Risk Dashboard

Active malicious campaigns across IT, OT and crypto, with who they typically go after and how they get in. Each card lists the dated sources it rests on. Victim counts are claims posted by criminals or estimates by trackers, and different sources count the same campaign differently. Blame for a country or group comes from the sources named, not from this site. The "what helps" steps are general good practice.

Crypto: hacks counted by trackers, against those named in the list below
Month	Counted in the chart	Named in the list
May 2026	29	4
June 2026	40	13
July 2026	30	28
August 2026	50	26
September 2026	55	5
October 2026†	56	4
November 2026†	3	3

Top countries by claimed victims, from the same tracker
Month	Victims	Top five countries
May 2026	646	United States 254, United Kingdom 36, Canada 31, Germany 29, Spain 21
June 2026	707	United States 234, Germany 38, Italy 30, Canada 29, India 28
July 2026	811	United States 330, Germany 48, Canada 36, United Kingdom 33, France 27
August 2026	964	United States 417, Italy 48, Germany 45, Canada 37, United Kingdom 32
September 2026	789	United States 321, Canada 30, India 27, Germany 25, Spain 24
October 2026	953	United States 408, Germany 54, Canada 31, Spain 28, Brazil 27

Entry route	Share
Phishing and social engineering	about 29%
Remote-access compromise	22% to 23%
Stolen credentials	14% to 15%
Unpatched edge devices	11% to 12%

Sector	Comparitech	CyberMaxx
Manufacturing	478	457
Technology	262	354
Finance	199	–
Healthcare	188	264
Government	124	–
Education	75	–
Business services	–	378

ITRansomware-as-a-serviceLatest source October 27, 2026

Qilin

One of the two most active ransomware operations of 2026. Criminal affiliates rent Qilin's tools and split the ransom with its operators. Its leak site claimed 357 victims in Q3 and 75 in September.

Typical targets: Professional services, public services, healthcare, financial services, manufacturing, high tech, retail and hospitality.; Professional servicesGovernmentHealthcareFinanceManufacturingTechnology and IT servicesRetail and food
Where: Mostly North America.

The service offers affiliates a "Call Lawyer" feature to add legal pressure on victims.

How they get in and what helps

How they get in

Fortinet FortiGate firewalls
WatchGuard Firebox, flaw CVE-2025-14733
Stolen login credentials

What helps

Keep offline backups and test a restore.
Turn on multi-factor authentication for every remote-access and VPN account.
Patch or replace internet-facing firewalls and VPN gateways first, and take management pages off the internet.

Sources (3)

Arete: Qilin ransomware spotlight (August 19, 2026)
Comparitech: ransomware roundup, Q3 2026 (October 6, 2026)
Brandefense: ransomware in September 2026 (October 27, 2026)

ITRansomware-as-a-serviceLatest source October 27, 2026

The Gentlemen

A fast-growing operation that pays affiliates 90% of each ransom. It builds for Windows, Linux and VMware ESXi servers. It claimed 342 victims in Q3 and led all groups in September with 105.

Typical targets: Manufacturing first, then technology and healthcare.; ManufacturingTechnology and IT servicesHealthcare
Where: United States, United Kingdom and Germany.

Check Point had counted more than 320 victims on its leak site by April 2026.

How they get in and what helps

How they get in

Internet-facing VPNs
Remote-access gateways
Firewall login portals that are unpatched or badly configured

What helps

Keep offline backups and test a restore.
Turn on multi-factor authentication for every remote-access and VPN account.
Patch or replace internet-facing firewalls and VPN gateways first, and take management pages off the internet.

Sources (3)

Check Point: The Gentlemen ransomware (April 20, 2026)
Comparitech: ransomware roundup, Q3 2026 (October 6, 2026)
Brandefense: ransomware in September 2026 (October 27, 2026)

ITRansomware-as-a-serviceLatest source October 27, 2026

Akira

A long-running group that CISA says has taken in about $244 million. Its claims fell 23% in Q3 compared with Q2 but it remained active, with 36 victims in September. It has expanded to attack Nutanix virtual machines.

