16-31 October 2023 Cyber Attacks Timeline

Last modified: December 28, 2023

Follow me on X

Connect on Linkedin

Connect on Mastodon

EVENTS

EVENTS/DAY

EVENTS

EVENTS/DAY

Motivations October H2 2023

Attack Techniques October H2 2023

In the second half of October 2023, I have collected 183 events (11.44 events per day,) a number slightly lower than the first fortnight of the same month, but a number which confirms the high level of activity that is characterizing this end of the year.

Ransomware continued to characterize the threat landscape (37 events were directly or indirectly related to this kind of attack,) and consequently malware attacks led the chart of the attack techniques with 34.4% (63 out of 183 events), a number in line with the previous two weeks. On the other hand, the exploitation of vulnerabilities characterized 15.3% of events, again a number in line with the previous period.

Rogue AI Agents

AI agents are escaping sandboxes, misusing credentials and acting without authorization. This live dashboard tracks every reported incident on a

The fintech sector saw the execution of a massive operation targeting more than 25 victims worldwide, where the threat actors stole $4.4 million in cryptocurrency using private keys and passphrases stored in stolen LastPass databases.

No particular mega breaches were recorded in this period, despite I must point out that I added a massive one to the previous timeline, which was unearthed later, and it is the one targeting the Indian Council of Medical Research, with 815 million records leaked of Indian citizens who had Covid-19 tests.

Threat actors driven by cyber espionage were quite busy in exploiting the numerous vulnerabilities disclosed in this period (and not only.) For example several groups including Sandworm, APT28, and APT40 carried on operations exploiting the CVE-2023-38831 WinRAR vulnerability, whilst the North Korean Lazarus leveraged the CVE-2023-42793 vulnerability in TeamCity to breach multiple organizations, and also Winter Vivern targeted European governments and think tanks via the Roundcube CVE-2023-5631 flaw. Besides this widespread exploitation, other interesting events related to cyber espionage concern a report from the French Cyber Security Agency (ANSSI) revealing a long standing campaign by the Russian APT28 targeting government entities, businesses, universities, research institutes, and think tanks in France since the second half of 2021.

But obviously the war in Middle East was also the trigger for multiple operations carried out by Hacktivists on both sides (including some well-known actors such as Killnet and Anonymous Sudan,) with Israel and other allied countries targeted by multiple attacks.

Of course, my suggestion is always the same: browse the timeline, and obviously share it to support my work in spreading the risk awareness across the community. And don’t forget to follow @paulsparrows on X (formerly Twitter,) or even connect on Linkedin, or Mastodon for the latest updates.

