Multiple Ransomware Attacks Target Various Industries in September 2026

• •Multiple ransomware groups are actively targeting various industries, including pharmaceuticals and technology.
• •Data leaks involve millions of records, with significant operational impacts reported.
• •No ransom amounts have been disclosed, but deadlines for data publication are set by attackers.

In September 2026, several ransomware groups, including Rhysida and N0N, claimed responsibility for multiple data-leak incidents affecting diverse organizations. Victims include MPA Pharma, Nexbex Solutions, and AstraZeneca Türkiye, with data theft incidents reported involving millions of records across various sectors, including pharmaceuticals, technology, and education. The Rhysida group listed MPA Pharma, claiming access to 5.8 TB of sensitive data, while N0N targeted entities like PayPal support operations and a Vietnamese betting operator, with claims of extensive personal and operational data theft. No ransom amounts were specified in the claims, and the incidents are characterized as data-leak operations rather than encryption events. The attacks have led to operational disruptions and network blackouts for some organizations, with deadlines set for data publication by the threat actors. As of September 19, 2026, the situation remains fluid, with ongoing threats of data exposure and operational impacts.