Quick links
Press Enter to search, Esc to close
Threat Library
Major incidents with a dated timeline, how the attack worked, who was behind it and the lessons for defenders.
Incident 2026
LiteLLM 1.107.0 compromise, LiteLLM October 2026 supply chain attack
On 21 October 2026 a malicious LiteLLM 1.107.0 was published to PyPI and to the project's Docker image tags.
Read
Incident 2026
Railway security disclosure, Railway environment variable exposure
On 21 October 2026 the cloud platform Railway said an unauthorized third party may have accessed encrypted customer environment variables and, for some, obtained the decrypted contents.
Read
Incident 2026
UpdraftCentral key theft
The developer of the WordPress backup plugin UpdraftPlus and the UpdraftCentral dashboard says someone gained unauthorised access to its website over the weekend of 17 to 18 October 2026.
Read
Incident 2026
eMudhra emSign CA incident, emSign intermediate CA key compromise
In October 2026 a researcher reported that the private keys of eight eMudhra intermediate certificate authorities were so weak that anyone could recover them.
Read
Incident 2024
AdFection
AdFection is the name Citizen Lab gave to attacks that used targeted online ads. The ads installed mercenary spyware with no click.
Read
Incident 2026
On 27 September 2026 Citrix disclosed eight vulnerabilities in NetScaler ADC and NetScaler Gateway. Two of them were critical zero-days already being exploited.
Read
Incident 2026
In early August 2026 attackers took over the GitHub account of a maintainer of Keyv, a popular JavaScript caching library. They pushed malware into its npm packages.
Read
Incident 2026
In the night before 30 July 2026 an unknown actor got into Liechtenstein's register of beneficial owners (VwbP). The actor copied data on about 31,000 legal entities.
Read
Incident 2025
On 23 July 2026 the US CISA, NSA, FBI and partner agencies issued a warning. Russian state-supported actors, tracked mainly as LAUNDRY BEAR, were breaking into Zimbra Collaboration Suite webmail.
Read
Incident 2026
In July 2026 Hugging Face, an AI model and dataset platform, reported an intrusion into part of its production systems. An autonomous AI agent ran it from start to end.
Read
Incident 2026
In mid-June 2026 government agencies gave a warning. Leaked credentials for about 74,000 Fortinet firewalls and VPN gateways were being used against internet-facing devices.
Read
Incident 2026
AOMEI Backupper supply chain compromise
Attackers briefly changed the update files of the AOMEI Backupper installer. This ran at times between April and July 2026. The backup program then fetched and ran a backdoor.
Read
Incident 2026
In May 2026 CISA learned that internal AWS GovCloud keys had been posted in a public GitHub repository. A contractor owned the repository.
Read
Incident 2026
On 18 May 2026 an attacker published a malicious version 18.95.0 of the Nx Console extension for VS Code. The attacker used the identity of a real Nx contributor.
Read
Incident 2026
The TanStack npm worm, also called Mini Shai-Hulud, was a supply chain attack.
Read
Incident 2026
Between March and September 2026 CISA added eight Microsoft SharePoint vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog.
Read
Incident 2026
US agencies say Iranian-affiliated actors have disrupted internet-exposed industrial controllers (PLCs) since at least March 2026. They hit US government, water and energy organizations.
Read
Incident 2026
On 31 March 2026 two malicious versions of the Axios JavaScript library (1.14.1 and 0.30.4) were published to npm. The lead maintainer's account was compromised.
Read
Incident 2026
On 24 March 2026 two malicious versions of LiteLLM (1.82.7 and 1.82.8) were published to PyPI. LiteLLM is a popular AI gateway package. The versions carried a stealer for SSH keys, cloud credentials and Kubernetes tokens.
Read
Incident 2026
The Dutch Ministry of Finance found on 19 March 2026 that an unauthorized actor had accessed part of its IT systems.
Read
Incident 2026
In March 2026 an attacker used stolen credentials to publish a malicious version of the Trivy security scanner. The attacker also replaced the tags of two of its GitHub Actions with code that steals credentials.
Read
Incident 2026
On 25 February 2026 CISA and partner agencies in Australia, Canada, New Zealand and the UK said attackers were breaking into Cisco SD-WAN systems worldwide.
Read
Incident 2026
In January 2026 attackers abused a new login bypass, CVE-2026-24858. It was in Fortinet's FortiCloud single sign-on.
Read
Incident 2025
On 29 December 2025 coordinated destructive attacks hit more than 30 wind and solar farms in Poland. They also hit a large combined heat and power plant and a manufacturing company.
Read
Incident 2025
Coupang, South Korea's largest online retailer, said on 29 November 2025 that personal data of about 33.7 million customer accounts had been exposed.
