What actually happened to websites.
With sources, in one place.

GMO Cybersecurity by Ierae announced that ARTEX, a penetration-testing tool in which AI investigates and tests on its own, was used on attack servers behind a series of intrusions. The one server examined had about 20 Japanese companies as targets (9 of them in the same industry), and 6 more similar attack servers using AI were found. Of the targets, 8 companies disclosed data leaks in September–October (being a target does not mean every company was breached). CrowdStrike reported that the same tool was used in attacks on South Korean financial institutions. The tool had been public; publication has since stopped.

The entry weakness has not been disclosed. In a separate article (Oct 15), GMO notes that cyber attackers use AI to look for weaknesses in end-of-support products and in versions not listed in the vulnerability catalog (CVE). It is shown here as the same kind of finding.

Arcadia Inc. announced that SpeeCAN RAIDEN, a bulk-messaging service used by municipalities across Japan for disaster-alert email and similar services, was accessed by a third party without authorization. The data that may have leaked is estimated at about 3,136,000 email addresses, about 105,000 phone numbers and about 15,000 fax numbers. Yokosuka City said the email addresses of 47,065 disaster-alert subscribers and others may have leaked and that subscribers were already receiving suspicious email, and it stopped four services. The same company also announced a possible leak of users’ names, dates of birth, addresses and more from its emergency 119 reporting service (NET119).

This was an incident at a contractor’s service, not the municipalities’ own websites. The method of intrusion has not been disclosed, and no link to the attack AI agent (ARTEX) has been announced.

On an event application form for a program the city outsourced, the contractor set the viewing settings incorrectly, so applicants could see what other applicants had entered. The names, school grades, phone and fax numbers, email addresses and reasons for applying of 40 people were affected. An applicant reported it on October 14, and the contractor fixed the setting the same day.

The cause was not encryption (https), but it is an example of form input being seen by others.

On July 14, the city’s digital archive site “Dejimachi” was accessed through a system vulnerability, and some pages were altered into pages leading to online casino sites. It was found on August 28 after an outside report. The city disconnected the system from the network, stopped the service and is investigating.

Of the 69 links to local community councils on the Scottish Borders Council website, 16 led to offshore online gambling sites. Fifteen of the 16 had been hosted on a third-party directory that became unresponsive about eight years earlier, and the old links had stayed on the site. After a BBC Scotland report, the council removed all affected links.

On a rental server the university contracts, a vulnerability in “JCE,” a Joomla extension used by one site, was used in early June to place a web shell (a program for controlling the server from outside). It is believed to have spread to other sites on the same server by late July; unauthorized accounts and SEO spam were found. The university suspended multiple sites on that server.

The Australian Cyber Security Centre (ACSC) warned of an ongoing global campaign using weaknesses in website content management systems (CMS) and their plugins. Files for remote control (webshells) have been placed on many small and mid-sized business websites. The campaign covers 17 weaknesses in WordPress plugins, Craft CMS, Joomla's JCE and others; fixes exist for all of them, some released many months earlier.

Individual businesses were not named.

A vulnerability in a tool used for the “virtual tour” on the university website was used so that some pages forwarded visitors to unrelated external sites. It was found on June 12. The university states that no personal or confidential information was leaked.

A vulnerability in the software used for the “virtual campus tour” on the university website was used to create malicious URLs that appeared in search results, so content unrelated to the university was shown under its domain. It was found on June 17. The university states that there was no intrusion into its servers, no altered files, and no leak of personal or confidential information.

The Ministry warned about fake email posing as municipal tax offices (e.g. “City Hall, Resident Tax Division”) and urging residents to pay resident tax by QR-code payment. Of 862 .lg.jp organizations (prefectures, cities and wards), only 16 (1.9%) set DMARC to quarantine or reject fake email (survey published March 2026).

UK telecom company Virgin Media O2 warned that search engines and AI tools can show fake customer service numbers. In its research, 13% of Brits (about 1 in 8) had been shown a fake customer service number via search engines or AI tools, and 10% rely on numbers generated by AI tools. The company said it has dealt with fraud cases where customers called such numbers and were scammed. It advises using only numbers listed on official company websites, apps or bills.