Typical targets: Manufacturing, education, IT, healthcare, financial services, and food and agriculture.; ManufacturingEducationTechnology and IT servicesHealthcareFinanceRetail and food
Where: Not stated in the sources we checked.

Entry details come from CISA's advisory update, reported in November 2025, so check them against newer advice.

How they get in and what helps

How they get in

SonicWall flaw CVE-2024-40766
Stolen VPN credentials and password spraying
Veeam backup flaws CVE-2023-27532 and CVE-2024-40711

What helps

Keep offline backups and test a restore.
Turn on multi-factor authentication for every remote-access and VPN account.
Patch or replace internet-facing firewalls and VPN gateways first, and take management pages off the internet.

Sources (3)

The Register: CISA update on Akira ransomware (November 14, 2025)
Comparitech: ransomware roundup, Q3 2026 (October 6, 2026)
Brandefense: ransomware in September 2026 (October 27, 2026)

ITRansomware groupLatest source October 27, 2026

SafePay

CISA and the FBI warned on 20 October 2026 that SafePay has listed more than 600 victims since August 2024, including critical infrastructure. The group also telephones victims to pressure them.

Typical targets: Businesses, critical infrastructure and government bodies, including government bodies in Latin America.; GovernmentManufacturingTechnology and IT servicesFinanceHealthcare
Where: United States, Europe (including Germany) and Latin America.

How they get in and what helps

How they get in

Password guessing
Old flaws in Cisco, Veeam and SonicWall products (CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711, CVE-2024-40766)
Phishing and network scanning
Abuse of AnyDesk and TeamViewer remote tools

What helps

Keep offline backups and test a restore.
Turn on multi-factor authentication for every remote-access and VPN account.
Patch or replace internet-facing firewalls and VPN gateways first, and take management pages off the internet.
Block remote-support tools you do not use, and be wary of unexpected phone calls from "IT support".

Sources (2)

The Record: FBI says SafePay is among the most active, 600 victims (October 20, 2026)
Brandefense: ransomware in September 2026 (October 27, 2026)

ITRansomware-as-a-serviceLatest source August 19, 2026

Medusa

More than 500 victims since June 2021. A joint CISA, FBI and HHS update in August 2026 warns that Medusa affiliates buy access from brokers and exploit new flaws within a day of disclosure.

Typical targets: Healthcare, defense, manufacturing, government services, IT and financial firms, plus education, insurance and law.; HealthcareManufacturingGovernmentTechnology and IT servicesFinanceEducationProfessional services
Where: Not stated in the source.

How they get in and what helps

How they get in

Access bought from brokers (reported prices from $100 to $1 million)
Phishing
New flaws in ScreenConnect, Fortinet EMS, GoAnywhere and BeyondTrust, sometimes within 24 hours

What helps

Keep offline backups and test a restore.
Turn on multi-factor authentication for every remote-access and VPN account.
Patch or replace internet-facing firewalls and VPN gateways first, and take management pages off the internet.
Apply security updates to remote-support and file-transfer tools within days, not weeks.

Sources (1)

Help Net Security: Medusa ransomware, CISA warning (August 19, 2026)

ITRansomware-as-a-serviceLatest source August 10, 2026

Gunra

A service operating since April 2025, built on leaked code from the Conti ransomware. An FBI and CISA advisory on 10 August 2026 describes attacks on government bodies and critical infrastructure.

Typical targets: Government and critical infrastructure, including healthcare, finance, manufacturing, construction, transport and utilities.; GovernmentHealthcareFinanceManufacturingCritical infrastructure
Where: Not stated in the source.

How they get in and what helps

How they get in

Fortinet flaws CVE-2024-55591 and CVE-2025-24472 (FortiOS and FortiProxy)
SSL-VPN accounts left on default passwords
Weak SSH passwords

What helps

Keep offline backups and test a restore.
Turn on multi-factor authentication for every remote-access and VPN account.
Patch or replace internet-facing firewalls and VPN gateways first, and take management pages off the internet.
Change default passwords on every network device.

Sources (1)

FBI and CISA advisory on Gunra ransomware (PDF) (August 10, 2026)

ITData theft and extortionLatest source October 22, 2026

Clop: Windchill and FlexPLM data theft

Attackers broke into PTC Windchill and FlexPLM product-design servers using flaw CVE-2026-12569 (severity 9.3) and stole files. CISA listed the flaw as exploited in late June 2026. Clop made 110 claims in Q3 and 24 in September.

