A brief overview of the main incidents in industrial cybersecurity. Q2 2026

Related tags

automotive

cyberincidents overview

data leakage

denial of IT services

denial of operations

denial of service

electronics industry

energy sector

logistics

manufacturing

personal data leakage

ransomware

supply chain

transportation

utilities

water supply

In Q2 2026, 163 incidents were publicly confirmed by victims. All of these incidents are included in the table at the end of the overview, with select incidents described in detail.

Report at a glance

In our review of publications by researchers investigating threats to industrial organizations, we noted a significant increase in stories describing attacks on control systems intended to cause physical damage. Unsurprisingly, the number of such incidents confirmed by the attacked parties has also increased. The organizations that suffered most were obviously the ones not paying sufficient attention to the security of their automation systems for a number of reasons, primarily economic ones.

We all remember how, in 2023, US utility companies, represented by a coalition of states and the AWWA and NRWA water associations, succeeded in getting a federal appeals court to block new Environmental Protection Agency (EPA) requirements that water utilities undergo mandatory cybersecurity audits. The logical result was a series of incidents at water utilities across the United States beginning in the first quarter and continuing into the third, as we will discuss in our next report. Insufficient security of public utilities, particularly water supply, is a global problem, not just a US-specific one. These utilities are typically small private enterprises with modest IT/OT budgets, making it difficult for them to invest significant resources in information security. We recall the recent cyberincident in Køge, Denmark, which resulted in a ruptured main pipeline. This quarter, we also learned more about the 2025 attacks on water supply facilities in five Polish cities.

For the same reasons as utility automation systems, automatic tank gauge (ATG) systems in petroleum storage facilities remain a popular target for hacktivists. In Q4 2025, the Canadian Cybersecurity Centre (CCCS) reported attacks on these systems; now they have hit facilities in the United States.

Hacktivist enthusiasts repeatedly remind us that many vital automation systems remain under the radar. Many of these systems are concentrated in transportation and logistics infrastructure, particularly rail transport. We all remember the story of the Polish schoolboy who derailed trams. This quarter, a similar incident was reported in Taiwan, resulting in a 48-minute delay to four trains.

ICS-targeting attack

North Dakota water treatment plant

Utilities | Ransomware | Attacks targeting ICS

A water treatment plant serving the city of Minot, North Dakota, was hit with ransomware in March. City officials confirmed the incident and reported that the water treatment plant and all facilities related to the city’s water system had remained operational and safe at all times. According to a letter provided by the city to the FBI and seen by the media, staff detected the ransomware on March 14, forcing operators to revert to manual processes for about 16 hours before a replacement server could be installed. Minot’s communications and engagement manager stated that ransomware had been detected on the Minot Water Treatment Plant’s SCADA system. According to the letter, a message from those who had installed the ransomware was found on the now-uninstalled SCADA server, but it did not contain a direct request for money and the city did not pay any amount. Minot’s communications and engagement manager didn’t know which ransomware family was responsible for the attack, but said that the city’s technical recovery was nearly complete. The plant used an old server to support its gauge readings while staff prepared a new server.

Thermal power plant in Sweden

Energy | Attacks targeting ICS

According to a Swedish defense official, a group of hackers attempted to disrupt operations at a thermal power plant in Sweden in Spring 2025. Sweden’s minister for civil defense said during a press conference in Stockholm on April 15 that the attack was directed at systems that control physical activities and that the attack was unsuccessful because of the facility’s built-in security protection. The targeted plant wasn’t named. Sweden’s security service investigated the incident and identified alleged perpetrators that are believed to have links to Russia.

Taiwan high speed rail

Transportation, logistics | Denial of operations | Attacks targeting ICS | Cyber-physical consequences

A student in Taiwan was arrested for interfering with the TETRA (TErrestrial Trunked RAdio) communication system used by Taiwan High Speed Rail Corporation (THSRC). According to local media reports, the student halted four trains for 48 minutes on April 5 by using software-defined radio (SDR) communications and handheld radios to transmit a high-priority “General Alarm” signal, triggering emergency braking procedures. Before the attack, the student intercepted and decoded TETRA radio parameters using SDR equipment he had bought online and then programmed them into handheld radios to impersonate legitimate beacons. The police also found that an accomplice provided the attacker with some critical THSRC parameters that enabled the attack. THSRC’s radio system has reportedly been in service for 19 years and its parameters were apparently not rotated during that time, allowing the attacker to bypass seven verification layers. Following the incident, THSRC examined the logs and found that the signal had been sent from a radio beacon that hadn’t been assigned for duty. Upon checking that the device was not missing, a plausible scenario was unauthorized cloning, and the police were alerted.

