Ransomware incidents
Ransomware incidents, most recently reported first.
Shibata Construction Survey’s September ransomware attack raises fears of over 3,500 personal data records leaking
3.5KImpact: Possible leak of more than 3,500 personal data records
Reports indicate that more than 3,500 personal data records may have been leaked following a ransomware attack on Japanese construction consultancy Shibata Construction Survey on September 20, 2026. The potentially affected information includes names, addresses, and phone numbers of landowners and others handled in work commissioned by local governments, although an actual external leak has not been confirmed.
Read on 日経クロステック ↗Thegentlemen claims ransomware attack on Megatrans
Ransomware group Thegentlemen listed Argentine logistics company Megatrans as a victim. Whether a breach actually occurred, the date of the attack, the extent of the damage and the company’s response have not been confirmed.
Read on SOCRadar ↗Ransomware hits Koka’s voice broadcast system in Japan
25KImpact: Voice broadcast system outage; possible leak of around 25,000 records, including personal information
A ransomware attack on the voice broadcast system server in Koka, Shiga Prefecture, Japan, shut down the emergency information voice broadcast system. Outdoor loudspeakers and other equipment became unavailable, and around 25,000 records, including personal information, may have been leaked. As of November 12, there was no estimate for restoration.
Related reports: 5 · last report →Ransomware attack on Belarus’s ActiveCloud disrupts customer services
Impact: Customer websites, applications, and business services disrupted for several days
Belarusian cloud provider ActiveCloud suffered a ransomware attack that encrypted part of its cloud infrastructure. Customer websites, applications, and business services were disrupted for several days. Most virtual servers had been restored by the morning of November 12, but some remained unavailable.
Related reports: 2 · last report →N0n claims ransomware attack on Female Daily Network
N0n claimed to have attacked Indonesia's Female Daily Network and posted the claim on its leak site. Whether a breach or encryption actually occurred, the extent of the damage, and the organization's response have not been independently verified.
Related reports: 2 →Krybit claims ransomware attack on Ceytech Makine
The ransomware group Krybit claimed to have attacked Turkish machinery manufacturer Ceytech Makine. SOCRadar lists the incident as an attacker claim, and whether a breach actually occurred, the incident date, the extent of the damage, and response measures have not been confirmed.
Read on SOCRadar ↗Barracuda claims ransomware attack on Proliant
Impact: The attackers claim to have stolen 1.23 TB of data. The actual volume of leaked data and the number of people affected remain unconfirmed.
The ransomware group Barracuda added US-based Proliant to its victim list on November 12, 2026. The attackers claimed to have stolen 1.23 TB from the main file server, including contracts, financial records belonging to the company and its partners, and employee information. The timing of the actual breach, the extent of the damage, and the company's response have not been independently verified.
Read on SOCRadar ↗Ransomware attack on Denmark's Mailmak exposes subscription data
75KImpact: Subscription data exposed; delivery information for 75,000 IDA members potentially affected
Danish subscription and mailing company Mailmak suffered a ransomware attack in the early hours of November 11, exposing subscription data. Mailmak handles magazine mailing for 75,000 IDA members, and names, addresses, and contact details may be affected, but payment information was excluded.
Read on Ritzau／Ingeniørforeningen, IDA ↗INC Ransom claims attack on Thailand's Millimed
INC Ransom claimed to have attacked Thai pharmaceutical company Millimed Co., Ltd. SOCRadar lists the incident at the attacker-claim stage; whether a breach actually occurred, the extent of the damage and the incident date remain unconfirmed.
Read on SOCRadar ↗Cyberattack disrupts administrative systems at Brazil’s Port of Santos
Impact: Disruptions to internal systems and the website, with delays to some tasks including scheduling and billing
The Santos Port Authority in Brazil experienced disruptions to its internal systems and website following a cyberattack that began on November 6, 2026. Some tasks were switched to manual processing, delaying scheduling and billing, but vessel and cargo operations continued. The port authority set up a crisis response team and began recovery efforts, while the Federal Police also launched an investigation. A ransom demand by the group claiming responsibility was confirmed, but there were no negotiations or payments, and unauthorized access to data remained unconfirmed.
Related reports: 13 · last report →Ransomware encrypts some EROWA Systems servers
Impact: Part of the server infrastructure encrypted; indications of system data exfiltration
Swiss industrial supplier EROWA Systems discovered a ransomware attack on October 12. The attack encrypted part of its server infrastructure, and the investigation also found indications that system data had been exfiltrated.
Read on Inside IT ↗Vortex claims ransomware attack on Alexion
SOCRadar confirmed on November 10, 2026, that Vortex had listed Alexion as a victim. Whether an actual breach or encryption occurred, the extent of the damage, and when the incident occurred have not been independently verified.
Read on SOCRadar ↗Frolina Home listed among claimed Climax ransomware victims
SOCRadar reported that Climax listed Frolina Home as a victim on its leak site on November 10, 2026. Neither an actual ransomware infection nor a data leak has been independently verified, and the extent of the damage and the company's response remain unconfirmed.
Read on SOCRadar ↗Kurogane Kasei hit by ransomware attack
Kurogane Kasei suffered a ransomware attack. The incident resurfaced a year after the investigation findings were released, while the specific extent of the damage and response measures remained unconfirmed.
Read on ScanNetSecurity ↗sumoteks.com targeted by Krybit ransomware attack
sumoteks.com was reported to have been targeted by a Krybit ransomware attack. The specific extent of the damage and response measures have not been confirmed.
Read on SOCRadar ↗Next One restores operations a month after September ransomware attack encrypts ERP and backups
Impact: ERP database and backup server encrypted; issuing quotes and invoices and accessing customer files disrupted
It was belatedly disclosed that French indoor advertising company Next One suffered a ransomware attack in late September 2026 that encrypted its ERP database and backup server. Issuing quotes and invoices and accessing customer and prospect files were disrupted. The company resumed work using a temporary server within 48 hours of detecting the incident and restored normal operations after approximately one month of data recovery and synchronization.
Read on Cyberattaque.org ↗Ransomware leaks personal and business partner data at Sanko Techno’s Vietnam subsidiary
898Impact: Personal information on approximately 898 people and 10 group-related individuals, and information on approximately 1,348 business partners
An intrusion exploiting a network device configuration error at Sanko Techno’s Vietnam subsidiary led to ransomware encryption and a data leak. The final investigation confirmed that personal information on approximately 898 people and 10 group-related individuals, as well as information on approximately 1,348 business partners, had been leaked. Systems have been restored to normal operation.
Related reports: 2 · last report →Hanil Networks blocks ransomware attack, maintains normal operations
IT infrastructure company Hanil Networks suffered a ransomware attack. The company said it immediately blocked the attack and was operating normally with no information leaked. Financial authorities are checking whether its financial institution clients were affected.
Read on 보안뉴스 ↗PixelLeaks claims attack on Italy’s PC Express
Impact: Attackers’ claim: Obtained a database of more than 24,000 client company mailboxes, along with business correspondence and internal documents. The actual extent of the data breach remains unconfirmed.
Reports on November 9, 2026, said ransomware group PixelLeaks had claimed an attack on Italy’s PC Express (Multimedia Informatica). The attackers threatened to release what they said was a database of more than 24,000 client company mailboxes, along with business correspondence and internal documents. Official confirmation from the affected organization, the actual incident date, and response measures could not be verified.
Read on SOCRadar ↗BOZZUTO hit by Vortex ransomware attack
BOZZUTO was hit by a Vortex ransomware attack. The extent of the damage, the timing of the incident, and the response have not been confirmed.
Read on SOCRadar ↗