Geo Map October H2 2023

No Data Found

ID	Date Reported	Date Occurred	Date Discovered	Author	Target	Description	Attack	Target Class	Attack Class	Country	Link	Tags
1	16/10/2023	-	-	?	Android users in Italy	Researchers from D3Lab observe the Android 'SpyNote' malware in attacks targeting Italy using a fake 'IT-alert' public alert service announcing a fake volcano eruption.	Malware	Individual	Cyber Crime	IT		D3Lab, Android, SpyNote, IT-alert
2	16/10/2023	'In recent weeks'	'In recent weeks'	?	Multiple organizations	Researchers from Malwarebytes discover a new Google Search malvertising campaign targeting users looking to download the popular Notepad++ text editor, employing advanced techniques to evade detection and analysis.	Malvertising	Multiple Industries	Cyber Crime	>1		Malwarebytes, Google Search, Notepad++
3	16/10/2023	-	05/10/2023	SingularityMD	Clark County School District	The Clark County School District (CCSD) is hit by a cyber attack claimed by a threat actor name 'SingularityMD'. Three weeks after, the attacker emails parents their children's' data that was allegedly stolen during the cyberattack.	Unknown	Education	Cyber Crime	US		SingularityMD, Clark County School District. CCSD
4	16/10/2023	-	15/10/2023	Black Basta	Ampersand	Ampersand, a television advertising sales and technology company jointly owned by the three largest U.S. cable operators (Comcast Corporation, Charter Communications and Cox Communications) is hit with a Black Basta ransomware attack.	Malware	Information and communication	Cyber Crime	US		Ampersand, Comcast Corporation, Charter Communications, Cox Communications, Black Basta, ransomware
5	16/10/2023	16/10/2023	16/10/2023	?	Westchester Medical Center Health Network	Westchester Medical Center Health Network releases a statement, warning that HealthAlliance Hospital, Margaretville Hospital and Mountainside Residential Care Center are “experiencing a potential cybersecurity threat and an IT system outage."	Unknown	Human health and social work	Cyber Crime	US		Westchester Medical Center Health Network,HealthAlliance Hospital, Margaretville Hospital, Mountainside Residential Care Center.
6	16/10/2023	-	-	Pro-Russian hacker group	Spotify account of a British-based music artist named Rebzyyx	A pro-Russian hacker group claims to have hacked a British-based music artist named Rebzyyx, replacing their profile image and album covers with pictures featuring Russian flags.	Account Takeover	Arts entertainment, recreation	Hacktivism	GB		Russia, Ukraine, Rebzyyx, Spotify
7	16/10/2023	Since at least 11/10/2023	13/10/2023	?	Individuals in Russia, Sweden, Romania, Iran, India, US, Japan, Germany, and the UK	Researchers from Bitdefender discover multiple Israel war-themed spam campaigns.	Scam	Individual	Cyber Crime	DE GB IN IR JP RO RU SE US		Bitdefender, Scam
8	16/10/2023	-	-	Lumma Stealer	Multiple organizations	Researchers from Trend Micro discover a campaign delivering the Lumma Stealer via Discord.	Malware	Multiple Industries	Cyber Crime	>1		Trend Micro, Lumma Stealer, Discord
9	16/10/2023	-	14/10/2023	ALPHV AKA BlackCat	QSI	The BlackCat ransomware group adds QSI Banking to its victim list and claims to have stolen 5 TB of data.	Malware	Professional, scientific and technical	Cyber Crime	US		QSI, BlackCat, ALPHV, ransomware
10	16/10/2023	28/07/2023	-	XorDDoS	Multiple organizations	Researchers from Palo Alto discover a new campaign from the XorDDoS Trojan.	Malware	Multiple Industries	Cyber Crime	>1		Palo Alto, XorDDoS
11	16/10/2023	11/10/2023	11/10/2023	?	Akumin	Akumin files a notice of data breach after discovering that it had been the recent victim of a ransomware attack.	Malware	Professional, scientific and technical	Cyber Crime	US		Akumin, ransomware
12	16/10/2023	During May 2023	-	Clop AKA Lace Tempest, TA505, and FIN11	Gillette Children’s Specialty Healthcare	Gillette Children’s Specialty Healthcare confirms that the protected health information of 542 patients was compromised as part of the mass exploitation of the zero day vulnerability in Progress Software’s MOVEit Transfer application.	CVE-2023-34362 Vulnerability	Human health and social work	Cyber Crime	US		Clop, Cl0p, Lace Tempest, TA505, FIN11, Gillette Children’s Specialty Healthcare, MOVEit, CVE-2023-34362
13	16/10/2023	22/02/2023	07/03/2023	?	Peerstar	Peerstar, a provider of mental health support services, notifies 11,438 patients about the exposure and potential theft of their protected health information.	Unknown	Human health and social work	Cyber Crime	US		Peerstar
14	16/10/2023	14/10/2023	14/10/2023	CyberAv3ngers	ORPAK Systems	The hacktivist group CyberAv3ngers claims responsibility for a major cyberattack on ORPAK Systems, a prominent provider of gas station solutions in Israel, taking offline 200 gasoline pumps.	Unknown	Professional, scientific and technical	Hacktivism	IL		CyberAv3ngers, ORPAK Systems
15	17/10/2023	-	-	?	Unknown organization(s)	Cisco warnes of CVE-2023-20198, a new maximum severity authentication bypass zero-day in its IOS XE software actively exploited in the wild, few days later over 40,000 systems are compromised.	CVE-2023-20198 Vulnerability	Unknown	N/A	N/A		Cisco, CVE-2023-20198, IOS XE
16	17/10/2023	-	02/10/2023	uid=0	D-Link	Taiwanese networking equipment manufacturer D-Link confirmed a data breach linked to information stolen from its network and put up for sale on BreachForums.	Account Takeover	Manufacturing	Cyber Crime	TW		D-Link, Uid=0, BreachForums
17	17/10/2023	-	-	?	Plastic surgery offices across the United States	The FBI warns of cyber criminals using spoofed emails and phone numbers to target plastic surgery offices across the United States for extortion in phishing attacks that spread malware.	Malware	Human health and social work	Cyber Crime	US		FBI, plastic surgery
18	17/10/2023	Since late August 2023	Since late August 2023	?	Unknown organization(s)	Researchers from Mandiant reveal that a critical vulnerability tracked as CVE-2023-4966 in Citrix NetScaler ADC/Gateway devices has been actively exploited as a zero-day since late August.	CVE-2023-4966 Vulnerability	Unknown	N/A	N/A		Mandiant, CVE-2023-4966, Citrix NetScaler ADC/Gateway
19	17/10/2023	Since at least September 2022	Since at least September 2022	TetrisPhantom	Government systems in the Asia-Pacific region	Researchers from Kaspersky disclose a new sophisticated threat tracked as ‘TetrisPhantom,’ using compromised secure USB drives to target government systems in the Asia-Pacific region.	Targeted Attack	Public admin and defence, social security	Cyber Espionage	N/A		Kaspersky, TetrisPhantom, USB, Pacific
20	17/10/2023	17/10/2023	17/10/2023	Black Basta	Servicio Nacional de Aduanas de Chile (Customs Department in Chile)	The government of Chile warns of ransomware attacks by the Black Basta gang after its customs department has to deal with an incident.	Malware	Public admin and defence, social security	Cyber Crime	CL		Servicio Nacional de Aduanas de Chile, Customs Department, Chile, Black Basta, ransomware
21	17/10/2023	Since June 2023	Since June 2023	?	Multiple organizations	Researchers from Proofpoint discover a new cluster of fake browser update campaigns leading to the NetSupport RAT, referred to as ZPHP or SmartApeSG.	Malware	Multiple Industries	Cyber Crime	>1		Proofpoint, NetSupport, RAT, ZPHP, SmartApeSG
22	17/10/2023	Since at least August 2023	-	?	Multiple organizations	Researchers from Proofpoint discover additional campaigns related to the ClearFake cluster distributing fake browser updates.	Malware	Multiple Industries	Cyber Crime	>1		Proofpoint, ClearFake
23	17/10/2023	-	-	Kimsuky	Multiple organizations	Researchers from Ahnlab discover a new campaign by the North Korean threat actor Kimsuky exploiting the Remote Desktop Protocol (RDP) to deliver the BabyShark malware.	Targeted Attack	Multiple Industries	Cyber Espionage	>1		Ahnlab, North Korea, Remote Desktop Protocol, RDP, BabyShark
24	17/10/2023	-	15/10/2023	Knight	BMW Munique Motors	The Knight ransomware group claims responsibility for a cyberattack on BMW Munique Motors, a Brazilian authorized BMW dealer.	Malware	Wholesale and retail	Cyber Crime	BR		Knight, ransomware, BMW Munique Motors
25	17/10/2023	-	-	Clop AKA Lace Tempest, TA505, and FIN11	MUSC Health	MUSC Health says patients' protected health information may have been compromised as its research support and services provider, Westat, was caught in the massive MOVEit hack.	CVE-2023-34362 Vulnerability	Human health and social work	Cyber Crime	US		Clop, Cl0p, Lace Tempest, TA505, FIN11, MUSC Health, Westat, MOVEit, CVE-2023-34362
26	17/10/2023	17/10/2023	17/10/2023	?	Fantom Foundation	The Fantom Foundation, a non-profit organization that supports the Fantom blockchain network, suffers a data breach apparently, due to the CVE-2023-4863 zero-day security vulnerability in Google Chrome, losing over $550,000 in cryptocurrency.	CVE-2023-4863 Vulnerability	Fintech	Cyber Crime	N/A		Fantom Foundation, CVE-2023-4863, Google Chrome
27	17/10/2023	-	-	Cactus	Società Canavesana Servizi	The Cactus ransomware gang claims responsibility for a cyber attack to Società Canavesana Servizi (SCS).	Malware	Water supply, waste mgmt, remediation	Cyber Crime	IT		Cactus, ransomware, Società Canavesana Servizi, SCS
28	17/10/2023	-	-	Knight	Kinesis Film	The Knight ransomware gang claims responsibility for a cyber attack to Kinesis Film	Malware	Arts entertainment, recreation	Cyber Crime	IT		Knight, ransomware, Kinesis Film
29	17/10/2023	-	-	Knight	Mario de Cecco Workwear and Corporate Wear	The Knight ransomware gang claims responsibility for a cyber attack to Mario de Cecco Workwear and Corporate Wear.	Malware	Manufacturing	Cyber Crime	IT		Knight, ransomware, Mario de Cecco Workwear and Corporate Wear
30	17/10/2023	-	-	Knight	Faieta Motor Company	The Knight ransomware gang claims responsibility for a cyber attack to Faieta Motor Company.	Malware	Wholesale and retail	Cyber Crime	IT		Knight, ransomware, Faieta Motor Company
31	17/10/2023	-	-	Black Basta	Piemme	The Black Basta ransomware gang claims responsibility for a cyber attack to Piemme Media Platform.	Malware	Information and communication	Cyber Crime	IT		Black Basta, Ransomware, Piemme Media Platform
32	17/10/2023	17/10/2023	17/10/2023	CyberAv3ngers	City of Nahariya	The hacktivists from the CyberAv3ngers claim responsibility for a cyber attack plunging the Israeli city of Nahariya into darkness.	Unknown	Electricity, gas steam, air conditioning	Hacktivism	IL		CyberAv3ngers, Israel, Palestine, Nahariya
