Threat Library

Significant Cyber Incidents. What Happened.

Major incidents with a dated timeline, how the attack worked, who was behind it and the lessons for defenders.

Sector
Year

Incident 2026

Citrix NetScaler Zero-Day Exploitation

On 27 September 2026 Citrix disclosed eight vulnerabilities in NetScaler ADC and NetScaler Gateway, two of them critical zero-days already being exploited.

  • Multiple sectors

September 2026Open

Incident 2026

Keyv Npm Maintainer Account Takeover

In early August 2026, attackers took over the GitHub account of a maintainer of Keyv, a widely used JavaScript caching library, and pushed malware into its npm packages.

  • Technology and software supply chain

August 2026Open

Incident 2026

Liechtenstein Beneficial Owner Register Breach

In the night before 30 July 2026, an unknown actor got into Liechtenstein's register of beneficial owners (VwbP) and copied data on about 31,000 legal entities.

  • Government and public sector

July to October 2026Open

Incident 2025

Zimbra Webmail Exploitation By Russian State Actors

On 23 July 2026 the US CISA, NSA, FBI and partner agencies warned that Russian state-supported actors, tracked mainly as LAUNDRY BEAR, were breaking into Zimbra Collaboration Suite webmail.

  • Government and public sector

July 2025 to July 2026Open

Incident 2026

Hugging Face AI Agent Intrusion

In July 2026 Hugging Face, an AI model and dataset platform, reported an intrusion into part of its production systems, run end to end by an autonomous AI agent.

  • Technology and software supply chain

July 2026Open

Incident 2026

Fortinet Device Credential Exposure

In mid-June 2026, government agencies warned that leaked credentials for about 74,000 Fortinet firewalls and VPN gateways were being used against internet-facing devices.

  • Technology and software supply chain

June 2026Open

Incident 2026

CISA Contractor GitHub Credential Exposure

In May 2026 CISA learned that internal AWS GovCloud keys and other internal material had been posted in a public GitHub repository owned by one of its contractors.

  • Government and public sector

May 2026Open

Incident 2026

Nx Console Extension And GitHub Repositories Breach

On 18 May 2026 an attacker published a malicious version 18.95.0 of the Nx Console extension for VS Code, using a real Nx contributor's identity.

  • Technology and software supply chain

May 2026Open

Incident 2026

TanStack Npm Worm (Mini Shai-Hulud)

The TanStack npm worm, also called Mini Shai-Hulud, was a supply chain attack.

  • Technology and software supply chain

May 2026Open

Incident 2026

SharePoint On-Premises Exploitation Wave Of 2026

Between March and September 2026, CISA added eight Microsoft SharePoint vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog.

  • Multiple sectors

March to September 2026Open

Incident 2026

Iranian-affiliated Attacks On US Industrial Controllers

US agencies say Iranian-affiliated actors have been disrupting internet-exposed industrial controllers (PLCs) in US government, water and energy organizations since at least March 2026.

  • Critical infrastructure

April 2026Open

Incident 2026

Axios Npm Package Compromise

On 31 March 2026, two malicious versions of the Axios JavaScript library (1.14.1 and 0.30.4) were published to the npm registry through the lead maintainer's compromised account.

  • Technology and software supply chain

March 2026Open

Incident 2026

LiteLLM PyPI Package Compromise

On 24 March 2026, two malicious versions of LiteLLM (1.82.7 and 1.82.8), a widely used AI gateway package, were published to PyPI with a credential stealer that looked for SSH keys, cloud…

  • Technology and software supply chain

March 2026Open

Incident 2026

Dutch Ministry Of Finance Breach

The Dutch Ministry of Finance breach began when the ministry found on 19 March 2026 that an unauthorized actor had accessed part of its IT systems.

