Recent Cyber Incidents

This is a curated list of recent-ish cybersecurity incidents that have been in the news, along with links to information. The quality of information and level of detail varies widely across incidents – which is normal for cybersecurity incidents.

Note: These are only examples; you are welcome to choose a different cybersecurity incident if you want. Also, these links are just a place to start; you should try to find better sources of information if you can.

2026
2025
2024
2023
2022
Older, but more detailed

2026

Canvas (Instructure) hack in May 2026: https://www.nytimes.com/2026/05/07/education/canvas-hacked-down-data-breach.html and https://krebsonsecurity.com/2026/05/canvas-breach-disrupts-schools-colleges-nationwide/. And the resolution: https://www.nytimes.com/2026/05/12/us/canvas-instructure-hackers-deal.html?smid=nytcore-ios-share

Update on BlackCat/ALPHV: Ransomware negotiator pleads guilty to being a double agent and workign for BlackCat: https://gizmodo.com/a-ransomware-negotiator-pleads-guilty-to-being-a-double-agent-2000749234

Fast16 is malware created by the US or its allies that disrupted Iran’s Nuclear Program in the late 2000’s: https://www.wired.com/story/fast16-malware-stuxnet-precursor-iran-nuclear-attack/ and https://www.securityweek.com/pre-stuxnet-sabotage-malware-fast16-linked-to-us-iran-cyber-tensions/

Hasboro – the toy maker – was hacked and says it will take weeks to recover: https://techcrunch.com/2026/04/01/hasbro-hacked-may-take-several-weeks-to-recover/

Possible US Government iPhone hacking tool leaked: https://www.schneier.com/blog/archives/2026/04/possible-us-government-iphone-hacking-tool-leaked.html

Aura, the identity theft protection company, succumbed to a phishing attack: https://gizmodo.com/the-company-paid-to-protect-your-identity-just-got-hacked-2000735410

Police takedowns of cyber criminal groups often end up teaching other groups: https://www.wsj.com/articles/online-crime-busts-are-teaching-hackers-how-to-avoid-getting-caught-96f0312c?mod=djemCybersecruityPro&tpl=cs

$4.4 million in crypto was stolen when the police left a wallet passphrase in a photo of confiscated crypto hardware: https://www.schneier.com/blog/archives/2026/03/south-korean-police-accidentally-post-cryptocurrency-wallet-password.html

Medical company Stryker was hit with an Iran-linked cyberattack: https://www.wsj.com/articles/stryker-hit-with-suspected-iran-linked-cyberattack-52f6615c?mod=djemCybersecruityPro&tpl=cs and https://krebsonsecurity.com/2026/03/iran-backed-hackers-claim-wiper-attack-on-medtech-firm-stryker/ and https://therecord.media/stryker-cyberattack-iran-hackers?mkt_tok=Njc4LUZITC03MTAAAAGggRtps6qrDT1VpFGRS1w1CZTekauMb42qM8veaoIh8voE0obGiDpmCabbCNudicSFf7jhoTFU9FHBg5SKSotwXyV9Qaub4oO9Q-gOOID0

An unknown hacker used Anthropic’s Claude LLM to hack the Mexican government: https://www.schneier.com/blog/archives/2026/03/claude-used-to-hack-mexican-government.html

With the US/Israel – Iran war has come a number of stories about related cyberattacks: https://therecord.media/iran-cyber-us-command-attack?mkt_tok=Njc4LUZITC03MTAAAAGgUvmysdOSknec5Np7I3ISfXQ9YVO86U9W7P8JGgf8IjTBqv3phu65ARA8M1Gehmpg4eWw5wIKLU9Gby_nku5gJCMfuKgTOdWsG0iUh-E4 and https://www.wsj.com/articles/iran-backed-hackers-aim-for-economic-disruption-30c323b5?mod=djemCybersecruityPro&tpl=cs show both sides are doing cyber attacks.

There is evidence that Israel hacked traffic cameras in Tehran and used them to track people to kill them: https://www.schneier.com/blog/archives/2026/03/israel-hacked-traffic-cameras-in-iran.html

South Korea’s Coupang had a data breach of 34 million users (half the population of Korea): https://www.reuters.com/sustainability/boards-policy-regulation/south-korea-says-coupang-must-address-security-loopholes-probe-data-breach-2026-02-10/

A defector from North Korea describes how he worked for US companies via laptop farms to earn money for North Korea: https://www.wsj.com/world/asia/a-defector-explains-the-remote-work-scam-helping-north-korea-pay-for-nukes-277fc94f?mod=djemCybersecruityPro&tpl=cs

Poland’s energy plants hit by attack (nice report from Poland’s CERT): https://cert.pl/en/posts/2026/01/incident-report-energy-sector-2025/?mod=djemCybersecruityPro&tpl=cs