33	18/10/2023	End of September 2023	End of September 2023	?	Multiple organizations	Researchers from Cado discover 'Qubitstrike', a campaign where attackers are scanning for internet-exposed Jupyter Notebooks to breach servers and deploy a cocktail of malware consisting of a Linux rootkit, crypto miners, and password-stealing scripts.	Malware	Multiple Industries	Cyber Crime	>1		Cado, Qubitstrike, Jupyter Notebooks, Linux
34	18/10/2023	'In recent weeks'	'In recent weeks'	Multiple threat actors including Sandworm, APT28, and APT40	Multiple organizations	Google's Threat Analysis Group's (TAG) observe multiple government-backed threat actors exploiting the known vulnerability, CVE-2023-38831, in WinRAR.	CVE-2023-38831 Vulnerability	Multiple Industries	Cyber Espionage	>1		Google, Threat Analysis Group, TAG, CVE-2023-38831, WinRAR, Russia, China, Sandworm, APT28, APT40
35	18/10/2023	Between August 2022 and May 2023	In early September 2022	?	Oil and gas firms and the defense industry in Eastern Europe	Researchers from Kaspersky discover an updated version of the MATA backdoor framework deployed in attacks targeting oil and gas firms and the defense industry in Eastern Europe, exploiting the CVE-2021-26411 vulnerability.	Targeted Attack	Multiple Industries	Cyber Espionage	>1		Kaspersky, MATA, CVE-2021-26411
36	18/10/2023	Since early October 2023	Since early October 2023	Lazarus (aka Diamond Sleet and ZINC) and Andariel (aka Onyx Sleet and PLUTONIUM)	Multiple organizations	Microsoft says that the North Korean Lazarus and Andariel hacking groups are exploiting the CVE-2023-42793 vulnerability in TeamCity servers to deploy backdoor malware, likely to conduct software supply chain attacks.	Targeted Attack	Multiple Industries	Cyber Espionage	>1		Microsoft, North Korea, Lazarus, Diamond Sleet, ZINC, Andariel, Onyx Sleet, PLUTONIUM, CVE-2023-42793, TeamCity
37	18/10/2023	-	12/10/2023	Ukrainian Cyber Alliance	Trigona	Hacktivists under the Ukrainian Cyber Alliance hack the servers of the Trigona ransomware gang and wipe them after copying all the information available.	Unknown	Other service activities	Hacktivism	N/A		Ukrainian Cyber Alliance, Trigona, ransomware
38	18/10/2023	11/10/2023	11/10/2023	?	Casio	Japanese electronics manufacturer Casio discloses a data breach impacting customers from 149 countries after hackers gained to the servers of its ClassPad education platform.	Unknown	Manufacturing	Cyber Crime	JP		Casio
39	18/10/2023	During October 2023	During October 2023	?	Multiple organizations	Researchers from Malwarebytes discover a Google Ads campaign pushing a fake KeePass download site that used Punycode to appear as the official domain of the KeePass password manager to distribute malware.	Malvertising	Multiple Industries	Cyber Crime	>1		Malwarebytes, Google Ads, KeePass, Punycode
40	18/10/2023	-	-	ALPHV AKA BlackCat	Multiple organizations	Researchers from Palo Alto Networks reveal that the BlackCat/ALPHV ransomware operation has begun to use a new tool named 'Munchkin' that utilizes virtual machines to deploy encryptors on network devices stealthily.	Malware	Multiple Industries	Cyber Crime	>1		Palo Alto Networks, BlackCat, ALPHV, ransomware, Munchkin
41	18/10/2023	30/05/2023	29/06/2023	Akira	BHI Energy	US energy services firm BHI Energy discloses to have been hit by an Akira ransomware attack.	Malware	Electricity, gas steam, air conditioning	Cyber Crime	US		BHI Energy, Akira, ransomware
42	18/10/2023	Between 11/10/2021 and 09/08/2022	-	?	AIDS Alabama	AIDS Alabama discloses a security breach.	Unknown	Human health and social work	Cyber Crime	US		AIDS Alabama
43	18/10/2023	-	-	?	Populus Financial Group	Populus Financial Group files a notice of data breach after learning information that had been entrusted to the company was subject to unauthorized access.	Unknown	Finance and insurance	Cyber Crime	US		Populus Financial Group
44	18/10/2023	-	30/05/2023	Clop AKA Lace Tempest, TA505, and FIN11	Meadville Medical Center	Meadville Medical Center confirms that it was affected by the MOVEit Transfer hacks	CVE-2023-34362 Vulnerability	Human health and social work	Cyber Crime	US		Meadville Medical Center, Clop, Cl0p, Lace Tempest, TA505, FIN11, MOVEit, CVE-2023-34362
45	19/10/2023	Between February and September 2023	Between February and September 2023	Crambus (aka OilRig, APT34, MuddyWater)	Middle Eastern government network	Researchers from Broadcom Symantec reveal that the Iranian hacking group tracked as OilRig (APT34) breached at least twelve computers belonging to a Middle Eastern government network and maintained access for eight months, installing a PowerShell backdoor dubbed 'PowerExchange.'	Targeted Attack	Public admin and defence, social security	Cyber Espionage	N/A		Broadcom/Symantec, Crambus, OilRig, APT34, Middle East, PowerShell, PowerExchange, MuddyWater
46	19/10/2023	For at least five years	-	?	Individuals in India	India's Central Bureau of Investigation (CBI) raids 76 locations in a nationwide crackdown, named Operation Chakra-II, on cybercrime operations behind tech support scams and cryptocurrency fraud.	Scam	Individual	Cyber Crime	IN		India, Central Bureau of Investigation, CBI, Operation Chakra-II
47	19/10/2023	Since at least 14/10/2023	14/10/2023	?	QNAP devices	QNAP reveals to have taken down a malicious server used in widespread brute-force attacks targeting Internet-exposed NAS (network-attached storage) devices with weak passwords.	Brute-force	Multiple Industries	Cyber Crime	>1		QNAP
48	19/10/2023	Since at least April 2022	During April 2022	?	Organizations providing business-to-business (B2B) products and services	Researchers from Kaspersky reveal that a campaign emerged in April 2022, targeting network resources to mine Monero cryptocurrency, steal data and set up other malware to allow for further access, is still active with at least 200 targets worldwide.	Malware	Multiple Industries	Cyber Crime	BR RO RU SA VN >1		Kaspersky, FBI
49	19/10/2023	20/09/2023	20/09/2023	BlackDogs2023	Undisclosed organization	Researchers from Sophos reveal the details of a ransomware attack, carried out using a using a LockBit copy, and exploiting an Adobe ColdFusion vulnerability.	Malware	Unknown	Cyber Crime	N/A		Sophos, ransomware, LockBit copy, Adobe ColdFusion, BlackDogs2023
50	19/10/2023	-	17/10/2023	Knight	US Claims Solutions	The Knight ransomware group adds US Claims Solutions (USCS) to the list of its victims.	Malware	Finance and insurance	Cyber Crime	US		Knight, ransomware, US Claims Solutions, USCS
51	19/10/2023	Since August 2023	-	ExelaStealer	Multiple organizations	Researchers from Fortinet discover a new infostealer malware named ExelaStealer.	Malware	Multiple Industries	Cyber Crime	>1		Fortinet, ExelaStealer
52	19/10/2023	19/10/2023	19/10/2023	?	Viking Line	Viking Line is hit with a DDoS attack	DDoS	Transportation and storage	Cyber Crime	FI		Viking Line
53	19/10/2023	-	-	?	Undisclosed online retailer	Researchers from Sucuri discover a campaign exploiting an outdated OpenCart version to launch a skimmer attack.	Malicious Script Injection	Wholesale and retail	Cyber Crime	N/A		Sucuri, OpenCart
54	19/10/2023	05/02/2023	31/01/2023	?	Dollar Energy Fund	Dollar Energy Fund (DEF) files a notice of data breach after discovering that its network was accessed by an unauthorized party.	Unknown	Human health and social work	Cyber Crime	US		Dollar Energy Fund, DEF
55	19/10/2023	28/02/2023	02/03/2023	?	Concorde Investment Partners	Concorde Investment Partners, parent company to Concorde Investment Services, Concorde Asset Management, and Concorde Insurance Agency (collectively “Concorde”), files a notice of data breach after discovering that an unauthorized party was able to access an employee’s email account.	Account Takeover	Finance and insurance	Cyber Crime	US		Concorde Investment Partners, Concorde Investment Services, Concorde Asset Management, Concorde Insurance Agency, Concorde
56	19/10/2023	16/05/2023	22/05/2023	?	Trust Benefit Technologies	Trust Benefit Technologies files a notice of data breach after discovering that an unauthorized party was able to access portions of the company’s computer system.	Unknown	Professional, scientific and technical	Cyber Crime	US		Trust Benefit Technologies
57	19/10/2023	'Recently'	'Recently'	?	PennyMac Loan Services	PennyMac Loan Services files a notice of data breach after discovering that unauthorized actors were able to access information that had been entrusted to the company.	Unknown	Finance and insurance	Cyber Crime	US		PennyMac Loan Services
58	19/10/2023	15/03/2023	24/03/2023	?	Piedmont Healthcare	Piedmont Healthcare confirms to have been affected by a cyberattack on its claims processing and administrative services provider, Pharm-Pacc.	Unknown	Human health and social work	Cyber Crime	US		Piedmont Healthcare, Pharm-Pacc.
59	19/10/2023	-	19/09/2023	ALPHV AKA BlackCat	Cadre Services	The ALPHV/BlackCat ransomware gang lists Cadre Services among its victims, claiming to have stolen 100 GB of files.	Malware	Professional, scientific and technical	Cyber Crime	US		ALPHV, BlackCat, ransomware, Cadre Services
60	19/10/2023	-	-	?	4,000 Israeli citizens	A criminal group publishes the details of 4,000 Israeli citizens on Telegram.	Unknown	Individual	Hacktivism	IL		Israel, Palestine, Telegram
61	19/10/2023	19/10/2023	19/10/2023	?	Italian Ministry of Infrastructure and Transport Facebook Page	The Facebook page of the Italian Ministry of Infrastructure and Transport is hijacked to promote a bitcoin scam.	Account Takeover	Public admin and defence, social security	Cyber Crime	IT		Italian Ministry of Infrastructure and Transport, Facebook
62	20/10/2023	'Recently'	'Recently'	DuckTail	Organizations in the UK, US, and India	Researchers at WithSecure expose a new wave of attacks carried out by the same Vietnamese threat actor behind the DuckTail campaign, targeting entities in the U.K., the U.S., and India.	Malware	Multiple Industries	Cyber Crime	IN UK US		WithSecure, DuckTail, DarkGate, RedLine
63	20/10/2023	-	-	?	Okta	Okta says attackers accessed files containing cookies and session tokens uploaded by customers to its support management system after breaching it using stolen credentials.	Account Takeover	Professional, scientific and technical	Cyber Crime	US		Okta
64	20/10/2023	02/10/2023	02/10/2023	?	BeyondTrust	BeyondTrust reveals to have detected an identity-centric attack on an in-house Okta administrator account	Account Takeover	Professional, scientific and technical	Cyber Crime	US		Okta, BeyondTrust
65	20/10/2023	18/10/2023	18/10/2023	?	CloudFlare	Cloudflare also discover malicious activity linked to Okta's breach on its servers.	Account Takeover	Professional, scientific and technical	Cyber Crime	US		Okta, CloudFlare
