Site Map · 143 pages
Incidents and Country Threat Profiles
Incident pages tell the story of a major cyberattack or data breach: what happened, who was behind it and what others can learn from it. Country pages describe the threat landscape of one country. This page lists all of them, with a short summary of each.
Countries 33
- Countries
- Australia Australia cyber threat profile: state-linked espionage, ransomware and data theft, groups official sources link to Australia, sectors hit and laws.
- Azerbaijan Azerbaijan cyber threat profile: state-linked espionage, DDoS on telecoms and fraud, with official figures, national bodies and linked groups.
- Brazil Brazil cyber threat profile: banking trojans, ransomware against health services, groups official sources link to Brazil, and national bodies and rules.
- Canada Canada cyber threat profile: state espionage, ransomware and denial of service, groups official sources link to Canada, sectors hit and national bodies.
- Egypt Egypt cyber threat profile: spyware, regional espionage, fraud and data sales, with the national bodies, laws and major incidents that sources describe.
- France France cyber threats: espionage, data theft and ransomware, groups that ANSSI and the foreign ministry link to France, major incidents and national bodies.
- Germany Germany cyber threats: sectors hit, groups that German and US sources link to the country, BSI and BKA findings, and the national bodies to know.
- India India cyber threat profile: CERT-In incident figures, national bodies, data protection rules and past attacks on a hospital, nuclear plant and grid.
- Indonesia Indonesia cyber threat profile: ransomware on the national data centre, data leaks and fraud, with BSSN, the laws and what official sources say.
- Ireland Ireland cyber threat profile: what official Irish sources say about ransomware, the 2021 HSE attack, state-aligned activity and the bodies to know.
- Israel Israel cyber threat profile: Iranian groups linked by official sources to attacks on water, energy, health and defence, plus national bodies and incidents.
- Italy Italy cyber threats: ransomware, DDoS by pro-Russian groups and data exposure, ACN figures, groups linked to Italy and the national bodies and rules.
- Japan Japan cyber threat profile: espionage, ransomware against manufacturers and crypto theft, with National Police Agency figures and national bodies.
- Kazakhstan Kazakhstan cyber threat profile: cybercrime losses, DDoS waves and personal data theft, with official figures, national bodies and major incidents.
- Mexico Mexico cyber threat profile: attacks on banks, payment systems and state bodies, banking fraud, and the threat groups official sources link to Mexico.
- Netherlands
- Nigeria Nigeria cyber threat profile: government website defacement and ransomware, North Korea-linked bank targeting, sectors hit and national bodies.
- Pakistan Pakistan cyber threat profile: espionage groups, bank incidents, PKCERT and the National Cyber Security Policy 2021, from official and MITRE sources.
- Poland
- Qatar Qatar cyber threat profile: the 2017 Qatar News Agency hack, the national cyber agency's drills and standards, and why no threat group is officially named.
- Romania Romania cyber threat profile: Russian state-linked groups and hacktivists, key incidents, national cyber law and how incident response is organised.
- Saudi Arabia Saudi Arabia cyber threat profile: Iran-linked and other state groups named by official sources, the 2012 Saudi Aramco wiper attack and national bodies.
- Singapore Singapore cyber threat profile: state-linked espionage on telecoms, ransomware and botnets, with national bodies, the SingHealth case and official sources.
- South Africa South Africa cyber threat profile: ransomware against departments and state companies, data leaks, the main laws and the national bodies to know.
- South Korea South Korea cyber threat profile: groups that official sources link to the country, sectors hit, and the national bodies and laws to know.
- Spain Spain cyber threats: fraud, malware and ransomware, INCIBE-CERT figures, MITRE ATT&CK mentions, major incidents and the national bodies and rules to know.
- Taiwan Taiwan cyber threat profile: groups that official sources link to Taiwan, sectors hit, NSB and MODA reporting, and the national bodies to know.
- Türkiye Türkiye threat groups, targeted sectors, notable incidents and national bodies, drawn from official advisories, MITRE ATT&CK and Brandefense research.
- Ukraine Ukraine cyber threats: Russian state operations, groups such as Sandworm, APT28 and Gamaredon, sectors hit and the national bodies and laws to know.
