Trackers / Ransomware

Last updated Aug 25, 2026

Ransomware Incidents

Thousands get claimed on leak sites. A few dozen confirm it. Confirmed attacks get a row, with how long the company says it was down.

Get an alert when there’s a new incident

One email per new filing. Cheaper than a threat intel feed.

Days since the last confirmed incident

34

told the SEC about
an attack in 2026

The 34 so far, at a glance

What happened

8Reported an outage
26Data theft or access, no outage reported

One of 34 companies said exactly when it was back. Time a full restore of your most critical database, so your company could say it too.

Download CSVHow we countCite or reuse (CC BY 4.0)Placeholder: how to cite and reuse this data. Free to share and adapt under CC BY 4.0, with credit to The Datamaxxer by Eon.

2026 incidents that caused an outage, by date detected

Detected
Incident
What happened
Recovered
Source
August 25, 2026
008
Boston Scientific
Medtech
Unauthorized activity caused a network outage. The company says it is unlikely to meet 2026 guidance.
Partly restored by day 14. Full recovery “uncertain.” Update due after its Oct 28 earnings call
SEC 8-K
June 19, 2026
007
River Financial
Bank
Ransomware, stated in the filing, plus data theft.
Not stated
SEC 8-K
May 4, 2026
006
West Pharmaceutical
Pharma packaging
Systems encrypted and data exfiltrated. The filing does not use the word ransomware.
16 days or less. Core systems in 7 or less
SEC 8-K/A
March 28, 2026
005
Hasbro
Toys
Unauthorized network access. About $25M in lost revenue and $11M in costs.
53 to 92 days
SEC 10-Q
March 16, 2026
004
CareCloud
Healthcare IT
Unauthorized access and data exfiltration.
About 8 hours
SEC 8-K
March 11, 2026
003
Stryker
Medtech
A malicious file. First filed under Item 8.01, then amended to 1.05.
29 days or less
SEC 8-K/A
March 11, 2026
002
Trio-Tech
Semiconductor testing
Ransomware, stated in the filing, at a Singapore subsidiary. Escalated to Item 1.05 after data leaked.
197 days or less
SEC 8-K
February 14, 2026
001
UFP Technologies
Medical device components
Data exfiltrated, some of it “stolen or destroyed.”
Cited backups
10 days or less
SEC 8-K

"Or less" means the company said it was back as of a filing date. There will be a ninth: get the alert. Spot a filing we missed? Email us

How we count

What counts

Rows: 2026 incidents disclosed in an SEC 8-K or confirmed by the company. Leak-site claims don't get a row.

What doesn't

Naming anyone from a leak-site claim alone. Attacker names from press reports only.

How we source

SEC filings and their follow-ups, including earnings calls. Recovery times in the companies' own words.

The Datamaxxer newsletter

Hear about it before your boss forwards it to you.

  • 01Tracker updates: every new AI agent and ransomware incident, and whether the data came back
  • 02New research from Eon's engineers, starting with how nine AI models did on a generated company
  • 03Datamaxxing in the wild: real teams getting more out of their data
  • 04One thing to check on your own systems before Monday

Are you a peak datamaxxer?

Take the quiz