Ransomware Attacks Tracker
106
September 2026
Security & Stability
A structured record of 35 confirmed ransomware attacks causing operational disruption to businesses and public sector organisations in July 2026.
Ransomware attack cyber incident organization hit reported
CISOs and enterprise security teams use this data to track active ransomware campaigns and assess organisational exposure to the same threat actors. Cyber insurance underwriters monitor attack frequency and severity to inform pricing and coverage decisions. Incident response firms and threat intelligence providers use attack data to brief clients and update detection playbooks.
6498
<div style="overflow-x:auto;width:100%"><table class="catchall-table"><thead><tr><th style="min-width:40px">#</th><th style="min-width:240px">Event</th><th style="min-width:140px;white-space:nowrap">Attack Type</th><th style="min-width:140px;white-space:nowrap">Location</th><th style="min-width:140px;white-space:nowrap">Ransom Amount</th><th style="min-width:140px;white-space:nowrap">Impact Description</th><th style="min-width:140px;white-space:nowrap">Affected Company</th><th style="min-width:140px;white-space:nowrap">Ransom Currency</th><th style="min-width:140px;white-space:nowrap">Ransomware Group</th><th style="min-width:140px;white-space:nowrap">Attack Date</th><th style="min-width:120px;white-space:nowrap">Source</th></tr></thead><tbody><tr><td>1</td><td style="min-width:240px">ShinyHunters Ransomware Attack on Instructure</td><td style="min-width:140px">Ransomware/extortion (data breach with ransom demand, no specific ransomware variant named)</td><td style="min-width:140px">United States</td><td style="min-width:140px"></td><td style="min-width:140px">ShinyHunters breached Instructure's Canvas LMS, exfiltrating 3.65 terabytes of data affecting approximately 275 million records of students, teachers, and staff across nearly 9,000 academic institutions, and disrupted final exams across the United States.</td><td style="min-width:140px">Educational technology company Instructure was a major victim of the group</td><td style="min-width:140px"></td><td style="min-width:140px">ShinyHunters</td><td style="min-width:140px">2026-04-25</td><td style="white-space:nowrap"><a href="https://www.alarabiya.net/technology/cybersecurity-privacy/2026/09/16/%D9%82%D8%A7%D8%A6%D9%85%D8%A9-%D8%A8%D8%A7%D8%AE%D8%B7%D8%B1-%D8%A7%D9%84%D8%A7%D8%AE%D8%AA%D8%B1%D8%A7%D9%82%D8%A7%D8%AA-%D9%88%D8%A7%D9%84%D9%87%D8%AC%D9%85%D8%A7%D8%AA-%D8%A7%D9%84%D8%B3%D9%8A%D8%A8%D8%B1%D8%A7%D9%86%D9%8A%D8%A9-%D9%81%D9%8A-2026" target="_blank" rel="nofollow">https://www.alarabiya.net/technology/cybersecurity-privacy/2026/09/16/%D9%82%D8%A7%D8%A6%D9%85%D8%A9-%D8%A8%D8%A7%D8%AE%D8%B7%D8%B1-%D8%A7%D9%84%D8%A7%D8%AE%D8%AA%D8%B1%D8%A7%D9%82%D8%A7%D8%AA-%D9%88%D8%A7%D9%84%D9%87%D8%AC%D9%85%D8%A7%D8%AA-%D8%A7%D9%84%D8%B3%D9%8A%D8%A8%D8%B1%D8%A7%D9%86%D9%8A%D8%A9-%D9%81%D9%8A-2026</a></td></tr><tr><td>2</td><td style="min-width:240px">Rhysida Ransomware Attack on Berlin State Government</td><td style="min-width:140px">Rhysida</td><td style="min-width:140px">Berlin, Germany</td><td style="min-width:140px">30</td><td style="min-width:140px">Approximately 6TB of sensitive administrative and personnel data was exfiltrated and leaked after Berlin refused a 30 BTC ransom demand, causing operational disruptions across government departments.</td><td style="min-width:140px">Berlin's state government is dealing with the fallout of a ransomware attack</td><td style="min-width:140px">BTC</td><td style="min-width:140px">Rhysida</td><td style="min-width:140px">2026-08-07</td><td style="white-space:nowrap"><a href="https://tech-insider.org/rhysida-ransomware-berlin-government-breach-2026" target="_blank" rel="nofollow">https://tech-insider.org/rhysida-ransomware-berlin-government-breach-2026</a></td></tr><tr><td>3</td><td style="min-width:240px">ShinyHunters Ransomware Attack on Clop</td><td style="min-width:140px"></td><td style="min-width:140px"></td><td style="min-width:140px"></td><td style="min-width:140px">ShinyHunters breached Clop's Tor leak site, stole private keys, source code, and server logs, defaced the portal, and issued a ransom demand.</td><td style="min-width:140px">ShinyHunters hacked the Clop ransomware gang's website on the dark web.</td><td style="min-width:140px"></td><td style="min-width:140px">ShinyHunters</td><td style="min-width:140px">2026-09-18</td><td style="white-space:nowrap"><a href="https://www.01net.com/actualites/guerre-hackers-shinyhunters-pirate-rival-clop-dark-web.html" target="_blank" rel="nofollow">https://www.01net.com/actualites/guerre-hackers-shinyhunters-pirate-rival-clop-dark-web.html</a></td></tr><tr><td>4</td><td style="min-width:240px">Manchester Airports Group Stolen Customer Data Extortion Attack</td><td style="min-width:140px"></td><td style="min-width:140px">United Kingdom</td><td style="min-width:140px"></td><td style="min-width:140px">Personal details of approximately 8.8 million customers were exfiltrated and leaked online, though airport operations remained unaffected.