The city published a list of 5 domains of its closed sites that had been taken over by third parties, warning that they are unrelated to the city, may lead to dangerous sites and should not be opened out of curiosity, and asking linking sites to remove the links.

Microsoft reported that phishing emails appearing to be sent internally from organizations' own domains had seen increased use since May 2025. The emails took advantage of complex mail routing and misconfigured spoof protections, and reached a wide variety of organizations across industries; one campaign was used for financial scams against organizations. Microsoft said strict DMARC reject and SPF hard fail policies help prevent this, while a permissive mode does not protect against spoofed messages.

A vulnerability in the library’s website was used to embed malicious scripts in about 100 articles published between March 2016 and February 2025. Visitors between February 6 and November 13, 2025 may have seen suspicious ads or been forced to external sites. The university closed the site, switched to a simple temporary site, and said it would rebuild it with clean copies of the CMS core, theme and plugins.

A server publishing research from the Research Institute for Languages and Cultures of Asia and Africa was accessed through a vulnerability in its content management system (CMS), and some pages were altered to forward visitors to online casino sites. The possible impact period was June 5 to August 8, 2025. The university took the server offline and said it would fix the vulnerability and remove the altered files before reopening.

Through unauthorized access that used a weakness in a monitoring tool, the JavaScript for the payment page was altered. Data of 30,431 cards (29,932 customers) used from July 23 to August 8, 2025 may have leaked, including card numbers, expiry dates and security codes as well as names, addresses, phone numbers and email addresses. Card payments were stopped on August 8.

The source states the cause was altered JavaScript for the payment page. It does not mention CSP.

Users reported that phone numbers shown in Google's AI Overviews led to scammers instead of the company. In the US, a person looking for Royal Caribbean's customer service number called the number shown and was tricked into sharing credit card details. In India, a person searching for Swiggy Instamart's customer care number was given a number, although the company has no phone support, only chat. Google was reported to be aware of the issue and to have taken action against a few numbers it identified.

Security company Netcraft asked an AI model (GPT-4.1 family), in plain language, for the login website of 50 brands in finance, retail, tech and utilities. Of the 97 domains suggested, 66% belonged to the brand, 29% were unregistered, parked or inactive, and 5% belonged to unrelated businesses, so 34% were not brand-owned. In a separate case, the AI search engine Perplexity listed a convincing fake Wells Fargo page as the login link, above the real site.

The Australian Taxation Office said reports of email scams impersonating the ATO had increased by over 300% compared with the same time the year before. It noted that scam reports generally rise at tax time, when people expect to hear from the ATO. The ATO reminded people that it will never send an unsolicited message with a link asking them to return personal information or log into its online services.

The source does not mention sender settings such as DMARC. It is cited as an example of fake email in an organization's name.

South Korea's National Tax Service said it had become harder to tell real messages from fake ones, as hacking emails were being sent even using its own domain (@nts.go.kr). From June 27, 2025, it began a service on its Hometax tax site that lets people check whether an email or text message was really sent by the National Tax Service.

The source does not mention settings such as DMARC. It is cited as an example of fake email using an organization's own domain.

Dantumadiel has used dantumadiel.frl since 2017 but had never registered the similar dantumadiel.nl. When local broadcaster Omrop Fryslân rented the .nl domain, it received 36 emails meant for the municipality within just over a week, including citizen service numbers (BSN), objections and youth-care information. The municipality itself had also sent mail to that address and printed it in eight issues of its bulletin between July 2024 and March 2025. The municipality then bought the .nl domain and redirected it to its official site.

The website was defaced three times and all pages were taken offline for about 36 days; catalog search and reservations were handled by phone. According to the prefecture, there were traces of repeated ID/password attempts (brute force) on the management software, and the latest updates had not been applied to some software. The prefecture apologized for the long disruption.

On Soonchunhyang University's main homepage, a weakness in its server software (WebLogic) was used to place a malicious file. More than 2,000 records, including names, departments, student IDs, addresses and contact details, were taken and posted on social media. A patch Oracle released in October 2017 had not been applied for about six years. Kyungsung University's portal was attacked the same way.

