Vietnam Cyber Watch
Reports since 1 Jan 2026. Not a live feed.
Threat level, Vietnam
Background readingHacktivismIncident response
No public level found
No published national cyber threat level found for Vietnam, checked 7 Nov 2026. The Ministry of Public Security's Department of Cybersecurity and the National Cybersecurity Association issue warnings.
Source: Ministry of Public Security, Department of Cybersecurity
From official agencies
| Date | Agency | Advisory or alert |
|---|
Agency headlines, unedited.
Compare countries
| Country | Threat level | Confirmed | Claimed only | Via a vendor | Latest report |
|---|---|---|---|---|---|
 Malaysia | Medium | 19 | 35 | 7 | 7 Nov 2026 |
 Singapore | None published | 12 | 24 | 3 | 7 Nov 2026 |
 Indonesia | None published | 6 | 32 | 0 | 5 Nov 2026 |
 Thailand | None published | 9 | 33 | 0 | 3 Nov 2026 |
 Philippines | None published | 9 | 35 | 4 | 7 Nov 2026 |
| Vietnam | None published | 5 | 34 | 0 | 5 Nov 2026 |
 Israel | None published | 4 | 2 | 0 | 7 Nov 2026 |
 Iran | None published | 4 | 0 | 0 | 13 Jun 2026 |
 United Arab Emirates | None published | 4 | 4 | 1 | 7 Oct 2026 |
 Saudi Arabia | None published | 2 | 5 | 0 | 12 Oct 2026 |
 Egypt | None published | 1 | 4 | 1 | 29 Oct 2026 |
 South Africa | None published | 8 | 0 | 1 | 26 Oct 2026 |
 Nigeria | None published | 2 | 3 | 0 | 8 Aug 2026 |
 Kenya | None published | 1 | 6 | 0 | 25 Jul 2026 |
 India | None published | 9 | 2 | 1 | 28 Oct 2026 |
 Pakistan | None published | 3 | 3 | 0 | 22 Jul 2026 |
 Bangladesh | None published | 1 | 5 | 0 | 23 Oct 2026 |
 Sri Lanka | None published | 4 | 3 | 1 | 1 Jul 2026 |
 Cambodia | None published | 0 | 3 | 0 | 10 Jun 2026 |
 Myanmar | None published | 1 | 5 | 0 | 25 Oct 2026 |
 Brunei | None published | 0 | 0 | 0 | |
 Poland | BRAVO-CRP | 5 | 0 | 4 | 1 Oct 2026 |
 Ukraine | None published | 7 | 0 | 1 | 4 Nov 2026 |
 Russia | None published | 7 | 0 | 1 | 1 Nov 2026 |
 Czechia | None published | 3 | 0 | 1 | 22 Oct 2026 |
 Romania | None published | 2 | 0 | 0 | 14 Jul 2026 |
 Estonia | None published | 5 | 0 | 3 | 4 Nov 2026 |
 Turkey | None published | 3 | 0 | 1 | 16 Sep 2026 |
 United Kingdom | None published | 5 | 1 | 3 | 2 Nov 2026 |
 Germany | None published | 4 | 0 | 1 | 2 Nov 2026 |
 France | None published | 7 | 0 | 2 | 4 Nov 2026 |
 Netherlands | None published | 5 | 1 | 1 | 2 Nov 2026 |
 Italy | None published | 5 | 0 | 0 | 7 Nov 2026 |
 Spain | None published | 3 | 0 | 0 | 5 Feb 2026 |
 Ireland | None published | 3 | 4 | 0 | 2 Nov 2026 |
 Sweden | None published | 5 | 3 | 2 | 2 Nov 2026 |
 United States | None published | 6 | 0 | 2 | 28 Aug 2026 |
 Canada | None published | 5 | 0 | 1 | 21 Aug 2026 |
 Mexico | None published | 2 | 4 | 1 | 21 Aug 2026 |
 Brazil | None published | 2 | 2 | 0 | 2 Nov 2026 |
 Argentina | None published | 1 | 2 | 0 | 4 Aug 2026 |
 Chile | None published | 1 | 2 | 0 | 2 Nov 2026 |
 Colombia | None published | 1 | 2 | 0 | 4 Nov 2026 |
 Japan | None published | 9 | 0 | 5 | 4 Nov 2026 |
 South Korea | Caution | 6 | 0 | 2 | 29 Oct 2026 |
 China | None published | 0 | 3 | 0 | 7 Aug 2026 |
 Taiwan | None published | 9 | 0 | 2 | 3 Nov 2026 |
 Hong Kong | None published | 3 | 0 | 3 | 30 Oct 2026 |
 Australia | None published | 5 | 0 | 1 | 2 Nov 2026 |
 New Zealand | None published | 7 | 2 | 1 | 3 Sep 2026 |
2026 counts. Click a row to open a country.
