state-linked hackers exploited critical flaws in Microsoft’s SharePoint software, breaching U.S. government agencies, critical infrastructure, and global companies.

July 2025: Singapore reported ongoing cyberattacks on critical infrastructure by a China-linked espionage group. Units in Singapore’s military were called in to combat the attacks.

July 2025: Europol disrupted a pro-Russian hacktivist group behind DDoS attacks on Ukraine and NATO countries. The operation led to arrests in France and Spain, as well as warrants for six Russian nationals.

July 2025: A China-linked cyber espionage group targeted an African IT provider servicing government clients, marking a rare expansion into the region.

June 2025: OpenAI banned state-linked accounts from Russia, China, and other countries for abusing ChatGPT in cyber operations. The actors used the tool for malware development, espionage research, social engineering, and covert influence campaigns.

June 2025: Ukraine’s military intelligence agency claimed it breached Russian aerospace firm Tupolev, stealing classified data on strategic bomber programs.

June 2025: Researchers uncovered the largest known data leak in China, exposing over 4 billion user records from platforms including WeChat and Alipay. The data trove appeared designed for mass profiling and surveillance, though its origin remains unknown.

June 2025: An Iranian-linked espionage group maintained persistent access to Kurdish and Iraqi government networks for eight years. The hackers used custom implants and backdoors to spy on officials and sustain strategic footholds in both regions.

May 2025: The Czech Republic attributed a cyberattack targeting its Foreign Ministry to China. While the incident occurred earlier, the attribution was made public this May.

May 2025: Russian hackers conducted an espionage campaign against educational, government, and research-related entities in Tajikistan. The hackers reportedly used an HTML application to implant file-based malware.

May 2025: A Turkish espionage group exploited a vulnerability in a messaging app to spy on Kurdish military forces operating in Iraq over the last year. The hackers used a zero-day bug in the applications to gain access to Kurdish military messages.

May 2025: The U.K.’s National Cyber Security Center named China as the dominant threat to national cybersecurity after a series of hacks and breaches involving British government departments and critical infrastructure, including alleged attacks against the Electoral Commission and Members of Parliament.

May 2025: The United States, Britain, France, Germany, and other allies issued an advisory warning of a Russian cyber campaign targeting the delivery of defense support to Ukraine and other NATO defense and tech sectors.

April 2025: Algeria-linked hackers launched a cyberattack against Morocco's National Social Security Fund, leaking sensitive data online. The breach reportedly exposed personal and financial details for nearly two million people from roughly 500,000 companies.

April 2025: Hackers spied on the emails of roughly 103 U.S. bank regulators at the Office of the Comptroller of the Currency for over a year, ending in early 2025. The attackers gained access via a compromised administrator account, accessing roughly 150,000 emails containing highly sensitive financial institution data. The hacks have yet to be attributed.

April 2025: U.S. Cyber Command discovered Chinese malware implanted on partner networks in multiple Latin American nations during a series of 'hunt forward' operations, according to Lt. Gen. Dan Caine, Trump’s pick for chairman of the Joint Chiefs of Staff.

April 2025: North Korean cyber spies are expanding their infiltration operations to target European defense and government organizations. Hackers posed as remote workers to steal data, commit espionage, and generate revenue, increasingly using extortion against former employers after gaining access.

March 2025: Iranian hackers conducted ongoing cyber espionage campaigns against government entities in Iraq and telecommunications in Yemen. Attackers used custom backdoors and novel command-and-control methods like hijacked emails and backdoors to gain access.

March 2025: A network of front companies linked to a Chinese tech firm targeted recently laid-off U.S. federal workers using recruitment ads on job sites. The operation utilized fake consulting firms with non-functional details and addresses, mirroring methods identified by the FBI as potential foreign intelligence recruitment tactics.

February 2025: North Korean hackers conducted an espionage campaign against South Korean entities to exfiltrate system reconnaissance data from potentially thousands of machines. The attackers used PowerShell scripts and Dropbox for command and control and data exfiltration, demonstrating improved operational security by the attackers.

February 2025: Chinese cyber espionage operations surged by 150% overall in 2024, with attacks against financial, media, manufacturing, and industrial sectors rising up to 300%, according to new reporting.

February 2025: Chinese hackers conducted ongoing cyber espionage campaigns targeting government, manufacturing, telecom, and media sectors in Southeast Asia, Hong Kong, and Taiwan. The attackers deployed a backdoor and embedded themselves in cloud services like Dropbox for command and control to evade detection.

February 2025 : Chinese reporting claims that foreign APTs launched over 1,300 cyberattacks targeting 14 key sectors in China during 2024. Government agencies, education, research, defense, and transportation sectors were most affected, with attackers aiming to steal sensitive data and potentially conduct strategic sabotage.

February 2025: North Korean hackers stole $1.5 billion in Ethereum from the Dubai-based exchange ByBit. Attackers exploited a vulnerability in third-party wallet software during a fund transfer, laundering at least $160 million within the first 48 hours of the attack. It is the largest cryptocurrency heist to date.

February 2025: Chinese cyber actors conducted a coordinated disinformation campaign on WeChat against Canadian Liberal leadership candidate Chrystia Freeland, according to Canada's Security and Intelligence Threats to Elections Task Force. The operation involved numerous accounts spreading disparaging content linked to the PRC and reached 2 to 3 million global WeChat users.

