Incident 2026
Citrix NetScaler Zero-Day Exploitation
On 27 September 2026 Citrix disclosed eight vulnerabilities in NetScaler ADC and NetScaler Gateway, two of them critical zero-days already being exploited.
- Multiple sectors
Open
Quick links
Press Enter to search, Esc to close
Threat Library
Major incidents with a dated timeline, how the attack worked, who was behind it and the lessons for defenders.
Incident 2026
On 27 September 2026 Citrix disclosed eight vulnerabilities in NetScaler ADC and NetScaler Gateway, two of them critical zero-days already being exploited.
Open
Incident 2026
In early August 2026, attackers took over the GitHub account of a maintainer of Keyv, a widely used JavaScript caching library, and pushed malware into its npm packages.
Open
Incident 2026
In the night before 30 July 2026, an unknown actor got into Liechtenstein's register of beneficial owners (VwbP) and copied data on about 31,000 legal entities.
Open
Incident 2025
On 23 July 2026 the US CISA, NSA, FBI and partner agencies warned that Russian state-supported actors, tracked mainly as LAUNDRY BEAR, were breaking into Zimbra Collaboration Suite webmail.
Open
Incident 2026
In July 2026 Hugging Face, an AI model and dataset platform, reported an intrusion into part of its production systems, run end to end by an autonomous AI agent.
Open
Incident 2026
In mid-June 2026, government agencies warned that leaked credentials for about 74,000 Fortinet firewalls and VPN gateways were being used against internet-facing devices.
Open
Incident 2026
In May 2026 CISA learned that internal AWS GovCloud keys and other internal material had been posted in a public GitHub repository owned by one of its contractors.
Open
Incident 2026
On 18 May 2026 an attacker published a malicious version 18.95.0 of the Nx Console extension for VS Code, using a real Nx contributor's identity.
Open
Incident 2026
The TanStack npm worm, also called Mini Shai-Hulud, was a supply chain attack.
Open
Incident 2026
Between March and September 2026, CISA added eight Microsoft SharePoint vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog.
Open
Incident 2026
US agencies say Iranian-affiliated actors have been disrupting internet-exposed industrial controllers (PLCs) in US government, water and energy organizations since at least March 2026.
Open
Incident 2026
On 31 March 2026, two malicious versions of the Axios JavaScript library (1.14.1 and 0.30.4) were published to the npm registry through the lead maintainer's compromised account.
Open
Incident 2026
On 24 March 2026, two malicious versions of LiteLLM (1.82.7 and 1.82.8), a widely used AI gateway package, were published to PyPI with a credential stealer that looked for SSH keys, cloud…
Open
Incident 2026
The Dutch Ministry of Finance breach began when the ministry found on 19 March 2026 that an unauthorized actor had accessed part of its IT systems.
Open
Incident 2026
In March 2026 an attacker used stolen credentials to publish a malicious version of the Trivy security scanner and to replace the tags of two of its GitHub Actions with credential-stealing…
Open
Incident 2026
On 25 February 2026, CISA and partner agencies in Australia, Canada, New Zealand and the UK said attackers were breaking into Cisco SD-WAN systems worldwide.
Open
Incident 2026
In January 2026, attackers abused a new login bypass (CVE-2026-24858) in Fortinet's FortiCloud single sign-on.
Open
Incident 2025
On 29 December 2025, coordinated destructive attacks hit more than 30 wind and solar farms, a large combined heat and power plant and a manufacturing company in Poland.
Open
Incident 2025
Coupang, South Korea's largest online retailer, disclosed on 29 November 2025 that the personal data of about 33.7 million customer accounts had been exposed.
Open
Incident 2025
On 15 October 2025 F5, a maker of network and application delivery products, told the US SEC that a nation-state threat actor had long-term access to its BIG-IP development environment.
Open
Incident 2025
On 19 September 2025 RTX found a ransomware incident on systems that support Collins Aerospace's MUSE software, which lets airlines share check-in and boarding resources at airports.
Open
Incident 2025
In mid-September 2025, a self-copying worm called Shai-Hulud spread through the npm package registry, the main store for JavaScript code.
Open
Incident 2025
On 2 September 2025 Jaguar Land Rover (JLR) said a cyber incident had hit it, and it shut down its own systems.
