| Incident | Title | Severity | Category | Platforms | Stage | Commander | Opened | |
|---|---|---|---|---|---|---|---|---|
| INC-2026-0417 | Credential stuffing against RO users | Sev 2 | Third-party (RO) compromise | Client Portal | Contain | F••••• H•••• | Mon 08:10 | |
| INC-2026-0419 | MFA fatigue against compliance officers | Sev 2 | Account compromise | Client Portal | Eradicate | I•••• K•••• | Tue 09:41 | |
| INC-2026-0421 | Macro malware on workstation WS-0571 | Sev 3 | Malware or ransomware | Corporate IT | Recover | T••••• R••••• | Today 07:58 | |
| INC-2026-0414 | Unencrypted export on file share | Sev 3 | Data exposure | AFC OS | Contain | F••••• H•••• | Sun 15:20 | |
| INC-2026-0411 | Look-alike goAML domain registered | Sev 3 | Fraud | Website | Lessons learned | I•••• K•••• | Fri 11:02 |