Cyberattacks in 2026 So Far: What Is Confirmed and What Businesses Should Do

Part 10 of 10 in the series Lessons from Major Cyber Incidents · United States, Europe and Asia · 2026

The first nine articles in this series looked back at incidents from 2024 and 2025, where official findings are available. This last one covers 2026 so far. Many of these cases are still under investigation, so we include only what an official body or the affected organization has confirmed, and we label everything else clearly. All information is as of October 4, 2026.

The numbers behind the year

Three major reports published in 2026 set the scene.

• FBI. The Internet Crime Complaint Center received 1,008,597 complaints in 2025, with reported losses of $20.877 billion. It logged 3,611 ransomware complaints and 24,768 business email compromise complaints, the latter with $3.046 billion in reported losses (FBI IC3 2025 Annual Report). These are reported losses only and do not capture downtime or unreported incidents.
• Verizon. The 2026 Data Breach Investigations Report found ransomware present in 48 percent of the breaches it analyzed, up from 44 percent the year before. A third party was involved in 48 percent of breaches. Exploitation of software vulnerabilities was the way in for 31 percent, up from 20 percent (Verizon 2026 DBIR).
• Verizon, on ransom payments. The same report puts the median ransom paid at $139,875 and found that 69 percent of ransomware victims did not pay.

Those three trends, ransomware, third parties and unpatched software, run through every case below.

United States: a hospital system on paper

On Thursday, February 19, 2026, a ransomware attack on the University of Mississippi Medical Center (UMMC) took down its network and many IT systems, including its electronic medical record. UMMC closed its clinics across the state, while its hospitals and emergency departments continued to operate using paper procedures (NPR, February 21, 2026). Clinics resumed normal operations on March 2 (BleepingComputer, March 4, 2026).

Not confirmed: how the attackers got in, whether patient data was taken, and what it cost. A ransomware group later claimed responsibility, and UMMC declined to comment on the threat (The Record, March 17, 2026).

United States: data theft at a hospital operator

Nutex Health, a hospital operator, told the SEC on August 31, 2026 that information on its servers had been accessed and taken by an unauthorized third party, including patient, employee, provider, business and financial information (Nutex Health Form 8-K). The filing states that the company had not identified a material impact on its operations and that a putative class action lawsuit had been filed.

Not confirmed: the entry point and the number of people affected. The Register reported that a ransomware group listed the company on its leak site without offering evidence (The Register, September 1, 2026). The confirmed fact is data theft.

United States: a material incident at a medical device maker

Stryker told the SEC that it identified a cybersecurity incident on March 11, 2026 that disrupted its business operations. In an amended filing on April 9, it said the incident had a material impact on its first-quarter results and that operations had been restored (Stryker Form 8-K/A). The filing does not state how the incident began. We covered this case earlier in our article on the Stryker disruption.

Europe: Berlin refuses to pay

The State of Berlin confirmed that attackers stole data from its state network and that a group calling itself Rhysida offered the data for sale with a minimum price of 30 bitcoin. Berlin refused to pay. Its Chief Digital Officer said: “The State of Berlin will not give in to blackmail.” (State of Berlin statement). The deadline passed on September 4, 2026, and the data was then published (Infosecurity Magazine, September 7, 2026).

Not confirmed by the state’s own statement: the entry point and the exact dates of the intrusion.

Asia: a rail group’s shops and hotels go offline

Keio Corporation, a Tokyo rail, retail and hotel group, was hit by ransomware on September 26, 2026. According to reports of the company’s announcement, it isolated its network and notified police. Trains kept running. Hotel and payment-related services were disrupted (SC Media, September 29, 2026; BleepingComputer, September 28, 2026).

Not confirmed: the entry point, any data theft and the cost. We were not able to open the company’s own notice, so this account relies on press reports.

Worldwide: two flaws now tied to ransomware campaigns

Two critical vulnerabilities in widely used infrastructure software were patched by their vendors in late July 2026, according to BleepingComputer (vCenter report; TeamCity report), and added to CISA’s Known Exploited Vulnerabilities catalog in August. CISA’s catalog now marks both as known to be used in ransomware campaigns (CISA KEV data).

• VMware vCenter Server (CVE-2026-59310), the console used to manage virtual servers. Added to the catalog on August 18, 2026.
• JetBrains TeamCity (CVE-2026-63077), a tool used to build and release software. Added on August 5, 2026.

JetBrains itself was affected. The company disclosed that one of its own servers was vulnerable to the TeamCity flaw, that malicious activity was identified from August 8, and that the intrusion was discovered on August 23, which is 15 days later (JetBrains incident report). Even the company that wrote the fix had a vulnerable server of its own.

Europe: police take down a ransomware service

On September 30, 2026, an operation led by police and prosecutors in Hamburg, Germany, with Europol’s support, seized the leak site and servers of the KillSec ransomware group, and three people were provisionally arrested (Group-IB, a participating security firm; The Record, October 1, 2026). The arrests are provisional and the suspects are presumed innocent.

Takedowns matter, and they do not remove the need for each organization’s own defenses.

Four lessons the 2026 cases support

1. Patch internet-facing and management systems in days. In the JetBrains case, a vulnerable server was compromised within about two weeks of the fix being released. Verizon’s data shows vulnerability exploitation rising sharply as a way in.
2. Plan to work without your core systems. UMMC’s clinics were closed for more than a week while its hospitals worked on paper procedures.
3. Expect data theft, with or without encryption. Berlin and Nutex are both confirmed as data theft. Backups do not help when the threat is publication.
4. Keep parts of the business separated. At Keio, trains kept running while other group businesses were disrupted. The reports do not say why. Separation between business units is the general principle that limits how far an attack spreads.

Official guidance covers all four. CISA’s #StopRansomware Guide and the UK NCSC’s guidance on mitigating malware and ransomware attacks are the best free starting points.

What this means for your organization

Across all ten articles in this series, the same short list of gaps appears: a login without MFA, an unpatched server facing the internet, a vendor with more access than anyone realized, and no rehearsed plan for working without a key system. None requires a large budget to check.

• An external security audit shows what an attacker can see from the internet.
• An internal security audit shows how far an intruder could move.
• A Microsoft 365 security audit and an Intune security audit cover identity, email, apps and devices.
• The free Ransomware Resilience Assessment takes a few minutes.

To decide where to start, schedule a consultation with Ali Hassani, CISSP, C|CISO.

Last verified: October 4, 2026. This article is general information based on the public sources cited, as of the date shown. It is not legal advice. OC Security Audit had no involvement in the incidents described and has no inside knowledge of them. Company names appear only to identify the organizations named in those public sources. Statements made in lawsuits are allegations and have not been proven. Where a source could not be confirmed, the article says so. If you believe anything here is inaccurate, contact us and we will review it.