Open
Incident 2025
In July 2025 hackers broke into a laboratory in Rijswijk that analyses cervical cancer screening tests for the Dutch national screening organization.
Open
Incident 2025
In July 2025, attackers exploited flaws in on-premises Microsoft SharePoint Server in an attack chain called ToolShell.
Open
Incident 2025
In 2025 an advanced persistent threat actor called UNC3886 attacked all four of Singapore's major telecommunications operators.
Open
Incident 2025
On 1 July 2025 criminals used login credentials tied to a Brazilian firm that connects financial institutions to the central bank and Pix, to move money out of reserve accounts that banks…
Open
Incident 2025
The Kazakhstan resident database leak of June 2025 involved a database said to hold 16.3 million records with personal data of Kazakh residents, which appeared in open access.
Open
Incident 2021
On 29 April 2025 France's foreign ministry formally said that Russia's military intelligence service (GRU) used the APT28 attack group to target or compromise a dozen French entities since…
Open
Incident 2025
In April 2025, South Korea's largest mobile carrier, SK Telecom, found that attackers had stolen USIM data from its core subscriber servers.
Open
Incident 2025
In April 2025, Marks & Spencer, the Co-op Group and Harrods were hit by separate cyber attacks that the UK National Crime Agency investigated together.
Open
Incident 2025
In March 2025 the popular GitHub Action tj-actions/changed-files was compromised.
Open
Incident 2025
On 21 February 2025, attackers stole about 1.5 billion US dollars in crypto assets from one Ethereum cold wallet of the exchange Bybit.
Open
Incident 2025
The cyberattacks on Azerbaijani media outlets hit more than ten major media platforms on 20 February 2025, including sites of one large media group, and restricted access to many of them.
Open
Incident 2019
On 8 January 2025 Japan's National Police Agency (NPA) and the National center of Incident readiness and Strategy for Cybersecurity (NISC) said that cyberattack campaigns against Japanese…
Open
Incident 2024
In late 2024, an attacker used a PowerSchool contractor's compromised login to reach the student information systems of PowerSchool's school customers and copied data out.
Open
Incident 2024
In late 2024 a hacker gained access to the Departmental Offices network of the US Department of the Treasury, and the case became public in early January 2025.
Open
Incident 2024
From December 2024 Italian government bodies, airports and transport firms were hit by waves of DDoS attacks claimed by the pro-Russian group NoName057(16).
Open
Incident 2024
In December 2024, attackers exploited two flaws, CVE-2024-50623 and CVE-2024-55956, in Cleo Harmony, VLTrader and LexiCom, which are managed file transfer products.
Open
Incident 2024
The cyber attacks and platform manipulation around Romania's 2024 presidential election led the Constitutional Court to annul the whole election process on 6 December 2024.
Open
Incident 2024
From at least 2021, state-sponsored hackers linked to China broke into the networks of telecom companies in many countries.
Open
Incident 2024
On 26 September 2024 the Dutch police told the Justice Minister that a police account had been hacked and that work contact details of all police staff, more than 62,000 people, were taken.
Open
Incident 2024
ANSSI, France's national cyber agency, received 548 cyber security events affecting entities linked to the Paris 2024 Olympic and Paralympic Games between 8 May and 8 September 2024.
Open
Incident 2024
The PDNS 2 national data center ransomware attack on 20 June 2024 disrupted Indonesia's Temporary National Data Center 2 in Surabaya, which hosts central and local government systems.
Open
Incident 2024
On 3 June 2024 Synnovis, the pathology (blood test) provider for several London NHS hospitals, was hit by a ransomware attack that affected almost all of its IT systems.
Open
Incident 2024
In May 2024 about 4,502.9 BTC, worth about 48.2 billion yen, left the wallets of the Japanese crypto exchange DMM Bitcoin without authorization.
Open
Incident 2024
In May 2024 Santander said an unauthorized party had accessed a database hosted by a third-party provider.
Open
Incident 2024
The APT28 attack on the SPD executive was publicly attributed by the German Federal Government on 3 May 2024.
Open
Incident 2024
In the first quarter of 2024, attackers used social engineering to take over accounts of Cap emploi advisers and reach the France Travail job seeker database.
Open
Incident 2024
The Change Healthcare ransomware attack of February 2024 hit a UnitedHealth Group company that moves claims and payments between providers, pharmacies and health plans.