Official numbers
| Measure | Value | Period | Source |
|---|---|---|---|
| Cyberattacks on information systems, including critical national systems | more than 500,000 | 2025 | Tuoi Tre (Col. Nguyen Ba Son, A05) |
| Online fraud cases taking property, with losses in the thousands of billions of VND | nearly 1,000 | H1 2026 | Tuoi Tre (Col. Nguyen Ba Son, A05) |
| Data leak, loss and illegal data trading cases detected and handled by police | 40 | H1 2026 | Cong An TP.HCM (A05 report) |
| Bank accounts, e-wallets and payment intermediary accounts flagged for signs of unlawful activity by the SBV monitoring system | more than 668,000 | as of 6 November 2026 | Dan Tri (Col. Nguyen Ba Son, A05) |
| Customer files biometrically matched against chip ID or VNeID (100% of accounts with digital transactions) | more than 178 million | as of 2 October 2026 | Sai Gon Giai Phong (SBV) |
| Individual and organisational customer files biometrically matched | 162.9 million individual, 2.6 million organisational | H1 2026 (reported 2 July 2026) | Vietstock (SBV IT Department) |
| SIMO fraud alerts sent; customers who paused or cancelled; value of those transactions | 5.8 million alerts; about 1.9 million customers; nearly VND 7,200 billion | first year of SIMO operation (reported 7 November 2026) | Sai Gon Giai Phong (SBV) |
| SIMO247 warnings; customers who paused or cancelled; transaction value | about 4.6 million; over 1.5 million; over VND 5,200 billion | as of 29 June 2026 | Vietstock (SBV IT Department) |
| Change in fraud cases | down 52% | 2025 vs 2024 | VTV (C06, Ministry of Public Security) |
| Accounts with fraud signs frozen from VNeID reports | more than 400 | June to October 2026 | VTV (C06, Ministry of Public Security) |
| Personal customer records cleaned through MPS and SBV coordination | over 107.9 million | cumulative to October 2026 | VTV (C06, Ministry of Public Security) |
| Ransomware incidents in Vietnam (vendor figure) | 5 in Q1, 11 in Q2, 15 in Q3 | Q1 to Q3 2026 | Thanh Nien Viet (Viettel Cyber Security report) |
| DDoS attacks recorded by Viettel Anti-DDoS (vendor figure); largest 4.01 Tbps | 1,958,124 | Q3 2026 | IPSIP (Viettel Threat Intelligence) |
| Publicly leaked data incidents and compromised user records (vendor figure) | 536 incidents; over 316 million records | H1 2026 | CafeF (VNPT Cyber Immunity) |
Who is targeting it
| Group | Kind | What it did | Sources | Reports |
|---|---|---|---|---|
| Qilin | Ransomware | Listed Vietnam Airlines in January 2026 and a Vietnamese construction consultancy in June 2026; Viettel names it among double-extortion groups hitting Vietnam in Q3. | ransomware.live · Thanh Nien Viet | Profile |
| The Gentlemen | Ransomware | Listed SASI JSC in January and a Vietnamese firm in June 2026, besides the tracked FPT Software and VUS claims. | ransomware.live Vietnam map | Profile |
| Nova | Ransomware | Listed four Vietnamese organisations between May and July 2026: AMACCAO, Nha Thanh Pho, Digipro and VNSO. | ransomware.live Vietnam map | Profile |
| INC Ransom | Ransomware | Listed Vedan in July and Geleximco in August 2026. | ransomware.live | Profile |
| N0n | Extortion | Posted data from BeLi Teacher, FSC education centers and the GC789 betting network in September 2026, besides the tracked Nam Dinh Vu Port claim. | ransomware.live Vietnam map | Profile |