66	20/10/2023	-	-	?	Unknown organization(s)	Cisco discloses a new high-severity zero-day (CVE-2023-20273), actively exploited to deploy malicious implants on IOS XE devices compromised using the CVE-2023-20198 zero-day previously disclosed.	CVE-2023-20273 Vulnerability	Multiple Industries	N/A	N/A		Cisco, CVE-2023-20273, IOS, CVE-2023-20198
67	20/10/2023	24/05/2023	24/05/2023	?	City of Philadelphia	The City of Philadelphia investigates a data breach after attackers "may have gained access" to City email accounts containing personal and protected health information five months ago, in May.	Account Takeover	Public admin and defence, social security	Cyber Crime	US		City of Philadelphia
68	20/10/2023	-	20/10/2023	Hunters International	Multiple organizations	A new ransomware-as-a-service brand named Hunters International emerges using code used by the Hive ransomware operation.	Malware	Multiple Industries	Cyber Crime	>1		Ransomware, Hunters International, Hive
69	20/10/2023	During 2023	During 2023	QuasarRAT	Multiple organizations	Researchers from Uptycs discover a new version of the QuasarRAT (AKA CinaRAT or Yggdrasil) employing a DLL side-loading,	Malware	Multiple Industries	Cyber Crime	>1		Uptycs, QuasarRAT, CinaRAT, Yggdrasil
70	20/10/2023	-	-	PLAY	Associated Wholesale Grocers	The PLAY ransomware group adds Associated Wholesale Grocers (AWG) to the list of their victims.	Malware	Accommodation and food service	Cyber Crime	US		PLAY, ransomware, Associated Wholesale Grocers, AWG
71	20/10/2023	07/08/2023	-	?	CoinFlip	GPD Holdings d/b/a CoinFlip files a notice of data breach after discovering that a CoinFlip employee’s email account was compromised.	Account Takeover	Fintech	Cyber Crime	US		GPD Holdings, CoinFlip
72	20/10/2023	Since October 2022	19/05/2023	?	Wescom Credit Union	Wescom Credit Union (Wescom) files a notice of data breach after discovering that attackers exploited a vulnerability on their ESG Barracuda Network appliance.	Vulnerability	Finance and insurance	Cyber Crime	US		Wescom Credit Union, Wescom, ESG, Barracuda Network
73	17/10/2023	-	-	Clop AKA Lace Tempest, TA505, and FIN11	Cape Fear Valley Health	Cape Fear Valley Health discloses that it suffered a data breach affecting 1,943 patients as its research support and services provider, Westat, was caught in the massive MOVEit hack.	CVE-2023-34362 Vulnerability	Human health and social work	Cyber Crime	US		Clop, Cl0p, Lace Tempest, TA505, FIN11, Cape Fear Valley Health, Westat, MOVEit, CVE-2023-34362
74	21/10/2023	-	-	?	Individuals in Spain	The Spanish National Police announces to have dismantled a cybercriminal organization that carried out a variety of computer scams to steal and monetize the data of over four million people.	Scam	Individual	Cyber Crime	ES		Spanish National Police
75	21/10/2023	-	-	?	META Law Enforcement Portal	A threat actor is selling access to Facebook and Instagram’s Police Portal used by law enforcement agencies to request data relating to users under investigation.	Account Takeover	Public admin and defence, social security	Cyber Crime	US		Meta, Facebook, Instagram, Law Enforcement
76	21/10/2023	Mid-October 2023	Mid-October 2023	?	American Family Insurance	Insurance giant American Family Insurance (AmFam) confirms it suffered a cyberattack and shuts down portions of its IT systems after customers reported website outages all week.	Unknown	Finance and insurance	Cyber Crime	US		American Family Insurance, AmFam
77	22/10/2023	-	09/10/2023	NoEscape	ASVEL	The French professional basketball team LDLC ASVEL (ASVEL) has confirmed that data was stolen after the NoEscape ransomware gang claimed to have attacked the club.	Malware	Arts entertainment, recreation	Cyber Crime	FR		ASVEL, NoEscape, ransomware
78	22/10/2023	During September 2023	-	Hunters International	Jaime S. Schwartz, M.D.	The ransomware group Hunters International claims to have stolen 1.1 terabytes of data – 248,245 files, from Jaime S. Schwartz, M.D., a plastic surgeon.	Malware	Human health and social work	Cyber Crime	US		https://www.databreaches.net/another-plastic-surgery-practice-appears-to-have-been-hit-this-time-by-hunters-international/
79	23/10/2023	Since 07/10/2023	Since 07/10/2023	?	Individuals on X (formerly Twitter)	Scammers are capitalizing on the Israel-Hamas war to collect donations by pretending to be legitimate charities.	Scam	Individual	Cyber Crime	>1		Israel, Hamas, X, Twitter
80	23/10/2023	-	29/09/2023	?	1Password	1Password, a popular password management platform used by over 100,000 businesses, suffers a security incident after hackers gained access to its Okta ID management tenant.	Account Takeover	Professional, scientific and technical	Cyber Crime	CA		1Password, Okta
81	23/10/2023	-	23/10/2023	Daixin Team	TransForm	A cyberattack on shared service provider TransForm impacts operations in five hospitals in Ontario, Canada - Windsor Regional Hospital, Hotel Dieu Grace, Erie Shores Healthcare, Hospice of Windsor-Essex, Chatham-Kent Health Alliance - impacting patient care and causing appointments to be rescheduled. The Daixin Team ransomware gang claims responsibility for the attack.	Unknown	Professional, scientific and technical	Cyber Crime	CA		TransForm, Ontario, Windsor Regional Hospital, Hotel Dieu Grace, Erie Shores Healthcare, Hospice of Windsor-Essex, Chatham-Kent Health Alliance, Daixin Team, ransomware
82	23/10/2023	-	Mid-October 2023	KibOrg and NLB	Alfa-Bank	Two group of Ukrainian hackers, KibOrg and NLB, collaborate with the country's security services, the SBU, to breach Alfa-Bank, Russia's largest private bank, a source within the department confirmed to Recorded Future News.	Unknown	Finance and insurance	Cyber Warfare	RU		Ukraine, Russia, KibOrg, NLB, SBU, Alfa-Bank
83	23/10/2023	-	-	?	Multiple organizations in Norway	Sofie Nystrøm, the head of Norway’s National Security Authority (NSM) warns that the exploitation of two recently disclosed Cisco vulnerabilities (CVE-2023-20198 and CVE-2023-20273) has resulted in “important businesses” in the country being compromised by threat actors.	CVE-2023-20198 and CVE-2023-20273 vulnerabilities	Multiple Industries	Cyber Crime	NO		Sofie Nystrøm, Norway’s National Security Authority, NSM, CVE-2023-20198, CVE-2023-20273
84	23/10/2023	Since early August 2023	Early August 2023	China-linked threat actors	Dozens of Canadian members of parliament, Prime Minister Justin Trudeau, and several Canadian government officials	Canada accuses China-linked threat actors of spreading disinformation and propaganda about its politicians on social media via the “spamouflage” campaign, purportedly targeting dozens of Canadian members of parliament, Prime Minister Justin Trudeau, and several government officials.	Coordinated Inauthentic Behavior	Public admin and defence, social security	Cyber Warfare	CA		Canada, China, spamouflage, Justin Trudeau
85	23/10/2023	'Recently'	'Recently'	TA2725	Banking customers in Mexico and Spain	Researchers from Proofpoint discover a new version of the Grandoreiro malware targeting both Mexico and Spain.	Malware	Finance and insurance	Cyber Crime	MX ES		Proofpoint, Grandoreiro
86	23/10/2023	-	-	Clop AKA Lace Tempest, TA505, and FIN11	New York Life Insurance Company	Andesa Services (“Andesa”) files a notice of data breach on behalf of New York Life Insurance Company (“New York Life”) after confirming that the widely-known MOVEit vulnerability impacted more than 30,000 New York Life policyholders.	CVE-2023-34362 Vulnerability	Finance and insurance	Cyber Crime	US		Clop, Cl0p, Lace Tempest, TA505, FIN11, New York Life Insurance Company, Andesa Services, Andesa, New York Life, MOVEit, CVE-2023-34362
87	23/10/2023	During Q3 2023	During Q3 2023	DoNot Team (AKA APT-C-35, Origami Elephant, and SECTOR02)	Organizations in Pakistan and Afghanistan	Researchers from Kaspersky discover a new campaign by the suspected threat actor DoNot Team targeting organizations in Pakistan and Afghanistan with a novel .NET-based backdoor called Firebird.	Targeted Attack	Multiple Industries	Cyber Espionage	IN PK		DoNot Team, APT-C-35, Origami Elephant, SECTOR02, Kaspersky, .NET, Firebird
88	23/10/2023	22/05/2023	22/05/2023	?	LiveAction	LiveAction files a notice of data breach after the company was the target of a ransomware attack.	Malware	Professional, scientific and technical	Cyber Crime	US		LiveAction, Ransomware
89	23/10/2023	-	08/09/2023	?	ProMach	ProMach files a notice of data breach after discovering that an unauthorized party gained access to the company’s IT network.	Unknown	Manufacturing	Cyber Crime	US		ProMach
90	23/10/2023	23/08/2023	12/07/2023	?	Guarantee Trust Life Insurance Company	Guarantee Trust Life Insurance Company files a notice of data breach after determining that an unauthorized party accessed an employee’s email account that contained confidential consumer information.	Account Takeover	Finance and insurance	Cyber Crime	US		Guarantee Trust Life Insurance Company
91	23/10/2023	09/09/2023	11/09/2023	?	Progressive Leasing	Progressive Leasing files a notice of data breach after discovering that an unauthorized party was able to access files stored on the company’s computer system.	Unknown	Finance and insurance	Cyber Crime	US		Progressive Leasing
92	23/10/2023	27/05/2023	03/08/2023	Clop AKA Lace Tempest, TA505, and FIN11	Bank of Canton	The Bank of Canton files notice of data breach, after discovering that one of the bank’s vendors experienced a MOVEit-related data breach.	CVE-2023-34362 Vulnerability	Finance and insurance	Cyber Crime	US		Clop, Cl0p, Lace Tempest, TA505, FIN11, Bank of Canton, MOVEit, CVE-2023-34362
93	23/10/2023	'Recently'	'Recently'	?	Dakota Eye Institute	Dakota Eye Institute (DEI) files a notice of data breach after discovering that patients’ personal information was compromised following a cyberattack.	Unknown	Human health and social work	Cyber Crime	US		Dakota Eye Institute, DEI
94	23/10/2023	-	-	?	Hopewell Area School District	The Hopewell Area School District is the target of a “sophisticated ransomware attack.”	Malware	Education	Cyber Crime	US		Hopewell Area School District, ransomware
95	23/10/2023	During the previous week	During the previous week	?	Orange County District Attorney's Office	Threat actors break into the Orange County District Attorney's office's information technology system last week, the DA's office announced Monday.	Unknown	Public admin and defence, social security	Cyber Crime	US		Orange County District Attorney's Office
96	23/10/2023	21/10/2023	21/10/2023	?	Clark County	Clark County's Information Technology department investigates suspicious activity detected on the county's computer network.	Unknown	Public admin and defence, social security	Cyber Crime	US		Clark County
