Ransomware incidents
Ransomware incidents, most recently reported first.
Shibata Construction Survey’s September ransomware attack sparks fears of over 3,500 personal data records leaking
3.5kImpact: Possible leak of more than 3,500 personal data records
Reports indicate that more than 3,500 personal data records may have been leaked following a ransomware attack on Japanese construction consultancy Shibata Construction Survey on 20 September 2026. The potentially affected information includes names, addresses and telephone numbers of landowners and others handled in work commissioned by local authorities, although an actual external leak has not been confirmed.
Read on 日経クロステック ↗Thegentlemen claims ransomware attack on Megatrans
Ransomware group Thegentlemen named Argentine logistics company Megatrans as a victim. Whether a breach actually occurred, the date of the attack, the scale of the damage and the company’s response remain unconfirmed.
Read on SOCRadar ↗Ransomware hits Koka’s voice broadcast system in Japan
25kImpact: Voice broadcast system outage; possible leak of around 25,000 records, including personal information
A ransomware attack on the voice broadcast system server in Koka, Shiga Prefecture, Japan, shut down the emergency information voice broadcast system. Outdoor loudspeakers and other equipment became unavailable, and around 25,000 records, including personal information, may have been leaked. As of 12 November, there was no estimate for restoration.
Related reports: 5 · last report →Ransomware cyber-attack on Belarus’s ActiveCloud disrupts customer services
Impact: Customer websites, applications and business services disrupted for several days
Belarusian cloud provider ActiveCloud suffered a ransomware cyber-attack that encrypted part of its cloud infrastructure. Customer websites, applications and business services were disrupted for several days. Most virtual servers had been restored by the morning of 12 November, but some remained unavailable.
Related reports: 2 · last report →N0n claims ransomware attack on Female Daily Network
N0n claimed to have attacked Indonesia's Female Daily Network and published the claim on its leak site. Whether a breach or encryption actually occurred, the extent of the damage and the organisation's response have not been independently verified.
Related reports: 2 →Krybit claims ransomware attack on Ceytech Makine
The ransomware group Krybit claimed to have attacked Turkish machinery manufacturer Ceytech Makine. SOCRadar records the incident as an attacker claim, and whether a breach actually occurred, the incident date, the extent of the damage and response measures remain unconfirmed.
Read on SOCRadar ↗Barracuda claims ransomware attack on Proliant
Impact: The attackers claim to have stolen 1.23 TB of data. The actual volume of leaked data and the number of people affected remain unconfirmed.
The ransomware group Barracuda added US-based Proliant to its victim list on 12 November 2026. The attackers claimed to have stolen 1.23 TB from the main file server, including contracts, financial records belonging to the company and its partners, and employee information. The timing of the actual breach, the extent of the damage and the company's response have not been independently verified.
Read on SOCRadar ↗Ransomware attack on Denmark's Mailmak exposes subscription data
75kImpact: Subscription data exposed; delivery information for 75,000 IDA members potentially affected
Danish subscription and mailing company Mailmak suffered a ransomware attack in the early hours of 11 November, exposing subscription data. Mailmak handles magazine post for 75,000 IDA members, and names, addresses and contact details may be affected, but payment information was excluded.
Read on Ritzau／Ingeniørforeningen, IDA ↗INC Ransom claims attack on Thailand's Millimed
INC Ransom claimed to have attacked Thai pharmaceutical company Millimed Co., Ltd. SOCRadar lists the incident at the attacker-claim stage; whether a breach actually occurred, the extent of the damage and the incident date remain unconfirmed.
Read on SOCRadar ↗Cyber-attack disrupts administrative systems at Brazil’s Port of Santos
Impact: Disruptions to internal systems and the website, with delays to some tasks including scheduling and billing
The Santos Port Authority in Brazil experienced disruptions to its internal systems and website following a cyber-attack that began on 6 November 2026. Some tasks were switched to manual processing, delaying scheduling and billing, but vessel and cargo operations continued. The port authority set up a crisis response team and began recovery efforts, while the Federal Police also launched an investigation. A ransom demand by the group claiming responsibility was confirmed, but there were no negotiations or payments, and unauthorised access to data remained unconfirmed.
