NeuralStackThe Center for Strategic and International Studies’ Significant Cyber Incidents timeline records a series of major attacks reported in 2026, spanning government agencies, financial institutions, technology companies and critical infrastructure. The tracker focuses on cyberattacks against government, defense and high-tech organizations, as well as economic crimes involving losses of more than a million dollars.
Among the most notable June entries, Russia’s Federal Security Service claimed that malware had infected the smartphones of senior government officials. The FSB said the campaign enabled attackers to steal data, intercept communications and conduct covert audio and video surveillance, but it did not identify the malware, provide technical evidence or attribute the operation to a specific country.
Other June incidents affected commercial and financial systems. Tata Electronics in India reportedly suffered a breach involving thousands of confidential files, including information related to Apple and Tesla, while Iran said cyberattacks disrupted card-based banking services at Bank Melli, Bank Saderat and Bank Tejarat. The Iranian disruption affected ATMs, point-of-sale terminals and mobile applications linked to card systems.
The insurance sector also faced operational consequences after a cyberattack compromised credit-rating data held by the National Association of Insurance Commissioners. The group ShinyHunters claimed responsibility, and rating agencies including Moody’s, S&P, KBRA, Fitch and Morningstar DBRS paused data sharing, forcing the NAIC to suspend investment-risk designations used to help determine insurers’ capital requirements.
Education was hit by an even larger claimed data theft in May. Instructure, which provides the Canvas learning management system, said attackers associated with ShinyHunters compromised its cloud infrastructure and claimed to have exfiltrated 3.65 terabytes of data belonging to roughly 275 million users across nearly 9,000 educational institutions. The reported exposure included student names, IDs and private communications, and Instructure ultimately paid a ransom to prevent a catastrophic leak.
Critical systems were also exposed through basic security weaknesses. U.S. officials said suspected Iranian hackers accessed automatic tank gauge systems at multiple gas stations after the systems were left publicly accessible without proper password protection. The attackers did not change physical fuel quantities, but they manipulated digital readings, raising concerns that similar access could be used to conceal dangerous gas leaks.
Why this matters
The timeline shows that cyber risk is increasingly concentrated in dependencies shared across industries, including cloud platforms, third-party operators, data exchanges and internet-connected monitoring equipment. The NVIDIA incident illustrates that exposure can remain limited to a regional partner: an unidentified actor impersonating ShinyHunters compromised GFN.am, a third-party GeForce NOW operator in Armenia, and attempted to extort the company after leaking local users’ names, phone numbers and email addresses, while NVIDIA’s core proprietary networks remained uncompromised.
The financial stakes are substantial, particularly in cryptocurrency. In April, a group suspected of being linked to North Korea exploited a major cryptocurrency exchange platform in an incident that LayerZero Labs estimated at roughly $293 million, describing it as the largest decentralized-finance attack of 2026. Other breaches involved personal data at France’s National Agency for Secure Credentials, where authorities said between 11 million and 18 million accounts were affected, and Dutch healthcare technology provider ChipSoft, whose temporary disconnection of compromised clients caused operational disruptions and portal shutdowns.
Attribution remains uneven across the incidents recorded by CSIS. Authorities and companies often named suspected groups or countries, but several entries relied on claims that were not accompanied by public technical evidence, leaving investigations, remediation and the true scope of compromise unresolved.