On the record from 26 August 2026

The global cyber war

48 events: 8 confirmed, 40 reported, 0 disputed. 17 statements, listed separately. The latest day recorded is 11 November 2026.

Hospitals, banks, power and water companies and supermarket freezers are attacked through computer networks, often with no attacker named. No war has been declared and there is no front line. What gets hit is what daily life runs on, and governments answer with warrants, seizures and accusations against other states. An attacker is named here only when a government, court or company has. How these records are made →

Key figures

Each figure links to the record it comes from.

The record, week by week

What was hit, when, and whether the record carries an attribution for it.

Food and cold chain 10

  1. Week of 24 Aug: 26 Aug 2026: Freezers fail at US military commissaries; the Pentagon investigates and has not confirmed a cyber cause. Confirmed. Not attributed.
  2. Week of 5 Oct: 11 Oct 2026: Refrigeration in hundreds of French supermarkets is changed remotely overnight; France later says an IRGC unit did it. Confirmed. Attributed by independent sources.
  3. Week of 2 Nov: 2 Nov 2026: Supermarket cooling systems in Germany are manipulated; food discarded in Bavaria, North Rhine-Westphalia and Lower Saxony. Confirmed. Not attributed. 2 Nov 2026: Italian catering company Siaf says its refrigeration control systems were hit by a cyberattack; government calls impact limited. Confirmed. Not attributed. 2 Nov 2026: Refrigeration contractor says attackers reached a computer controlling an Estonian store's system; Selver says one store affected. Reported. Not attributed. 2 Nov 2026: Musgrave says a cyber incident affected refrigeration in 13 SuperValu stores in Ireland. Reported. Not attributed. 2 Nov 2026: Romania's cyber directorate says six stores of one chain had refrigeration controllers attacked; it suspects no state actor. Reported. Not attributed. 2 Nov 2026: ICA and Coop stores in Sweden report refrigeration problems; one store says freezers were set to 50 C. Reported. Not attributed. 2 Nov 2026: Three UK meat suppliers and a wholesaler report attacks on refrigeration controllers; NCSC says national impact is minimal. Reported. Not attributed. 2 Nov 2026: Refrigeration disrupted at dozens of supermarkets in Belgium and Luxembourg; Belgian prosecutor opens an investigation. Confirmed. Not attributed.

Companies and software 11

  1. Week of 21 Sep: 26 Sep 2026: Japanese rail and hotel group Keio confirms a ransomware attack on its group servers. Reported. Not attributed.
  2. Week of 12 Oct: 12 Oct 2026: Ahold Delhaize takes some systems offline after a security issue in its network; websites and apps down in Europe and the US. Reported. Not attributed. 16 Oct 2026: ConnectWise reports unauthorised access to Cloud Backup credentials; Microsoft links the compromise to its Storm-0940 cluster. Reported. Not attributed.
  3. Week of 19 Oct: 24 Oct 2026: AI company Fireworks says an unauthorised party reached its development machines through a hacked cloud provider. Reported. Not attributed.
  4. Week of 26 Oct: 28 Oct 2026: Iris Plaza, the online shop of Japan's Iris Ohyama group, says personal data of up to about 7.7 million people may have leaked. Reported. Not attributed. 29 Oct 2026: PayCloud says unauthorised access to its Arara Message email service exposed email addresses of client companies. Reported. Not attributed. 30 Oct 2026: Blockchain analytics company Chainalysis says an external actor gained unauthorized access to its systems and internal tools. Reported. Not attributed. 1 Nov 2026: Russian hosting provider Beget says an attacker erased server data and destroyed its cloud infrastructure. Reported. Not attributed.
  5. Week of 2 Nov: 6 Nov 2026: Japanese retailer Nitori says a third party accessed one of its systems and up to 37.62 million records may have leaked. Reported. Not attributed. 8 Nov 2026: Russian web hosting provider ESTT says a cyberattack with file-encrypting malware disrupted its cloud services. Reported. Not attributed.
  6. Week of 9 Nov: 11 Nov 2026: ConnectWise investigates malicious activity affecting ScreenConnect partners; Huntress tracks dozens of hit organisations. Reported. Not attributed.

Events on this record

  1. Week of 24 Aug: 1
  2. Week of 31 Aug: 1
  3. Week of 7 Sep: 1
  4. Week of 14 Sep: 0
  5. Week of 21 Sep: 3
  6. Week of 28 Sep: 0
  7. Week of 5 Oct: 3
  8. Week of 12 Oct: 4
  9. Week of 19 Oct: 2
  10. Week of 26 Oct: 8
  11. Week of 2 Nov: 17
  12. Week of 9 Nov: 8
Shape incident official response Fill not attributed an attribution is on the record Colour confirmed reported disputed One mark is one event on the record, placed in the week it happened. A week runs Monday to Sunday.

Who has been named

An attribution is recorded only as a named government, court or company has stated it.

29 October 2026 · Finance · No fixed place

Binance halts withdrawals after a security incident; billions in crypto taken from its hot wallets

Attributed by independent sourcesNamed: Government of North Korea (DPRK), including the Korean People's Army

The FBI said on 31 October that North Korea was responsible for the theft and tied it to the actor it calls TraderTraitor, also tracked as Lazarus Group, Jade Sleet and APT38. By 30 October the blockchain analysis companies TRM Labs (on 29 October, with high confidence) and Chainalysis (as likely) had attributed the theft to TraderTraitor, AP reported. No North Korean response was found. President Trump said on 31 October that it was not known whether North Korea was behind it.