Senegal breach of National ID card database: https://therecord.media/senegal-breach-national-id-agency?mkt_tok=Njc4LUZITC03MTAAAAGf5wuC9_QsF-BqSSs2DdzRfrjMzAyZr0qWJ2Ccv7zOw8Wa0oyKtNq-FTsAIhHf8SOOkqV9DUVO52QUVC9dk5F1Vw3fjRnvF2cPnhtm6HLb

Wired reporting on pig butchering compounds in SE Asia ($): https://www.wired.com/story/he-leaked-the-secrets-southeast-asian-scam-compound-then-had-to-get-out-alive/

ShinyHunters uses voice phishing to bypass two factor authentication in real time for multiple organizations: https://cyberscoop.com/shinyhunters-voice-phishing-sso-okta-mfa-bypass-data-theft/

Two employees from the security firm Coalfire were arrested for doing a Red Team test of the Iowa Judicial Branch courts (after-action report): https://www.iowacourts.gov/collections/445/files/919/embedDocument?is=55c5762bb34fe81a3c5c8aa71996c793006e3f13fb200b1f3f83c79ae4ff0300&mod=djemCybersecruityPro&tpl=cs

Sandworm (Russian GRU) compromised Poland’s power grid: https://therecord.media/poland-electrical-grid-cyberattack-30-facilities-affected?mkt_tok=Njc4LUZITC03MTAAAAGfrmTlAjg2xp_6gmDgR6TqzL0nXg8mVtG3rGBwC21DMNYfKVTmFqpf_Jgw9KTxNSZdtsvuvDi7_FT9G3C6YLYXE7rpS6T26U02Q8h-92gU

Google tries to take down Ipidea botnet: https://www.wsj.com/tech/google-aims-knockout-blow-at-chinese-company-linked-to-massive-cyber-weapon-3c3fdc40?mod=djemCybersecruityPro&tpl=cs

Venezuela Raid of Maduro involved cyber attacks on critical infrastructure: https://www.wsj.com/articles/venezuela-raid-highlights-cyber-vulnerability-of-critical-infrastructure-28aed054?mod=djemCybersecruityPro&tpl=cs and https://www.politico.com/news/2026/01/03/trump-venezuela-cyber-operation-maduro-00709816

Relatedly, the US Military used cyberattacks to target air defenses during the 2025 bombing of Iranian nuclear facilities: https://therecord.media/iran-nuclear-cyber-strikes-us?mkt_tok=Njc4LUZITC03MTAAAAGfzYKyrMpN450zww4vNJy5pVfvs9sg-g9x5_lg53o4t6nxOSZAzG_6U6ETLeGkuIrXsy1gIusyu0E3XbeqcPGdeGiYLGJ8pRhocpcmEUvf

2025

Palo Alto Crosswalk signals hacked: https://padailypost.com/2025/12/29/crosswalk-signals-were-hacked-because-of-a-weak-password/

Telegram is being used to as a black market for online scams: https://www.wired.com/story/expired-tired-wired-chinese-scammer-crypto-markets/

The “Smishing Traid” conducting text messaging scams: https://www.theatlantic.com/technology/2025/11/smishing-scams/684905/ and https://www.wsj.com/tech/cybersecurity/url-scam-texts-china-gangs-68e96097

Denmark says Russia behind two cyber-attacks: https://www.theguardian.com/world/2025/dec/18/denmark-says-russia-was-behind-two-destructive-and-disruptive-cyber-attacks

Article about governments intentionally shutting down Internet: https://www.schneier.com/blog/archives/2025/12/deliberate-internet-shutdowns.html

SitusAMC hacked, including bank data: https://www.nytimes.com/2025/11/22/business/bank-data-hack.html?smid=nytcore-ios-share

Anthropic says AI used in Chinese cyberattack: https://www.nytimes.com/2025/11/14/business/chinese-hackers-artificial-intelligence.html?smid=nytcore-ios-share&referringSource=articleShare and https://www.anthropic.com/news/detecting-countering-misuse-aug-2025

State of Nevada Ransomware – After Action Report: https://gov.nv.gov/uploadedFiles/itnewnvgov/content/Governance/GTO%20Statewide%20Cyber%20Event%20AAR%20Final.pdf?mod=djemCybersecruityPro&tpl=cs

UPenn Data Breach of Student and Alumni Information: https://www.nytimes.com/2025/11/04/us/penn-data-breach-donors-students.html?smid=nytcore-ios-share&referringSource=articleShare

F5 (VPN / security provider) suffered a “sophisticated”, “long-term” hack, including control of build system and access to source code and customer configs: https://www.schneier.com/blog/archives/2025/10/serious-f5-breach.html

