May 2026 served as yet another powerful reminder that cyber threats continue to evolve in both scale and sophistication, impacting organizations of all sizes and industries. From leading technology providers and healthcare institutions to transportation networks, manufacturing companies, and media organizations, cybercriminals demonstrated their ability to exploit vulnerabilities across increasingly connected digital environments.
Some of the month’s most notable incidents involved organizations such as Instructure, MediaWorks, Taiwan High Speed Rail Corporation (THSRC), OpenAI, Grafana, NYC Health + Hospitals, Trellix, Vimeo, and Foxconn, highlighting that no sector is beyond the reach of modern cyber threats.
Key Cybersecurity Events in May 2026
- Ransomware Attacks in May 2026
- Data Breaches in May 2026
- Major Cyber Attacks in May 2026
- Newly Discovered Malware and Ransomware Variants
- Critical Vulnerabilities and Security Patches Released
- Cybersecurity Advisories, Threat Intelligence Reports, and Industry Analysis
Collectively, these incidents reveal several concerning trends shaping today’s cybersecurity landscape. Organizations continue to face growing risks from ransomware and extortion campaigns, supply chain compromises, third-party software vulnerabilities, attacks targeting critical infrastructure, and increasingly sophisticated threat actors leveraging advanced tactics to evade detection.
As businesses become more dependent on cloud platforms, SaaS applications, remote work environments, and interconnected digital ecosystems, the potential operational, financial, and reputational impact of a cyber incident continues to increase. A single security breach can disrupt business operations, expose sensitive data, damage customer trust, and result in significant regulatory and recovery costs.
The encouraging news is that many cyber risks can be significantly reduced through proactive planning and preparation. Organizations that invest in comprehensive cybersecurity strategies are better positioned to identify threats early, respond effectively, and maintain business continuity during security incidents.
Key areas of focus should include:
- Cyber Incident Response Planning
- Security Awareness and Employee Training
- Cybersecurity Risk Assessments
- Vulnerability Management Programs
- Executive Cyber Crisis Preparedness
- Incident Response Playbooks
- Tabletop Exercises and Cyber Drills
- Business Continuity and Disaster Recovery Planning
- Continuous Security Monitoring and Threat Detection
Ransomware Attacks in May 2026
| Date | Victim | Summary | Threat Actor | Business Impact | Source Link |
|---|---|---|---|---|---|
| May 4, 2026 | pro-Orbán Mediaworks | Ransomware group claims breach of pro-Orbán Hungarian media firm | World Leaks Ransomware Group | Hungarian media company Mediaworks confirmed that attackers stole and leaked nearly 8.5 TB of internal data, including payroll records, contracts, financial files, and internal communications, exposing sensitive business information and creating serious operational and reputational risks. | Ransomware attack on Hungarian media firm pro-Orbán |
| May 12, 2026 | Foxconn | Foxconn confirms cyber attack after Nitrogen claims Apple, Nvidia data theft | Nitrogen Ransomware Group | Foxconn confirmed a cyber attack after the Nitrogen ransomware gang claimed it had stolen sensitive files linked to Apple and NVIDIA projects, raising concerns over supply-chain exposure, intellectual property theft, and potential operational disruption within one of the world’s largest electronics manufacturing networks. | Foxconn Ransomware Attack |
| May 15, 2026 | West Pharmaceutical Services | West Pharma ransomware attack disrupts operations | Unknown | West Pharmaceutical suffered a ransomware attack that encrypted systems and stole data, forcing the company to shut down portions of its global network and disrupting manufacturing, shipping, and supply-chain operations critical to pharmaceutical and biotech customers worldwide. | West Pharmaceutical Ransomware Attack |
| May 18, 2026 | Grafana Labs | Grafana refuses to pay ransom after codebase theft | TeamPCP | Grafana Labs confirmed that attackers stole portions of its internal codebase during a supply-chain related breach, but the company refused to pay the ransom demand, raising concerns over potential source code exposure, downstream software integrity risks, and further exploitation attempts targeting customers and developers. | Source: The Record |
Data Breaches in May 2026
| Date | Victim | Summary | Threat Actor | Business Impact | Source Link |
|---|---|---|---|---|---|
| May 2, 2026 | Trellix | Trellix source code breach – Hackers gain unauthorised access to repository | Unknown | Trellix disclosed that attackers gained unauthorised access to part of its internal source code repository, exposing sensitive proprietary code and creating potential supply-chain and vulnerability discovery risks, although there was no evidence of product tampering or customer impact. | cybersecuritynews.com |