Read
Incident 2025
On 15 October 2025 F5, a maker of network and application delivery products, told the US SEC about an intrusion. A nation-state threat actor had long-term access to its BIG-IP development environment.
Read
Incident 2025
On 19 September 2025 RTX found a ransomware incident on systems that support Collins Aerospace's MUSE software. Airlines use MUSE to share check-in and boarding resources at airports.
Read
Incident 2025
In mid-September 2025 a self-copying worm called Shai-Hulud spread through the npm package registry. It is the main store for JavaScript code.
Read
Incident 2025
On 2 September 2025 Jaguar Land Rover (JLR) said a cyber incident had hit it. It shut down its own systems.
Read
Incident 2025
In July 2025 hackers broke into a laboratory in Rijswijk. It analyses cervical cancer screening tests for the Dutch national screening organization.
Read
Incident 2025
In July 2025 attackers exploited flaws in on-premises Microsoft SharePoint Server. The attack chain was called ToolShell.
Read
Incident 2025
In 2025 an advanced persistent threat actor called UNC3886 attacked all four of Singapore's major telecom operators.
Read
Incident 2025
On 1 July 2025 criminals used login details tied to a Brazilian firm that links banks to the central bank and Pix. They moved money out of the banks' reserve accounts.
Read
Incident 2025
In June 2025 a database that was said to hold 16.3 million records of Kazakh residents appeared in open access. It held personal data.
Read
Incident 2021
On 29 April 2025 France's foreign ministry said Russia's military intelligence service (GRU) had used the APT28 attack group. It targeted or compromised a dozen French entities since 2021.
Read
Incident 2025
In April 2025 South Korea's largest mobile carrier, SK Telecom, found that attackers had stolen USIM data. It came from its core subscriber servers.
Read
Incident 2025
In April 2025 Marks & Spencer, the Co-op Group and Harrods were hit by separate cyber attacks. The UK National Crime Agency investigated them together.
Read
Incident 2025
In March 2025 the popular GitHub Action tj-actions/changed-files was compromised.
Read
Incident 2025
On 21 February 2025 attackers stole about 1.5 billion US dollars in crypto assets. They took it from one Ethereum cold wallet of the exchange Bybit.
Read
Incident 2025
On 20 February 2025 cyberattacks hit more than ten major media platforms in Azerbaijan. Access to many of them was restricted.
Read
Incident 2019
On 8 January 2025 Japan's police agency (NPA) and the NISC said an actor called MirrorFace was behind attacks on Japanese organizations. The campaigns had run since about 2019.
Read
Incident 2024
In late 2024 an attacker used a compromised login of a PowerSchool contractor. It gave access to the student information systems of PowerSchool's school customers, and data was copied out.
Read
Incident 2024
In late 2024 a hacker gained access to the Departmental Offices network of the US Department of the Treasury. The case became public in early January 2025.
Read
Incident 2024
From December 2024 waves of DDoS attacks hit Italian government bodies, airports and transport firms. The pro-Russian group NoName057(16) claimed them.
Read
Incident 2024
In December 2024 attackers exploited two flaws, CVE-2024-50623 and CVE-2024-55956. They affect Cleo Harmony, VLTrader and LexiCom, which are managed file transfer products.
Read
Incident 2024
Cyber attacks and platform manipulation surrounded Romania's 2024 presidential election. On 6 December 2024 the Constitutional Court annulled the whole election process.
Read
Incident 2024
State-sponsored hackers linked to China broke into the networks of telecom companies in many countries. This has gone on since at least 2021.
Read
Incident 2024
On 26 September 2024 the Dutch police told the Justice Minister that a police account had been hacked. Work contact details of all police staff, more than 62,000 people, were taken.
Read
Incident 2024
France's national cyber agency, ANSSI, received 548 cyber security events between 8 May and 8 September 2024. They affected entities linked to the Paris 2024 Olympic and Paralympic Games.
Read
Incident 2024
A ransomware attack on 20 June 2024 disrupted Indonesia's Temporary National Data Center 2 in Surabaya. The center hosts central and local government systems.
Read
Incident 2024
On 3 June 2024 a ransomware attack hit Synnovis, the blood test provider for several London NHS hospitals. It affected almost all of its IT systems.
Read
Incident 2024
In May 2024 about 4,502.9 BTC, worth about 48.2 billion yen, left the wallets of the Japanese crypto exchange DMM Bitcoin. It was taken without authorization.
Read
Incident 2024
In May 2024 Santander said an unauthorized party had accessed a database. The database was hosted by a third-party provider.