Typical targets: Manufacturing, automotive, aerospace and retail firms, and the engineering and product-design data they keep in these systems.; ManufacturingRetail and foodTechnology and IT services
Where: Not stated in the sources.

ReliaQuest could not confirm that Clop is behind this wave, although Ransom-ISAC confirmed the attacks.

How they get in and what helps

How they get in

Unpatched PTC Windchill and FlexPLM servers exposed to the internet

What helps

Patch Windchill and FlexPLM now, and check whether the servers are reachable from the internet.
Look for signs of past intrusion, because data theft leaves little visible damage.

Sources (3)

BleepingComputer: Clop targets Windchill and FlexPLM (July 24, 2026)
The Hacker News: Cl0p affiliates target internet-exposed systems (July 25, 2026)
CyberMaxx: Q3 2026 ransomware report (October 22, 2026)

ITRansomware groupLatest source October 6, 2026

Dire Wolf

A human-operated group that steals data and then encrypts, a tactic called double extortion. It had listed 137 victims in 37 countries by late October 2026, and its Q3 claims rose about 1,450% on Q2.

Typical targets: Technology, healthcare and professional services, each about 15% of victims.; Technology and IT servicesHealthcareProfessional services
Where: Victims in 37 countries.

How they get in and what helps

How they get in

Not covered by the sources we checked

What helps

Keep offline backups and test a restore.
Turn on multi-factor authentication for every remote-access and VPN account.
Patch or replace internet-facing firewalls and VPN gateways first, and take management pages off the internet.

Sources (2)

Provendata: Dire Wolf ransomware (January 21, 2026)
Comparitech: ransomware roundup, Q3 2026 (October 6, 2026)

ITRansomware groupLatest source October 6, 2026

Rhysida

Claims rose about 200% in Q3. Examples from Comparitech's quarterly roundup: the Government of Berlin (about $2.3 million demanded, 5.79 TB claimed) and a hospital in the Philippines.

Typical targets: Government bodies and hospitals, in the examples reported.; GovernmentHealthcare
Where: Germany and the Philippines in the examples.

How they get in and what helps

How they get in

Not covered by the sources we checked

What helps

Keep offline backups and test a restore.
Turn on multi-factor authentication for every remote-access and VPN account.
Patch or replace internet-facing firewalls and VPN gateways first, and take management pages off the internet.

Sources (1)

Comparitech: ransomware roundup, Q3 2026 (October 6, 2026)

ITSupply chainLatest source October 30, 2026

Poisoned software packages and developer tools

In May 2026 attackers published about 170 booby-trapped npm and PyPI packages (404 malicious versions), including TanStack, Mistral AI, UiPath and OpenSearch libraries. A message on the attacker's site was signed "TeamPCP", the group behind the March 2026 Trivy compromise. The malware steals cloud and developer keys, then plants files so that the next developer who opens an infected project is also infected. On 21 October a separate incident hijacked the LiteLLM release pipeline. On 29 October a tampered Claude Code extension was served from Cursor's extension marketplace for about 11 hours, planting an SSH backdoor on developer machines. Anthropic says it did not build or publish that extension and that its own channels are unaffected.

Typical targets: Software developers, build servers and companies that use AI and cloud tooling.; Technology and IT services
Where: Worldwide.

How they get in and what helps

How they get in

Installing or importing a poisoned package
Opening a project that contains planted .claude/settings.json or .vscode/tasks.json files
A tampered editor extension installed from a marketplace

What helps

Check lockfiles for the affected packages and versions listed by SafeDep, and rotate any keys a build server held.
Delay adopting brand-new package versions for a few days.
Review unexpected .claude and .vscode files in repositories.
If you installed the Claude Code extension from Cursor's marketplace on 29 October, treat the machine as compromised and follow the removal steps in Phorion's advisory.