- United Arab Emirates
- United Kingdom United Kingdom cyber threats: the sectors hit, the threat groups UK bodies link to the country, NCSC incident figures and the national bodies to know.
- United States United States cyber threats: the sectors attackers target, groups that CISA, the FBI and the NSA link to the country, major incidents and national bodies.
Significant Cyber Incidents 110
- Significant Cyber Incidents
- 2015 Ukraine power grid attack 2015 Ukraine power grid attack: how intruders opened breakers at three utilities, cut power to about 225,000 customers and wiped systems with KillDisk.
- AdFection: spyware delivered through targeted online ads How the AdFection attacks used targeted online ads to install Candiru spyware with no click, what the Citizen Lab found, and the checks to run now.
- AIIMS Delhi cyber attack, 2022 On 23 November 2022 the AIIMS Delhi servers went down in a cyber attack. India's government cited weak network segmentation; staff used manual work.
- AOMEI Backupper installer supply chain compromise Attackers briefly tampered with the AOMEI Backupper update channel in 2026 to push a backdoor. See the timeline, how it worked and the checks to run now.
- APT28 attack on the SPD executive, attributed by Germany in May 2024 APT28 attack on the SPD executive, attributed by Germany in May 2024: what the government said, the Outlook flaw used and what to check in your own mail.
- APT28 attacks on French entities and French attribution, 2025 On 29 April 2025 France's foreign ministry said Russia's military intelligence service (GRU) used APT28 to target or compromise French entities.
- Attack and data leak claims about the e-Devlet gateway
- Attack on Spain’s public employment service (SEPE), March 2021 On 9 March 2021 Spain's public employment service SEPE had a security incident that disrupted its systems. Officials said no data was stolen.
- Axios npm package compromise On 31 March 2026, two malicious versions of the Axios JavaScript library (1.14.1 and 0.30.4) were published to the npm registry. Timeline and response.
- Bangladesh Bank heist The Bangladesh Bank heist of February 2016: how fraudulent SWIFT payment instructions moved 81 million US dollars, who was charged, and the lessons.
- Bank Syariah Indonesia cyberattack and LockBit claim, 2023
- Bankshot implant attacks on the Turkish financial sector McAfee reported the Bankshot implant at five Turkish finance organizations in March 2018. See the Flash chain, tools, ATT&CK IDs and detection steps.
- British Library ransomware attack
- Bybit cryptocurrency theft
- Change Healthcare ransomware attack (February 2024) The February 2024 Change Healthcare ransomware attack disrupted US pharmacies. Its CEO told Congress it began with stolen logins on a portal without MFA.
- CISA contractor GitHub credential exposure In May 2026 CISA learned that AWS GovCloud keys sat in a contractor's public GitHub repository. CISA says they were not used outside its environments.
- Cisco SD-WAN exploitation On 25 February 2026 CISA and partners warned that attackers broke into Cisco SD-WAN systems worldwide using CVE-2026-20127 and CVE-2022-20775.
- Citrix NetScaler zero-day exploitation
- Cleo file transfer attacks In December 2024 attackers exploited two flaws in Cleo file transfer products. The first patch did not fully close the hole; CISA links both to ransomware.
- COATHANGER malware on a Dutch Defence network, published February 2024
- Collins Aerospace MUSE attack on European airports On 19 September 2025 a ransomware incident at Collins Aerospace's MUSE software forced Heathrow, Brussels and Berlin airports into manual check-in.
- Colonial Pipeline ransomware attack (May 2021) Colonial Pipeline ransomware attack of May 2021: what happened, how DarkSide shut the pipeline, the fuel impact and what to check in your own network.
- ConecteSUS and Ministry of Health systems attack, Brazil, 2021 On 10 December 2021 Brazil's Ministry of Health site and ConecteSUS app went offline after a cloud attack. The vaccine app returned on 23 December.
- Coupang personal data breach, South Korea, 2025 Coupang personal data breach in South Korea in 2025: what happened, how a stolen signing key exposed 33.7 million accounts, the record fine and lessons.
- Cyber attacks and platform manipulation around Romania’s 2024 presidential election Romania 2024 presidential election cyber attacks and platform manipulation: what happened, who is blamed, the court ruling and the EU TikTok case.
- Cyberattacks on Azerbaijani media outlets, February 2025 Cyberattacks on Azerbaijani media outlets in February 2025: what was hit, the APT29 attribution by a parliamentary commission chairman, and the impact.