</td><td style="min-width:140px">Data allegedly stolen from the Manchester Airports Group (MAG) and leaked online this week includes the email addresses and phone numbers of 8.8 million people.</td><td style="min-width:140px"></td><td style="min-width:140px">FulcrumSec</td><td style="min-width:140px">2026-08-27</td><td style="white-space:nowrap"><a href="https://www.securityweek.com/manchester-airports-group-data-on-8-8-million-people-leaked-after-ransom-refusal" target="_blank" rel="nofollow">https://www.securityweek.com/manchester-airports-group-data-on-8-8-million-people-leaked-after-ransom-refusal</a></td></tr><tr><td>5</td><td style="min-width:240px">Stadtwerke Landsberg Encrypted in Cyberattack</td><td style="min-width:140px">Barracuda</td><td style="min-width:140px">Landsberg</td><td style="min-width:140px"></td><td style="min-width:140px">Central IT systems were encrypted and internet connections disconnected, though public utilities remained operational.</td><td style="min-width:140px">The Landsberg municipal utilities fell victim to a cyberattack</td><td style="min-width:140px"></td><td style="min-width:140px">Barracuda</td><td style="min-width:140px">2026-09-01</td><td style="white-space:nowrap"><a href="https://www.kreisbote.de/lokales/landsberg/erstmal-offline-cyber-attacke-trifft-stadtwerke-landsberg-94472771.html" target="_blank" rel="nofollow">https://www.kreisbote.de/lokales/landsberg/erstmal-offline-cyber-attacke-trifft-stadtwerke-landsberg-94472771.html</a></td></tr><tr><td>6</td><td style="min-width:240px">Revolut Data Breach and Extortion Demand</td><td style="min-width:140px">Social engineering / impersonation scam (no ransomware variant; not a ransomware attack)</td><td style="min-width:140px">United Kingdom</td><td style="min-width:140px">3,000,000</td><td style="min-width:140px">Sensitive personal and KYC data including passport details, bank account numbers, identity cards, and Bitcoin activity records of nearly 700 customers were exposed.</td><td style="min-width:140px">Hackers demanded a $3 million Monero ransom from Revolut</td><td style="min-width:140px">XMR</td><td style="min-width:140px">iamnotavillain</td><td style="min-width:140px">2026-09-12</td><td style="white-space:nowrap"><a href="https://blockweeks.com/news/318232" target="_blank" rel="nofollow">https://blockweeks.com/news/318232</a></td></tr><tr><td>7</td><td style="min-width:240px">Veradigm Cyber Incident and Ransomware Claim by The Gentlemen</td><td style="min-width:140px"></td><td style="min-width:140px">Chicago, United States</td><td style="min-width:140px"></td><td style="min-width:140px">Credentials stolen from a third-party vendor were used to access a customer-service API and copy patient personal details and Social Security numbers.</td><td style="min-width:140px">Healthcare technology company Veradigm disclosed a data breach after a cybersecurity incident at one of its third-party vendors exposed patients' personal data.</td><td style="min-width:140px"></td><td style="min-width:140px">The Gentlemen</td><td style="min-width:140px">2026-09-05</td><td style="white-space:nowrap"><a href="https://www.bleepingcomputer.com/news/security/veradigm-discloses-patient-data-breach-after-gentlemen-gang-claims-attack" target="_blank" rel="nofollow">https://www.bleepingcomputer.com/news/security/veradigm-discloses-patient-data-breach-after-gentlemen-gang-claims-attack</a></td></tr><tr><td>8</td><td style="min-width:240px">ShinyHunters Cyberattack and Extortion Demand Target McKesson</td><td style="min-width:140px">Vishing (voice phishing) attack via Okta SSO compromise</td><td style="min-width:140px">Irving, Texas</td><td style="min-width:140px">55,236,150</td><td style="min-width:140px">Hackers exfiltrated 1 terabyte of data containing approximately 284 million database records of patient and employee information, leading to service disruptions.</td><td style="min-width:140px">McKesson Corporation, one of North America's largest pharmaceutical distributors and healthcare-services companies, has confirmed a cybersecurity incident</td><td style="min-width:140px">USD</td><td style="min-width:140px">ShinyHunters</td><td style="min-width:140px">2026-08-25</td><td style="white-space:nowrap"><a href="https://cryptonews.net/news/security/33380627" target="_blank" rel="nofollow">https://cryptonews.net/news/security/33380627</a></td></tr><tr><td>9</td><td style="min-width:240px">Cyberattacks Target French General Directorate of Public Finances and Other Administrations</td><td style="min-width:140px"></td><td style="min-width:140px">France</td><td style="min-width:140px"></td><td style="min-width:140px">Tax data of approximately 680,000 taxpayers was compromised in cyberattacks targeting French state administrations.