  • Government and public sector

March 2026Open

Incident 2026

Trivy Scanner And GitHub Actions Compromise

In March 2026 an attacker used stolen credentials to publish a malicious version of the Trivy security scanner and to replace the tags of two of its GitHub Actions with credential-stealing…

  • Technology and software supply chain

March 2026Open

Incident 2026

Cisco SD-WAN Exploitation

On 25 February 2026, CISA and partner agencies in Australia, Canada, New Zealand and the UK said attackers were breaking into Cisco SD-WAN systems worldwide.

  • Multiple sectors

February 2026Open

Incident 2026

Fortinet FortiCloud SSO Exploitation

In January 2026, attackers abused a new login bypass (CVE-2026-24858) in Fortinet's FortiCloud single sign-on.

  • Technology and software supply chain

January 2026Open

Incident 2025

Poland Energy Sector Attacks

On 29 December 2025, coordinated destructive attacks hit more than 30 wind and solar farms, a large combined heat and power plant and a manufacturing company in Poland.

  • Energy and utilities

December 2025Open

Incident 2025

Coupang Personal Data Breach, South Korea, 2025

Coupang, South Korea's largest online retailer, disclosed on 29 November 2025 that the personal data of about 33.7 million customer accounts had been exposed.

  • Retail and consumer

November 2025Open

Incident 2025

F5 Nation-State Breach

On 15 October 2025 F5, a maker of network and application delivery products, told the US SEC that a nation-state threat actor had long-term access to its BIG-IP development environment.

  • Technology and software supply chain

August to October 2025Open

Incident 2025

Collins Aerospace MUSE Attack On European Airports

On 19 September 2025 RTX found a ransomware incident on systems that support Collins Aerospace's MUSE software, which lets airlines share check-in and boarding resources at airports.

  • Transport and manufacturing

September 2025Open

Incident 2025

Shai-Hulud Npm Worm

In mid-September 2025, a self-copying worm called Shai-Hulud spread through the npm package registry, the main store for JavaScript code.

  • Technology and software supply chain

September 2025Open

Incident 2025

Jaguar Land Rover Cyber Attack

On 2 September 2025 Jaguar Land Rover (JLR) said a cyber incident had hit it, and it shut down its own systems.

  • Transport and manufacturing

September 2025Open

Incident 2025

SharePoint ToolShell Attacks

In July 2025, attackers exploited flaws in on-premises Microsoft SharePoint Server in an attack chain called ToolShell.

  • Multiple sectors

July 2025Open

Incident 2025

Pix Payment Provider Theft, Brazil, 2025

On 1 July 2025 criminals used login credentials tied to a Brazilian firm that connects financial institutions to the central bank and Pix, to move money out of reserve accounts that banks…

  • Financial services

July 2025Open

Incident 2025

Kazakhstan Resident Database Leak, 2025

The Kazakhstan resident database leak of June 2025 involved a database said to hold 16.3 million records with personal data of Kazakh residents, which appeared in open access.

  • Government and public sector

June 2025Open

Incident 2021

APT28 Attacks On French Entities And French Attribution, 2025

On 29 April 2025 France's foreign ministry formally said that Russia's military intelligence service (GRU) used the APT28 attack group to target or compromise a dozen French entities since…

  • Government and public sector

2021 to 2024Open

Incident 2025

SK Telecom USIM Data Breach

In April 2025, South Korea's largest mobile carrier, SK Telecom, found that attackers had stolen USIM data from its core subscriber servers.

  • Telecommunications

April 2025Open

Incident 2025

UK Retail Attacks (M&S And Co-op)

In April 2025, Marks & Spencer, the Co-op Group and Harrods were hit by separate cyber attacks that the UK National Crime Agency investigated together.

  • Retail and consumer

April-May 2025Open

Incident 2025

Tj-Actions GitHub Action Compromise

In March 2025 the popular GitHub Action tj-actions/changed-files was compromised.

  • Technology and software supply chain

March 2025Open

Incident 2025

Bybit Cryptocurrency Theft

On 21 February 2025, attackers stole about 1.5 billion US dollars in crypto assets from one Ethereum cold wallet of the exchange Bybit.