| May 3, 2026 | Instructure | Instructure confirms data breach, ShinyHunters claims attack | ShinyHunters | Instructure confirmed that attackers stole data from its systems in a cyber attack, potentially exposing information tied to its Canvas learning platform and thousands of educational institutions, raising concerns over student and staff data privacy. Reports later suggested a ransom payment may have occurred. | Canvas Data Breach |
| May 5, 2026 | Vimeo | Vimeo data breach exposes personal information of 119,000 people | ShinyHunters | The breach exposed names and email addresses of more than 119,000 users after attackers exploited a third-party analytics provider, increasing phishing and fraud risks. | Bleeping Computer |
| May 8, 2026 | Zara (Inditex) | Zara data breach exposed personal information of 197,000 people | Unknown | Unauthorised access to a third-party database exposed transaction-related records for nearly 197,000 customers, increasing phishing and fraud risks. | Bleeping Computer |
| May 8, 2026 | NVIDIA GeForce NOW (GFN.am) | NVIDIA confirms GeForce NOW data breach affecting Armenian users | ShinyHunters | User information including names, email addresses, birth dates, and account metadata was exposed through a partner breach. | Bleeping Computer |
| May 11, 2026 | Škoda Auto | Skoda data breach hits online shop customers | Unknown | Customer names, emails, phone numbers, and order details were exposed, increasing phishing and fraud risks. | Security Week |
| May 15, 2026 | American Lending Center | American Lending Center Data Breach Affects 123,000 Individuals | Unknown | Sensitive personal and financial information belonging to approximately 123,000 individuals was exposed. | Security Week |
Cyber Attacks in May 2026
| Date | Victim | Summary | Threat Actor | Business Impact | Source Link |
|---|---|---|---|---|---|
| May 1, 2026 | Canonical (Ubuntu) | Ubuntu and Canonical services disrupted by DDoS attack claimed by hacktivists. | 313 Team (Islamic Cyber Resistance in Iraq) | A sustained DDoS attack disrupted Ubuntu and Canonical’s public-facing infrastructure, taking down key web services and security resources, preventing users from accessing updates, documentation, and developer tools. | Ubuntu Cyber Attack |
| May 4, 2026 | DigiCert | DigiCert revokes certificates after support portal hack. | Unknown | A social engineering attack compromised DigiCert’s support portal, enabling attackers to obtain fraudulent code-signing certificates later used to sign malware. | Security Week |
| May 5, 2026 | Taiwan High Speed Rail Corporation (THSRC) | Student hacked Taiwan high-speed rail to trigger emergency brakes. | Lin (23-year-old university student) | The attack forced four high-speed trains to stop for 48 minutes, exposing weaknesses in railway communication security systems. | Bleeping Computer |
| May 6, 2026 | Unnamed Organisation | MuddyWater hackers use Chaos ransomware as a decoy in attacks. | MuddyWater (Iran-linked APT) | Attackers infiltrated through Microsoft Teams social engineering, stole sensitive data, and used ransomware as a distraction while conducting espionage activities. | Bleeping Computer |
| May 6, 2026 | DAEMON Tools (Disc Soft Limited) | DAEMON Tools developers confirm breach and release malware-free version. | Unknown | Compromised software build environment distributed trojanized installers to thousands of users across more than 100 countries. | Bleeping Computer |
| May 7, 2026 | Cloud Infrastructure Operators | New PCPJack worm steals credentials and spreads through cloud environments. | PCPJack Operators | The worm targeted Docker, Kubernetes, Redis, and MongoDB environments, stealing credentials and establishing persistent access. | Bleeping Computer |
| May 9, 2026 | Hugging Face Users and AI Developers | Fake OpenAI repository pushes infostealer malware. | Unknown | Malware stole browser credentials, VPN logins, developer secrets, and cryptocurrency wallets from infected systems. | Bleeping Computer |
| May 14, 2026 | OpenAI | OpenAI confirms security breach in TanStack supply-chain attack. | TeamPCP | Two employee devices were compromised, exposing limited credentials and requiring certificate rotation and security enhancements. | Bleeping Computer |
| May 17, 2026 | Microsoft 365 Users and Organisations | Tycoon2FA hijacks Microsoft 365 accounts through device-code phishing. | Tycoon2FA Operators | Attackers gained persistent access to victim accounts, increasing risks of business email compromise, espionage, and data theft. | Bleeping Computer |
| May 20, 2026 | GitHub | GitHub confirms TeamPCP hack. | TeamPCP | A limited internal environment was breached, raising concerns about software supply-chain integrity despite no customer impact. | The Record |
| May 21, 2026 | City of Aurora | City loses $1.1 million after employee falls victim to phone scam. | Unknown Scam Operators | Attackers used social engineering to gain access to banking information and fraudulently transfer public funds. | City of Aurora Cyber Attack |
| May 30, 2026 | CBSE Revaluation Portal | CBSE revaluation portal hit by cyber attack. | Unknown | The attack allegedly altered records and disrupted access for approximately 50 students during the review process. | Bleeping Computer |
New Ransomware/Malware Discovered in May 2026
| New Ransomware | Summary |
|---|---|