97	23/10/2023	23/10/2023	23/10/2023	Rhysida	Azienda Ospedaliera Universitaria Integrata Verona	The University Hospital of Verona (Azienda Ospedaliera Universitaria Integrata Verona) suffers a cyber attack. The Rhysida ransomware group claims responsibility for the attack.	Malware	Human health and social work	Cyber Crime	IT		University Hospital of Verona, Azienda Ospedaliera Universitaria Integrata Verona, Rhysida, ransomware
98	23/10/2023	23/10/2023	23/10/2023	CYBER ERROR SYSTEM	ViLab	The hacktivists from CYBER ERROR SYSTEM deface the website of ViLab.	Defacement	Human health and social work	Hacktivism	IT		CYBER ERROR SYSTEM, ViLab
99	24/10/2023	Since May 2023	Since at least May 2023	Suspected Russian cybercriminals	financial and government organizations in Ukraine	The Ukraine's National Cyber Security Coordination Center (NCSСС) reveals that suspected Russian cybercriminals have increased their attacks against Ukrainian financial and government organizations using Smokeloader malware.	Malware	Multiple Industries	Cyber Crime	UA		Ukraine, Russia, National Cyber Security Coordination Center, NCSСС
100	24/10/2023	Since at least June 2023	During June 2023	?	Several state and key industrial organizations in Russia	Researchers from Kaspersky reveal that several state and key industrial organizations in Russia were attacked with a custom Go-based backdoor that performs data theft, likely aiding espionage operations.	Targeted Attack	Multiple Industries	Cyber Espionage	RU		Kaspersky, Go, Russia
101	24/10/2023	12/08/2023	-	NoEscape	City of Victorville	The city of Victorville is hit with a NoEscape ransomware attack.	Malware	Public admin and defence, social security	Cyber Crime	US		Victorville, NoEscape, ransomware.
102	24/10/2023	Since December 2022	Since December 2022	?	Brazilian Users of the PIX payment system	Researchers from Kaspersky discover a malicious campaign, named GoPIX, targeting the users of the PIX payment system in Brazil.	Malware	Finance and insurance	Cyber Crime	BR		Kaspersky, PIX, GoPIX
103	24/10/2023	-	-	?	Professionals belonging to various companies	Researchers from GData discover a malicious campaign using compromised Facebook accounts to deliver malware.	Malware	Individual	Cyber Crime	>1		Facebook, GData
104	24/10/2023	Between 22/07/2023 and 18/09/2023	08709/2023	Scammers from China	Individuals in India	Researchers from CloudSEK discover a campaign carried out by China-based scammers, using a combination of fake loan apps and India's real-time mobile payment system, Unified Payments Interface (UPI), to steal money from individuals.	Scam	Finance and insurance	Cyber Crime	IN		CloudSEK, China, Unified Payment Interface, UPI
105	24/10/2023	During July 2022	-	?	University of Tokyo	A computer at the University of Tokyo is infected with malware, possibly leaking up to 4,341 files containing addresses and grades of students from the academic years of 2003 to 2022.	Malware	Education	Cyber Crime	JP		University of Tokyo
106	24/10/2023	26/07/2023	26/07/2023	Clop AKA Lace Tempest, TA505, and FIN11	Welltok	Healthcare SaaS provider Welltok warns that a data breach exposed the personal data of nearly 8.5 million patients in the U.S. after the MOVEit file transfer program used by the company was hacked in a data theft attack.	CVE-2023-34362 Vulnerability	Professional, scientific and technical	Cyber Crime	US		Welltok, Clop, Cl0p, CVE-2023-34362, MOVEit, Lace Tempest, TA505, FIN11
107	25/10/2023	23/10/2023	23/10/2023	Rorschach	Grupo GTD	Chile's Grupo GTD warns that a cyberattack has impacted its Infrastructure as a Service (IaaS) platform, disrupting online services. The attack is attributed to the Rorschach ransomware gang.	Malware	Information and communication	Cyber Crime	CL		Grupo GTD, Rorschach, ransomware
108	25/10/2023	Since at least 12/10/2023	12/10/2023	Winter Vivern	Governmental entities and a think tank in Europe	Researchers from ESET discover a new campaign by the Winter Vivern group, exploiting CVE-2023-5631, a zero-day XSS vulnerability in Roundcube Webmail servers belonging to governmental entities and a think tank, all based in Europe.	CVE-2023-5631 Vulnerability	Multiple Industries	Cyber Espionage	EU		ESET, Winter Vivern, CVE-2023-5631, XSS, Roundcube
109	25/10/2023	Mid-October 2023	Mid-October 2023	Pro-Ukraine hackers	Spotify accounts of several well-known Russian musicians	A group of pro-Ukraine hackers compromise the Spotify accounts of several well-known Russian musicians, swapping out their profile pictures for images of Ukraine’s flag and a Ukrainian rapper, along with messages to stop Russia's war in Ukraine.	Account Takeover	Arts entertainment, recreation	Hacktivism	RU		Ukraine, Russia, Spotify
110	25/10/2023	Between May and August 2023	Between May and August 2023	YoroTrooper	Institutions and officials in Azerbaijan, Tajikistan, Kyrgyzstan, Uzbekistan	Researchers from Cisco Talos reveal that threat actors from YoroTrooper, believed to be based in Kazakhstan are targeting other members of the Commonwealth of Independent States in a wide-ranging espionage campaign, trying to disguise its operations to make it seem like the attacks are coming from Azerbaijan.	Targeted Attack	Public admin and defence, social security	Cyber Espionage	AZ KG TJ UZ		Cisco Talos, YoroTrooper
111	25/10/2023	25/10/2023	25/10/2023	Mysterious Team	Italian Airports of Puglia, Calabria, Valle D'Aosta, and Napoli	Bangladeshi hacktivists from Mysterious Team take down the websites of four italian airports (Puglia, Calabria, Valle D'Aosta, and Napoli)	DDoS	Transportation and storage	Hacktivism	IT		Bangladesh, Mysterious Team, Puglia, Calabria, Valle D'Aosta, Napoli
112	25/10/2023	Between 2022 and 2023	Between 2022 and 2023	Yellow Liderc (AKA Imperial Kitten, Tortoiseshell, TA456, Crimson Sandstorm)	Mediterranean organizations involved in the maritime, shipping, and logistics sectors	Researchers from PWC discover a new campaign by the Iranian actor Imperial Kitten using watering-hole attacks, with a new malware downloader named IMAPLoader, and a new method of infection, appdomain manager injection, against Mediterranean organizations involved in the maritime, shipping, and logistics sectors.	Targeted Attack	Transportation and storage	Cyber Espionage	>1		Yellow Liderc, Imperial Kitten, Tortoiseshell, TA456, Crimson Sandstorm, PWC, IMAPLoader, appdomain manager injection
113	25/10/2023	-	-	Clop AKA Lace Tempest, TA505, and FIN11	Kearny Bank	Kearny Bank joins the list of the victims of the massive MOVEit attack.	CVE-2023-34362 Vulnerability	Finance and insurance	Cyber Crime	US		Kearny Bank, Clop, Cl0p, CVE-2023-34362, MOVEit
114	25/10/2023	'Recently'	'Recently'	?	Individuals	Researchers at Sucuri discover a campaign infecting users with fake Google Chrome update malware, nicknamed “FakeUpdateRU.”	Malware	Individual	Cyber Crime	>1		Sucuri, Google Chrome, FakeUpdateRU
115	25/10/2023	-	-	DuckTail	Professionals belonging to various Italian companies, especially in the technology sector	Researchers from Cluster25 discover a malicious campaign employing LinkedIn messages as a vector for executing identity theft attacks.	Malware	Individual	Cyber Crime	IT		Cluster25, LinkedIn, DuckTail
116	25/10/2023	-	-	Mercidoctor	Multiple organizations	A new cryptocurrency stealer named Vacum Stealer emerges in the dark web.	Malware	Fintech	Cyber Crime	>1		Vacum Stealer, Mercidoctor
117	25/10/2023	-	-	Sheriff	Airbnb	A threat actor going by the name ‘Sheriff’ on the darkweb puts on sale 1.2 million records allegedly stolen from Airbnb, including sensitive details such as names, email addresses, countries of residence, cities, and more.	Unknown	Accommodation and food service	Cyber Crime	US		Sheriff, Airbnb
118	25/10/2023	'Recently'	'Recently'	?	Longhorn Imaging Center	South Austin Health Imaging dba Longhorn Imaging Center files a notice of data breach after discovering that confidential information in the company’s possession was subject to unauthorized access.	Unknown	Human health and social work	Cyber Crime	US		South Austin Health Imaging, Longhorn Imaging Center
119	25/10/2023	21/04/2023	05/09/2023	?	Fredericksburg Foot & Ankle Center	Fredericksburg Foot & Ankle Center reports a data breach that has affected up to 14,912 individuals.	Unknown	Human health and social work	Cyber Crime	US		Fredericksburg Foot & Ankle Center
120	25/10/2023	23/10/2023	23/10/2023	?	Allen Park Public Schools	Allen Park Public Schools in Michigan shuts down portions of its network and cancels classes after discovering a cybersecurity threat.	Unknown	Education	Cyber Crime	US		Allen Park Public Schools
121	25/10/2023	15/10/2023	15/10/2023	?	Municipality of Perugia	The Municipality of Perugia confirms to have been hit with a ransomware attack.	Malware	Public admin and defence, social security	Cyber Crime	IT		Municipality of Perugia, ransomware
122	26/10/2023	Since at least 2017	During 2022	StripedFly	Multiple organizations	Researchers from Kaspersky uncover a previously unknown, highly sophisticated malware, dubbed StripedFly, affecting over a million victims around the world since at least 2017.	Malware	Multiple Industries	Cyber Crime	>1		Kaspersky, StripedFly
123	26/10/2023	Since the second half of 2021	-	APT28 threat actor (aka 'Strontium' or 'Fancy Bear')	Multiple organizations in France	A report from ANSSI (Agence Nationale de la sécurité des systèmes d'information) reveals that the Russian APT28 threat actor (aka 'Strontium' or 'Fancy Bear') has been targeting government entities, businesses, universities, research institutes, and think tanks in France since the second half of 2021	Targeted Attack	Multiple Industries	Cyber Espionage	FR		ANSSI, Agence Nationale de la sécurité des systèmes d'information, APT28, Strontium, Fancy Bear
124	26/10/2023	During September 2023	During September 2023	?	Android users	Researchers from Dr.Web reveal that several malicious Google Play Android apps, including the 'FakeApp,' 'Joker,' and the 'HiddenAds' malware families, installed over 2 million times push intrusive ads to users while concealing their presence on the infected devices.	Malware	Individual	Cyber Crime	>1		Dr.Web, Google Play, Android, FakeApp, Joker, HiddenAds
125	26/10/2023	-	-	?	Western Washington Medical Group	Western Washington Medical Group (WWMG) files a notice of data breach after discovering that an unauthorized party was able to access information that had been entrusted to the company.	Unknown	Human health and social work	Cyber Crime	US		Western Washington Medical Group, WWMG
126	26/10/2023	-	03/03/2023	?	Ben E. Keith Company	Ben E. Keith Company files a notice of data breach after discovering that an unauthorized party was able to access files stored on the company’s computer network.	Unknown	Accommodation and food service	Cyber Crime	US		Ben E. Keith Company