| Vexy | Ransomware | Listed ZipAI on 5 November 2026 after the tracked Quy Nhon University claim. | ransomware.live | |
| Emperador | Extortion | Claimed EVN Hanoi customer data and offered it for sale in August 2026. | ransomware.live | Profile |
| Black X | Extortion | Claimed millions of FE CREDIT customer records in August 2026. | ransomware.live | |
| Coinbase Cartel | Extortion | Data-theft group without an encryptor that listed Pacific Airlines in January 2026. | ransomware.live | Profile |
| Stormous | Extortion | Claimed 5 TB from TTT Corporation in May 2026 and posted a full dump. | ransomware.live | |
| FEMBOYSec Intelligence Team / KurdFemboys | Hacktivist | Claimed 480,000 Ministry of Health staff records in May 2026. | Hendry Adrian (Dark Web Informer repost) | |
| Mustang Panda | State-aligned | Viettel Threat Intelligence ranked it the most prevalent APT group tracked against Vietnam in Q3 2026, at 72.3% relative prevalence. | IPSIP (Viettel Threat Intelligence) | |
| PXA Stealer ring | Scam syndicate | Vietnamese operators charged in Thanh Hoa in March 2026 for infostealer malware that hit more than 94,000 computers abroad. | Tuoi Tre | |
| Unattributed MOFA intrusion operator | Unattributed | Operator whose exposed toolkit showed admin access to the Ministry of Foreign Affairs sign-on server and probes of MPS and Ministry of Construction systems in September 2026. | InfraHunter |
Laws and rules this year
- 7 Nov 2026Planned 24-hour delay on first-time transfers (from early 2027). SBV officials said banks will from early 2027 let customers set their own limits and hold transfers to a first-time payee for at least 24 hours. Source
- 30 Oct 2026State Securities Commission cybersecurity dispatch. The SSC told securities and fund management firms to prepare incident plans, reset all passwords, review logs and remote access, and flag large or out-of-hours transfers. Source
- 19 Aug 2026Decree 330/2026/ND-CP on cybersecurity and personal data penalties. Administrative fines took effect on issue with no transition period, including VND 30 to 50 million for processing data without consent and VND 50 to 70 million for continuing after an objection. Source
- 1 Jul 2026SBV Circular 77/2025/TT-NHNN biometric rules for business accounts. High-value or above-threshold online transactions by companies require stronger authentication such as face verification of the legal representative. Source
- 1 Jul 2026Cybersecurity Law 2025 (No. 116/2025/QH15) in force. The consolidated Cybersecurity Law took effect and the 2018 Cybersecurity Law ceased to apply; it adds data security as a legal concept, 24-hour takedown duties and a ban on AI deepfake impersonation. Source
- 1 Mar 2026SBV Circular 77/2025/TT-NHNN app security rules. Banking apps must stop and tell the customer why when they detect debugging, emulators, hooking, repackaging, rooted or jailbroken devices. Source
- 5 Jan 2026SBV Circular 45/2025/TT-NHNN on card issuance. Card issuers must verify biometrics face to face before a bank card can be used for electronic transactions, and credit card cash withdrawals are capped at VND 100 million a month. Source
- 1 Jan 2026Personal Data Protection Law 2025 in force. The Personal Data Protection Law passed on 26 June 2025 took effect, putting personal data rules into a full statute for the first time. Source