</td><td style="min-width:140px">General Directorate of Public Finances (DGFiP), which resulted in the compromise of the tax data of some 680,000 taxpayers</td><td style="min-width:140px"></td><td style="min-width:140px">ZeroBytes</td><td style="min-width:140px">2026-06-26</td><td style="white-space:nowrap"><a href="https://www.jeanmarcmorandini.com/article-651368-face-a-la-multiplication-des-cyberattaques-contre-les-administrations-francaises-l-agence-de-la-securite-des-systemes-d-information-annonce-la-creation-d-un-nouveau-dispositif.html" target="_blank" rel="nofollow">https://www.jeanmarcmorandini.com/article-651368-face-a-la-multiplication-des-cyberattaques-contre-les-administrations-francaises-l-agence-de-la-securite-des-systemes-d-information-annonce-la-creation-d-un-nouveau-dispositif.html</a></td></tr><tr><td>10</td><td style="min-width:240px">Cyberattack on French Ministry of Ecological Transition</td><td style="min-width:140px"></td><td style="min-width:140px">France</td><td style="min-width:140px"></td><td style="min-width:140px">Several government websites were rendered inaccessible following a cyberattack and suspected compromise of user accounts.</td><td style="min-width:140px">Several government websites linked to the Ministry of Ecological Transition are inaccessible</td><td style="min-width:140px"></td><td style="min-width:140px">Indra</td><td style="min-width:140px">2026-09-02</td><td style="white-space:nowrap"><a href="https://fr.headtopics.com/news/plusieurs-sites-internet-gouvernementaux-lies-au-ministere-87326111" target="_blank" rel="nofollow">https://fr.headtopics.com/news/plusieurs-sites-internet-gouvernementaux-lies-au-ministere-87326111</a></td></tr><tr class="row-locked"><td>11</td><td style="min-width:240px">Flink Hit by LPG Ransomware Attack</td><td style="min-width:140px">LPG</td><td style="min-width:140px">Netherlands</td><td style="min-width:140px">100</td><td style="min-width:140px">Personal data and delivery details of one million customers and 13,000 employees were stolen.</td><td style="min-width:140px">Delivery company and online supermarket Flink has been hacked.</td><td style="min-width:140px">ETH</td><td style="min-width:140px">LPG</td><td style="min-width:140px">2026-09-25</td><td style="white-space:nowrap"><a href="https://tweakers.net/nieuws/252608/ransomwaregroep-hackt-onlinesupermarkt-flink-en-vraagt-slachtoffers-om-losgeld.html%23reactieForm" target="_blank" rel="nofollow">https://tweakers.net/nieuws/252608/ransomwaregroep-hackt-onlinesupermarkt-flink-en-vraagt-slachtoffers-om-losgeld.html%23reactieForm</a></td></tr><tr class="row-locked"><td>12</td><td style="min-width:240px">ShinyHunters Cyberattack on FBI Systems and Personnel Data Exfiltration</td><td style="min-width:140px"></td><td style="min-width:140px">WASHINGTON</td><td style="min-width:140px"></td><td style="min-width:140px">Hackers exfiltrated 2 to 3 terabytes of sensitive employee and applicant data and defaced the FBI's jobs website.</td><td style="min-width:140px">The FBI said Wednesday that it was investigating a criminal hacking group's claims that it had stolen 'very sensitive data'</td><td style="min-width:140px"></td><td style="min-width:140px">ShinyHunters</td><td style="min-width:140px">2026-09-22</td><td style="white-space:nowrap"><a href="https://tech.yahoo.com/cybersecurity/articles/hackers-hit-fbi-shinyhunters-stolen-140500752.html" target="_blank" rel="nofollow">https://tech.yahoo.com/cybersecurity/articles/hackers-hit-fbi-shinyhunters-stolen-140500752.html</a></td></tr></tbody></table></div>
<h3>What evidence is required for inclusion?</h3><p>An event is recorded when there is confirmed operational disruption attributable to a ransomware attack — such as system outages, service interruptions, or official acknowledgement.</p><h3>Are suspected attacks without confirmation included?</h3><p>No. Unconfirmed reports without at least one official acknowledgement from the affected organisation, a regulator, or law enforcement are excluded.</p><h3>Which sectors are most represented?</h3><p>Healthcare, government, financial services, and critical infrastructure tend to generate the most confirmed ransomware disclosures due to mandatory breach reporting requirements.</p><h3>How often is this dataset updated?</h3><p>We rerun this dataset once a month. You can create your own dataset that updates as frequently as every one hour on <a href="https://platform.newscatcherapi.com/catchall">platform.newscatcherapi.com/catchall</a></p>