U.S. gas stations

Energy | Attacks targeting ICS

According to CNN, U.S. officials suspect that Iranian-linked hackers were behind a series of breaches involving automatic tank gauge (ATG) systems used to monitor fuel storage tanks. The systems were accessible online without password protection, allowing attackers to manipulate the display readings viewed by operators to output incorrect fuel levels. According to officials, the incidents did not result in physical damage. The sources briefed on the investigation said Iran’s history of targeting gas tank systems is one reason the country is a top suspect. But, the sources cautioned, the U.S. government may not be able to definitively determine who was responsible because of a lack of forensic evidence left by the hackers.

In June, The U.S. Cybersecurity and Infrastructure Security Agency (CISA), FBI, NSA, Department of Energy, and other U.S. government partners published a joint notice warning that hackers are targeting internet-exposed automatic tank gauge (ATG) systems used to monitor fuel and liquid storage tanks across various critical infrastructure sectors.

Polish water supply

Utilities, water supply | Attacks targeting ICS

Poland’s Agencja Bezpieczeństwa Wewnętrznego (ABW) disclosed in May that attackers had breached water treatment facilities in five Polish towns during 2025: Jabłonna Lacka, Szczytno, Małdyty, Tolkmicko and Sierakowo. By gaining access, in some cases, to industrial control systems, the attackers were able to alter the technical parameters of equipment, which posed a direct risk to the continuity of their operation and, consequently, the supply of water to the population. Earlier in 2025, Deputy Prime Minister of Poland and Minister of Digital Affairs Krzysztof Gawkowski confirmed to the Onet.pl news portal that an attack on an unnamed water and sewage infrastructure of a large Polish city had occurred on August 13, 2025.

Attacks leading to denial of operations

Foxconn

Electronics, manufacturing | Denial of IT systems and operations | Ransomware

Multinational electronics manufacturer Foxconn Technology Group, headquartered in Taiwan where the company is known as Hon Hai, confirmed on May 12 to news sources that the company’s North American factories had experienced a cyberattack. According to Foxconn, the cybersecurity team immediately activated the response mechanism and implemented multiple operational measures to ensure the continuity of production and delivery. The affected factories were in the process of resuming normal production. An employee at one of Foxconn’s Wisconsin factories told DysruptionHub on May 5 that they began dealing with Wi-Fi issues on May 1 and were sent home due to the network outages. Computers were not working and employees had to use paper and pen for several different tasks. Internal notices reviewed by DysruptionHub also cited ongoing network issues affecting operations. One notice said the company could not continue normal activities and that operations would remain closed for the rest of the day to ensure the safety, efficiency, and integrity of company processes. A separate notice said there would be no first-shift production on May 5 because of continued network issues. On May 12 the company reported the attack in the bulletin on the Taiwan Stock Exchange portal. The day before, Nitrogen ransomware group listed Foxconn on its data leak website. The group claimed to possess 8 terabytes of Foxconn data, comprising more than 11 million files, and posted sample images it described as proof of leakage.

West Pharmaceutical Service

Pharmaceutical, manufacturing | Denial of IT systems, services and operations, data leakage | Ransomware

U.S. manufacturer of injectable pharmaceutical packaging and delivery systems West Pharmaceutical Services Inc. disclosed that it had experienced a cyberattack in a Form 8-K filing with the U.S. Securities and Exchange Commission (SEC). West Pharmaceutical first detected the incident on May 4, and three days later determined that the incident was a material cybersecurity attack in which certain data was exfiltrated by an unauthorized party and certain systems were encrypted. The incident had temporarily disrupted the company’s global business operations. West Pharmaceutical notified law enforcement agencies and brought in third-party cyber forensic experts. The company has restored its core enterprise systems. Critical processes for shipping, receiving, and manufacturing have restarted at some sites with restoration of the remaining sites in process, although the timeline for full recovery remains unknown. On May 13, an update on the company’s website stated that based on the findings of Palo Alto Networks Unit 42, the available evidence indicated that the identified unauthorized activity has been contained and the immediate risk to West’s operational environment has been mitigated.