Open
Incident 2024
The Romanian hospital information system ransomware attack hit the servers behind the hospital information system (HIS) used by many Romanian hospitals in the night of 11 to 12 February…
Open
Incident 2023
COATHANGER is advanced Chinese malware that the MIVD and AIVD found on an isolated Dutch Ministry of Defence research network.
Open
Incident 2023
On 12 December 2023 a cyber attack hit Kyivstar, Ukraine's largest mobile operator, with about 24 million mobile subscribers.
Open
Incident 2023
CyberAv3ngers is an Iranian IRGC-affiliated persona that claimed attacks on Israeli water, energy and shipping PLCs from September 2023.
Open
Incident 2023
The British Library ransomware attack began on Saturday 28 October 2023, when the Library found that ransomware had hit most of its online systems.
Open
Incident 2023
The Predator spyware attempts against an Egyptian opposition candidate in 2023 targeted a leading figure who planned to run for president, according to reports of 23 and 24 September 2023.
Open
Incident 2023
From 8 May 2023 customers of Bank Syariah Indonesia (BSI), the country's largest Islamic bank, could not use its mobile banking, ATMs and branches.
Open
Incident 2023
In March 2023 Latitude Financial, an Australian consumer finance company, told the ASX that attackers had stolen personal data.
Open
Incident 2023
On 25 February 2023 Nigeria's election commission (INEC) could not publish presidential result sheets on its public results portal, IReV, for many hours and in some places for weeks.
Open
Incident 2023
In February 2023 and June 2026, claims that the e-Devlet gateway had been attacked or its user data leaked were rejected in official statements.
Open
Incident 2023
In early February 2023 a ransomware campaign hit VMware ESXi servers that were exposed to the internet and not patched.
Open
Incident 2022
On 23 November 2022 the servers of the All India Institute of Medical Sciences (AIIMS) in New Delhi went down in a cyber attack that some reports called ransomware.
Open
Incident 2020
Emennet Pasargad is an Iranian group that the FBI says has run hack-and-leak and information operations, mainly against Israel, since at least 2020.
Open
Incident 2022
In October 2022 Medibank, one of Australia's largest private health insurers, found that attackers had taken customer data, later released on the dark web.
Open
Incident 2022
In late September 2022 a hacktivist group calling itself Guacamaya began leaking data taken from Mexico's Secretariat of National Defence (Sedena).
Open
Incident 2022
On 2 August 2022, as US House Speaker Nancy Pelosi arrived in Taiwan, government agencies reported an unprecedented number of cyberattacks, and the Presidential Office website was briefly…
Open
Incident 2021
Ghostwriter, which CERT Polska tracks as UNC1151, has run phishing, malware and disinformation campaigns against people and bodies in Poland since at least mid 2021.
Open
Incident 2022
On 24 February 2022, about one hour before Russia's full invasion of Ukraine, attackers disabled many satellite modems on Viasat's KA-SAT network.
Open
Incident 2021
On 10 December 2021 the Brazilian Ministry of Health website, the ConecteSUS app and several national health systems went offline after an attack on the ministry's cloud environment.
Open
Incident 2021
The US Treasury said in September 2022 that MuddyWater, a subordinate element of Iran's Ministry of Intelligence and Security, was assessed to have been involved, as recently as November…
Open
Incident 2021
The National Bank of Pakistan cyberattack hit the servers of the state-owned bank on the night of 29 October 2021 and disrupted some services, delaying payments to thousands of public…
Open
Incident 2021
In October 2021 the Hive ransomware group attacked the health information systems of Newfoundland and Labrador, Canada.
Open
Incident 2021
On the evening of 6 September 2021 ransomware encrypted the IT systems of South Africa's Department of Justice and Constitutional Development.
Open
Incident 2021
In the night between 31 July and 1 August 2021, a ransomware attack hit the data center that runs the IT systems of the Lazio Region in Italy and its health services.
Open
Incident 2021
On Thursday 22 July 2021 Transnet, South Africa's state-owned ports and freight company, suffered an IT security breach that it later said was a ransomware attack.
Open
Incident 2021
In early July 2021 a ransomware attack on the district of Anhalt-Bitterfeld in Saxony-Anhalt, Germany, nearly stopped the whole district administration.