Read
Incident 2024
The German Federal Government publicly blamed APT28 for the attack on the SPD executive on 3 May 2024.
Read
Incident 2024
In the first quarter of 2024 attackers used social engineering to take over accounts of Cap emploi advisers. Through them they reached the France Travail job seeker database.
Read
Incident 2024
The Change Healthcare ransomware attack hit a UnitedHealth Group company in February 2024. The company moves claims and payments between providers, pharmacies and health plans.
Read
Incident 2024
In the night of 11 to 12 February 2024 a ransomware attack hit the servers behind the hospital information system (HIS). Many Romanian hospitals use it.
Read
Incident 2023
COATHANGER is advanced Chinese malware. The MIVD and AIVD found it on an isolated research network of the Dutch Ministry of Defence.
Read
Incident 2023
On 12 December 2023 a cyber attack hit Kyivstar, Ukraine's largest mobile operator. It has about 24 million mobile subscribers.
Read
Incident 2023
CyberAv3ngers is an Iranian persona linked to the IRGC. It claimed attacks on Israeli water, energy and shipping PLCs from September 2023.
Read
Incident 2023
The British Library ransomware attack began on Saturday 28 October 2023. The Library found that ransomware had hit most of its online systems.
Read
Incident 2023
In 2023 the Predator spyware was used against an Egyptian opposition candidate. He was a leading figure who planned to run for president, according to reports of 23 and 24 September 2023.
Read
Incident 2023
From 8 May 2023 customers of Bank Syariah Indonesia (BSI), the country's largest Islamic bank, could not use mobile banking, ATMs or branches.
Read
Incident 2023
In March 2023 Latitude Financial, an Australian finance company, told the ASX that attackers had stolen personal data.
Read
Incident 2023
On 25 February 2023 Nigeria's election commission (INEC) could not publish result sheets on its portal, IReV. The outage lasted many hours, and in some places weeks.
Read
Incident 2023
In February 2023 and June 2026 there were claims that the e-Devlet gateway was attacked or its user data leaked. Official statements rejected them.
Read
Incident 2023
In early February 2023 a ransomware campaign hit VMware ESXi servers. They were exposed to the internet and not patched.
Read
Incident 2022
On 23 November 2022 the servers of AIIMS in New Delhi went down in a cyber attack. Some reports called it ransomware.
Read
Incident 2020
Emennet Pasargad is an Iranian group. The FBI says it has run hack-and-leak and information operations, mainly against Israel, since at least 2020.
Read
Incident 2022
In October 2022 Medibank, a large Australian health insurer, found that attackers had taken customer data. The data was later put on the dark web.
Read
Incident 2022
In late September 2022 a hacktivist group called Guacamaya began leaking data. The data came from Mexico's Secretariat of National Defence (Sedena).
Read
Incident 2022
On 2 August 2022 US House Speaker Nancy Pelosi arrived in Taiwan. That day government agencies reported a record number of cyberattacks, and an overseas attack briefly took the Presidential Office website offline.
Read
Incident 2021
Ghostwriter, which CERT Polska tracks as UNC1151, has run phishing, malware and disinformation campaigns in Poland. They have targeted people and bodies there since at least mid 2021.
Read
Incident 2022
On 24 February 2022, about one hour before Russia's full invasion of Ukraine, attackers disabled many satellite modems. They were on Viasat's KA-SAT network.
Read
Incident 2021
On 10 December 2021 the Brazilian Ministry of Health website, the ConecteSUS app and national health systems went offline. The cause was an attack on the ministry's cloud.
Read
Incident 2021
Cisco Talos saw MuddyWater target Turkish government bodies, including TÜBİTAK, as recently as November 2021, using PDFs that led to Excel macros.
Read
Incident 2021
On the night of 29 October 2021 an attack hit the servers of the National Bank of Pakistan. Some services were disrupted, and payments to thousands of public sector staff were delayed.
Read
Incident 2021
In October 2021 the Hive ransomware group attacked the health information systems of Newfoundland and Labrador in Canada.
Read
Incident 2021
On the evening of 6 September 2021 ransomware locked the IT systems of South Africa's Department of Justice and Constitutional Development.
Read
Incident 2021
In the night between 31 July and 1 August 2021 a ransomware attack hit the data center of the Lazio Region in Italy. The data center runs the region's IT systems and health services.
Read
Incident 2021
On 22 July 2021 Transnet, South Africa's state ports and freight company, suffered a security breach. It later said this was a ransomware attack.
Read
Incident 2021
In early July 2021 a ransomware attack hit the district of Anhalt-Bitterfeld in Saxony-Anhalt, Germany. It nearly stopped the whole district administration.