  • Financial services

February 2025Open

Incident 2025

Cyberattacks On Azerbaijani Media Outlets, February 2025

The cyberattacks on Azerbaijani media outlets hit more than ten major media platforms on 20 February 2025, including sites of one large media group, and restricted access to many of them.

  • Media and civil society

February 2025Open

Incident 2019

MirrorFace Campaigns Against Japan, 2019 To 2025

On 8 January 2025 Japan's National Police Agency (NPA) and the National center of Incident readiness and Strategy for Cybersecurity (NISC) said that cyberattack campaigns against Japanese…

  • Government and public sector

2019 to 2025Open

Incident 2024

PowerSchool Data Breach

In late 2024, an attacker used a PowerSchool contractor's compromised login to reach the student information systems of PowerSchool's school customers and copied data out.

  • Education

2024 to 2025Open

Incident 2024

US Treasury Breach Through BeyondTrust

In late 2024 a hacker gained access to the Departmental Offices network of the US Department of the Treasury, and the case became public in early January 2025.

  • Government and public sector

Late 2024Open

Incident 2024

NoName057(16) DDoS Campaigns Against Italy

From December 2024 Italian government bodies, airports and transport firms were hit by waves of DDoS attacks claimed by the pro-Russian group NoName057(16).

  • Government and public sector

December 2024 to July 2025Open

Incident 2024

Cleo File Transfer Attacks

In December 2024, attackers exploited two flaws, CVE-2024-50623 and CVE-2024-55956, in Cleo Harmony, VLTrader and LexiCom, which are managed file transfer products.

  • Multiple sectors

December 2024Open

Incident 2024

Salt Typhoon Telecom Intrusions

From at least 2021, state-sponsored hackers linked to China broke into the networks of telecom companies in many countries.

  • Telecommunications

October 2024Open

Incident 2024

Dutch Police Contact Data Breach, September 2024

On 26 September 2024 the Dutch police told the Justice Minister that a police account had been hacked and that work contact details of all police staff, more than 62,000 people, were taken.

  • Government and public sector

September 2024Open

Incident 2024

Paris 2024 Olympic Games Cyber Events

ANSSI, France's national cyber agency, received 548 cyber security events affecting entities linked to the Paris 2024 Olympic and Paralympic Games between 8 May and 8 September 2024.

  • Government and public sector

May to September 2024Open

Incident 2024

Synnovis NHS Pathology Ransomware Attack

On 3 June 2024 Synnovis, the pathology (blood test) provider for several London NHS hospitals, was hit by a ransomware attack that affected almost all of its IT systems.

  • Healthcare

June 2024 to November 2025Open

Incident 2024

DMM Bitcoin Crypto Theft, 2024

In May 2024 about 4,502.9 BTC, worth about 48.2 billion yen, left the wallets of the Japanese crypto exchange DMM Bitcoin without authorization.

  • Financial services

May 2024Open

Incident 2024

France Travail Data Breach, 2024

In the first quarter of 2024, attackers used social engineering to take over accounts of Cap emploi advisers and reach the France Travail job seeker database.

  • Government and public sector

Q1 2024Open

Incident 2024

Change Healthcare Ransomware Attack (February 2024)

The Change Healthcare ransomware attack of February 2024 hit a UnitedHealth Group company that moves claims and payments between providers, pharmacies and health plans.

  • Healthcare

February 2024Open

Incident 2024

Romanian Hospital Information System Ransomware Attack

The Romanian hospital information system ransomware attack hit the servers behind the hospital information system (HIS) used by many Romanian hospitals in the night of 11 to 12 February…

  • Healthcare

February 2024Open

Incident 2023

CyberAv3ngers Attacks On Unitronics PLCs, 2023

CyberAv3ngers is an Iranian IRGC-affiliated persona that claimed attacks on Israeli water, energy and shipping PLCs from September 2023.