Read the related incident on this site

Sources (3)

Phorion: official Claude Code extension compromise, security advisory (October 30, 2026)
The Register: Anthropic says the Claude Code extension compromise was not its own (October 30, 2026)
SafeDep: mass npm and PyPI supply chain attack (May 12, 2026)

ITState-linked espionageLatest source October 29, 2026

Volt Typhoon: Silent Train

On 29 October 2026 Lumen's Black Lotus Labs described Silent Train, a rotating relay network of hijacked home routers and IoT devices that the Chinese state-backed group Volt Typhoon uses to hide its most sensitive intrusions. The group exploits zero-day flaws in management systems, so it needs little lateral movement.

Typical targets: US government bodies, telecom and satellite providers, defense contractors, managed service providers, IT firms, military-linked universities, and water, energy, transport, aviation and emergency services.; GovernmentCritical infrastructureDefense and telecom
Where: Hawaii, California and Texas were targeted most often, with links to military bases and Indo-Pacific logistics.

The source article gives no defensive advice. The steps below are general guidance.

How they get in and what helps

How they get in

Versa Director CVE-2024-39717
N-able N-Central CVE-2025-8875 and CVE-2025-8876
Cisco Catalyst SD-WAN CVE-2026-20127
VeloCloud Orchestrator CVE-2026-16812
Possibly a Quest KACE zero-day

What helps

Patch management, SD-WAN and remote-management platforms first, and keep their admin pages off the internet.
Send logs to a separate system that device administrators cannot edit.
Replace end-of-life home and small-office routers that could serve as relay hops.

Sources (1)

Help Net Security: Volt Typhoon and the Silent Train relay network (October 29, 2026)

ITState-linked espionageLatest source October 22, 2026

Storm-0940 and AI-driven attacks on cloud backup

Microsoft says the China state-aligned group Storm-0940 used an open-source AI penetration-testing framework against ConnectWise Cloud Backup and tried to sign in to more than 2,250 customer Microsoft 365 tenants. Most attempts failed, but it gained privileged access at several organizations, sometimes in under three hours.

Typical targets: IT service providers and the businesses whose Microsoft 365 data they back up.; Technology and IT services
Where: Not stated.

How they get in and what helps

How they get in

Scanning and password spraying
Abuse of OAuth app permissions inside customer tenants

What helps

List the third-party apps with permission in your Microsoft 365 tenant and remove those you do not use.
Ask your IT provider whether it uses ConnectWise Cloud Backup or SkyKick, and what it found.

Read the related incident on this site

Sources (2)

ITState-linked espionage

Armory Castle: remote-support zero-day

A China-nexus espionage group, tracked as Armory Castle (also UNC5221 or Warp Panda), used a zero-day in BeyondTrust Remote Support (CVE-2026-102764, severity 9.3) against one self-hosted appliance on 29 August. CISA listed the flaw as exploited on 16 October.

Typical targets: Organizations that run self-hosted BeyondTrust Remote Support, a tool with privileged reach into many computers.; Technology and IT servicesGovernment
Where: Not stated.

How they get in and what helps

How they get in

A flaw in the appliance's internal messaging component

What helps

Self-hosted customers should patch at once and check for earlier compromise.
Keep remote-support appliances off the open internet where possible.

Read the related incident on this site

Sources (1)

The Hacker News: China-linked hackers exploited BeyondTrust zero-day

ITZero-day exploitationLatest source November 2, 2026

UTA0576: Ivanti Connect Secure zero-day chain

Volexity found an attacker, tracked as UTA0576, chaining flaws in Ivanti Connect Secure VPN gateways to take root control of an appliance that was fully patched at the time. Exploitation began on 3 October. CISA lists CVE-2026-111357 and CVE-2026-118527 as exploited, with federal deadlines of 2 and 13 November, and Help Net Security reports that Ivanti has now fixed all three flaws.

Typical targets: Organizations that run Ivanti Connect Secure. Volexity described one appliance at one customer, and no sectors or victim counts have been published.
Where: Not stated.

Volexity assessed with low confidence that the motive is criminal rather than espionage. The operation was disrupted, so the attacker's final goal is unknown. Volexity says the activity gets past Ivanti's Integrity Checker Tool.