- 1 Jan 2026Decree 356/2025/ND-CP replaces Decree 13/2023. The decree guiding the Personal Data Protection Law took effect and replaced Decree 13/2023 on personal data protection. Source
Full stories
Official statements
- 6 Nov 2026A05 deputy director Col. Nguyen Ba Son said more than 668,000 payment accounts showed signs of unlawful activity. Dan Tri
- 5 Nov 2026The foreign ministry says Vietnam is closely monitoring the cyberattacks on supermarket refrigeration systems. Hanoi Online
- 30 Oct 2026The State Securities Commission ordered securities and fund firms to review cybersecurity after attacks affected financial, banking and some securities systems. CafeF
- 22 Oct 2026The Department of Cybersecurity urges organisations running PHP sites to patch PHP2Shell by priority and keep monitoring. VietNamNet
- 22 Oct 2026SBV Deputy Governor Pham Tien Dung warned at Smart Banking 2026 that hackers may target banks' own funds and that banks must monitor security and transactions together. Bao Dau Tu
- 8 Oct 2026C06 said fraud cases fell 52% in 2025 and over 400 fraud accounts reported through VNeID had been frozen since June. VTV
- 24 Sep 2026An A05 report said police handled 40 data leak and data trading cases in the first half of 2026. Cong An TP.HCM
- 21 Sep 2026Provincial police charged a man for collecting and selling about 120 million personal records linked to agencies and businesses. Bao Lao Cai
- 12 Aug 2026Quang Ninh police and A05 dismantled a data trading and fraud ring that took over VND 110 billion. Bao Tin Tuc
- 7 Jul 2026Nghe An police reported seizing over 50 million personal records from a two-person data trading group. aFamily / Tien Phong
- 2 Jul 2026SBV said 100% of accounts with digital transactions were biometrically matched and SIMO247 warnings led 1.5 million customers to stop transfers worth over VND 5,200 billion. Vietstock
- 23 Jun 2026Nghe An provincial police arrested two people on 23 June 2026 who held over 50 million personal records (72.4 GB) of officials, students and business leaders and sold them on Facebook and Telegram. aFamily (from Tien Phong)
- 10 Jun 2026Lam Dong police announced charges against a 16-year-old who allegedly sold 20 million records from the national vaccination system. Viet Nam News
- 22 May 2026VNCERT director Tran Trung Hieu said two ministry-level systems lost millions of user records and warned that leaders may face criminal liability for hidden incidents. VietNamNet
- 24 Mar 2026Thanh Hoa police charged 12 people over PXA Stealer malware that infected more than 94,000 computers worldwide. Tuoi Tre
- 24 Mar 2026Thanh Hoa provincial police charged 12 people on 24 March 2026 for building and spreading PXA Stealer and Adonis malware that infected more than 94,000 computers worldwide. Tuoi Tre / Phap Luat TP.HCM
Incidents
39 of 39 incidents
| What happened | Sources | |||||
|---|---|---|---|---|---|---|
| ⚠️ ClaimedZipAI (zipai.vn) | 5 Nov 2026 | Other | Ransomware | Claimed. Vexy Ransomware listed the Vietnamese AI image and voice service on 5 November 2026. | ransomware.live✓ 7 Nov | |
| ✅ ConfirmedHOCMAI | 1 Nov 2026 | Education | Intrusion | None | Confirmed. Outsiders accessed the system on 30 Oct; contained, users must reset passwords. Claimed. A headline suggests over 7 million accounts were hacked; HOCMAI has not confirmed a figure. | Tap chi An ninh mang✓ 7 Nov |
