Incidents

Nov 2026

2026-11-05

Air Botswana disclosed a suspected ransomware attack that gave unauthorised parties access to some internal systems containing employee and internal information. The airline identified the incident and activated its response procedures, engaging relevant authorities and addressing data protection obligations while passenger booking systems, aircraft systems, flight operations, and aviation safety systems remained unaffected. It operates a smaller fleet serving scheduled destinations across several countries and is wholly government-owned. The disclosure did not specify how many people were affected, which systems were accessed, whether data was copied or encrypted, or if a ransom was demanded, and no group has claimed responsibility. Botswana's Data Protection Act requires breach notification to the Information and Data Protection Commission without delay and where feasible within 72 hours of awareness, with penalties for failure to implement appropriate security safeguards.

Nov 2026

2026-11-04

Cyber-attacks targeting refrigeration systems disrupted supermarket chains across at least ten European countries, causing freezer temperatures to rise as high as 50 degrees Celsius and forcing retailers to discard spoiled food. Co-op locations in Sicily and Tuscany were among the affected businesses, with national authorities noting outdated security measures and exposed interfaces. The European Union characterized the incidents as a serious threat to the food supply chain, while several member states opened investigations into the breaches that also impacted other grocery retailers and corner shops.

Nov 2026

2026-11-04

A cyberattack targeting an external refrigeration management provider disrupted operations at seven Intermarché stores in Portugal, contributing to a wider wave of incidents across at least ten European countries that caused supermarket freezer temperatures to spike as high as 50 degrees Celsius and forced retailers to discard spoiled food. The broader campaign, which also affected chains in Belgium, Ireland, Italy, and other nations, resulted in food losses estimated in the tens of millions of euros and prompted European Union officials to warn of deliberate attempts to disrupt the food supply chain.

Nov 2026

2026-11-04

A cyber incident affecting refrigeration systems in 13 SuperValu stores operated by food wholesaler Musgrave forced the removal of some chilled and frozen products from sale after monitoring systems detected the issue. The company stated that its investigation was ongoing and that immediate action had been taken, with the disruption occurring as part of a wider European wave of attacks on supermarket cooling units that caused temperature spikes and spoiled food.

Nov 2026

2026-11-03

Ahold Delhaize reported that a cyberattack caused temperatures in refrigerators and freezers at dozens of its stores in Belgium and Luxembourg to spike, spoiling food and forcing shelves to be cleared. The company’s refrigeration operator said attackers switched evaporators into defrost mode and technicians worked through the night to disconnect affected units from the network. The disruption echoed earlier attacks on supermarket cooling systems across Europe, with no group claiming responsibility.

Nov 2026

2026-11-02

Shop & Go convenience shops attached to Q8 service stations were among dozens of retail locations across several European countries whose refrigeration and freezer units were compromised in a suspected cyber-attack, with attackers switching evaporators to defrost mode and driving temperatures as high as 50C. Technicians were mobilized in the early hours to disconnect affected installations, while retailers removed chilled and frozen products from sale and faced potential food losses amid widespread disruption to grocery supply chains.

Nov 2026

2026-11-04

SuperValu, Ireland’s third-largest supermarket chain, reported that a specific model of refrigeration systems was affected by a cyber incident at 13 of its 223 stores. The event was part of a broader wave of suspected cyberattacks targeting grocery cooling systems across multiple European countries, where temperatures in fridges and freezers spiked to as high as 50 degrees Celsius, spoiling food and in some cases causing fires. Retailers in Belgium, Estonia, Ireland, Luxembourg, and Sweden reported overnight temperature increases, with additional incidents affecting Ahold Delhaize, Spar, ICA, Coop, and Axfood locations. No group claimed responsibility for the attacks.

Nov 2026

2026-11-02

A cyberattack targeting refrigeration systems disrupted supermarkets across multiple European countries, with temperatures in affected units rising to as high as 50°C. A Proxy Delhaize store in Belgium was among those hit, forcing staff to discard spoiled fresh and frozen products after an overnight incident. The broader chain reported that several dozen locations, primarily in Belgium with a few in neighboring Luxembourg, experienced cooling failures while distribution centers continued normal operations and deliveries remained uninterrupted. Other retailers, including ICA, Coop, Carrefour, and Ikea, also reported compromised refrigeration equipment, and similar attacks had previously affected hundreds of stores in France, causing significant food losses. No group has claimed responsibility for the incidents.

Nov 2026

2026-11-05

Mercado Bitcoin suspended deposits and withdrawals after a cybersecurity incident in which blockchain security companies reported more than $46 million left the platform, though the company did not confirm the figure. The exchange stated the attack did not harm customers or cause a data breach, but blockchain security experts disputed that assessment, citing evidence that hackers siphoned funds from some customer wallets. Tether froze about $4.5 million of the stolen funds, and other platforms froze another $2 million, while Chainalysis investigators tracked the coins to help the industry identify, freeze, and disrupt impacted funds. The platform, which calls itself the largest digital assets investment platform in Latin America with about 4.5 million customers, pledged to restore services in the coming days and coordinated with authorities.

Nov 2026

2026-11-02

The Ukrainian Air Force reported that its air raid alert application was compromised, triggering false nationwide warnings of radiation, nuclear, chemical, and street fighting threats while sirens sounded across multiple regions. Messages in Ukrainian and Russian referenced an incoming strike and urged residents to take cover, though officials stated there was no actual danger and warned against clicking suspicious links. The false alerts were cleared within roughly an hour, after which the system began gradually resuming normal operations with added security measures, while a separate emergency app in Russia was also reported hacked shortly afterward.