127	26/10/2023	-	31/05/2023	Clop AKA Lace Tempest, TA505, and FIN11	Greater Rochester Independent Practice Association	Greater Rochester Independent Practice Association (GRIPA) files a notice of data breach after discovering that the software vulnerability within MOVEit enabled hackers to access confidential consumer information within the company’s possession.	CVE-2023-34362 Vulnerability	Human health and social work	Cyber Crime	US		Greater Rochester Independent Practice Association, GRIPA, Clop, Cl0p, Lace Tempest, TA505, FIN11, MOVEit, CVE-2023-34362
128	26/10/2023	Since at least six months	'Recently'	Shuangyirat	Multiple organizations in China	Researchers from NSFOCUS discover a targeted attack against multiple organizations in China.	Targeted Attack	Multiple Industries	Cyber Espionage	CN		Shuangyirat, NSFOCUS
129	26/10/2023	26/04/2023	18/05/2023	?	Reeds Spring school district	The Reeds Spring school district notifies employees and families that it was the "victim of a sophisticated cyber attack" that involved the unauthorized access — and acquisition — of district and personal data.	Unknown	Education	Cyber Crime	US		Reeds Spring school district
130	26/10/2023	-	-	ALPHV AKA BlackCat	LBA Hospitality	The ALPHV AKA BlackCat ransomware gang claims responsibility for breaching LBA Hospitality	Malware	Accommodation and food service	Cyber Crime	US		ALPHV, BlackCat, ransomware, LBA Hospitality
131	26/10/2023	26/10/2023	26/10/2023	Akira	Michael Garron Hospital	The Michael Garron Hospital is hit with an Akira ransomware attack.	Malware	Human health and social work	Cyber Crime	CA		Michael Garron Hospital, Akira, ransomware
132	27/10/2023	During mid-2023	During mid-2023	Lazarus (aka Diamond Sleet and ZINC)	Undisclosed software vendor	Researchers from Kaspersky reveal that earlier in 2023, the North Korean Lazarus threat actor repeatedly compromised a software vendor with the SIGNBT and LPEClient malware, using flaws in vulnerable software.	Vulnerability	Professional, scientific and technical	Cyber Espionage	N/A		Kaspersky, Lazarus, SIGNBT, LPEClient
133	27/10/2023	25/10/2023	25/10/2023	?	More than 25 victims worldwide	Threat actors steal $4.4 million in cryptocurrency using private keys and passphrases stored in stolen LastPass databases.	Account Takeover	Fintech	Cyber Crime	>1		LastPass
134	27/10/2023	-	-	LockBit 3.0	Boeing	Boeing says to be assessing a claim made by the Lockbit ransomware gang that it had "a tremendous amount" of sensitive data stolen from the aerospace giant that it would dump online.	Malware	Professional, scientific and technical	Cyber Crime	US		Boeing, LockBit
135	27/10/2023	-	27/10/2023	Akira	Stanford University	Stanford University investigates a cybersecurity incident within its Department of Public Safety after the Akira ransomware gang claims it attacked the school.	Malware	Education	Cyber Crime	US		Stanford University, Department of Public Safety, Akira, ransomware
136	27/10/2023	27/10/2023	27/10/2023	Ukrainian IT Army	Three Russian internet providers, Miranda-media, Krimtelekom, and MirTelekom	The group of cyber activists known as the Ukrainian IT Army claims to have taken down three Russian internet providers, Miranda-media, Krimtelekom, and MirTelekom, operating in the occupied territories.	DDoS	Information and communication	Hacktivism	RU		Ukraine, Russia, IT Army, Miranda-media, Krimtelekom, MirTelekom
137	27/10/2023	Since at least 16/10/2023	16/10/2023	?	Users of the Russian Jabber messaging service	A man-in-the-middle (MitM) attack on jabber.ru (aka xmpp.ru) service’s servers, hosted by German providers Hetzner and Linode, is believed to have been set up as lawful interception.	MitM	Individual	Cyber Crime	RU		Man-in-the-middle, MitM, jabber.ru, xmpp.ru, Hetzner
138	27/10/2023	-	12/07/2023	Clop AKA Lace Tempest, TA505, and FIN11	NASCO	NASCO files a notice of data breach after discovering that the vulnerability within MOVEit resulted in an unauthorized party being able to access certain information in the company’s possession.	CVE-2023-34362 Vulnerability	Human health and social work	Cyber Crime	US		NASCO, MOVEit, Cl0p, Clop, Lace Tempest, TA505, FIN11, CVE-2023-34362
139	27/10/2023	During Q3 2023	During Q3 2023	?	Individuals	Researchers from HP Wolf Security uncover a campaign delivering malware on the aspiring hackers in disguise of the popular malware XWorm.	Malware	Individual	Cyber Crime	>1		HP Wolff Security, GitHub
140	27/10/2023	27/10/2023	27/10/2023	Anonymous Sudan	Spotify	Spotify is down and the pro-Russia group Anonymous Sudan claims responsibility for the attack.	DDoS	Arts entertainment, recreation	Hacktivism	SE		Spotify, Russia, Anonymous Sudan
141	27/10/2023	During May 2023	During May 2023	Clop AKA Lace Tempest, TA505, and FIN11	CCleaner	The maker of the popular optimization app CCleaner confirms that threat actors stole a trove of personal information about its paid customers following a MOVEit data breach in May.	CVE-2023-34362 Vulnerability	Professional, scientific and technical	Cyber Crime	GB		CCleaner, MOVEit, Cl0p, Clop, Lace Tempest, TA505, FIN11, CVE-2023-34362
142	27/10/2023	07/06/2023	-	?	Five Guys	Five Guys discloses a security breach where hackers gained access to the email accounts of two employees.	Account Takeover	Accommodation and food service	Cyber Crime	US		Five Guys
143	27/10/2023	-	-	?	Multiple organizations	Researchers from Elastic discover a campaign aimed to compromise users with signed MSIX application packages to gain initial access, and leveraging a stealthy loader called GHOSTPULSE which decrypts and injects its final payload to evade detection.	Malware	Multiple Industries	Cyber Crime	>1		Elastic, MSIX, GHOSTPULSE
144	27/10/2023	13/06/2023	-	?	ITW Food Equipment Group	ITW Food Equipment Group files a notice of data breach after learning that an unauthorized party was able to access the company’s computer system.	Unknown	Wholesale and retail	Cyber Crime	US		ITW Food Equipment Group
145	27/10/2023	28/06/2023	-	?	SBM Management Services	SBM Management Services files a notice of data breach after learning that an unauthorized party may have been able to access and acquire information from the company’s computer network.	Unknown	Administration and support service	Cyber Crime	US		SBM Management Services
146	27/10/2023	29/03/2023	'Recently'	?	Drug Free Workplaces USA	Drug Free Workplaces USA files a notice of data breach after discovering that an unauthorized party may have gained access to two employee email accounts.	Account Takeover	Administration and support service	Cyber Crime	US		Drug Free Workplaces USA
147	27/10/2023	-	21/08/2023	?	Resort Data Processing	Resort Data Processing (RDP) files a notice of data breach after discovering that an SQL injection attack enabled an unauthorized user to access confidential information in the company’s possession.	SQLi	Professional, scientific and technical	Cyber Crime	US		Resort Data Processing, RDP
148	27/10/2023	-	01/06/2023	Clop AKA Lace Tempest, TA505, and FIN11	North Mississippi Health Services	North Mississippi Health Services (NMHS) posts a notice on its website describing a third-party data breach at Cadence Bank, a company that provides treasury management services to NMHS, due to the exploitation of MOVEit vulnerability.	CVE-2023-34362 Vulnerability	Human health and social work	Cyber Crime	US		North Mississippi Health Services, NMHS, Cadence Bank, MOVEit, Cl0p, Clop, Lace Tempest, TA505, FIN11, CVE-2023-34362
149	27/10/2023	-	01/06/2023	Clop AKA Lace Tempest, TA505, and FIN11	Pathology Resource Network	Pathology Resource Network (PRN) adds a website notice on its homepage after discovering that Cadence Bank, which provides treasury management services to PRN, experienced a MOVEit-related data breach.	CVE-2023-34362 Vulnerability	Human health and social work	Cyber Crime	US		Pathology Resource Network, PRN, Cadence Bank, MOVEit, Cl0p, Clop, Lace Tempest, TA505, FIN11, CVE-2023-34362
150	27/10/2023	24/07/2023	30/08/2023	?	PeakMed Colorado	PeakMed Colorado files a notice of data breach after discovering that an unauthorized party had obtained access to an employee’s login credentials.	Account Takeover	Human health and social work	Cyber Crime	US		PeakMed Colorado
151	27/10/2023	27/05/2023	21/07/2023	Clop AKA Lace Tempest, TA505, and FIN11	MasTec	MasTec files a notice of data breach after discovering a MOVEit-related data breach at Delta Dental affected employees and dependents enrolled in the company’s Care Opt Plus Group Benefits Plan For Hourly & Salaried Employees.	CVE-2023-34362 Vulnerability	Professional, scientific and technical	Cyber Crime	US		MasTec, Delta Dental, Care Opt Plus Group Benefits Plan For Hourly & Salaried, Employees, MOVEit, Cl0p, Clop, Lace Tempest, TA505, FIN11, CVE-2023-34362
152	27/10/2023	28/05/2023	31/05/2023	Clop AKA Lace Tempest, TA505, and FIN11	Barrick Gold	Barrick Gold files a notice of data breach after discovering that attackers exploited the vulnerability in the MOVEit secure file-transfer software used by the company.	CVE-2023-34362 Vulnerability	Mining and quarrying	Cyber Crime	US		Barrick Gold, MOVEit, Cl0p, Clop, Lace Tempest, TA505, FIN11, CVE-2023-34362
153	28/10/2023	28/10/2023	28/10/2023	Black Basta	Toronto Public Library	The Toronto Public Library (TPL) warns that many of its online services are offline after suffering a Black Basta ransomware attack over the weekend.	Unknown	Education	Cyber Crime	CA		Toronto Public Library, TPL, Black Basta, ransomware
154	29/10/2023	-	-	?	Individuals	Researchers from Malwarebytes discover a malvertising campaign delivering malware via Google Dynamic Search Ads.	Malware	Multiple Industries	Cyber Crime	>1		Malwarebytes, Google Dynamic Search Ads
155	30/10/2023	-	-	BiBi-Linux	Linux systems belonging to Israeli companies	Researchers from Security Joes discover a new malware wiper known as BiBi-Linux, used to destroy data in attacks targeting Linux systems belonging to Israeli companies.	Malware	Multiple Industries	Cyber Warfare	IL		Security Joes, BiBi-Linux, Israel
156	30/10/2023	19/10/2023	-	PLAY	Dallas County	Dallas County experiences a cybersecurity incident that affected parts of its network. The PLAY ransomware gang claims responsibility for the attack.	Malware	Public admin and defence, social security	Cyber Crime	US		PLAY, ransomware, Dallas County
157	30/10/2023	30/10/2023	30/10/2023	DumpForums and Ukrainian Cyber Alliance	National Payment Card System (NSPK)	Activists from the DumpForums group and the Ukrainian Cyber Alliance say they defaced a website of the government-run National Payment Card System (NSPK) and reportedly gained access to the internal systems of the consumer payment network Mir (“world” in Russian), a homegrown alternative to brands like Visa and Mastercard, is operated by the NSPK.	Unknown	Finance and insurance	Hacktivism	RU		Russia, Ukraine, DumpForums, Ukrainian Cyber Alliance, National Payment Card System, NSPK, Mir