How they get in and what helps

How they get in

CVE-2026-104935: authentication bypass and code execution on the VPN appliance
A privilege escalation to root, and a file-upload flaw (CVE-2026-118527) that CISA lists as exploited

What helps

Install the fixed Connect Secure release from Ivanti's advisory, then investigate for compromise instead of relying on the Integrity Checker Tool.
Preserve memory and logs before rebooting, and use the indicators and YARA rules Volexity published.
Rotate credentials the appliance could reach, including domain logins, and keep its admin pages off the internet.

Read the related incident on this site

Sources (2)

The Hacker News: attacker chains three Ivanti Connect Secure flaws (October 13, 2026)
Help Net Security: CISA tells federal agencies to remediate exploited Ivanti Connect Secure vulnerabilities (November 2, 2026)

ITSupply chain

Gheist: stolen GitHub tokens used to dump secrets

Wiz has tracked Gheist since 15 September. Attackers use stolen GitHub tokens to push a workflow file to every private repository the token can reach. The workflow prints the repository's secrets in an encoded form that GitHub's log masking does not catch, and the tool downloads the log and deletes the run seconds later. As of 24 October Wiz had seen more than 13,500 planted branches from more than 850 compromised accounts, and about two-thirds of the accounts had since disappeared from GitHub. Around 19 October a second job appeared that targets self-hosted runners; Wiz describes it as buggy and reports no successful run.

Typical targets: Developers and companies that keep code and cloud credentials in GitHub, especially those with production secrets in repository settings or self-hosted runners.; Technology and IT services
Where: Worldwide.

How they get in and what helps

How they get in

Stolen GitHub tokens, which Wiz traced to infostealer logs and to tokens exposed in earlier supply-chain attacks such as the March Trivy compromise

What helps

Rotate every secret the affected repositories could read and revoke the tokens that pushed the commits.
Look for ci-sync- branches that add only a sync-check workflow, and do not approve held runs of it.
Use GitHub Apps or short-lived fine-grained tokens, require reviewers on environments that hold production secrets, and run self-hosted runners as short-lived machines.

Sources (1)

The Hacker News: Gheist uses stolen GitHub tokens to harvest secrets

OTAttacks on industrial controllersLatest source August 4, 2026

Attacks on US water and wastewater controllers

On 26 to 27 July 2026 attackers hit more than 30 community water systems in Minnesota. The FBI and EPA reported incidents at utilities in at least seven states since 27 July, and Michigan found nine more systems. Effects included lost visibility and control, pressure loss, flooding, communications outages and boil-water notices. Public reporting shows no confirmed contamination.

Typical targets: Small and mid-sized water and wastewater utilities that leave controllers reachable from the internet.; Critical infrastructure
Where: Minnesota, Michigan and at least five other US states. Separate unverified claims relate to Canadian water systems.

No one has formally been blamed. The pattern resembles Iranian-affiliated activity described in advisory AA26-097A, which LevelBlue treats as a working hypothesis. Pro-Russian hacktivist claims in Canada are unverified.

How they get in and what helps

How they get in

Controllers exposed to the internet, mainly Rockwell Allen-Bradley MicroLogix 1100 and 1400
Earlier related activity also involved Rockwell CompactLogix and Micro850, Schneider BMX P34 and Modicon M340, and Siemens S7-1200 controllers
Attackers changed IP addresses and passwords to lock operators out and, in at least one case, altered the controller's project file

What helps

Take controllers, operator screens and cellular modems off the public internet; use a hardened VPN or private cellular network.
Change default and shared passwords, and compare controller programs with known-good copies.
Keep the ability to run wells, pumps and valves by hand, and rehearse it.

Sources (1)

LevelBlue SpiderLabs: July 2026 attacks on US water systems (August 4, 2026)

OTProcess manipulationLatest source November 5, 2026

European supermarket refrigeration attacks

On the night of 11 to 12 October 2026 attackers remotely forced refrigeration controllers into defrost mode at hundreds of French supermarkets. Cold rooms reached 50 degrees Celsius, food was spoiled and some fires started. France's CERT-FR widened its alert from Danfoss controllers to Copeland and Dixell devices. On 2 November a second wave hit food stores in Sweden, Belgium, Ireland, Luxembourg, the Netherlands, Finland and Estonia. Danfoss said its products were involved, and a Belgian refrigeration firm confirmed a cyberattack. On 29 October Reuters had reported that US investigators are treating freezer failures at military base stores as a suspected cyberattack. No link between the cases has been established. On 5 November CISA, the FBI and partner agencies issued joint guidance on attacks against refrigeration and cold-storage controllers, without naming products or a culprit.

