What Reuters Reported on the 2026 Rise in AI-Driven Cyberattacks

Reuters’ September 4 factbox portrayed a broad 2026 cyber-risk picture: companies were dealing with attacks and ransomware that could expose sensitive information and interrupt business operations. The reporting is useful as a roundup, but it is important not to turn its framing into an attribution for every company on the list. The supplied excerpts do not show that each incident was caused by AI or involved ransomware. 67

The central Reuters finding: AI is changing the cyber-risk environment

Reuters reported that major technology companies, including OpenAI, Anthropic, Microsoft, Alphabet and Amazon, called on August 27 for a broad defensive response to what they described as an approaching wave of AI-driven hacking. Their warning was prospective: they said AI-enabled attacks could become much more widespread as models become more capable. 4

Separate Reuters reporting described practical signs of that shift. Verizon’s annual breach report, as relayed by Reuters in May, found that 31% of more than 31,000 reviewed breaches began with vulnerability exploitation—overtaking stolen credentials—and said attackers were increasingly using AI to find software weaknesses. 12 Reuters also reported that cyber insurers were reassessing how policies define a hack and when coverage applies as AI agents create new questions about autonomous behavior. 3

Those developments explain the alarm, but they do not prove a direct AI role in every corporate incident included in Reuters’ September factbox.

What Reuters said about the White House coordination group

Reuters reported in July that the White House was launching a cybersecurity coordination group bringing together AI developers and critical-infrastructure operators. The stated purpose in the available report was to share information about cybersecurity vulnerabilities identified by AI systems. 2325

The material provided does not identify the group’s members, legal authority, operating rules, launch schedule, or required actions. It is therefore best understood as an announced coordination effort, not a fully specified program.

Company incidents with specific details in the supplied reporting

Nike: investigation after an unverified leak claim

On January 26, Nike said it was investigating a potential cybersecurity incident after the ransomware group World Leaks claimed it had published 1.4 terabytes of Nike business-operation data. Reuters said it could not immediately download or verify the purported data. The key distinction is that the group made the claim; the reported exposure had not been independently verified in the supplied account. 14

Bumble, Match Group, Panera Bread and Crunchbase: reported cyberattacks, limited details

Reuters’ company-page excerpt said Bloomberg News, citing company spokespersons, reported that Bumble, Match Group and Crunchbase had been hit by cyberattacks; Panera Bread appeared in the report’s headline. The excerpts supplied here do not provide attack methods, actors, data categories, disruption, extortion demands or final outcomes for these companies. 8

Novo Nordisk: copied internal information and a temporary shutdown

On June 11, Novo Nordisk said unauthorized actors copied information from its internal IT systems, including limited clinical-trial patient data. The company began an investigation and temporarily shut down certain internal systems, according to the Reuters factbox reproduced in the supplied material. 22

fairlife: U.S. production temporarily suspended

Coca-Cola-owned dairy company fairlife temporarily suspended U.S. production operations on July 17 after a third party gained unauthorized access to parts of its systems, Reuters reported. The supplied excerpt does not identify the third party, the data involved, or whether ransomware or an extortion demand was involved. 25

Abbott Laboratories and Clover Health: investigations and unusual login activity

Also on July 17, Abbott said it was investigating two cybersecurity incidents involving unauthorized access to certain internal systems. Clover Health said it had detected unusual login activity on some systems. The available reporting does not establish the attack method, perpetrator, data impact or outcome for either case. 26

NovoCure: more than 1,400 U.S. patient records exposed

NovoCure said on September 1 that unauthorized access to certain information systems in mid-August exposed internal records of more than 1,400 U.S. patients. Reuters characterized the event as part of a growing number of healthcare-sector cyberattacks. The supplied Reuters excerpt does not name a perpetrator or describe a ransom demand, operational outage, or resolution. 20

What cannot be concluded from the available excerpts

Reuters’ September 4 piece was explicitly a list of U.S. companies that had reported or been affected by cyber incidents during the year. 7 For many names in the broader roundup—including Wynn Resorts, Stryker, Crunchyroll, Hasbro, OpenAI, Rockstar Games, West Pharmaceutical Services, Instructure/Canvas, Blank Rome, Carnival, iRhythm Holdings, AdaptHealth, Fortinet, Levi Strauss, Uber Freight, GE, Fiserv, Apollo Global Management and Boston Scientific—the supplied material does not contain the underlying incident entries needed to verify dates, techniques, threat actors, stolen data, outages, ransom demands, investigations or outcomes.

That limitation matters. A company’s inclusion in a factbox is not, on its own, evidence that it suffered ransomware, that AI was used in the attack, or that a criminal group’s claims were confirmed.

The practical takeaway

The Reuters reporting supports a cautious conclusion: 2026’s cyber threat environment was being shaped by more capable AI tools, faster vulnerability discovery and concern about autonomous agents, while organizations across sectors continued to disclose very different types of security incidents. 3412

For readers assessing an individual company, the most reliable approach is to separate four questions: what the company confirmed, what an alleged attacker claimed, whether the claim was independently verified, and what operational or data impact was actually disclosed. That distinction is especially important when a roundup combines ransomware allegations, unauthorized-access investigations and security-testing incidents under a single broad trend.