Loading story…
A cyberattack disrupted operations at Delta, a Russian provider of alarm and security systems for homes, businesses, and vehicles, causing widespread outages and customer complaints. Delta described the incident as a “large-scale” and “well-organized” external attack, with company leadership claiming it originated from an unspecified hostile foreign state; Delta also said it had no evidence at the time that customers’ personal data had been compromised. As services went down, Delta’s website and phone lines remained offline into the following day, forcing the company to communicate with customers via VKontakte while it worked to restore systems from backups amid concerns about follow-on attacks.
The outage had immediate real-world impact, particularly for users of Delta’s vehicle security features: reports described customers being unable to unlock cars, disable alarms, or use remote start, with some accounts alleging doors locking unexpectedly and even engines shutting down while in motion. Separate reporting noted Delta’s app (launched in 2020) supports tracking vehicle location and stores payment data, increasing customer concern about potential exposure if Delta’s internal systems were breached; however, no threat actor has claimed responsibility and it remains unclear whether the disruption was caused by DDoS or a more destructive intrusion such as ransomware or a wiper.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
On the same day, a separate large-scale outage affected Russian airline and airport booking and check-in systems tied to Sirena-Travel. Authorities said this incident was caused by an internal technical failure rather than a cyberattack.
By 2026-01-27, Delta's website and phone lines were still unavailable, forcing the company to communicate with customers through social platforms. Reports said the outage continued to affect vehicle and building alarm functions across Russia.
After the attack, an unidentified Telegram channel claiming to be behind the intrusion published an alleged archive of stolen Delta data. The authenticity of the archive was not independently verified, and reporting noted uncertainty over whether any customer data was actually exposed.
Following the disruption, Delta said the attack was a coordinated intrusion originating from a hostile foreign state or foreign actor. The company said it was restoring systems from backups while trying to prevent follow-on attacks, and stated it had no evidence that customer personal data had been compromised.
On 2026-01-26, Russian security systems provider Delta was hit by what it described as a large-scale external cyberattack. The incident disrupted smart alarm services for homes, businesses, and vehicles, with customers reporting inability to unlock cars, disable alarms, start engines, and other service failures.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
fortra.com
Open sourcescworld.com
Open sourcenews.risky.biz
Open sourcetherecord.media
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Russian security systems provider **Delta** said it was hit by a cyberattack that disrupted services used in commercial facilities, private homes, and automobiles. Reports said customers experienced widespread failures in vehicle security functions, including cars that would not start, alarms that could not be turned off, and vehicles that could not be opened, while some users were told recovery might require dealer reflashing. At the same time, Delta’s website was unavailable and its phone lines were reportedly unreachable, compounding the outage. The incident drew concern because Delta’s products are used for remote protection and access control, raising the prospect of broad operational disruption for customers. Delta confirmed the cyberattack to Russian media, but no actor had been publicly identified, and there was no confirmed evidence of a personal data leak despite customer fears that account or vehicle-related information may have been exposed.
Jun 29, 2026
A cyberattack on **CDK Global** knocked key dealership management systems offline and disrupted operations at thousands of auto dealerships across the United States. Dealers reported being unable to access core functions for sales, financing, service, and vehicle records, forcing many to switch to manual paperwork and delaying transactions. After suffering two related intrusions, CDK also warned customers that threat actors were attempting **social-engineering** attacks against dealerships during the outage, raising concerns that criminals were exploiting the disruption to gain further access or steal information. The outage quickly translated into major financial damage across the automotive retail sector. Industry estimates cited losses that could approach **$1 billion**, reflecting stalled vehicle sales, service delays, and operational backlogs. Separate reporting later said CDK Global was believed to have paid roughly **$25 million** in ransom to the attackers as the company worked to restore systems and stabilize customer operations, underscoring the scale of the incident and its downstream impact on the dealership ecosystem.
Jul 4, 2026
Russian-linked cyber operations hit Ukraine at the outset of the invasion with both destructive malware and a major satellite communications disruption. Security researchers identified the **HermeticWiper** data-wiping malware on hundreds of systems in Ukraine, with additional impacts reported at a Ukrainian financial institution and government contractors in Latvia and Lithuania. The activity coincided with **DDoS** attacks against Ukrainian government entities and PrivatBank, underscoring a coordinated effort to degrade communications and critical services as military operations began. A parallel attack on Viasat’s **KA-SAT** network knocked 40,000 to 45,000 satellite modems offline, many of them permanently, after attackers compromised a VPN-connected management center in Turin and pushed wiper malware through a software update server. Viasat later said the incident unfolded in two stages, with a second wave using compromised modems to flood company systems and complicate recovery; the disruption spilled into Europe, including outages affecting **5,800 Enercon wind turbines in Germany**. U.S. and EU officials attributed the operation to Russian hackers, and the investigation helped support sanctions announced in 2022.
Jun 29, 2026