Unoaerre

Manufacturing | Denial of IT systems and operations | Ransomware

Italian jewelry manufacturing company Unoaerre was the victim of a cyberattack that paralyzed its operating system, leading the cybercriminals to demand a ransom of EUR 3.8 million in Bitcoin. According to the local news outlet, the attack happened on May 8. The plant was gradually emptied and employees were asked to leave the premises as a precaution, while IT specialists began operations to isolate the systems and contain the intrusion. Initial investigations suggested that the attack may have links to countries in the Middle East and Eastern Europe. Despite the interruption, initial checks indicated that the damage was not irreversible and that production could resume. Technical investigations remained to determine whether sensitive data, commercial information, or confidential projects were accessed.

Mackay Sugar

Food and beverage, manufacturing | Denial of services and operations | Ransomware

Australian sugar producer Mackay Sugar disclosed on June 10 that it had suffered a cyberattack affecting some of its operations. Advocacy group Canegrowers confirmed the incident had shut down sugar milling and cane haulage across the Farleigh and Racecourse mills just outside Mackay. Canegrowers Mackay chairman said many growers were issued with cease harvesting advice by Mackay Sugar early on June 10, adding that the cyberincident had affected multiple parts of the business. In an update on June 12, Mackay Sugar stated that the company had recommenced a limited manual crushing operation at the Farleigh Mill, processing cane that had been harvested prior to the incident. While some operations have resumed in a controlled manner, key cane supply and logistics systems remained subject to ongoing restoration and no additional cane was being accepted at the mills.

On June 17, Mackay Sugar said the investigation had identified evidence of unauthorized access by an external party to parts of the IT environment. The company’s monitoring has identified that an external party has made a claim about the company on a dark web site. Mackay Sugar worked urgently to verify the claims, including the nature and extent of any information which may have been accessed. The company continued to progress the restoration of the systems that support cane supply, harvesting and mill operations.

On June 26, Mackay Sugar issued a report that all three Mackay Sugar mills were now operational. The Gentlemen ransomware group claimed responsibility for the attack on Mackay Sugar on June 15.

Kintetsu World Express

Transportation, logistics | Denial of IT systems and operations

Japanese logistics provider Kintetsu World Express (KWE), which offers air and sea cargo services globally, has issued a statement announcing an IT outage that occurred in the early hours of May 15, 2026, at KWE-Kintetsu World Express (S) Pte Ltd., a subsidiary of the group, following unauthorized access by a third party. After the intrusion, the affected systems were taken offline and isolated. This incident has affected some of Singapore’s air export-related operations and domestic warehousing operations. No impact on operations outside of Singapore or on core business systems has been confirmed. On May 20, the company issued a statement providing an update and said that all affected operations had returned to normal. Immediately after this incident occurred, the group established an emergency response headquarters and, in cooperation with external security experts, took action based on its cybersecurity business continuity plan (BCP).

Katun Corporation

Manufacturing | Denial of IT systems and operations

Taiwanese manufacturer of compatible toner cartridges for copiers and printers General Plastic Industrial Co., Ltd. announced unauthorized access to the computer network of its subsidiary Katun Corporation in a bulletin published on the Taiwan Stock Exchange (TWSE) portal on June 16. Upon learning of the unauthorized access, the IT department immediately carried out system isolation procedures to prevent the impact from expanding and simultaneously activated defense measures. The company assessed the operational impact of this incident, including the temporary suspension of shipments. Shipment operations were in the process of being restored and have gradually resumed.

Cedro Têxtil

Manufacturing | Denial of IT systems and operations

Brazilian textile manufacturer Cedro Têxtil confirmed it has fallen victim to a cybersecurity incident that has affected its technological environments and impacted the operation of certain corporate systems. An employee told the media outlet Sete Dias that the core system supporting the company’s entire network had gone offline, and that operations had been suspended since June 18 and were expected to resume after 10:00 PM on June 22. The company has mobilized experts to bring the situation under control and is working to safely restore operations. The company has not yet identified the perpetrator of the attack.

Incidents at large organizations

Medtronic

Manufacturing | Data leakage

American-Irish medical device manufacturing company Medtronic disclosed a cyberattack in a Form 8-K filing with the U.S. Securities and Exchange Commission (SEC). The company announced on April 24 that an unauthorized third party had accessed data in some of the company’s information technology systems. Based on its investigation, Medtronic has not identified any impact to its products, patient safety, connections to customers, manufacturing and distribution operations, financial reporting systems, or ability to meet patient needs. In addition, the company did not expect the incident to have a material impact on its business or financial results. On the same day, April 24, Medtronic reported a cyberattack on its website. According to Medtronic’s website, the networks that support the company’s corporate IT systems, products, and manufacturing and distribution operations are separate. Hospital customer networks remain separate from Medtronic IT networks and are secured and managed by customers’ IT teams. The company has been working to identify any personal information that may have been accessed.