Related reports: 13 · last report →Ransomware encrypts some EROWA Systems servers
Impact: Part of the server infrastructure encrypted; indications of system data exfiltration
Swiss industrial supplier EROWA Systems discovered a ransomware attack on 12 October. The attack encrypted part of its server infrastructure, and the investigation also found indications that system data had been exfiltrated.
Read on Inside IT ↗Vortex claims ransomware attack on Alexion
SOCRadar confirmed on 10 November 2026 that Vortex had listed Alexion as a victim. Whether an actual breach or encryption occurred, the extent of the damage, and when the incident occurred have not been independently verified.
Read on SOCRadar ↗Frolina Home listed among claimed Climax ransomware victims
SOCRadar reported that Climax named Frolina Home as a victim on its leak site on 10 November 2026. Neither an actual ransomware infection nor a data leak has been independently verified, and the scale of the damage and the company's response remain unconfirmed.
Read on SOCRadar ↗Kurogane Kasei suffers ransomware attack
Kurogane Kasei was targeted in a ransomware attack. The incident came to light again a year after the investigation findings were published, while the precise extent of the damage and the response measures remained unconfirmed.
Read on ScanNetSecurity ↗sumoteks.com targeted by Krybit ransomware attack
sumoteks.com was reported to have been targeted by a Krybit ransomware attack. The precise extent of the damage and the response measures have not been confirmed.
Read on SOCRadar ↗Next One restores operations a month after September ransomware attack encrypts ERP and backups
Impact: ERP database and backup server encrypted; issuing quotations and invoices and accessing customer files disrupted
It was belatedly disclosed that French indoor advertising company Next One suffered a ransomware attack in late September 2026 that encrypted its ERP database and backup server. Issuing quotations and invoices and accessing customer and prospective customer files were disrupted. The company resumed work using a temporary server within 48 hours of detecting the incident and restored normal operations after approximately one month of data recovery and synchronisation.
Read on Cyberattaque.org ↗Ransomware exposes personal and business partner data at Sanko Techno’s Vietnam subsidiary
898Impact: Personal information on approximately 898 people and 10 group-related individuals, and information on approximately 1,348 business partners
An intrusion exploiting a network device configuration error at Sanko Techno’s Vietnam subsidiary resulted in ransomware encryption and a data leak. The final investigation confirmed that personal information on approximately 898 people and 10 group-related individuals, along with information on approximately 1,348 business partners, had been leaked. Systems have been restored to normal operation.
Related reports: 2 · last report →Hanil Networks blocks ransomware attack, maintains normal operations
IT infrastructure company Hanil Networks suffered a ransomware attack. The company said it immediately blocked the attack and was operating normally with no information leaked. Financial authorities are checking whether its financial institution clients were affected.
Read on 보안뉴스 ↗PixelLeaks claims cyber-attack on Italy’s PC Express
Impact: Attackers’ claim: Obtained a database of more than 24,000 client company mailboxes, together with business correspondence and internal documents. The actual extent of the data breach remains unconfirmed.
Reports on 9 November 2026 said ransomware group PixelLeaks had claimed an attack on Italy’s PC Express (Multimedia Informatica). The attackers threatened to publish what they said was a database of more than 24,000 client company mailboxes, together with business correspondence and internal documents. Official confirmation from the affected organisation, the actual incident date and response measures could not be verified.
Read on SOCRadar ↗BOZZUTO hit by Vortex ransomware attack
BOZZUTO suffered a ransomware attack by Vortex. The extent of the damage, when the incident occurred and the response have not been confirmed.
Read on SOCRadar ↗