| BARADAI Ransomware | Newly discovered ransomware identified in May 2026 that encrypts files, appends a unique extension, and drops a ransom note demanding payment for decryption. |
| BAVACAI Ransomware | New MedusaLocker-based ransomware variant first detected on May 5, 2026, combining file encryption with data theft and threatening public leaks within 72 hours. |
| HookedWing | Newly highlighted threat operation added to threat-detection systems in May 2026, using phishing pages impersonating Google, Microsoft, and GitHub to steal credentials and hijack browser sessions. |
Vulnerabilities/Patches Discovered in May 2026
| Date | New Flaws/Fixes | Summary |
|---|---|---|
| May 2, 2026 | CVE-2026-41940 | Researchers reported that attackers had actively exploited a critical cPanel authentication bypass flaw to gain unauthorised root access to vulnerable hosting servers and deploy Sorry ransomware, leading to website encryption, outages, and service disruption across compromised environments. |
| May 4, 2026 | CVE-2026-31431 | Cybersecurity officials said attackers had started exploiting the “Copy Fail” Linux flaw in real-world attacks, allowing local users to tamper with system files in memory and escalate privileges to gain full root access on vulnerable Linux machines. |
| May 4, 2026 | CVE-2026-4670 | Progress Software warned MOVEit Automation customers to urgently patch a critical authentication bypass flaw that could have let unauthenticated attackers gain unauthorised access to exposed file-transfer systems and potentially escalate control if chained with a second privilege-escalation bug. |
| May 8, 2026 | CVE-2026-1340 | CISA ordered U.S. federal agencies to patch a critical Ivanti Endpoint Manager Mobile zero-day within four days after confirming that attackers had been actively exploiting it to gain remote code execution and potentially take over exposed enterprise mobile management systems. |
| May 12, 2026 | CVE-2026-23016 and CVE-2026-23017 | Fortinet warned that critical remote code execution flaws in FortiSandbox and FortiAuthenticator could allow attackers to run malicious code remotely and fully compromise vulnerable enterprise security appliances if left unpatched. |
| May 13, 2026 | CVE-2026-45185 | Researchers disclosed that a critical flaw in the Exim mail server could have allowed unauthenticated attackers to remotely execute malicious code on vulnerable Linux email servers, potentially leading to full server compromise and email data theft if systems were left unpatched. |
| May 14, 2026 | CVE-2026-2588 | Researchers disclosed that the newly discovered Fragnesia flaw in Linux systems could have allowed local attackers to escalate privileges to root access, potentially giving them full control over vulnerable machines and enabling malware deployment or data theft. |
| May 14, 2026 | CVE-2026-4178 | Researchers disclosed that an 18-year-old vulnerability in NGINX could have allowed attackers to trigger denial-of-service conditions and potentially achieve remote code execution on vulnerable web servers through specially crafted requests. |
| May 15, 2026 | CVE-2026-20354 | CISA ordered all U.S. federal agencies to urgently patch a critical Cisco SD-WAN vulnerability after evidence emerged that attackers had actively exploited the flaw to gain unauthorised access to enterprise networking environments. |
| May 24, 2026 | CVE-2026-10956 | Attackers exploited a critical SQL injection flaw in Ghost CMS as part of a large-scale ClickFix campaign, using compromised websites to trick visitors into executing malicious commands that installed malware and stole credentials from infected systems. |
| May 27, 2026 | CVE-2026-26831 | CISA ordered federal agencies to patch an actively exploited cPanel plugin vulnerability within four days after attackers were found abusing the flaw to compromise servers and potentially gain unauthorised access to hosted environments. |
| May 28, 2026 | CVE-2026-28879 | Researchers disclosed a new zero-day vulnerability in Gogs that allowed attackers to achieve remote code execution on vulnerable self-hosted Git service instances, potentially enabling full server compromise and unauthorised access to source code repositories. |
| May 28, 2026 | CVE-2026-48720 | Hackers exploited a critical vulnerability in FortiClient EMS to deploy infostealer malware on compromised systems, allowing attackers to steal credentials, sensitive data, and gain deeper access into targeted enterprise networks. |
Warnings/Advisories/Reports/Analysis
| News Type | Summary |
|---|---|
| Warning | US federal agencies issued a warning that Iran-linked hackers were actively targeting critical infrastructure sectors like water and energy, raising fears of operational disruption and public safety risks if the attacks succeeded. |
| Warning | Australia’s financial regulator warned that banks had fallen behind in managing AI-related cyber risks, saying advanced AI tools could help attackers find vulnerabilities faster and launch larger-scale cyber attacks if stronger controls were not introduced. |
| Warning | The UAE issued a warning that Iran-linked cyber actors had started using artificial intelligence and deepfake tools to scale phishing, malware, and misinformation campaigns, increasing the sophistication and volume of cyber threats targeting critical sectors and the public. |