Typical targets: Supermarket chains and other users of internet-connected commercial refrigeration controllers.; Retail and food
Where: France, then Sweden, Belgium, Ireland, Luxembourg, the Netherlands, Finland and Estonia.

No group has claimed either wave and authorities have not blamed anyone. Reporting finds no evidence yet that the waves, or the US base failures, are linked.

How they get in and what helps

How they get in

Remote controllers exposed to the internet, many of them end-of-life models that no longer get updates
In the Dutch cases, DutchNews reports systems that were not on a secure network and still used a default password
Possibly shared maintenance infrastructure, which is still an open question

What helps

Remove building and refrigeration controllers from direct internet exposure.
Replace controllers that no longer receive updates.
Keep independent temperature sensors that the control system cannot switch off.

Read the related incident on this site

Sources (5)

CryptoState-linked theftLatest source September 18, 2026

WaterPlum: fake job interviews

Law enforcement and security agencies from Australia, Germany, Japan and the US warned on 18 September 2026 about a North Korean campaign in which fake recruiters ask job seekers to download a "coding test". The file installs a backdoor. The agencies counted more than 30,000 infected devices, more than 7,000 compromised crypto wallets and at least $10.71 million stolen.

Typical targets: Web designers, engineers, and crypto and Web3 specialists who are looking for work.; Crypto and Web3Technology and IT services
Where: Worldwide.

If a victim later gets a real job, the infected computer may give the attackers a path into the new employer.

How they get in and what helps

How they get in

A "coding assignment" or recruitment test sent by a fake recruiter
Remote-access trojans and information stealers that stay on the machine after the interview ends

What helps

Never run a coding test on your work or wallet computer. Use a separate, disposable device or virtual machine.
Verify recruiters through the company's official site.
Warning signs of fake candidates: claims that do not hold up, refusal to meet in person, video glitches and requests to be paid in crypto.

Sources (1)

The Register: North Korea's fake job interviews infected 30,000 devices (September 18, 2026)

CryptoState-linked theftLatest source November 1, 2026

North Korea-linked exchange and protocol heists

On October 31 the FBI said North Korea was responsible for the theft of more than $6 billion from Binance on or about October 29, naming its TraderTraitor group and publishing 628 addresses for exchanges to block. Binance says the way in was a compromised DevOps engineer's laptop. Earlier in 2026, Chainalysis attributed more than $1 billion of crypto theft to North Korea-linked actors, and Elliptic counts more than 51 suspected incidents. On the firms' assessment this includes the Bitget hack (about $388 million, September 24), where the exchange says attackers used a flaw in third-party security software to obtain credentials and insert fraudulent withdrawals.

Typical targets: Crypto exchanges, DeFi protocols and their staff, often through patient social engineering.; Crypto and Web3
Where: Worldwide.

The Binance attribution is an FBI finding. Earlier attributions come from private analytics firms and company statements, not from a government.

How they get in and what helps

How they get in

A compromised engineer's laptop that reached a service container, according to Binance's preliminary account
Long, patient social-engineering approaches to staff
Third-party security software, according to Bitget (not independently verified)

What helps

Verify job offers, investor meetings and support contacts through a second channel.
Require independent approval for withdrawals so one set of stolen credentials is not enough.
Keep the management pages of your security tools off the internet.

Read the related incident on this site

Sources (3)

CryptoHardware supply chainLatest source October 12, 2026

Tampered hardware wallets

From about 9 October 2026, thefts hit more than 300 wallets, mostly in Southeast Asia, with estimates of $90 to $93 million. Ledger confirmed that an affected customer's device held an unauthorized hardware implant. Ledger says a criminal group bought genuine devices, fitted implants able to read recovery phrases, and fed them back into the market through resellers.

Typical targets: Individuals who bought a hardware wallet from a reseller instead of the maker.; Crypto and Web3
Where: Mostly Southeast Asia. One report mentions a modified device at a German retailer.