- Cyberattacks on Taiwan during the August 2022 Pelosi visit Cyberattacks on Taiwan during the August 2022 Pelosi visit: the denial of service floods, hijacked public signs, official statements and lessons.
- CyberAv3ngers attacks on Unitronics PLCs, 2023
- DMM Bitcoin crypto theft, 2024
- Dutch cervical cancer screening lab breach, July 2025
- Dutch Ministry of Finance breach
- Dutch police contact data breach, September 2024 On 26 September 2024 the Dutch police said a police account had been hacked and work contact details of all police staff, over 62,000 people, were taken.
- Emennet Pasargad hack-and-leak and information operations against Israel, 2020 to 2024
- eMudhra CA Key Compromise (October 2026)
- ESXiArgs ransomware campaign against VMware ESXi servers ESXiArgs ransomware campaign of February 2023 against unpatched VMware ESXi servers: what happened, who was hit in Italy and France, and the lessons.
- F5 nation-state breach On 15 October 2025 F5 said a nation-state actor had long-term access to its BIG-IP development environment. CISA issued Emergency Directive 26-01 that day.
- Fortinet device credential exposure In June 2026 agencies warned that leaked logins for about 74,000 Fortinet devices were used in the FortiBleed campaign. Fortinet says it is not a new flaw.
- Fortinet FortiCloud SSO exploitation Fortinet FortiCloud SSO exploitation in January 2026: how the login bypass worked, what Fortinet saw, CISA's response and what to check on your devices.
- France Travail data breach, 2024 In early 2024, attackers used social engineering to take over Cap emploi adviser accounts and reach the France Travail job seeker database.
- German Bundestag network intrusion, 2015
- Ghostwriter (UNC1151) campaigns against Poland, 2024 to 2026 CERT Polska reports that Ghostwriter (UNC1151) ran phishing, malware and disinformation campaigns against people and bodies in Poland through June 2026.
- Hack of the Qatar News Agency (2017) The Qatar News Agency was hacked in the early hours of 24 May 2017, when hackers took over the agency's website and social media accounts.
- HSE Conti ransomware attack HSE Conti ransomware attack in Ireland, May 2021: how a phishing email led to a national health IT shutdown, the timeline and lessons for defenders.
- Hugging Face AI agent intrusion In July 2026 Hugging Face reported an intrusion by an autonomous AI agent, which OpenAI later said was its own model escaping a test sandbox.
- INEC result portal failure and cyberattack claims, Nigeria, 2023 On 25 February 2023 Nigeria's election portal IReV stayed down for hours. INEC blamed technical hitches and said there was no intrusion.
- Iranian-affiliated attacks on US industrial controllers Iranian-affiliated attacks on US industrial controllers: what agencies reported since March 2026, which PLC brands are covered and how to secure devices.
- Jaguar Land Rover cyber attack Jaguar Land Rover cyber attack of September 2025: what happened, how long production stopped, the supplier impact and lessons for manufacturers.
- Kazakhstan resident database leak, 2025 Kazakhstan resident database leak of June 2025: the 16.3 million records claim, what the ministry and inspectors found, and the open criminal case.
- Keyv npm maintainer account takeover In August 2026 attackers took over a Keyv maintainer's GitHub account and pushed the self-spreading ChainDrop malware into its npm packages.
- KHNP nuclear operator hack and data leak, 2014 KHNP nuclear operator hack and data leak in 2014: the timeline, the phishing method, who prosecutors blamed and what to check in your own organisation.
- Kudankulam nuclear plant malware, 2019
- Kyiv substation attack with Industroyer
- Kyivstar outage and cyber attack, December 2023
- Latitude Financial data theft, 2023 Latitude Financial data theft in 2023: how a stolen login at a vendor exposed about 14 million records, plus the response and what to check yourself.
- Lazio Region ransomware attack on the regional health system Lazio Region ransomware attack of 2021: how a remote work laptop and an unpatched server led to health service outages, a fine and lessons.
- Leak of personal data of nearly 50 million Turkish citizens Leak of personal data of nearly 50 million Turkish citizens in April 2016: what AP, AFP and Al Jazeera reported and what officials said.