| Warning | Cybersecurity researchers warned that threat actors had abused Telegram Mini Apps through a fraud platform dubbed FEMITBOT to run fake crypto-investment scams, impersonate major brands, and deliver malicious Android APKs, using Telegram bots and phishing dashboards to trick users into depositing funds or installing malware. |
| Report | Researchers reported that attackers had compromised the official DAEMON Tools installer in a supply-chain attack, silently delivering malware and backdoor access to thousands of users worldwide, with a smaller number of high-value victims later receiving more advanced payloads for deeper system compromise. |
| Report | Researchers reported that a newly discovered Linux malware called Quasar Linux (QLNX) had targeted software developers by stealing credentials, planting stealthy backdoors, and hiding inside development environments to enable long-term access and possible software supply-chain compromises. |
| Warning | Palo Alto Networks issued a warning that attackers had actively exploited a critical zero-day flaw in PAN-OS firewalls, allowing unauthenticated remote code execution and putting internet-exposed enterprise firewalls at immediate risk of full compromise. |
| Warning | Ivanti issued a warning that attackers had actively exploited a newly discovered zero-day flaw in its Endpoint Manager Mobile product, allowing threat actors with admin-level access to run malicious code remotely and potentially take over enterprise mobile management systems. |
| Warning | Australia’s cyber agency issued a warning that attackers were actively using ClickFix social engineering tricks on compromised WordPress sites to spread Vidar Stealer malware, stealing passwords, browser data, and cryptocurrency wallet information from victims who unknowingly ran malicious commands. |
| Report | SecurityWeek reported that AI firm Braintrust disclosed a data breach after hackers accessed one of its AWS accounts, potentially exposing customer API keys and prompting urgent key rotation to prevent unauthorized AI model usage and account abuse. |
| Warning | Škoda warned that hackers had breached its online merchandise shop and accessed customer contact and order information, increasing the risk of phishing scams and fraud attempts against affected buyers, although payment card details were not exposed. |
| Warning | Signal issued a warning and introduced new in-app security alerts and verification prompts to help users detect phishing and social engineering scams after state-linked attackers abused the platform’s linked-device feature to hijack accounts and spy on private chats. |
| Report | BleepingComputer reported that U.S. government officials had requested testimony and detailed information from Instructure regarding the massive Canvas cyber attack, as lawmakers investigated how the breach exposed sensitive student and staff data across thousands of schools and universities. |
| Warning | Cisco issued a warning that a newly discovered critical SD-WAN authentication bypass flaw had been actively exploited in zero-day attacks, allowing threat actors to gain high-level access to vulnerable enterprise network controllers and potentially manipulate network traffic or maintain persistent access. |
| Report | PantherNOW reported that Canvas services were restored after a massive cyber attack linked to ShinyHunters disrupted access for thousands of schools worldwide and exposed data allegedly tied to 275 million users, causing widespread concern over student privacy and academic system security. |
| Warning | The FBI warned that the Silent Ransom Group had carried out in-person social engineering attacks to steal employee credentials and sensitive company data, using tactics such as impersonation and physical access attempts to bypass traditional cybersecurity defences. |
| Warning | The FBI warned that cyber criminals had created fake FIFA-themed websites and ticketing platforms to scam World Cup fans, steal payment information, and trick victims into fraudulent travel, merchandise, and cryptocurrency schemes. |
At Synergy IT Solutions Group, we help organizations strengthen their cyber resilience through comprehensive cybersecurity services, including security assessments, incident response planning, managed security solutions, vulnerability management, cybersecurity training, cloud security consulting, and business continuity planning.
Our team works closely with businesses to build proactive security programs that help prevent attacks, minimize business disruption, and improve overall cyber resilience. In an environment where cyber threats continue to evolve rapidly, taking action today can significantly reduce the likelihood and impact of tomorrow’s cyber incidents.
If your organization is looking to strengthen its cybersecurity posture, improve incident readiness, or reduce operational risk, our experts are here to help.
Schedule your cybersecurity consultation today and discover how to reduce risk, strengthen resilience, and protect your business from evolving cyber threats:
Source : https://www.cm-alliance.com/cybersecurity-blog/biggest-cyber-attacks-data-breaches-ransomware-attacks-of-may-2026