Why smartphones are being stolen in London: https://www.nytimes.com/2025/10/15/world/europe/london-police-phone-theft-china-gang.html?smid=nytcore-ios-share&referringSource=articleShare

Russians recruiting local teenagers in The Hague for cyber-espionage: https://news.risky.biz/the-cyberespionage-gig-economy/

Scattered Spider Duo tied to $115M in Ransoms: https://krebsonsecurity.com/2025/09/feds-tie-scattered-spider-duo-to-115m-in-ransoms/

Cyberattack Forces Cancellations at European Airports: https://www.nytimes.com/2025/09/21/world/europe/brussels-airport-delays-europe-cyberattack.html?smid=nytcore-ios-share&referringSource=articleShare

Stealing baseball ticket’s from MLB’s Ballpark App: https://www.nytimes.com/athletic/6644767/2025/09/19/mlb-digital-ticket-theft-ballpark-app/

Chinese Hackers pretend to be a US Congressman during trade talks: https://www.wsj.com/politics/national-security/china-trade-talks-spy-5c4801ca?mod=djemCybersecruityPro&tpl=cs

Salt Typhoon collects data on virtually all Americans: https://www.nytimes.com/2025/09/04/world/asia/china-hack-salt-typhoon.html?smid=nytcore-ios-share&referringSource=articleShare

Workday CRM breach: https://therecord.media/workday-social-engineering-data-breach?mkt_tok=Njc4LUZITC03MTAAAAGcZsIHtYk4xRpy59NxBwdWG0YGYXHOfkmzFBiDiHJxgT09c3GCtEHsEciBD-_bQ5wyYMZJrnsYiLbyn3e1Cna_gjv2DVCLNzWCW9SVlMRN

Russians behind breach of Federal Court Filing System: https://www.nytimes.com/2025/08/12/us/politics/russia-hack-federal-court-system.html?smid=nytcore-ios-share&referringSource=articleShare

Columbia University Data Breach: https://www.bleepingcomputer.com/news/security/columbia-university-data-breach-impacts-nearly-870-000-students-applicants-employees/ and https://www.nytimes.com/2025/06/25/nyregion/columbia-university-cyberattack.html?smid=nytcore-ios-share&referringSource=articleShare

Zero-day in Microsoft Sharepoint leading to data theft: https://www.schneier.com/blog/archives/2025/07/microsoft-sharepoint-zero-day.html

Hackers are targetting call centers to steal customer data: https://www.wsj.com/tech/cybersecurity/how-hackers-are-turning-tech-support-into-a-threat-8c0837b1?mod=djemCybersecruityPro

Hackers impersonate White House Chief of Staff: https://www.wsj.com/politics/policy/federal-authorities-probe-effort-to-impersonate-white-house-chief-of-staff-65da0d59

NLRB whistleblower claims Russia stole government data from US using DOGE account: https://krebsonsecurity.com/2025/04/whistleblower-doge-siphoned-nlrb-case-data/

Lots of details about ByBit (crypto exchange) hack of over $1.5B: https://www.nytimes.com/2025/03/06/technology/bybit-crypto-hack-north-korea.html

Disney insider threat: https://www.wsj.com/tech/cybersecurity/disney-employee-ai-tool-hacker-cyberattack-3700c931

Lee Enterprises, a newspaper company, was distrupted by a cyberattack: https://www.nytimes.com/2025/02/09/business/media/newspaper-cyberattack-lee-enterprises.html?smid=nytcore-ios-share&referringSource=articleShare

2024

Krispy Kreme cyber-attack prevented online ordering; company suggests people visit stores. https://www.wsj.com/articles/cyberattack-snarls-krispy-kremes-online-ordering-ce98d21f?mod=djemCybersecruityPro&tpl=cs – and $1.6M settlement of resulting lawsuit: https://www.charlotteobserver.com/news/business/article314499470.html?mod=djemCybersecruityPro&tpl=cs

Silk Typhoon hackers indicted for hacking US Treasury, lots of others: https://www.schneier.com/blog/archives/2025/03/silk-typhoon-hackers-indicted.html and https://www.wired.com/story/us-charges-12-alleged-spies-in-chinas-freewheeling-hacker-for-hire-ecosystem/ and https://www.nytimes.com/2024/12/30/us/politics/china-hack-treasury.html?smid=nytcore-ios-share&referringSource=articleShare

Schneider Electric cyberattack: https://www.wsj.com/articles/schneider-electric-investigates-cyberattack-8153d8c3

xz Utils Backdoor (2024): https://www.schneier.com/blog/archives/2024/04/xz-utils-backdoor.html and https://www.nytimes.com/2024/04/03/technology/prevent-cyberattack-linux.html?unlocked_article_code=1.h00.nDPf.n9rA2dx-Uqzm&smid=nytcore-ios-share&referringSource=articleShare&ugrp=m&sgrp=c-cb (and https://www.schneier.com/blog/archives/2024/04/other-attempts-to-take-over-open-source-projects.html for other examples)