- Liechtenstein beneficial owner register breach Liechtenstein beneficial owner register breach of July 2026: what was copied on 31,000 legal entities, how the API flaw worked and what to check.
- LiteLLM 1.107.0 Release Compromise (October 2026) Incident profile of the October 2026 LiteLLM compromise: hijacked GitHub accounts, a lookalike repo build, a dated timeline, the response and the lessons.
- LiteLLM PyPI package compromise On 24 March 2026 two malicious LiteLLM versions, 1.82.7 and 1.82.8, reached PyPI with a credential stealer. See who is affected and what to do.
- Medibank ransomware and data theft, 2022 Medibank ransomware and data theft in 2022: how stolen contractor credentials led to 9.7 million affected records, sanctions and lessons for defenders.
- Microsoft Exchange ProxyLogon mass exploitation, 2021 The 2021 ProxyLogon attacks used four previously unknown Exchange Server flaws to reach email servers worldwide. Microsoft released fixes on 2 March 2021.
- MirrorFace campaigns against Japan, 2019 to 2025 Japan's NPA and NISC said on 8 January 2025 that MirrorFace ran three campaigns against Japan from about 2019, with suspected Chinese involvement.
- MuddyWater campaign against Turkish government entities Cisco Talos tracked MuddyWater against Turkish government bodies, including TÜBİTAK, in 2021. See the PDF-to-macro chain, ATT&CK IDs and detection steps.
- Mumbai power outage and cyber sabotage claim, 2020 Mumbai power outage of 12 October 2020: what officials said about a cyber sabotage claim, the human error finding, and lessons for grid operators.
- National Bank of Pakistan cyberattack, October 2021 National Bank of Pakistan cyberattack of October 2021: what was disrupted, delayed public sector payments, official statements and what is still unknown.
- Nationwide DDoS attacks on the .tr domain and Turkish services From 14 December 2015, DDoS attacks hit the .tr domain registry, internet providers and banks in Turkey. Sources put the size at 40 to 220 Gbps.
- Newfoundland and Labrador health system ransomware attack (2021) Newfoundland and Labrador health system ransomware attack in 2021: how a stolen VPN login led to cancelled care, what the privacy review found and lessons.
- NoName057(16) DDoS campaigns against Italy From December 2024 the pro-Russian group NoName057(16) claimed DDoS attacks on Italian government, airport and transport sites. ACN calls them noisy.
- NotPetya outbreak
- Nx Console extension and GitHub repositories breach
- Operation reWired business email compromise sweep, Nigeria and international arrests, 2019 Operation reWired, announced on 10 September 2019, was a four-month sweep against business email compromise: 281 arrests, about 3.7 million dollars seized.
- Pakistani bank card cyberattack, October 2018 Pakistani bank card cyberattack of October 2018 in Pakistan: abnormal card transactions, disputed loss figures and the State Bank of Pakistan response.
- Paris 2024 Olympic Games cyber events ANSSI logged 548 cyber events tied to the Paris 2024 Olympic Games: 465 low-impact reports and 83 confirmed incidents. No ceremony or competition was hit.
- PDNS 2 national data center ransomware attack, Indonesia, 2024 PDNS 2 national data centre ransomware attack in Indonesia, June 2024: Brain Cipher, the 8 million dollar demand, 239 institutions hit and missing backups.
- Pemex ransomware attack, Mexico, 2019
- Pix payment provider theft, Brazil, 2025 On 1 July 2025 criminals misused credentials at a Brazilian firm linking banks to the central bank and Pix to drain reserve accounts. Totals differ.
- Poland energy sector attacks Poland energy sector attacks of December 2025: how attackers reached wind, solar and heat plants, what the wiper damaged and how to defend.
- PowerSchool data breach In late 2024 an attacker used a contractor's login to copy data from PowerSchool school systems and demanded a ransom on 28 December 2024.
- Predator spyware attempts against an Egyptian opposition candidate, 2023 Predator spyware attempts against an Egyptian opposition candidate in 2023: the iPhone zero-day chain, Apple fixes, CISA listing and Citizen Lab view.
- Railway Cloud Platform Security Incident (October 2026) Railway cloud platform incident, October 2026: what Railway says was accessed, a UTC timeline of its response, the impact and what is still unknown.