11 October 2026 · Food and cold chain · France

Refrigeration in hundreds of French supermarkets is changed remotely overnight; France later says an IRGC unit did it

Attributed by independent sourcesNamed: Shahid Kaveh, Islamic Revolutionary Guard Corps

On 9 November the Paris prosecutor's office named Shahid Kaveh, which it described as a cyber-offensive unit affiliated with the IRGC Electronic and Cyber Center, citing the use of Farsi and IP addresses tracing to devices in Iran; Foreign Minister Jean-Noel Barrot said he could confirm the IRGC carried out the attack. CBS News reported no immediate response from Iranian authorities and none was found as of 9 November.

The other 40 incidents carry no attribution on the record. Where someone has pointed to a suspect short of that, the event's page says who said it and on what basis. How attribution is recorded →

What was hit

42 incidents by sector, newest first in each. All events in one list →

Food and cold chain10 incidents · 10 countries · latest 2 Nov
Health3 incidents · 3 countries · latest 6 Nov
Utilities and transport3 incidents · 3 countries · latest 11 Nov
Finance5 incidents · 3 countries · latest 4 Nov
Government7 incidents · 7 countries · latest 11 Nov
Companies and software11 incidents · 4 countries · latest 11 Nov
Other3 incidents · 3 countries · latest 10 Nov

Where

Each country links to what happened there. A count of our records, not of organisations or people affected.

Days

Each day has its own page. The timeline → · All days →

DateEventsStatements
11 November 202630
10 November 202622
9 November 202633
8 November 202611
6 November 202631
5 November 202611
4 November 202613
3 November 202612
2 November 2026100
1 November 202611
31 October 202612
30 October 202610

Timeline

A short brief for each day, linked to its records. The whole timeline →

Day

11 November 2026

3 events

Maersk said a threat actor breached systems of a company it had acquired and stole data, and the ransomware group WhiteArmor claimed the attack; no government or examining company has named an actor. [1] ConnectWise said it was investigating malicious activity affecting some partners of its ScreenConnect service, and Huntress said it was tracking six compromised managed service providers and more than 286 endpoints across 47 organisations. [1] Ukraine's state news agency Ukrinform said its website and X account were attacked; nobody has named an actor. [1]

Every sentence and figure comes from the records linked after it.

What was hit

  • Utilities and transport 1
  • Government 1
  • Companies and software 1

3 incidents in 2 countries · 3 not attributed

Day

10 November 2026

2 events · 2 statements

The ransomware group BYOD, which took responsibility for the attack on Vanderbilt University, claimed to have more than one million Social Security numbers from it, CyberScoop reported. French Foreign Minister Jean-Noel Barrot said France was weighing measures against Iran over the cyberattacks it blames on the IRGC, some of which might never be made public, Iran International reported, and said France would push for EU sanctions. The University of Tübingen said attackers took about 3,900 staff records from its systems, in a press release made public that day; nobody has named an actor. [1] Poland's digital affairs minister Krzysztof Gawkowski said a cyberattack on the state platform ePUAP was detected and stopped, and the platform was taken offline as a precaution; nobody has named an actor. [1]

Every sentence and figure comes from the records linked after it.

What was hit

  • Government 1
  • Other 1

2 incidents in 2 countries · 2 not attributed

Statement

The ransomware group BYOD, which took responsibility for the attack on Vanderbilt University in a post on its leak blog, claims to have more than one million Social Security numbers from the attack, CyberScoop reported on 10 November.

BYOD
10 Nov · to a mixed audience
Reported by CyberScoop

Open

On the other wars' records

An incident between the direct parties to another war on the record stays in that war's record. 12 such events are listed here and not counted above.

DateEventRecordStatus
4 November 2026The Kyiv Independent says hackers broke into its website and newsletter systems and sent fake messagesThe Russia-Ukraine warReported
1 November 2026Ukraine's Air Alarm app shows false radiation and chemical warnings; the air force says it was likely subjected to hostile interferenceThe Russia-Ukraine warReported
29 June 2026Israel's cyber chief says hostile cyber incidents tripled to about 4,800 in JuneThe US-Israel-Iran warReported
1 April 2025Hackers take control of a Norwegian dam and change water flowsThe Russia-Ukraine warReported
1 December 2024Hackers damage a Danish waterworks, leaving about 50 households without waterThe Russia-Ukraine warReported
1 November 2024Hackers access a public water fountain system in the NetherlandsThe Russia-Ukraine warReported
1 June 2024DDoS attacks on Dutch party and transport websites on EU election dayThe Russia-Ukraine warReported
1 May 2024False report of Polish mobilisation planted on Poland's national news agency after hackThe Russia-Ukraine warReported
1 March 2024Hackers access a water mill and hydroelectric installation in FranceThe Russia-Ukraine warReported
1 January 2024Prevented cyberattack on Dutch critical infrastructure reported by MIVD, 2024The Russia-Ukraine warReported
1 January 2024Hackers access wastewater facility in Wydminy, PolandThe Russia-Ukraine warReported
12 December 2023Cyberattack knocks out Kyivstar, Ukraine's largest mobile operator, disrupting air raid alertsThe Russia-Ukraine warReported