Oct 2026

2026-11-04

A Swedish ICA Kvantum store in Sjöbo reported that hackers compromised its refrigeration and freezing systems, raising temperatures to 50 degrees Celsius and forcing staff to discard spoiled goods. The incident was part of a broader wave of cyberattacks targeting supermarket refrigeration across several European countries, including Belgium, Luxembourg, Ireland, and Estonia, where chains such as Coop, Delhaize, Carrefour, SuperValu, and Selver experienced disrupted cooling, product removals, or limited fresh and frozen availability. In France, similar attacks previously compromised hundreds of supermarket and independent store cooling systems, apparently focusing on older technology, while affected retailers elsewhere worked to restore operations and replenish chilled and frozen ranges.

Oct 2026

2026-11-02

Hackers stole more than $6 billion in crypto from Binance in about 20 minutes, with roughly half in stablecoins that were quickly frozen by issuers and the rest in tokens like bitcoin and ether that are likely unrecoverable. The exchange's losses could top $3 billion, exceeding its $1 billion emergency fund, though it pledged to cover losses using reserves and other assets while assuring users their funds are safe. Deposits and withdrawals were suspended, and researchers observed unprecedented laundering patterns involving thousands of automated transactions designed to obscure the trail of funds.

Oct 2026

2026-11-03

A cyberattack forced the University of New Mexico Health system to divert ambulances, suspend outpatient surgeries and appointments, and cancel classes across its health sciences schools while nonessential staff remained home. The organization, which operates the state’s only Level I trauma center and burn unit, later restored critical electronic systems and resumed normal hospital and clinic operations after working with external security partners. A ransomware group claimed responsibility, stating it compromised tens of thousands of systems including Active Directory, email, and Oracle databases, and alleging theft of personal and patient data such as Social Security numbers, payroll records, and electronic health records; the group also offered free decryption keys for healthcare facilities while retaining the stolen information.

Oct 2026

2026-11-01

The Federal Election Commission restored its electronic filing system after taking it offline for nearly 41 hours to contain a cyberattack that temporarily concealed spending from major donors. The outage prevented super PACs and other groups from submitting mandatory 24- and 48-hour reports, keeping recent political expenditures out of public view during a period of accelerated campaign spending. Agency officials said a bad actor attempted to breach its systems, prompting the shutdown and requiring users to reset passwords before regaining access. While the commission stated the disruption would not affect voters' ability to cast ballots, the lack of transparency around the cause fueled speculation as hundreds of millions of dollars in outside money flowed in the final stretch of the election cycle.

Oct 2026

2026-11-02

Three former employees filed class action lawsuits against J.B. Hunt Transport Services, Inc. alleging a ransomware group breached an isolated portion of its technology system and accessed employee personal information including names, dates of birth, Social Security numbers, driver’s license numbers, contact details, and financial data. The hacker group claimed to possess 140,838 employee records along with millions of carrier contacts, invoices, access-permission records, mailboxes, and organizational records, demanding a $5 million ransom. The company stated its systems remained operational, that it engaged a cybersecurity firm, notified law enforcement, and revoked unauthorized access, while the suits claim negligence, breach of contract, unjust enrichment, invasion of privacy, and breach of fiduciary duty and argue affected individuals face ongoing risk of financial crimes and identity theft.

Oct 2026

2026-11-02

GMO Internet Group disclosed that an intrusion into its Onamae Desktop Cloud service potentially exposed malware on up to 26,739 customer servers, leading the provider to shut down systems and reduce availability while investigating with Trend Micro. The breach compromised MetaTrader 4 and MetaTrader 5 credentials and trading-account details, though payment information remained secure, and the attacker demanded an 8 billion yen ransom that the company refused to pay before customer and corporate data was published online. Although the threat actor warned of a ransomware payload and data leak, no ransomware was ultimately activated on customer machines, and the firm offered each affected customer 5,000 yen in compensation while promising additional payments and legal action against those sharing the leaked information.

Oct 2026

2026-11-03

The provided materials do not contain an incident involving Johns Hopkins Bayview Medical Center. The only available article describes a breach at the Florida Department of Education affecting approximately 4.9 million individuals through its student financial aid website, with exposed data including names, Social Security numbers, dates of birth, addresses, phone numbers, email addresses, and gender codes.

Oct 2026

2026-11-03

Sony Network Communications confirmed a hacker attack on its member database affecting internet provider and plala customers, with approximately 2.59 million records stolen including names, phone numbers, email addresses, user IDs, dates of birth, genders, and internet connection IDs. The breach also exposed mailbox passwords for 54,401 addresses across four email services and sixteen bank account records, while credit card numbers and primary account passwords were not compromised. The company detected the intrusion several days after it began, shut down the affected server, and reported the case to Japan's Personal Information Protection Commission, noting no confirmed secondary damage at the time of announcement.

Oct 2026

2026-10-21

On 19 October 2026, five OVHcloud CLI releases (v0.11.0-v0.15.0) were modified to distribute an information-stealing binary that retrieved secrets from disk. The releases were live for about 1 hour 34 minutes before being blocked. OpenSourceMalware linked the operation to GlassWorm, while describing the connection to an earlier developer-account compromise as inferential.

Oct 2026

2026-11-02

A former employee filed a class action lawsuit alleging that ONEOK failed to protect highly sensitive data after a hacking group called Redact breached a small number of cloud-based user accounts and reportedly leaked 67.5 gigabytes of information including names, addresses, Social Security numbers, dates of birth, and financial details. The company stated that unauthorized activity affected limited data, that fewer than 70 people were impacted and all were notified, that federal law enforcement and third-party cybersecurity experts were engaged, and that the incident was resolved with no business or operational impacts.