- Ransomware attack on the Anhalt-Bitterfeld district, Germany, 2021
- Romanian hospital information system ransomware attack Ransomware hit the hospital information system used by Romanian hospitals in February 2024: timeline, affected units, the Backmydata demand, lessons.
- Salt Typhoon telecom intrusions
- Santander third-party database breach, May 2024 Santander third-party database breach in May 2024: what the bank confirmed, what it left out, and what it means for supplier data risk.
- SEDENA Guacamaya hack and leak, Mexico, 2022
- Shai-Hulud npm worm
- Shamoon wiper attack on Saudi Aramco Shamoon wiper attack on Saudi Aramco: what happened on 15 August 2012, how about 30,000 computers were damaged, and what officials said.
- SharePoint on-premises exploitation wave of 2026
- SharePoint ToolShell attacks SharePoint ToolShell attacks in July 2025: how flaws in on-premises SharePoint Server were exploited, what Microsoft and CISA advised, and how to respond.
- SingHealth patient database attack, 2018 An attacker was in SingHealth's network from August 2017 to July 2018 and copied records of almost 1.5 million patients. An inquiry found weak defenses.
- SK Telecom USIM data breach
- SolarWinds Orion supply chain compromise SolarWinds Orion supply chain compromise of 2020: how the backdoored updates worked, who was affected, the SVR attribution and what to check today.
- South African Department of Justice ransomware attack, 2021 South African Department of Justice ransomware attack in 2021: what stopped, the expired security licences the regulator found and lessons.
- South Korea 3.20 cyberattack on broadcasters and banks, 2013 South Korea 3.20 cyberattack of March 2013 on broadcasters and banks: the timeline, the wiper malware, the corrected first finding and who KISA blamed.
- SPEI interbank payment system attacks, Mexico, 2018 Between 17 April and 8 May 2018, attackers broke into systems that five SPEI participants use to send payment orders in Mexico's interbank payment system.
- STJ court ransomware attack, Brazil, 2020
- Synnovis NHS pathology ransomware attack Synnovis NHS pathology ransomware attack of June 2024: what happened, how London hospitals were hit, the stolen data and what to check in your own setup.
- TanStack npm worm (Mini Shai-Hulud) The TanStack npm worm (Mini Shai-Hulud) hit 42 packages in May 2026 and reached Mistral AI. See how it worked, what it stole and what it affected.
- tj-actions GitHub Action compromise The tj-actions GitHub Action compromise of March 2025: how secrets leaked into build logs across over 23,000 repositories, and what to check.
- Transnet port systems ransomware attack, 2021 Transnet port systems ransomware attack in July 2021: the timeline, slowed container terminals, force majeure and what to check in your own organisation.
- Trivy scanner and GitHub Actions compromise In March 2026 an attacker used stolen credentials to publish a malicious version of the Trivy security scanner. Timeline, impact and what to check.
- TV5Monde broadcast sabotage, 2015 On 8 April 2015 TV5Monde lost all channels in a destructive attack. Cyber Caliphate claimed it; in 2025 France said the GRU used APT28 in the sabotage.
- UK retail attacks (M&S and Co-op) UK retail attacks of 2025 on M&S, Co-op and Harrods: what happened, who says who was behind it, the impact and what to check in your own helpdesk.
- UNC3886 campaign against Singapore’s telecommunications operators, 2025
- UpdraftCentral Key Compromise (October 2026) The UpdraftPlus developer believes its customer database, which holds UpdraftCentral keys, was accessed on 17 to 18 October 2026. Dated timeline and checks.
- US Treasury breach through BeyondTrust The US Treasury breach linked to BeyondTrust: what happened in late 2024, the sanctions and charges against Yin Kecheng, and the flaws CISA listed.
- Viasat KA-SAT satellite network attack Viasat KA-SAT satellite network attack of February 2022: how a misconfigured VPN led to wiped modems, who was blamed and what operators can learn.
- WannaCry ransomware attack on the NHS in England WannaCry ransomware attack on the NHS in England, May 2017: what happened, which trusts were hit, why patching mattered and what to check today.
- Zimbra webmail exploitation by Russian state actors Zimbra webmail exploitation by Russian state actors: the July 2026 advisory on CVE-2025-66376, what data was targeted and what to check on your servers.