MOVEIt and Clop (2023-2024): https://www.blackfog.com/what-we-know-about-the-moveit-exploit/ and https://therecord.media/clop-moveit-zero-day-dustin-childs-interview and https://www.wired.com/story/moveit-breach-victims/

UnitedHealth Group / Change Healthcare (2024, still ongoing): https://www.hhs.gov/about/news/2024/03/05/hhs-statement-regarding-the-cyberattack-on-change-healthcare.html and https://www.npr.org/sections/health-shots/2024/03/09/1237038928/health-industry-ransomware-cyberattack-change-healthcare-optum-uhc-united

Bad Dog (band) and copyright fraud (2024) - https://www.nytimes.com/2024/01/13/business/music-streaming-fraud-spotify.html?smid=nytcore-ios-share&referringSource=articleShare

Museum attacks (2024): https://www.nytimes.com/2024/01/03/arts/design/museum-cyberattack.html?smid=nytcore-ios-share&referringSource=articleShare

Cyber Kidnapping (2024): https://kutv.com/news/local/missing-foreign-exchange-student-out-of-utah-located-in-box-elder-county

2023

Insomniac data breach / Rhysidia$ (2023): https://www.ign.com/articles/insomniac-hackers-release-stolen-data-leak-wolverine-videos-future-projects-and-more?utm_source=instagram

Lapsus$ and GTA6 (2023): https://www.bbc.com/news/technology-67663128

Ukraine cell infrastructure Kyivstar (2023): https://www.reuters.com/technology/cybersecurity/ukraine-says-russian-intelligence-linked-hackers-claim-cyberattack-mobile-2023-12-13/ (is this “hacktivists” engaging in acts of war? https://therecord.media/ukraine-intelligence-claims-attack-on-russia-tax-service and https://www.schneier.com/blog/archives/2023/12/cyberattack-on-ukraines-kyivstar-seems-to-be-russian-hacktivists.html)

Gay Furry Hackers (2023): https://www.engadget.com/self-proclaimed-gay-furry-hackers-breach-nuclear-lab-152034192.html and https://cybernews.com/news/idaho-national-lab-data-breach/#google_vignette

UW Phishing alert (2023): https://it.wisc.edu/news/phishing-attempt-netid-mfa-duo/ (I don’t know much about this; if you do, it could make for a good report. But if you can’t find more information than this, then it likely won’t be very good.)

Danish power infrastructure (2023): https://cybernews.com/news/denmark-cyberattack-energy-infrastructure-sandworm/

Attacking Ohio city infrastructure (2023): https://therecord.media/huber-heights-ohio-ransomware-attack

MGM ransomware (2023): https://cybersecuritynews.com/mgm-resorts-systems-restored/

Equilend (2023): https://www.wsj.com/articles/equilend-a-securities-lending-platform-hit-by-cyberattack-f219fbdf?mod=djemCybersecruityPro&tpl=cy

23 and me (2023): https://techcrunch.com/2024/01/25/23andme-admits-it-didnt-detect-cyberattacks-for-months/?mod=djemCybersecruityPro&tpl=cy&guccounter=1

Pennsylvania courts DDoS (2023): https://therecord.media/ddos-attack-knocks-pennsylvania-court-system-services-offline?utm_medium=email&_hsmi=293031103&_hsenc=p2ANqtz-8UJPkqnawqixbeHU4HLEUA1ytvEc9djocbUxMBUTH4vDbtTL28Lb9M7GYhtU8nhG2igP4WCMkcoBQWPBNUwTFrKfiHlQ&utm_content=293028239&utm_source=hs_email

Hacking to chill free speech (2023): https://www.indexoncensorship.org/2023/12/hacking-is-far-more-than-a-security-issue-it-chills-free-speech/

GPS challenges because Ukraine war (2023): https://www.nytimes.com/2023/11/21/world/europe/ukraine-israel-gps-jamming-spoofing.html?smid=nytcore-ios-share&referringSource=articleShare

Baruch college ransomware (2023): https://theticker.org/12149/news/breaking-potential-ransomware-attack-causes-campus-wide-system-outage-switch-to-remote-learning/

Volt Typhoon (2023): https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-038a

NextGen Health Ransomware (2023): https://www.washingtonpost.com/politics/2023/01/23/latest-cyberattack-health-care-shows-how-vulnerable-sector-is/

Albanian Banks (2023): https://www.nytimes.com/2023/02/25/world/europe/albania-iran-nato-cyberattacks.html?smid=nytcore-ios-share&referringSource=articleShare