The cart pages of “e-Namu”, a legacy online-shop system more than 10 years old, were attacked, and 122 orderers' personal records leaked from the sites of 17 businesses that used it. Most shops had moved to a newer system, but a few small businesses kept using the old one. Korea's Personal Information Protection Commission fined NHN Commerce 8.7 million won, among other penalties, for neglecting technical support for the legacy system.

The TLS certificate for Elexon’s Insights Solution (data.elexon.co.uk), the main channel for operational data on GB electricity balancing and settlement, was valid until July 8, 2024, and then expired, so browsers showed a certificate warning. API integrations could also stop working. The certificate was renewed around lunchtime on July 9, after about half a day of outage (according to The Register).

The Ministry of the Interior and Safety's directory of official government websites listed 5,826 sites, but a news investigation found 356 would not open, 5 had wrong addresses and 2 were old addresses now held by others. The 2 were or.kr addresses left empty after the institutions moved to go.kr, and they led to an adult goods shop and an illegal gambling site. After the report, the ministry deleted or changed those links.

The FBI, the U.S. Department of State and the NSA jointly warned that North Korean actors known as Kimsuky were exploiting improperly configured DMARC policies to send spoofed email. The emails posed as real journalists, academics and other experts in East Asian affairs. The advisory explains that without properly configured DMARC, spoofed email can be sent as if it came from a legitimate domain, and it recommends setting DMARC to quarantine (p=quarantine) or reject (p=reject).

After two towns merged into Pelt in 2019, the former town's domain overpelt.be was not renewed and passed to unknown owners, who now also control email addresses ending in @overpelt.be; the site now looks like a blog on various topics. The municipality noticed in 2022 and tried to buy it back, without success. A security researcher separately bought 107 expired domains that had belonged to welfare agencies, police zones and similar bodies, to raise awareness.

HMRC said it responded to 207,800 referrals from the public about suspicious contact in the year to January (181,873 the year before). More than 79,000 of them offered bogus tax rebates. Scammers use email, phone calls and texts that mimic government messages to look authentic. HMRC reminded people that it will not email, text or phone to tell them they are due a refund.

The source does not mention sender settings such as DMARC. It is cited as an example of fake email in an organization's name.

The chatbot on Air Canada's website said a bereavement fare could be claimed within 90 days of the ticket being issued, so the customer bought full-fare tickets. In fact, bereavement rates did not apply to completed travel, as explained on another page of the website. The airline argued it could not be held liable for the chatbot's answers, but British Columbia's Civil Resolution Tribunal found the airline did not take reasonable care to ensure its chatbot was accurate and ordered it to pay.

Not a phone number or address case: the AI answer differed from the official page.

A survey by the Dutch government's standards forum (Forum Standaardisatie) found that, of 2,661 domains of central government, municipalities and other public bodies, 81% had a DMARC policy in mid-2023. The report explains that DMARC, DKIM and SPF together prevent email spoofing and make phishing in the name of government organizations harder. It concludes that 19% of the domains still needed a strict DMARC policy to prevent phishing email in the name of government organizations. For municipalities (363 domains), the figure was 90%.

Five domains of discontinued prefectural sites were acquired by third parties through auctions and similar means. The prefecture warned they were unrelated to it and asked linking sites to remove the links.

A fault in an online application service sent 2 residents’ subsidy applications and 3 businesses’ grant applications (personal data of 51 people) to another municipality using the same service. The city apologized and asked for deletion (it states this occurred within a closed inter-government network, with no leak outside).

The cause was not encryption, but it is an example of application data reaching others.

In June–July 2023, two public-facing web servers at a U.S. federal agency were broken into. Both ran outdated versions of Adobe ColdFusion (2016 and an early 2021 release). CISA stated that both servers were running outdated versions of software.

The agency was not named. CISA says there is no evidence confirming that data was taken.

