#critical-infrastructure

South Africa's air navigation provider ATNS found ransomware-linked malware in an OT network supporting aviation weather services, with suspected data exfiltration to China-based IPs. No flights were disrupted; the actor is unknown and a forensic probe is under way.

Warlock (Storm-2603 / GOLD SALEM / Longlegs) kept exploiting SharePoint ToolShell flaws into 2026, ransoming 33+ hosts at a critical-infrastructure operator via SYSVOL across Europe, Africa and Latin America.

CenterPoint's 8-K confirms a customer-data breach through an external-facing system — but the 7.49M figure, the SSN exposure, and the 'unprotected API' mechanism all come from the attacker's forum post, not the company. Filed under Item 8.01, deemed immaterial for now.

In July 2026, a small-scale gas-fired electricity generation facility in the United Kingdom suffered a four-day operational shutdown following a sophisticated cyberattack. The targeted plant,...

The BlackSuit ransomware group (a rebrand of Royal Ransomware) compromised CDK Global, the dominant Dealer Management System provider for North American auto dealerships, causing a weeks-long outage affecting ~15,000 dealerships' ability to sell, finance, service, and manage vehicles — one of the most disruptive ransomware incidents against a critical software supplier in 2024.

The ALPHV/BlackCat ransomware group compromised Change Healthcare, the largest US healthcare claims clearinghouse, causing a nationwide outage of pharmacy, medical claims, and payment processing affecting hundreds of thousands of providers, pharmacies, and patients — the most significant cyberattack on US healthcare infrastructure to date.

CISA, NSA, and FBI confirmed that PRC state-sponsored actor Volt Typhoon maintained undetected access to multiple US critical infrastructure networks for at least five years, extracting NTDS.dit databases and pre-positioning for potential OT disruption.