 ⚠️ ClaimedFPT Software | 31 Oct 2026 | Other | Ransomware | Claimed. Listed on The Gentlemen's leak site; FPT has not commented. | ransomware.live✓ 7 Nov | |
| ⚠️ Claimeddangvuongcac | 21 Oct 2026 | Other | Ransomware | Claimed. Hyflock listed dangvuongcac on its leak site on 21 October 2026. | ransomware.live✓ 7 Nov | |
| ⚠️ ClaimedNam Dinh Vu Port | 12 Oct 2026 | Transport | Ransomware | Claimed. The container terminal operator is listed on N0n's leak site. | ransomware.live✓ 7 Nov | |
 ⚠️ ClaimedVietnam SuperPort | 9 Oct 2026 | Transport | Ransomware | Claimed. The logistics hub is listed on Nightspire's leak site. | ransomware.live✓ 7 Nov | |
 ⚠️ ClaimedMat Bao Corporation | 2 Oct 2026 | Other | Ransomware | Claimed. Rhysida claims about 106.8 GB from the hosting and domain provider. | ransomware.live✓ 7 Nov | |
 ⚠️ ClaimedVUS English Center | 30 Sep 2026 | Education | Ransomware | Claimed. Listed on The Gentlemen's leak site. | ransomware.live✓ 7 Nov | |
| ⚠️ ClaimedMinistry of Foreign Affairs (sso-ingo.mofa.gov.vn) | 21 Sep 2026 | Government | Intrusion | Claimed. Researchers found an exposed attacker toolkit, captured 21 September 2026, with a realm-admin token for the MOFA Keycloak sign-on server plus attempted attacks on Ministry of Public Security mail and a Ministry of Construction portal. | InfraHunter✓ 7 Nov | |
 ⚠️ ClaimedQuy Nhon University | 19 Sep 2026 | Education | Ransomware | Claimed. Listed on Vexy's leak site. | ransomware.live✓ 7 Nov | |
| ⚠️ ClaimedBeLi Teacher / FSC education centers | 18 Sep 2026 | Education | Data leak | Claimed. N0n posted data it said came from the AWS environment of BeLi Teacher and FSC education centers on 18 September 2026. | ransomware.live✓ 7 Nov | |
| ⚠️ ClaimedGC789 betting network (Boundless TE) | 18 Sep 2026 | Other | Data leak | Claimed. N0n listed a Vietnamese betting operator it named as the GC789 network on 18 September 2026. | ransomware.live✓ 7 Nov | |
 ⚠️ ClaimedFE CREDIT | 30 Aug 2026 | Finance | Data leak | Claimed. Black X said it obtained personal information of millions of FE CREDIT customers and threatened to leak it unless contacted (estimated attack 28 August 2026). | ransomware.live · Darkfield✓ 7 Nov | |
 ⚠️ ClaimedSanko Vietnam (sankovn.com) | 26 Aug 2026 | Manufacturing | Ransomware | Claimed. Krybit listed sankovn.com on its leak site on 26 August 2026. | ransomware.live✓ 7 Nov | |
 ⚠️ ClaimedEVN Hanoi Power Corporation (EVNHANOI) | 22 Aug 2026 | Energy | Data leak | Claimed. Emperador claimed over 300 GB including about 13.36 million customer records, 6.99 million subscriptions and 2.26 million account records, offered for sale. | ransomware.live · cyberthreatintelligence.net✓ 7 Nov | |
| ✅ ConfirmedQuang Ninh cross-province data and fraud ring | 12 Aug 2026 | Other | Not disclosed | Confirmed. Quang Ninh police and the A05 department dismantled a ring that bought personal data, posed as bank staff, took over VND 110 billion from thousands of victims and laundered 1.24 million USDT. | Bao Tin Tuc✓ 7 Nov | |
 ⚠️ Claimedl-a.com.vn | 7 Aug 2026 | Other | Ransomware | Claimed. L Group listed l-a.com.vn on its leak site on 7 August 2026. | ransomware.live✓ 7 Nov | |
| ⚠️ ClaimedGeleximco (geleximco.vn) | 4 Aug 2026 | Other | Ransomware | Claimed. INC Ransom listed the conglomerate's domain on 4 August 2026 and claimed 200 GB of data. | ransomware.live✓ 7 Nov | |