For several months, the commemorative web address printed on about 800,000 Maryland license plates (starspangled200.org) redirected to a site promoting online casinos in the Philippines. The domain originally belonged to a state commission for the commemoration and had changed hands several times since 2016. The Motor Vehicle Administration worked with the state IT department and a domain broker to recover it, and it now redirects to the MVA homepage.

A weakness in the site’s content management system was used to rewrite pages so that visitors were automatically sent to a malicious site. The site was taken down for investigation.

Over a weekend in April 2023, the Starlink satellite internet service had a multi-hour global outage. SpaceX’s Elon Musk posted that it was caused by an expired ground station certificate and that the company was checking the system for other single-point vulnerabilities.

This was a ground station certificate, not a website certificate. It is cited as an example of a service stopping when a certificate expires.

Japan's Ministry of Internal Affairs and Communications, the National Police Agency and the Ministry of Economy, Trade and Industry asked credit card companies to strengthen anti-phishing measures, as phishing emails posing as card companies were frequently leading users to fake sites to steal card numbers. Noting that phishing emails often spoof domain names, they asked companies to add DMARC to all public domains, including ones that send no email, and to run it with a policy that has receivers reject spoofed email.

On a U.S. federal agency's web server, a weakness was used in a component (Telerik UI for ASP.NET AJAX) still running a 2013 version. From November 2022 to early January 2023, multiple cyber attackers placed and ran files on the server. According to the vendor, builds before early 2020 have this weakness.

The agency was not named. In April 2023, a weakness in an old version of the same component was also used at a second agency.

Amazon said that fake order confirmations made up more than 50% of the Amazon impersonation scams reported by its customers. That year it had initiated takedowns of more than 20,000 phishing websites and 10,000 phone numbers. Earlier the same year it implemented email verification technology across more than 20 countries, so that in Gmail, Yahoo! and other common providers the Amazon smile logo icon shows an email is really from Amazon.

The source does not name DMARC. It is cited as an example of a company adopting sender verification.

From midnight on June 1 until 12:04 on June 2, 2022, visitors to the company website (www.gyosei-system.co.jp) saw an error. The cause was an expired SSL certificate. The company apologized and said it would strengthen its management.

On January 14, 2022, about 15 government websites, including the Ministry of Foreign Affairs and the Cabinet of Ministers portal, were defaced and taken offline. Ukraine's CERT said a weakness in October CMS, used to manage the sites, was the likely way in. A fix for that weakness had been released in August 2021.

Malicious code injected into the online store captured the email addresses and passwords of 6,241 people when they logged in, and the name, card number, expiry date and CVV of another 98 people. The store ran on Magento 1.9 and four security patches released by Adobe had not been applied; support for Magento 1 had ended on 30 June 2020. Singapore's Personal Data Protection Commission (PDPC) imposed a financial penalty of S$8,000 and directed the company to upgrade to a supported version within 6 months.

In August 2021, cyber attackers got into the Electoral Commission's Microsoft Exchange server and, until October 2022, could reach the names and home addresses of about 40 million people on the Electoral Register. According to the UK's data protection regulator (ICO), fixes for the weaknesses used had been released in April and May 2021 but had not been applied. Password rules were also inadequate.

The way in was an internet-facing mail server, not the public website. It is shown as an example of internet-facing software left without updates.

On February 15, 2021 (US Pacific time), an issue with updating certificate configurations caused the active TLS certificate in Google Voice’s frontend systems to expire. Devices trying to connect or reconnect could not do so and could not make or receive VoIP calls, for a total of 4 hours 22 minutes. Google apologized and listed steps including more alerts for upcoming certificate expiry and better automated tooling for certificate rotation.

A digital certificate on a system that receives results from a medical lab was not renewed on July 31 and stayed invalid until August 4. Together with a server failure that began on July 25, around 300,000 COVID-19 test results went unprocessed or uncounted. The state's Health and Human Services secretary explained what had happened.

This was a certificate on a data-receiving system, not a public website. It is cited as an example of a system stopping when a certificate expires.

In eight cities across three US states, JavaScript was injected into the payment page of the Click2Gov sites residents use to pay for services such as utilities. Card numbers, CVVs, expiry dates, names and addresses entered there were sent to a remote server. The researchers believe it began around April 10, 2020. Five of the eight cities had also been affected in 2018.