Ledger says its own chip, operating system, servers and sales channel were not compromised. No attacker has been identified.

How they get in and what helps

How they get in

Physically altered devices sold through resellers (confirmed cases involved the reseller CryptoBilis)

What helps

Buy hardware wallets only directly from the maker and check the packaging for tampering.
If you bought from a reseller recently, follow the maker's integrity-check steps before using the device.

Read the related incident on this site

Sources (1)

The Crypto Times: Ledger CryptoBilis hack explained (October 12, 2026)

Date	Category	Country	Incident	Type	Source
May 1 2026	IT	United Kingdom	Canonical (Ubuntu) websites hit by hacktivist DDoS	DDoS	scworld.com
May 2 2026	IT	Not stated	Trellix source code repository accessed without authorisation	Data breach	bleepingcomputer.com
May 3 2026	IT	United States	Central Medical Services of Westrock (US), INC ransomware	Ransomware	Roundup: Comparitech: ransomware roundup, May 2026
May 4 2026	IT	United States	DigiCert support portal social-engineered, rogue certificates	Cyberattack	Roundup: CM Alliance: biggest cyber attacks, data breaches and ransomware attacks, May 2026
May 4 2026	IT	Hungary	Mediaworks (pro-Orban media) ransomware, 8.5 TB leaked	Ransomware	therecord.media
May 5 2026	IT	Taiwan	Taiwan High Speed Rail false alarms stop four trains	Cyberattack	Roundup: CM Alliance: biggest cyber attacks, data breaches and ransomware attacks, May 2026
May 5 2026	IT	United States	Vimeo user data stolen via analytics provider	Data breach	bleepingcomputer.com
May 6 2026	IT	Not stated	DAEMON Tools installers trojanized in build compromise	Supply chain	Roundup: CM Alliance: biggest cyber attacks, data breaches and ransomware attacks, May 2026
May 7 2026	IT	United States	Canvas learning platform breached and school logins defaced	Ransomware & extortion	Cyberfeed6
May 8 2026	IT	Armenia	NVIDIA GeForce NOW partner GFN.am user data exposed	Data breach	bleepingcomputer.com
May 8 2026	IT	Spain	Zara customer records exposed via third-party database	Data breach	bleepingcomputer.com
May 9 2026	IT	Not stated	Hugging Face fake OpenAI repository spreads infostealer	Supply chain	Roundup: CM Alliance: biggest cyber attacks, data breaches and ransomware attacks, May 2026
May 11 2026	IT	Czechia	Skoda Auto online shop customer data exposed	Data breach	bleepingcomputer.com
May 12 2026	IT	Taiwan	Foxconn confirms ransomware, Nitrogen claims Apple data	Ransomware	theregister.com
May 13 2026	IT	South Korea	South Korean electronics maker infiltrated by MuddyWater	Espionage	Roundup: CM Alliance: biggest cyber attacks, data breaches and ransomware attacks, May 2026
May 14 2026	IT	United States	OpenAI devices hit in TanStack supply-chain attack	Supply chain	Roundup: CM Alliance: biggest cyber attacks, data breaches and ransomware attacks, May 2026
May 14 2026	OT	Not stated	Researchers: Sandworm escalates inside industrial networks it has already entered	State-linked activity	Cyberfeed6
May 2026	IT	United States	Accretech America manufacturer, AiLock ransomware	Ransomware	Roundup: Comparitech: ransomware roundup, May 2026
May 15 2026	IT	United States	American Lending Center breach exposes 123,000 people	Data breach	comparitech.com
May 2026	IT	Australia	Australian College of Business Intelligence, Qilin ransomware	Ransomware	Roundup: Comparitech: ransomware roundup, May 2026
May 2026	IT	Thailand	Bangkok Metropolitan Administration, KRYBIT ransomware	Ransomware	Roundup: Comparitech: ransomware roundup, May 2026
May 2026	IT	Australia	Bluize Australian tech firm, Qilin ransomware	Ransomware	Roundup: Comparitech: ransomware roundup, May 2026
May 2026	IT	Japan	CKC Network (Japan) company ransomware claim	Ransomware	Roundup: Comparitech: ransomware roundup, May 2026
May 2026	IT	Taiwan	CSB Energy Technology (Taiwan), Lynx ransomware	Ransomware	Roundup: Comparitech: ransomware roundup, May 2026
May 2026	IT	United States	Carnival discloses social-engineering breach affecting about 6 million customers	Data breach	Cyberfeed6
May 2026	IT	Japan	Chuoh Pack Industry packaging maker (Japan) ransomware	Ransomware	Roundup: Comparitech: ransomware roundup, May 2026
May 2026	IT	United States	Cushman & Wakefield real estate firm, Qilin ransomware	Ransomware	Roundup: Comparitech: ransomware roundup, May 2026
May 2026	IT	United States	Delano Public Schools (US) ransomware attack	Ransomware	Roundup: Comparitech: ransomware roundup, May 2026
May 2026	IT	United States	DentaQuest breach exposes health data of 15 million people	Data breach	Cyberfeed6
May 2026	IT	Netherlands	Dutch Language Institute, The Gentlemen ransomware	Ransomware	Roundup: Comparitech: ransomware roundup, May 2026
May 2026	IT	United States	Egnyte software company, INC ransomware claim	Ransomware	Roundup: Comparitech: ransomware roundup, May 2026
May 2026	IT	Malaysia	Elken Malaysia manufacturer, Bavacai ransomware	Ransomware	Roundup: Comparitech: ransomware roundup, May 2026
May 2026	IT	France	Eyguieres town (France), Qilin ransomware	Ransomware	Roundup: Comparitech: ransomware roundup, May 2026
May 2026	IT	Germany	GTF Freese German manufacturer, Payload ransomware	Ransomware	Roundup: Comparitech: ransomware roundup, May 2026
May 2026	IT	Japan	Gakusan (Japan) company ransomware claim	Ransomware	Roundup: Comparitech: ransomware roundup, May 2026
May 2026	IT	Croatia	Jastrebarsko city (Croatia), ThreeAM ransomware	Ransomware	Roundup: Comparitech: ransomware roundup, May 2026
May 2026	IT	Australia	Kennedy McLaughlin finance firm (Australia), Qilin	Ransomware	Roundup: Comparitech: ransomware roundup, May 2026
May 2026	IT	Japan	Koa Glass (Japan) manufacturer, The Gentlemen ransomware	Ransomware	Roundup: Comparitech: ransomware roundup, May 2026
May 2026	IT	Spain	Mediapost marketing firm (Spain), Qilin ransomware	Ransomware	Roundup: Comparitech: ransomware roundup, May 2026
May 2026	IT	Australia	Menzies Group (Australia) service firm, Qilin ransomware	Ransomware	Roundup: Comparitech: ransomware roundup, May 2026

