Ransomware Incident Tracker

The service said malware was found on 2026-10-20 and about 26,739 servers were stopped from 04:00 on 2026-10-21. GMO's 2026-10-24 disclosure confirmed customer information was taken out. Its 2026-10-28 disclosure says 「当社グループは、攻撃者からの要求には永久に応じません。」 (the group will never comply with the attacker's demands), calls the attacker's use of customers' assets and information 「脅迫の手段」 (a means of extortion), and confirms that information apparently related to customers was published by a person believed to be the attacker. A ransomware attack was not confirmed as of the 10th report (2026-10-27 13:55).

"As the ongoing criminal investigation continues, the City of Columbia can confirm it is a victim of a ransomware attack." Impacted: MyColaSC and online services related to Animal Services, reservations for Parks and Recreation, and GIS; Police, Fire, 911, Columbia Water and the Payment Center unaffected.

Per the police FIR filed on the hospital's complaint (Times of India, 2026-10-27), "the hospital alleged that all nine of its servers were hacked, data was encrypted and a ransom was demanded for its release." The FIR states patient care, billing, insurance processing and reporting were affected. Hospital executive committee member Dr Milind Vaishnav: "The services have not stopped, they have just slowed down."

Toho Holdings says the unauthorized access was 「ランサムウェア攻撃を行う第三者による不正アクセスが原因であり」 (caused by a third party that carries out ransomware attacks) and that data leaked. It says Entouch's business continuity was not affected.

Cause: unauthorized access by a third party (ransomware attack) (第三者からの不正アクセス（ランサムウェア攻撃）)

University says: 「本事案についてはサイバー攻撃、いわゆるランサムウェア攻撃によるものと判断しており」 (it has judged the incident to be a cyberattack, a so-called ransomware attack). Its virtualization infrastructure failed early Oct 2, taking down the campus network, email, websites, and academic, finance, HR/payroll and library systems.

Title: system failure caused by a ransomware attack

Damage that appears to have been caused by ransomware (ランサムウェアによると思われる被害) on a NAS used by administrative departments, found Sep 24 at 08:42. Oct 30 update: personal data of about 80,000 students, staff, former students and staff, and related parties (including passwords), plus patient data such as departments, diagnoses and visit dates (count under investigation), may have leaked; police consulted.

Company's 2nd report (Oct 3): 「2026年9月20日に発生したランサムウェアのサイバー攻撃によるシステム障害」 (system failure from a ransomware cyberattack on Sep 20). It cut affected systems off, stopped network order processing, confirmed some internal information leaked, and expected to resume network orders after finishing EDR rollout and scans on Sep 30.

Ransomware attack, some servers encrypted

Confirmed unauthorized access involving ransomware (ランサムウェアによる不正アクセス)

「不正アクセスに起因する障害は、ランサムウェアによる攻撃であることを確認いたしました」 (confirmed the failure caused by unauthorized access was a ransomware attack). The attacked area was separate from customer systems and data.

Researchers describe agent-driven extortion against production databases: tables and databases dropped, ransom demanded.

"determined that ransomware had been deployed across portions of its server environment"; "Certain operations have been impacted."

"The incident involved a ransomware attack affecting certain of the Firm's information systems." Navient says it had no disruption to its own operations or customer services.

"The communications from the threat actor demanded payment in exchange for not publicly disclosing this information." Data was on third-party-hosted business applications.

"certain data was exfiltrated by an unauthorized party and certain systems were encrypted". The May 20 amendment says it is "fully operational across its manufacturing, supply chain and commercial sites globally."

"Instructure reached an agreement with the unauthorized actor"; it says "no Instructure customers will be extorted as a result of this incident."

Confirmed encryption damage by ransomware (ランサムウェアにより暗号化される被害)

3rd report (Apr 15): 「本システム障害はランサムウェア感染が原因であることが判明いたしました」 (the system failure was found to be caused by a ransomware infection). Production, orders and shipping continued.

"The subsidiary experienced a ransomware incident that resulted in encryption of certain files within the Company's network." Singapore subsidiary; network taken offline to contain it; company data disclosed Mar 18.

"responding to a cybersecurity incident involving ransomware that may have impacted certain systems within its network"; an unauthorized third party "may have gained access to portions of the company's network and deployed ransomware." Affected systems isolated.

Company notice title: 「ランサムウェア感染被害のお知らせ」 (notice of ransomware infection). Final report (Sep 7): ransomware entered through an external connection device and some servers were encrypted; backups survived and were used to restore. Card terminals were down at some hotels.

Bots wipe exposed MongoDB collections and leave a note demanding about $500 in BTC

The company said a ransomware infection caused a system failure (ランサムウェア感染によりシステム障害が発生), found 2026-01-07: email unusable and order-taking and shipping delayed. 2nd report (Jan 26): work and email on new PCs resumed in stages from Jan 27. 4th and final report (Apr 27): systems and operations stable; no clear sign of information leaking outside the company.

Romania's national cyber directorate (DNSC) says it was notified on Dec 20 of "un atac cibernetic de tip ransomware" (a ransomware cyberattack) on workstations and servers of Apele Romane and 10 of its 11 regional water basin administrations. About 1,000 IT systems were compromised, including GIS, database, email/web and DNS servers. Attackers used Windows BitLocker to encrypt files and left a ransom note asking to be contacted within 7 days. Operational technology was not affected; water infrastructure kept running, coordinated by phone and radio.

System failure caused by ransomware infection (ランサムウェア感染によるシステム障害)

A criminal group "demanded a ransom"; "We will not pay this ransom"

Infected with ransomware via unauthorized external access (外部からの不正アクセスによりランサムウェアに感染)

"unauthorized access and deployment of encryption and monitoring software by a third party"; threat actors threatened to release information unless paid

Logs in through missing or weak auth, copies data, drops databases, leaves a ransom table (README_TO_RECOVER, PLEASE_READ_ME, PWNED)

Company notice: the US subsidiary's server was hit by ransomware and 「サーバーに保管されている一部のファイルが暗号化されている」 (some files stored on the server were encrypted); confirmed Sep 20 local time. Normal operations continued.