Open
Incident 2021
In May 2021 Conti ransomware hit Ireland's Health Service Executive (HSE), the public health service.
Open
Incident 2021
The Colonial Pipeline ransomware attack began on 7 May 2021, when the US petroleum pipeline operator shut down its pipeline system after a DarkSide attack on its IT network.
Open
Incident 2021
Spain's State Public Employment Service (SEPE) suffered a security incident on 9 March 2021 that interrupted the availability of its information and communications systems.
Open
Incident 2021
The Microsoft Exchange ProxyLogon attacks of early 2021 used four previously unknown flaws in on-premises Exchange Server to reach email servers around the world.
Open
Incident 2020
The SolarWinds Orion supply chain compromise was disclosed in December 2020, when attackers were found to have put a backdoor into Orion network monitoring updates released between March…
Open
Incident 2020
On 3 November 2020 a ransomware attack hit the network of Brazil's Superior Court of Justice (STJ) during judgment sessions.
Open
Incident 2020
On 12 October 2020 a widespread power outage hit Mumbai and its suburbs, stopping trains and delaying exams.
Open
Incident 2019
Pemex, Mexico's state oil company, detected a ransomware attack on 10 November 2019 that began at a computer center in the State of Mexico.
Open
Incident 2019
In late October 2019 researchers said the network of the Kudankulam Nuclear Power Plant in Tamil Nadu was infected with Dtrack spyware.
Open
Incident 2019
Operation reWired was a four-month sweep against business email compromise (BEC) schemes, announced by the US Department of Justice and the FBI on 10 September 2019.
Open
Incident 2018
The Pakistani bank card cyberattack began on 27 October 2018, when the Pakistani bank saw abnormal transactions on one of its international payment card schemes and shut the scheme down.
Open
Incident 2017
Between August 2017 and July 2018 an attacker broke into the network of SingHealth, Singapore's largest public healthcare group, and copied the records of almost 1.5 million patients…
Open
Incident 2018
Between 17 April and 8 May 2018, attackers broke into the systems that five participants of Mexico's SPEI interbank payment system use to send payment orders.
Open
Incident 2018
MITRE ATT&CK says that in 2018 Lazarus Group used the Bankshot implant, a remote access tool, in attacks against the Turkish financial sector.
Open
Incident 2017
NotPetya
NotPetya was a destructive outbreak that began in Ukraine on 27 June 2017.
Open
Incident 2016
On 17 December 2016, malware called Industroyer, also known as CrashOverride, disrupted a transmission substation outside Kyiv, Ukraine.
Open
Incident 2017
The Qatar News Agency hack happened in the early hours of 24 May 2017, when hackers took over the agency's website and social media accounts and posted false remarks attributed to the emir.
Open
Incident 2017
On Friday 12 May 2017 the WannaCry ransomware, released worldwide, locked computers across the NHS in England.
Open
Incident 2016
In April 2016 a database with the personal details of nearly 50 million Turkish citizens was posted online.
Open
Incident 2016
In February 2016 attackers sent fraudulent payment instructions over the SWIFT network from Bangladesh Bank's account at the Federal Reserve Bank of New York.
Open
Incident 2015
On 23 December 2015, remote intruders opened breakers at three regional electricity distribution companies in Ukraine.
Open
Incident 2015
From 14 December 2015, DDoS attacks hit the servers of Turkey's .tr domain registry, large internet providers and banks, according to BuzzFeed News and Al-Monitor.
Open
Incident 2015
In early May 2015 German authorities learned that attackers had compromised the internal network of the German Bundestag, the national parliament.
Open
Incident 2015
On the evening of 8 April 2015, the French-language broadcaster TV5Monde lost all its channels, its website and its social media accounts in a destructive cyber attack.
Open
Incident 2014
In December 2014 data from Korea Hydro & Nuclear Power Co.
Open
Incident 2013
On 20 March 2013 at about 2 p.m., the networks of three South Korean broadcasters (KBS, MBC and YTN) and several banks stopped working at the same time.
Open
Incident 2012
On 15 August 2012 the Shamoon wiper virus hit workstations at Saudi Aramco, the Saudi national oil company.
Open
Nothing matches. Try another word or filter.
Counts as of 17 October 2026
Brandefense
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.