 ⚠️ ClaimedVNSO | 22 Jul 2026 | Other | Ransomware | Claimed. Nova listed VNSO on its leak site on 22 July 2026. | ransomware.live✓ 7 Nov | |
 ⚠️ ClaimedVedan Vietnam | 18 Jul 2026 | Manufacturing | Ransomware | Claimed. INC Ransom listed Vedan Corp on its leak site on 18 July 2026. | ransomware.live✓ 7 Nov | |
 ⚠️ ClaimedDigipro | 17 Jul 2026 | Other | Ransomware | Claimed. Nova listed Digipro on its leak site on 17 July 2026. | ransomware.live✓ 7 Nov | |
| ⚠️ ClaimedNha Thanh Pho | 21 Jun 2026 | Other | Ransomware | Claimed. Nova listed Nha Thanh Pho on its leak site on 21 June 2026. | ransomware.live✓ 7 Nov | |
 ⚠️ Claimedutb.edu.vn | 20 Jun 2026 | Education | Ransomware | Claimed. LockBit 5 listed the higher education institution at utb.edu.vn on 20 June 2026, with an estimated attack date of 15 May 2026. | ransomware.live✓ 7 Nov | |
| ⚠️ ClaimedGo2Joy (go2joy.vn) | 20 Jun 2026 | Other | Ransomware | Claimed. RansomEXX said it released the complete database of the hourly hotel booking platform on 20 June 2026. | ransomware.live✓ 7 Nov | |
| ✅ ConfirmedHo Chi Minh City vacation-contract fraud rings | 19 Jun 2026 | Other | Not disclosed | Confirmed. Ho Chi Minh City police announced 11 cases with nearly 200 suspects who bought victims' personal data online and took VND 612 billion through vacation-contract fraud. | Cong An TP.HCM✓ 7 Nov | |
 ⚠️ ClaimedConstruction consulting JSC (name garbled on leak site) | 15 Jun 2026 | Property | Ransomware | Claimed. Qilin listed a Vietnamese general construction consulting joint stock company on 15 June 2026; the tracker shows the name with Vietnamese characters stripped. | ransomware.live✓ 7 Nov | |
 ⚠️ ClaimedHop Long Tech (hoplongtech.com) | 12 Jun 2026 | Other | Ransomware | Claimed. ThreeAM listed hoplongtech.com on its leak site on 12 June 2026. | ransomware.live✓ 7 Nov | |
| ⚠️ ClaimedHansoll Textile (Vietnam) | 8 Jun 2026 | Manufacturing | Ransomware | Claimed. Payload listed Hansoll Textile's Vietnam operation on its leak site on 8 June 2026. | ransomware.live✓ 7 Nov | |
| ✅ ConfirmedNational Vaccination Information System (Ministry of Health, Department of Preventive Medicine) | 5 Jun 2026 | Health | Intrusion | Unnamed 16-year-old student from Nghe An | Confirmed. Lam Dong provincial police charged a Grade 10 student on 5 June 2026 with breaking into the national vaccination system through a security flaw and selling about 20 million personal records for over VND 100 million. | Viet Nam News · Techz (Lam Dong police announcement)✓ 7 Nov |
| ⚠️ ClaimedUnidentified APIS passenger database (Viettel-hosted, Hanoi) | 3 Jun 2026 | Transport | Data leak | Claimed. Kinryu Labs researchers found an open Elasticsearch cluster holding about 220.8 million passenger and crew records from 2017 to April 2026, reported it on 3 June and saw it closed on 8 June; no operator has been named. | eSecurity Planet✓ 7 Nov | |
| ✅ ConfirmedTwo unnamed ministry-level agencies | 22 May 2026 | Government | Data leak | Confirmed. VNCERT director Tran Trung Hieu said on 22 May 2026 that VNCERT was handling a very serious incident in which two ministry-level systems lost millions of user records, undetected by their SOCs. | VietNamNet · Viet Bao (from VietNamNet)✓ 7 Nov | |
 ⚠️ ClaimedAMACCAO | 22 May 2026 | Other | Ransomware | Claimed. Nova listed AMACCAO on its leak site on 22 May 2026. | ransomware.live✓ 7 Nov | |