Skoda Auto

Automotive, manufacturing | Personal data leakage

Czech automobile manufacturer Skoda Auto discovered that unauthorized individuals had exploited a vulnerability in the software used to run its online shop during a recent technical security monitoring exercise. The company’s online shop contained customers’ personal information, including full names, postal addresses, email addresses, phone numbers, order history, and hashed passwords. No credit card numbers or other financial information were stored there, as this information is exclusively processed by payment service providers. As a precaution, Skoda’s online shop was taken offline as soon as the incident was discovered. The vulnerability has since been eliminated, and the incident has been handed over to a specialized IT forensics department for technical analysis. The incident has also been reported to the relevant data protection authority. The company couldn’t say for sure whether customers’ personal details were ever copied or retrieved.

Denso

Automotive, manufacturing | Data leakage | Ransomware

Japanese automotive components manufacturer Denso Corporation confirmed on its website that its group companies’ facilities located in Italy and Morocco have suffered unauthorized access to their networks by a third party. After learning about the unauthorized access on March 28, 2026, the company immediately established an internal emergency response headquarters. As a result of investigations, the company confirmed that it can’t be ruled out that some information concerning external parties and the company may have been illegally extracted by a third party due to the unauthorized access. At the time of notification, no significant impact has been confirmed on production activities or product deliveries to customers as a result of this incident. The Qilin ransomware group claimed responsibility for the attack on Denso in April.

Novo Nordisk

Pharmaceutical, manufacturing | Personal data leakage | Extortion

Danish pharmaceutical company Novo Nordisk has disclosed a cyberattack involving unauthorized access to a limited number of internal IT systems. The company took several of its systems offline following the incident, notified authorities, and investigated with the assistance of external cybersecurity experts. The company’s core business operations were not impacted and remained up and running. Novo Nordisk discovered that certain non-public data, including personal data, were copied externally without authorization. In a June 18 update, the company said that the incident affected a limited amount of information related to patients participating in certain clinical trials. According to Novo Nordisk’s breach notice, this information is not directly linked to any patients by name or other direct identifiers. Healthcare providers affected by the incident were informed that compromised data may include company name, registration number, contact email address, phone number, office location, and WhatsApp details. The FulcrumSec extortion group claimed on June 16 to have stolen more than a terabyte of data from Novo Nordisk and said it was ‌exploring selling parts of the data after unsuccessfully demanding $25 million from the company.

Tata Electronics

Electronics, manufacturing | Personal data leakage, supply chain | Ransomware

Indian electronics company Tata Electronics confirmed to Reuters in a statement on June 22 that it had identified a cybersecurity incident on some of its systems a few weeks ago, after researchers said The World Leaks groups posted purported component design and specification papers of Apple and Tesla, both customers ‌of the Indian group. Response protocols were deployed immediately, and the incident has had no impact on the company’s operations across businesses, which remained unaffected. A source familiar with the matter said that Tata Electronics had received a ransom demand related to the incident. Reuters reported that Tata Electronics informed some employees at its iPhone assembly operations about the data breach, according to a second industry source familiar with the matter. The report also said Apple was investigating the incident.

The World Leaks ransomware group claimed responsibility for the attack on Tata Electronics on June 12. Among the leaked information, there are multiple directories and documents allegedly containing manufacturing data for Apple products, including internal component schematics, PCB designs, material specifications, and SDK files. The World Leaks dark web site said the Tata Electronics data consists of more than 200,000 files totaling over 630 gigabytes.

Ukrposhta

Logistics, transportation | Denial of IT systems and IT services | Hacktivist

Ukrainian national postal operator Ukrposhta reported temporary disruptions to its mobile app following a cyberattack on its IT systems. The attack, which occurred on the night of June 24 to 25, led to instability and outages of digital services. Ukrposhta confirmed the incident, saying that experts worked to quickly restore normal operation of the platform. Ukrposhta added that they will notify users after the application is fully restored. The IT Army of Russia hacktivist group claimed responsibility for the attack on June 25. The group alleged it had breached Ukrposhta’s infrastructure several weeks earlier, gained access to one of the company’s servers and exfiltrated a database containing user information, along with other internal data.

Appendix. Full list of confirmed incidents