November 2026

Maersk said a threat actor breached systems of a company it had acquired and stole data, and the ransomware group WhiteArmor claimed the attack; no government or examining company has named an actor. ^[1] ConnectWise said it was investigating malicious activity affecting some partners of its ScreenConnect service, and Huntress said it was tracking six compromised managed service providers and more than 286 endpoints across 47 organisations. ^[1] Ukraine's state news agency Ukrinform said its website and X account were attacked; nobody has named an actor. ^[1]

Every sentence and figure comes from the records linked after it.

The ransomware group BYOD, which took responsibility for the attack on Vanderbilt University, claimed to have more than one million Social Security numbers from it, CyberScoop reported. French Foreign Minister Jean-Noel Barrot said France was weighing measures against Iran over the cyberattacks it blames on the IRGC, some of which might never be made public, Iran International reported, and said France would push for EU sanctions. The University of Tübingen said attackers took about 3,900 staff records from its systems, in a press release made public that day; nobody has named an actor. ^[1] Poland's digital affairs minister Krzysztof Gawkowski said a cyberattack on the state platform ePUAP was detected and stopped, and the platform was taken offline as a precaution; nobody has named an actor. ^[1]

Every sentence and figure comes from the records linked after it.

Vanderbilt University made public a cyberattack that it warned may affect campus devices and systems and asked people to disconnect from campus WiFi, The Record reported, and the ransomware group BYOD listed the university and claimed to have stolen data. ^[1] The Paris prosecutor's office said it requested international arrest warrants against the leader of Shahid Kaveh, which it described as an offensive cyber unit affiliated with the Revolutionary Guards, and his two deputies over the attacks of 11 and 12 October, and Foreign Minister Jean-Noel Barrot said the IRGC carried out the attack on French supermarket refrigeration. ^[1] CERT-FR said in a report that it imputes offensive cyber activity targeting France to the units Shahid Shoostari and Shahid Kaveh within the IRGC's electronic and cyber centre. The Philippines' Securities and Exchange Commission said it was investigating a data security incident in which individual profile information may have been exposed; nobody has named an actor. ^[1]

Every sentence and figure comes from the records linked after it.

Russian web hosting provider ESTT said a cyberattack disrupted services across its cloud infrastructure and that it found no evidence of a leak of customer data; nobody has named an actor. ^[1] The ransomware group WhiteArmor claimed an attack on Maersk and demanded 5 million US dollars, BleepingComputer reported.

Every sentence and figure comes from the records linked after it.

Japanese retailer Nitori Holdings said a third party gained unauthorized access to a system it manages and that up to 37.62 million records of personal information, including names, addresses and phone numbers, may have leaked; nobody has named an actor. ^[1] A health centre in Chur, Switzerland, said patient and staff data left its network in a cyberattack, and the ransomware group Cloak claimed it. ^[1] York University in Toronto said an unauthorised actor took personal information submitted through some of its online forms, in a notice made public that day; nobody has named an actor. ^[1]

Every sentence and figure comes from the records linked after it.

French banking group Crédit Mutuel Arkéa said a cyberattack allowed fraudulent operations and that some transactions were suspended; nobody has named an actor. ^[1] The hacktivist personas NoName057(16) and Z-Pentest claimed the attacks on European supermarket refrigeration systems, and European Commission spokesperson Thomas Regnier said those attacks were not isolated incidents, naming no culprit.

Every sentence and figure comes from the records linked after it.

Russian hosting and cloud provider Beget said that on the night of 1 to 2 November an attacker reached the management layer of its architecture and erased server data, destroying its cloud infrastructure, BleepingComputer reported. ^[1] Beget said 60% of shared hosting and 40% of dedicated servers had been restored by 9 November and that it saw no sign customer data was downloaded or changed, and no attacker has been named. ^[1]

Every sentence and figure comes from the records linked after it.