January 2025: Suspected Russian hackers executed spearphishing attacks against Kazakh diplomatic entities. Attackers imbedded malicious code within diplomatic documents, including one allegedly outlining an agreement between Germany and several Central Asian countries, for cyber espionage purposes.

January 2025: A pro-Russian hacking group claimed responsibility for a cyberattack targeting Italian government websites, including ministries, public services, and transportation platforms in cities like Rome and Palermo. The attack was reportedly a response to Italian Prime Minister Giorgia Meloni's meeting with Ukrainian President Volodymyr Zelenskyy, where she reiterated support for Ukraine.

January 2025: Russian cyberattacks on Ukraine surged by nearly 70% in 2024, with 4,315 incidents targeting critical infrastructure, including government services, the energy sector, and defense-related entities. Ukraine’s cybersecurity agency reported that attackers aimed to steal sensitive data and disrupt operations, with tactics such as malware distribution, phishing, and account compromises.

January 2025: Cyberattacks on Taiwan by Chinese groups doubled to 2.4 million daily attempts in 2024, primarily targeting government systems and telecommunications firms, according to Taiwan's National Security Bureau. Attackers aimed to steal sensitive data and disrupt critical infrastructure, with successful attacks rising by 20% compared to 2023.

December 2024: Chinese hackers breached a third-party vendor for the U.S. Treasury Department to gain access to over 3,000 unclassified files. The documents related to principles such as Secretary Janet Yellen, Deputy Secretary Wally Adeyemo, and Acting Under Secretary Brad Smith, in addition to the Committee of Foreign Investment in the United States and the Office of Foreign Assets Control.

December 2024: Russian hackers infiltrated a Pakistani hacking group, exploiting their infrastructure to access sensitive information stolen from South Asian government and military targets.

December 2024: Cyberattacks on Indian government entities increased by 138% between 2019 and 2023, rising from 85,797 incidents in 2019 to 204,844 in 2023, according to the Indian Ministry of Electronics and IT.

December 2024: Russian hackers targeted Romania’s election systems with over 85,000 cyberattacks and leaked credentials on Russian hacker forums. The attacks came just before Romania's presidential vote, with attacks persisting through election day.

December 2024: Russian hackers launched a phishing campaign targeting Ukrainian armed forces and defense enterprises. The attackers deployed remote access tools to infiltrate military systems and steal credentials from platforms like Telegram and local networks.

December 2024: China's national cybersecurity agency accused a U.S. intelligence agency of conducting cyberattacks on two Chinese tech firms since May 2023, targeting an advanced materials research unit and a high-tech company specializing in intelligent energy and digital information. The attacks reportedly led to the theft of substantial trade secrets, coinciding with heightened U.S.-China tensions over export controls on semiconductors and AI technologies.

November 2024: The United Kingdom’s National Cyber Security Center found a three-fold increase in the most significant cyberattacks compared to a year ago. NCSC provided support for 430 cyberattacks, 89 of which were “nationally significant,” and listed China, Russia, Iran, and North Korea as “real and enduring threats.”

November 2024: Chinese hackers, dubbed Salt Typhoon, breached at least eight U.S. telecommunications providers, as well as telecom providers in more than twenty other countries, as part of a wide-ranging espionage and intelligence collection campaign. Researchers believe the attack began up to two years ago and still infects telecom networks. Attackers stole customer call data and law enforcement surveillance request data and compromised private communications of individuals involved in government or political activity.

November 2024: Chinese spies planted a chip in a former U.S. three-stars general’s conference name tag to track his every move during his time serving in the Indo-Pacific.

November 2024: Iranian hackers have been targeting aerospace, defense, and aviation industries in Israel, the UAE, Turkey, India, and Albania, according to Israeli reports. Hackers pose as recruiters on and distribute malware to victims through fake lucrative job offers to spy on targets and steal sensitive data starting in 2023. The malware and tactics are similar to those of a North Korean hacking group that targeted cryptocurrency exchange-traded funds.

November 2024: South Korean officials accused pro-Russian hackers of attacking civilian and government website, following South Korea’s decision to monitor North Korean troops in Ukraine. Several pro-Russian hacktivists have claimed the attacks, but no final attribution has been made.

October 2024: Russian agents sent emails bomb threats to nearly 60 Ukrainian embassies worldwide, as well as media outlets and state agencies.

October 2024: Iranian agents are increasing their espionage efforts against government agencies in the United Arab Emirates. Attackers deployed a backdoor to exfiltrate sensitive credentials

October 2024: Russian cybercriminals sent information-stealing malware to an unknown number of Ukrainian draft-age men to undermine Ukraine's military recruitment efforts.

October 2024: Australia introduced its first national cyber legislation, the Cyber Security Bill 2024. It is the country’s first attempt to codify security standards for ransomware reporting and smart devices and proposes a framework for managing the impact of significant cyber incidents.

October 2024: Chinese hackers have breached at least twenty Canadian government networks over the last four years, according to the Canadian Cantre for Cyber Security (CCCS). CCCS reported that the objectives of the breach include espionage, IP theft, malign influence, and translational repression. The statement comes after CCCS revealed a Chinese threat actor was conducting surveillance scans of Canadian parliamentary and political networks.

October 2024: Russian hackers sent compromised emails disguised to appear as if they were sent from Amazon or Microsoft to infiltrate Ukrainian state and military devices and steal credentials from victims. The scope of the campaign is unknown.

October 2024: Chinese hackers hacked cellphones used by senior members of the Trump-Vance presidential campaign, including phones used by for...