  • Energy and utilities

September 2023Open

Incident 2023

British Library Ransomware Attack

The British Library ransomware attack began on Saturday 28 October 2023, when the Library found that ransomware had hit most of its online systems.

  • Education

October 2023Open

Incident 2023

Latitude Financial Data Theft, 2023

In March 2023 Latitude Financial, an Australian consumer finance company, told the ASX that attackers had stolen personal data.

  • Financial services

March 2023Open

Incident 2023

Attack And Data Leak Claims About The e-Devlet Gateway

In February 2023 and June 2026, claims that the e-Devlet gateway had been attacked or its user data leaked were rejected in official statements.

  • Government and public sector

February 2023 and June 2026Open

Incident 2022

AIIMS Delhi Cyber Attack, 2022

On 23 November 2022 the servers of the All India Institute of Medical Sciences (AIIMS) in New Delhi went down in a cyber attack that some reports called ransomware.

  • Healthcare

November to December 2022Open

Incident 2022

Medibank Ransomware And Data Theft, 2022

In October 2022 Medibank, one of Australia's largest private health insurers, found that attackers had taken customer data, later released on the dark web.

  • Financial services

October 2022Open

Incident 2022

SEDENA Guacamaya Hack And Leak, Mexico, 2022

In late September 2022 a hacktivist group calling itself Guacamaya began leaking data taken from Mexico's Secretariat of National Defence (Sedena).

  • Government and public sector

September 2022Open

Incident 2022

Cyberattacks On Taiwan During The August 2022 Pelosi Visit

On 2 August 2022, as US House Speaker Nancy Pelosi arrived in Taiwan, government agencies reported an unprecedented number of cyberattacks, and the Presidential Office website was briefly…

  • Government and public sector

August 2022Open

Incident 2022

Viasat KA-SAT Satellite Network Attack

On 24 February 2022, about one hour before Russia's full invasion of Ukraine, attackers disabled many satellite modems on Viasat's KA-SAT network.

  • Telecommunications

February 2022Open

Incident 2021

ConecteSUS And Ministry Of Health Systems Attack, Brazil, 2021

On 10 December 2021 the Brazilian Ministry of Health website, the ConecteSUS app and several national health systems went offline after an attack on the ministry's cloud environment.

  • Government and public sector

December 2021Open

Incident 2021

MuddyWater Campaign Against Turkish Government Entities

The US Treasury said in September 2022 that MuddyWater, a subordinate element of Iran's Ministry of Intelligence and Security, was assessed to have been involved, as recently as November…

  • Government and public sector

November 2021Open

Incident 2021

National Bank Of Pakistan Cyberattack, October 2021

The National Bank of Pakistan cyberattack hit the servers of the state-owned bank on the night of 29 October 2021 and disrupted some services, delaying payments to thousands of public…

  • Financial services

October 2021Open

Incident 2021

Lazio Region Ransomware Attack On The Regional Health System

In the night between 31 July and 1 August 2021, a ransomware attack hit the data center that runs the IT systems of the Lazio Region in Italy and its health services.

  • Government and public sector

July to August 2021Open

Incident 2021

Transnet Port Systems Ransomware Attack, 2021

On Thursday 22 July 2021 Transnet, South Africa's state-owned ports and freight company, suffered an IT security breach that it later said was a ransomware attack.

  • Transport and manufacturing

July 2021Open

Incident 2021

HSE Conti Ransomware Attack

In May 2021 Conti ransomware hit Ireland's Health Service Executive (HSE), the public health service.

  • Healthcare

May 2021Open

Incident 2021

Colonial Pipeline Ransomware Attack (May 2021)

The Colonial Pipeline ransomware attack began on 7 May 2021, when the US petroleum pipeline operator shut down its pipeline system after a DarkSide attack on its IT network.