158	30/10/2023	30/10/2023	30/10/2023	?	Südwestfalen IT	A threat actor encrypts the servers of the local municipal service provider Südwestfalen IT. To prevent the malware from spreading, the company restricts access to its infrastructure for over 70 municipalities, primarily in the western German state of North Rhine-Westphalia.	Malware	Professional, scientific and technical	Cyber Crime	DE		Ransomware, Südwestfalen IT, North Rhine-Westphalia
159	30/10/2023	28/05/2023	-	Clop AKA Lace Tempest, TA505, and FIN11	U.S. Department of Justice	The email addresses of about 632,000 employees from the Justice and Defense departments were accessed in the massive MOVEit hack affecting the Office of Personnel Management.	CVE-2023-34362 Vulnerability	Public admin and defence, social security	Cyber Crime	US		Cl0p, Clop, Lace Tempest, TA505, FIN11, CVE-2023-34362, MOVEit, U.S. Department of Justice, Office of Personnel Management
160	30/10/2023	28/05/2023	-	Clop AKA Lace Tempest, TA505, and FIN11	U.S. Department of Defense	The email addresses of about 632,000 employees from the Justice and Defense departments were accessed in the massive MOVEit hack affecting the Office of Personnel Management.	CVE-2023-34362 Vulnerability	Public admin and defence, social security	Cyber Crime	US		Cl0p, Clop, Lace Tempest, TA505, FIN11, CVE-2023-34362, MOVEit, U.S. Department of Justice, Office of Personnel Defense
161	30/10/2023	Since at least 30/10/2023	30/10/2023	?	Unknown organization(s)	Researchers from F5 warn that CVE-2023-46747, a recently patched critical vulnerability in F5’s BIG-IP product, is being exploited in the wild chained with CVE-2023-46748, another flaw in BIG-IP.	CVE-2023-46747 and CVE-2023-46748 vulnerabilities	Unknown	N/A	N/A		F5, CVE-2023-46747, CVE-2023-46748, BIG-IP
162	30/10/2023	Since at least December 2020	-	?	Multiple organizations	Researchers from Palo Alto identify an active campaign named EleKtra-Leak, performing automated targeting of exposed identity and access management (IAM) credentials within public GitHub repositories to use them in cryptojacking campaigns.	Account Takeover	Multiple Industries	Cyber Crime	>1		Palo Alto, EleKtra-Leak, GitHub
163	30/10/2023	30/10/2023	30/10/2023	UserSec	Manchester Airport	The Russian group UserSec claims responsibility for taking down the Manchester Airport website.	DDoS	Transportation and storage	Hacktivism	GB		UserSec, Manchester Airport, Russia
164	30/10/2023	30/10/2023	30/10/2023	UserSec	Manchester Airport	The Russian group UserSec claims responsibility for taking down the Gatwick Airport website.	DDoS	Transportation and storage	Hacktivism	GB		UserSec, Gatwick Airport, Russia
165	30/10/2023	During 11/10/2023 and 18/10/2023	During 11/10/2023 and 18/10/2023	TA571	Over 1,200 customers in a variety of industries globally	Researchers from ProofPoint discover a new campaign by TA571 delivering the Forked variant of IcedID.	Malware	Multiple Industries	Cyber Crime	>1		ProofPoint, TA571, Forked, IcedID
166	30/10/2023	During mid-October 2023	During mid-October 2023	During mid-October 2023	Multiple organizations in South Korea	Researchers from AhnLab discover a new campaign delivering the Remcos remote control malware being distributed through an email disguised as a payslip.	Malware	Multiple Industries	Cyber Crime	KR		AhnLab, Remcos, payslip
167	30/10/2023	-	26/07/2023	?	United Medical Centers	United Medical Centers (UMC) files a notice of data breach after discovering that an unauthorized party accessed and removed certain files from the company’s computer system.	Unknown	Human health and social work	Cyber Crime	>1		United Medical Centers, UMC
168	30/10/2023	25/08/2023	'Recently'	?	Milford Management Corporation	Milford Management Corporation files a notice of data breach after discovering that an unauthorized party was able to gain access to the company’s computer system.	Unknown	Real estate	Cyber Crime	US		Milford Management Corporation
169	30/10/2023	30/03/2023	16/02/2023	?	Kyocera AVX Components Corporation	Kyocera AVX Components Corporation (Kyocera) files a notice of data breach after discovering that portions of its network were encrypted following a ransomware cyberattack.	Malware	Manufacturing	Cyber Crime	US		Kyocera AVX Components Corporation, Kyocera, ransomware
170	30/10/2023	22/02/2023	07/03/2023	?	La Red Health Center	La Red Health Center reports a data breach affecting 35,602 individuals in total.	Unknown	Human health and social work	Cyber Crime	US		La Red Health Center
171	30/10/2023	-	-	?	Members of Armenian civil society say	Members of Armenian civil society say they have received new warnings from Apple that their smartphones were targeted for infection with commercial spyware.	Targeted Attack	Individual	Cyber Espionage	AM		Apple, Armenia
172	30/10/2023	31/08/2023	30/08/2023	?	Truepill	Postmeds, doing business as ‘Truepill,’ sends notifications of a data breach informing recipients that threat actors accessed their sensitive personal information. 2.3 million customers are affected.	Unknown	Professional, scientific and technical	Cyber Crime	US		Postmeds, Truepill
173	31/10/2023	Since the beginning of August 2023	15/10/2023	?	Multiple organizations	Researchers from ReversingLabs discover a new NuGet typosquatting campaign pushing malicious packages that abuse Visual Studio's MSBuild integration to execute code and install malware stealthily.	Malware	Multiple Industries	Cyber Crime	>1		ReversingLabs, NuGet, Visual Studio, MSBuild
174	31/10/2023	30/10/2023	30/10/2023	?	Ace Hardware	Ace Hardware confirms that a cyberattack is preventing local stores and customers from placing orders as the company works to restore 196 servers.	Unknown	Wholesale and retail	Cyber Crime	US		Ace Hardware
175	31/10/2023	-	-	Two Ukrainian individuals	Critical infrastructures in Russia	The Russian Federal Security Service (FSB) arrests two individuals believed to have helped Ukrainian forces carry out cyberattacks to disrupt Russian critical infrastructure targets.	Malware	Electricity, gas steam, air conditioning	Cyber Warfare	RU		Russia, Ukraine, Federal Security Service, FSB
176	31/10/2023	-	-	State-sponsored attackers	Several political opposition figures in India	Several political opposition figures in India receive notifications from Apple warning that their phones may be “targeted by state-sponsored attackers.”	Targeted Attack	Individual	Cyber Espionage	IN		Apple, India
177	31/10/2023	Since 2022	-	Scarred Manticore	Military and telecom sectors in Saudi Arabia, the United Arab Emirates, Jordan, Kuwait, Oman, Iraq, and Israel.	Researchers from Check Point discover an ongoing Iranian espionage campaign by Scarred Manticore, an actor affiliated with the Ministry of Intelligence and Security (MOIS) and leveraging LIONTAIL, an advanced passive malware framework.	Targeted Attack	Multiple Industries	Cyber Espionage	IQ IL JO KW OM SA UAE US		Check Point, Iran, Scarred Manticore, Ministry of Intelligence and Security, MOIS, LIONTAIL
178	31/10/2023	24/10/2023	24/10/2023	LockBit 3.0	Río Hondo College	Río Hondo College in Southern California is listed in the Lockbit ransomware leak site.	Malware	Education	Cyber Crime	US		Río Hondo, Lockbit 3.0, Lockbit, ransomware
179	31/10/2023	Between 10/10/2023 and 11/10/2023	Between 10/10/2023 and 11/10/2023	?	Facebook users in Europe, Africa and the Caribbean	Researchers from Bitdefender discover a malvertising campaign where cybercriminals are using Facebook ads to distribute the NodeStealer malware and hijack users' social media accounts.	Malvertising	Individual	Cyber Crime	>1		Bitdefender, Facebook, NodeStealer
180	31/10/2023	-	30/10/2023	LockBit 3.0	Querétaro Intercontinental Airport	The Querétaro Intercontinental Airport confirms reports that it had been attacked. The LockBit ransomware gang claims responsibility for the attack.	Malware	Transportation and storage	Cyber Crime	MX		Querétaro Intercontinental Airport, LockBit, LockBit 3.0, ransomware
181	31/10/2023	28/10/2023	28/10/2023	?	British Library	The British Library faces a major outage that impacts the website and many of its services following a cyber attack.	Unknown	Education	Cyber Crime	GB		British Library
182	31/10/2023	Since April 2022	-	Arid Viper	Arabic-speaking Android users	Researchers from Cisco Talos expose the latest operations of the espionage-driven Arid Viper targeting Arabic-speaking Android users.	Targeted Attack	Individual	Cyber Espionage	>1		Cisco Talos, Arid Viper
183	31/10/2023	During Q3 2023	During Q3 2023	?	Multiple organizations	Researchers from HP Wolf Security unveil a rise in the availability of malware "meal kits" for less than $100 is fueling a surge in campaigns using remote access Trojans (RATs), often embedded in seemingly legitimate Excel and PowerPoint files attached to emails.	Malware	Multiple Industries	Cyber Crime	>1		HP Wolf Security
184	31/10/2023	-	01/09/2023	?	Deer Oaks	Deer Oaks – The Behavioral Health Solution (“Deer Oaks”) files a notice of data breach after discovering that a ransomware attack compromised the security of information stored on the company’s computer network.	Malware	Human health and social work	Cyber Crime	US		Deer Oaks Behavioral Health, ransomware
185	31/10/2023	'Recently'	'Recently'	?	Smoothie King	SK USA (Smoothie King) files a notice of data breach after discovering that an unauthorized party was able to access confidential information that had been entrusted to the company.	Unknown	Wholesale and retail	Cyber Crime	US		SK USA, Smoothie King
186	31/10/2023	31/10/2023	31/10/2023	?	Unibot	Threat actors exploit Telegram-based trading tool Unibot to steal $580,000 worth of crypto, forcing the company to pause transactions.	Vulnerability	Fintech	Cyber Crime	>1		Unibot, Telegram
187	31/10/2023	-	-	Alpha Team	Avangate	The Alpha Team ransomware gang claims responsibility for a cyber attack to Avangate.	Malware	Wholesale and retail	Cyber Crime	IT		Avangate, Alpha Team, ransomware
188	31/10/2023	-	-	Cyber Av3ngers	10 Israeli water treatment facilities	The Cyber Av3ngers collective claims to have knocked 10 Israeli water treatment facilities offline (Hedera, Palmachim, Sorek, Ashkelon, Haifa, Chorazim, Kfar Haruv, Taberiye, Eilat, and Daniyal)	Unknown	Water supply, waste mgmt, remediation	Hacktivism	IL		Cyber Av3ngers, Israel, Hedera, Palmachim, Sorek, Ashkelon, Haifa, Chorazim, Kfar Haruv, Taberiye, Eilat, Daniyal
ID	Date Reported	Date Occurred	Date Discovered	Author	Target	Description	Attack	Target Class	Attack Class	Country	Link	Tags