Read
Incident 2021
In May 2021 Conti ransomware hit Ireland's Health Service Executive (HSE), the public health service.
Read
Incident 2021
The Colonial Pipeline ransomware attack began on 7 May 2021. The US pipeline operator shut down its pipeline system after a DarkSide attack on its IT network.
Read
Incident 2021
On 9 March 2021 Spain's State Public Employment Service (SEPE) had a security incident. Its information and communications systems were interrupted.
Read
Incident 2021
The ProxyLogon attacks of early 2021 hit Microsoft Exchange Server. They used four unknown flaws to reach email servers around the world.
Read
Incident 2020
The SolarWinds Orion compromise was disclosed in December 2020. Attackers had put a backdoor into Orion network monitoring updates released between March and June 2020.
Read
Incident 2020
A ransomware attack hit the network of Brazil's Superior Court of Justice (STJ) on 3 November 2020. It struck during judgment sessions.
Read
Incident 2020
On 12 October 2020 a widespread power outage hit Mumbai and its suburbs. Trains stopped and exams were delayed.
Read
Incident 2019
Pemex, Mexico's state oil company, found a ransomware attack on 10 November 2019. It began at a computer center in the State of Mexico.
Read
Incident 2019
In late October 2019 researchers said the network of the Kudankulam Nuclear Power Plant in Tamil Nadu was infected with Dtrack spyware.
Read
Incident 2019
Operation reWired was a four-month sweep against business email compromise (BEC) schemes. The US Department of Justice and the FBI announced it on 10 September 2019.
Read
Incident 2018
The Pakistani bank card attack began on 27 October 2018. The bank saw odd transactions on one of its international card schemes and shut the scheme down.
Read
Incident 2017
Between August 2017 and July 2018 an attacker broke into the network of SingHealth, Singapore's largest public healthcare group. The attacker copied the records of almost 1.5 million patients.
Read
Incident 2018
Between 17 April and 8 May 2018, attackers broke into systems used by five participants of Mexico's SPEI payment system. They used them to send payment orders.
Read
Incident 2018
McAfee reported the North Korea-linked Bankshot implant at five Turkish finance organizations in March 2018, delivered by a Flash exploit.
Read
Incident 2017
NotPetya
NotPetya was a destructive outbreak that began in Ukraine on 27 June 2017.
Read
Incident 2016
On 17 December 2016 malware called Industroyer, also known as CrashOverride, disrupted a transmission substation outside Kyiv, Ukraine.
Read
Incident 2017
The Qatar News Agency hack happened in the early hours of 24 May 2017. Hackers took over its website and social media accounts and posted false remarks attributed to the emir.
Read
Incident 2017
On Friday 12 May 2017 the WannaCry ransomware locked computers across the NHS in England. It was released worldwide.
Read
Incident 2016
In April 2016 a database with the personal details of nearly 50 million Turkish citizens was posted online.
Read
Incident 2016
In February 2016 attackers sent fraudulent payment instructions over the SWIFT network. They came from Bangladesh Bank's account at the Federal Reserve Bank of New York.
Read
Incident 2015
On 23 December 2015 remote intruders opened breakers at three regional electricity distribution companies in Ukraine.
Read
Incident 2015
From 14 December 2015 DDoS attacks hit the servers of Turkey's .tr domain registry, large internet providers and banks, according to BuzzFeed News and Al-Monitor.
Read
Incident 2015
In early May 2015 German authorities learned that attackers had compromised the internal network of the German Bundestag, the national parliament.
Read
Incident 2015
On the evening of 8 April 2015 the French-language broadcaster TV5Monde lost all its channels, its website and its social media accounts. It was a destructive cyber attack.
Read
Incident 2014
In December 2014 a Twitter account posted data from Korea Hydro and Nuclear Power Co. (KHNP) online. KHNP is the state-run operator of all 23 South Korean nuclear reactors.
Read
Incident 2013
On 20 March 2013, at about 2 p.m., the networks of three South Korean broadcasters (KBS, MBC and YTN) stopped working. Several banks went down at the same time.
Read
Incident 2012
On 15 August 2012 the Shamoon wiper virus hit workstations at Saudi Aramco, the Saudi national oil company.
Read
Nothing matches. Try another word or filter.
About This List
This list holds 109 major cyber incidents. Each card shows the name, the year, the sector and a short summary. Open a card to read the full story. Every incident page has a dated timeline. It also explains how the attack worked, who was behind it and what defenders can learn.
To find an incident fast, use the sector and year buttons above the cards. You can also type a word in the search box at the top, such as a country, a sector or a malware name.
Counts as of 7 November 2026
Brandefense
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.