Incidents per month

All categories

Incidents by country

Ransomware leak-site claims

Current campaigns

Ransomware in Q3 2026

Crypto theft in Q3 2026

How attackers got in, Q3 2026

Claimed victims by sector, Q3 2026

Qilin

How they get in

What helps

The Gentlemen

How they get in

What helps

Akira

How they get in

What helps

SafePay

How they get in

What helps

Medusa

How they get in

What helps

Gunra

How they get in

What helps

Clop: Windchill and FlexPLM data theft

How they get in

What helps

Dire Wolf

How they get in

What helps

Rhysida

How they get in

What helps

Poisoned software packages and developer tools

How they get in

What helps

Volt Typhoon: Silent Train

How they get in

What helps

Storm-0940 and AI-driven attacks on cloud backup

How they get in

What helps

Armory Castle: remote-support zero-day

How they get in

What helps

UTA0576: Ivanti Connect Secure zero-day chain

How they get in

What helps

Gheist: stolen GitHub tokens used to dump secrets

How they get in

What helps

Attacks on US water and wastewater controllers

How they get in

What helps

European supermarket refrigeration attacks

How they get in

What helps

WaterPlum: fake job interviews

How they get in

What helps

North Korea-linked exchange and protocol heists

How they get in

What helps

Tampered hardware wallets

How they get in

What helps

The incidents behind the charts

How to read these numbers

Sources