Loading story…
A cyberattack dealt a “critical blow” to the International Meteor Organization’s aging website infrastructure, taking much of the Belgium-based nonprofit’s online services offline. The organization, which coordinates meteor observations, expects partial service disruption for several weeks as it moves to new infrastructure and services.
The IMO restored its fireball-reporting system as a priority and is maintaining meteor and asteroid tracking communications through Facebook while recovery continues. No threat actor has claimed responsibility, and the organization has not disclosed the attack method, motive, full operational impact, or whether any data was accessed or stolen.
See attribution, scope, and your downstream exposure.
2 events from the most recent confirmed update back to the earliest known activity.
During the continuing website disruption, the IMO restored its fireball-reporting system for user submissions and shifted meteor and asteroid tracking communications to Facebook. It said partial service disruption could continue for several weeks while it moved to new infrastructure and services.
The International Meteor Organization said a cyberattack dealt a “critical blow” to its aging infrastructure, taking much of its website offline. The attacker, attack method, motive, extent of impact, and whether data was accessed or stolen were not disclosed.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
2 references tracked. Mallory keeps watching after this page renders.
arstechnica.com
Open sourcetherecord.media
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Belgian hospital **AZ Monica** (campuses in Antwerp and Deurne) shut down all servers after a cyberattack discovered around **06:30** local time, forcing the organization to cancel scheduled care and operate emergency services at reduced capacity. With staff unable to access electronic patient records, the hospital postponed non-urgent consultations and procedures, shifted to paper-based registration, and transferred **seven critical-care patients** to other hospitals as a precaution; reporting also indicates **~70 planned operations were cancelled** and **~70 patients** were sent home. Authorities were notified and a criminal investigation is underway, with the public prosecutor involved and Belgium’s federal police cybercrime unit reported on site. Public reporting has not yet confirmed whether systems were encrypted or whether any ransom/extortion demand was made. Separately, Central Maine Healthcare in the U.S. reported a prior-year breach affecting **145,381** individuals after attackers maintained access for over two months, but that incident is unrelated to the AZ Monica disruption.
Jun 29, 2026
Internet Archive confirmed a breach that exposed data tied to **31 million user accounts** after attackers displayed a malicious JavaScript pop-up on the site announcing the intrusion. According to reporting validated by security researcher Troy Hunt and others, the stolen data dated to September 2024 and included **email addresses, screen names/usernames, bcrypt password hashes, and other system data** from the organization's digital library platform. The disclosure unfolded as Internet Archive was also contending with **intermittent distributed denial-of-service attacks** that disrupted availability and a site defacement linked to a compromised JavaScript library. Founder Brewster Kahle said security upgrades were underway; hacktivist group **BlackMeta** claimed responsibility for the DDoS activity, while the actor behind the underlying data theft was not identified. The breach was later cataloged by Have I Been Pwned as affecting 31 million records.
Jun 29, 2026
Pro-Russian hacktivist group NoName057(16) claimed responsibility for distributed denial-of-service (DDoS) attacks that briefly disrupted the websites of Belgian telecom operators Proximus and Scarlet. The attacks, which occurred on a Wednesday morning, were detected and mitigated quickly by Proximus technicians, resulting in minimal impact. NoName057(16) also claimed to have targeted an internal Telenet portal, but Telenet denied any disruption or compromise. Ghent University Hospital was also affected by a DDoS attack around the same time, though there is no confirmation of a direct link to the telecom incidents. The attacks are part of a broader campaign announced by a coalition of eight hacktivist groups with pro-Russian and pro-Palestinian affiliations, which have threatened to target Belgium’s internet infrastructure with DDoS operations and potential data exposure. While the coalition itself has not issued operational claims or demonstrated verifiable activity, NoName057(16) continues to act independently, maintaining a pattern of targeting Belgian entities. The campaign is expected to persist, with further DDoS attempts and possible claims of data exposure anticipated in the near future.
Jun 29, 2026