The source states the cause was script injected into the payment page. It does not mention CSP. The source is a security firm's report and does not name the cities.

On the morning of February 3, 2020, Microsoft Teams was unavailable for about three hours. Users trying to sign in saw errors saying an HTTPS connection could not be established. Microsoft said an authentication certificate had expired, and restored the service by deploying an updated certificate.

On October 7, 2019, a third party added unauthorized code to two pages on macys.com: the checkout page and the My Account wallet page. The code captured the names, addresses, phone numbers, email addresses, card numbers, security codes and expiry dates customers typed there. A suspicious connection to another website was noticed on October 15, and the code was removed the same day. Use on mobile devices and the app was not involved.

The source states the cause was unauthorized code added to the pages. It does not mention CSP.

In July 2019, a known weakness in the online store's checkout was used to collect card customers' names, billing addresses, card expiry dates and security codes. According to the forensic investigator, a software patch for the problem had been issued three years before the attack. The site was patched on July 10, 2020, so purchases over about a year were affected. About 320,000 consumers nationwide were affected.

In January 2019, during the US government shutdown, more than 80 TLS certificates used on .gov websites expired and were not renewed (according to Netcraft). Browsers showed warnings on sites of the Department of Justice, NASA, the Court of Appeals and others. The Justice Department site ows2.usdoj.gov, whose certificate expired on December 17, 2018, was on the HSTS preload list, so Chrome and Firefox did not allow users past the warning and the site could not be opened.

From about 1:39 pm to 6:04 pm on December 6, 2018, SoftBank and Y!mobile LTE mobile service was unavailable or hard to use across Japan. Ericsson, the equipment maker, said its initial analysis pointed to an expired certificate in the software, and its CEO apologized. Similar faults were reported at operators in 11 other countries using Ericsson equipment at almost the same time.

This was a certificate inside mobile network equipment, not a website certificate. It is cited as an example of a system stopping when a certificate expires.

From 22 June to 5 September 2018, a cyber attacker got into the company network and edited a JavaScript file on britishairways.com. For 15 days from 21 August, a copy of the card details customers entered was sent to a separate domain controlled by the cyber attacker (BAways.com). The UK Information Commissioner's Office (ICO) said the data of approximately 429,612 people may have been accessed, and issued a £20m penalty in October 2020.

The source states the cause was an edited JavaScript file on the website. It does not mention CSP (the setting that limits which scripts can run). It is cited as an example of input being read by a script running in the page.

A cyber attacker inserted malicious code into the JavaScript of a third-party chat bot that the company had also placed on its payment page. The code collected what customers typed, including names, card numbers, expiry dates and CVV numbers. 9.4 million people in Europe (1.5 million in the UK) were notified as potentially affected. The UK ICO issued a £1.25m penalty in November 2020.

The ICO said the risk of third-party scripts on payment pages was well known, and named measures such as SRI (checking that a script has not been altered) and CSP (setting where scripts may load from). The company confirmed a content security policy was not used before the breach.

On the network of a Turkish telecom operator (Türk Telekom), people trying to download software from official sites such as Avast, CCleaner, Opera and 7-Zip were switched to versions bundled with spyware. The report says this was possible because these sites sent users to unencrypted (HTTP) downloads by default, even where HTTPS was supported. It says hundreds of users in Turkey and Syria were affected.

The source is a report by a research lab (Citizen Lab). It calls for wide use of HTTPS, especially on software download sites.

On 11 February 2018, the JavaScript of a text-to-speech add-on (Browsealoud) loaded by many sites was altered, and code that mined cryptocurrency ran on visitors' devices. More than 4,000 sites were affected, including the UK ICO, NHS trusts and local councils. According to the UK National Cyber Security Centre (NCSC), no money was taken from users, but device performance and battery life may have been affected.

The NCSC advised deciding carefully on third-party JavaScript, and named SRI (checking that a script has not been altered) and CSP (setting where scripts may load from). It noted that several independent researchers wrote that a well-defined CSP would have blocked this attack.