 ⚠️ ClaimedMinistry of Health of Vietnam | 14 May 2026 | Health | Data leak | Claimed. An actor claimed more than 480,000 records of doctors, nurses and medical staff and published a first batch, threatening to sell the rest. | Hendry Adrian (repost of Dark Web Informer)✓ 7 Nov | |
 ⚠️ ClaimedTTT Corporation (ttt.vn) | 6 May 2026 | Other | Ransomware | Claimed. Stormous claimed about 5 TB of design files, contracts, staff records and building security plans, demanded USD 900,000, and posted a full dump on 13 May 2026. | ransomware.live · ransomware.live (full dump post)✓ 7 Nov | |
| ⚠️ ClaimedVietnam Fortress Tools JSC | 4 Apr 2026 | Manufacturing | Ransomware | Claimed. DragonForce listed the export-focused garden tool maker on its leak site on 4 April 2026. | ransomware.live✓ 7 Nov | |
 ⚠️ ClaimedFindNear | 23 Feb 2026 | Other | Ransomware | Claimed. Cipherforce listed FindNear on its leak site on 23 February 2026. | ransomware.live✓ 7 Nov | |
 ⚠️ ClaimedPacific Airlines | 29 Jan 2026 | Transport | Data leak | Claimed. Coinbase Cartel, a data-theft extortion group, listed the Ho Chi Minh City-based carrier on 29 January 2026. | ransomware.live✓ 7 Nov | |
 ⚠️ ClaimedSASI JSC | 20 Jan 2026 | Other | Ransomware | Claimed. The Gentlemen listed SASI JSC on its leak site on 20 January 2026. | ransomware.live✓ 7 Nov | |
 ⚠️ ClaimedVietnam Airlines | 18 Jan 2026 | Transport | Ransomware | Claimed. Qilin listed Vietnam Airlines on its leak site on 18 January 2026 and threatened to publish data unless the airline negotiated. | ransomware.live · DeXpose✓ 7 Nov |
FAQ
Does Vietnam have a national cyber threat level?
No published national cyber threat level was found for Vietnam (checked 7 Nov 2026). The Ministry of Public Security's Department of Cybersecurity and the National Cybersecurity Association issue warnings.
Which organisations in Vietnam confirmed cyber incidents recently?
5 incidents confirmed since January 2026: HOCMAI, Quang Ninh cross-province data and fraud ring, Ho Chi Minh City vacation-contract fraud rings, National Vaccination Information System (Ministry of Health, Department of Preventive Medicine) and Two unnamed ministry-level agencies.
Which Vietnam organisations appear on ransomware or leak sites?
34 claims, not confirmed by the organisations: ZipAI (zipai.vn), FPT Software, dangvuongcac, Nam Dinh Vu Port, Vietnam SuperPort, Mat Bao Corporation, VUS English Center and Ministry of Foreign Affairs (sso-ingo.mofa.gov.vn) and others.
What counts as a confirmed incident?
The organisation, a regulator, the police or a minister has said something happened, as reported by a named outlet. Everything else is listed as claimed.
Why list leak-site claims at all?
Ransomware and extortion crews post victims on leak sites before anyone confirms. The list shows what attackers say. Treat it as a lead and check with the organisation.
Is the map a live attack feed?
No. It counts incidents and claims reported in 2026. Live attack maps from security vendors show scanning traffic hitting their sensors, which does not mean a place was attacked.
How often is it updated?
By hand when a national level changes or a notable incident is reported. The date is shown in the header.
Sources: official statements and regional press, including Bernama, The Star, Malay Mail, CNN Indonesia and Newsbytes.PH; leak-site claims from public ransomware trackers. Each entry links its source.