Multiple Ransomware Attacks Target Various Sectors on September 18, 2026

• •Multiple organizations, including MPA Pharma and AstraZeneca Türkiye, were targeted on the same day.
• •The attacks involved significant data theft, with millions of records compromised across various sectors.
• •No ransom demands were disclosed, but publication deadlines suggest ongoing threats from the attackers.

On September 18, 2026, the ransomware groups Rhysida and N0N claimed responsibility for multiple data-leak incidents affecting various organizations, including MPA Pharma, a Vietnamese betting operator, STOKR, PayPal support operations, BeLi Teacher, Argentem Creek Partners, and AstraZeneca Türkiye. The attacks primarily involved data theft rather than system encryption, with significant volumes of sensitive information reported stolen. MPA Pharma was listed with 2.9 million files and 5.8 TB of data, while the Vietnamese betting operator had over 2 million registered bettors' data compromised. STOKR's leak involved sensitive investor information, and PayPal's support operations faced exposure of 86.7 million connection records. The attackers set deadlines for further data publication, indicating ongoing threats. No ransom amounts were specified in the claims, and the extent of the operational impact remains uncertain.