What “cyber war” actually means in 2026.

Computer worm that targeted industrial control systems at Iran's Natanz uranium-enrichment facility. Designed to physically degrade gas centrifuges by manipulating PLC code while reporting normal operation to monitoring systems. The first publicly-documented case of a cyber weapon causing physical destruction of industrial equipment. Widely attributed in declassified reporting (Sanger NYT 2012, Kim Zetter's book Countdown to Zero Day) to US + Israeli cooperation under the Olympic Games program. Has not been officially claimed.

Sony Pictures Entertainment compromised by attackers who released ~100 TB of internal data, including unreleased films, executive emails, and employee personal information. Tied by US government attribution to North Korea / DPRK in response to The Interview film. Treasury Department sanctions followed. One of the first major public examples of state-actor reprisal against a US private company over content.

Destructive malware initially disguised as ransomware. Spread via compromised Ukrainian tax-accounting software (M.E.Doc). Caused estimated $10B+ in global damages across Maersk, Merck, FedEx TNT, Mondelez, Reckitt, others. Attributed by US, UK, and other governments to Russia / GRU. The largest documented cyber-attack economic impact to date in public reporting.

Software supply-chain attack inserting malicious code into the Orion network-monitoring product. Backdoored updates pushed to ~18K SolarWinds customers including US federal agencies (Treasury, Commerce, State, DHS, Energy, parts of DoD). Attributed to Russia / SVR. Triggered the Biden administration's 2021 Executive Order 14028 on Improving the Nation's Cybersecurity.

Four zero-day vulnerabilities in on-premises Microsoft Exchange Server exploited at scale by Chinese state-sponsored actors (Microsoft attribution to HAFNIUM). Estimated tens of thousands of organizations compromised before patches were available. FBI subsequently used court order to remove malicious web shells from victim systems in unprecedented active cyber operation on US private infrastructure.

Ransomware attack on the operator of the largest US fuel pipeline. Pipeline shut down for 6 days, causing fuel shortages across the southeastern US. Attributed to DarkSide ransomware group (Russia-based). Colonial paid ~$4.4M ransom; FBI later recovered ~$2.3M of the cryptocurrency. The incident pushed pipeline cybersecurity into federal Transportation Security Administration mandatory directives.

Joint CISA / NSA / FBI / Five Eyes advisory disclosing a China-state-sponsored campaign of pre-positioning in US critical infrastructure (telecommunications, transportation, water, energy) for potential disruptive operations in a future crisis. Subsequent disclosures through 2024-2025 expanded the scope. Different from typical espionage — the publicly stated assessment is that Volt Typhoon is positioning for sabotage, not collection.

China-state-sponsored compromise of US telecommunications carriers (AT&T, Verizon, Lumen confirmed publicly) gaining access to lawful-intercept systems · the same systems used by US law enforcement for court-authorized wiretaps. Considered one of the most consequential US telecommunications intrusions in public reporting. Disclosed by FBI / CISA late 2024.

ALPHV/BlackCat ransomware attack on Change Healthcare, a subsidiary of UnitedHealth Group processing roughly one-third of US healthcare claims. Disrupted billing across thousands of providers. UnitedHealth confirmed payment of $22M ransom. Notification of affected individuals continued through 2024-2025 with estimates exceeding 100M people. The largest US healthcare data breach by individuals affected to date.