Creating the timelines is a very time-consuming task.

Any little helps!

No Data Found

The “Breachometer” compares the current number of events/day with the max and min values recorded in the previous 12 months.

Rogue AI Agents
AI agents are escaping sandboxes, misusing credentials and acting without authorization. This live dashboard tracks every reported incident on a horizontal timeline, with charts showing which AI companies and agents are involved, the techniques used and how they got in. It updates automatically as new ...
Mega Breaches in 2026
Here’s a collection of the main mega breaches (that is data breaches with more than one million records compromised and possibly leaked) during 2026. The information is derived from the cyber attacks timelines that I published, normally, on a bi-weekly basis.
October 2026 Cyber Attacks Timeline
A live view of the month's vetted cyber incidents, updated as new events are confirmed. Explore the timeline, filter by attack type, and see motivations, techniques, initial access methods, targeted sectors and target countries on an interactive map.
AI-Assisted Malicious Campaigns
In this blog post I am collecting the campaigns that show evidence of being AI-generated, or make use of AI tools to increase their impact. As always I will continue to update the list as soon as new campaigns emerge.
September 2026 Cyber Attacks Statistics
September 2026 recorded 182 cyber incidents, and Cyber Crime drove roughly three in four of them (73.9%). Malware was the top attack vector at 27.8%, exploitation of public-facing applications led initial access at 28.9%, and Information & Communication was the most targeted sector. Explore the ...