  • Energy and utilities

May 2021Open

Incident 2021

Microsoft Exchange ProxyLogon Mass Exploitation, 2021

The Microsoft Exchange ProxyLogon attacks of early 2021 used four previously unknown flaws in on-premises Exchange Server to reach email servers around the world.

  • Multiple sectors

March 2021Open

Incident 2020

SolarWinds Orion Supply Chain Compromise

The SolarWinds Orion supply chain compromise was disclosed in December 2020, when attackers were found to have put a backdoor into Orion network monitoring updates released between March…

  • Technology and software supply chain

December 2020Open

Incident 2020

STJ Court Ransomware Attack, Brazil, 2020

On 3 November 2020 a ransomware attack hit the network of Brazil's Superior Court of Justice (STJ) during judgment sessions.

  • Government and public sector

November 2020Open

Incident 2019

Pemex Ransomware Attack, Mexico, 2019

Pemex, Mexico's state oil company, detected a ransomware attack on 10 November 2019 that began at a computer center in the State of Mexico.

  • Energy and utilities

November 2019Open

Incident 2019

Kudankulam Nuclear Plant Malware, 2019

In late October 2019 researchers said the network of the Kudankulam Nuclear Power Plant in Tamil Nadu was infected with Dtrack spyware.

  • Energy and utilities

September to November 2019Open

Incident 2018

Pakistani Bank Card Cyberattack, October 2018

The Pakistani bank card cyberattack began on 27 October 2018, when the Pakistani bank saw abnormal transactions on one of its international payment card schemes and shut the scheme down.

  • Financial services

October 2018Open

Incident 2017

SingHealth Patient Database Attack, 2018

Between August 2017 and July 2018 an attacker broke into the network of SingHealth, Singapore's largest public healthcare group, and copied the records of almost 1.5 million patients…

  • Healthcare

August 2017 to July 2018Open

Incident 2018

SPEI Interbank Payment System Attacks, Mexico, 2018

Between 17 April and 8 May 2018, attackers broke into the systems that five participants of Mexico's SPEI interbank payment system use to send payment orders.

  • Financial services

April 2018Open

Incident 2017

NotPetya Outbreak

NotPetya

NotPetya was a destructive outbreak that began in Ukraine on 27 June 2017.

  • Financial services

June 2017Open

Incident 2016

Kyiv Substation Attack With Industroyer

On 17 December 2016, malware called Industroyer, also known as CrashOverride, disrupted a transmission substation outside Kyiv, Ukraine.

  • Energy and utilities

December 2016Open

Incident 2017

Hack Of The Qatar News Agency (2017)

The Qatar News Agency hack happened in the early hours of 24 May 2017, when hackers took over the agency's website and social media accounts and posted false remarks attributed to the emir.

  • Government and public sector

May 2017Open

Incident 2016

Bangladesh Bank Heist

In February 2016 attackers sent fraudulent payment instructions over the SWIFT network from Bangladesh Bank's account at the Federal Reserve Bank of New York.

  • Financial services

February 2016Open

Incident 2015

2015 Ukraine Power Grid Attack

On 23 December 2015, remote intruders opened breakers at three regional electricity distribution companies in Ukraine.

  • Energy and utilities

December 2015Open

Incident 2015

German Bundestag Network Intrusion, 2015

In early May 2015 German authorities learned that attackers had compromised the internal network of the German Bundestag, the national parliament.

  • Government and public sector

May 2015Open

Incident 2015

TV5Monde Broadcast Sabotage, 2015

On the evening of 8 April 2015, the French-language broadcaster TV5Monde lost all its channels, its website and its social media accounts in a destructive cyber attack.

  • Media and civil society

April 2015Open

Incident 2012

Shamoon Wiper Attack On Saudi Aramco

On 15 August 2012 the Shamoon wiper virus hit workstations at Saudi Aramco, the Saudi national oil company.

  • Energy and utilities

August 2012Open

Brandefense

Stay Ahead Of Digital Threats.

Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.

Request a demo