SESAME is currently undertaking a phased recovery following a ransomware attack that was detected in the early hours of Monday, 5 October 2026 (having begun late on Sunday, 4 October). The incident caused extensive disruption across the Centre’s IT environment, impacting computing systems, storage and institutional services.
Upon detecting the attack, SESAME immediately initiated a coordinated emergency response. IT systems were isolated and powered down, and the accelerator was safely shut down. An Incident Response Working Group was established, bringing together specialists from the Centre’s computing, data acquisition, control and administrative IT teams.
The attack affected substantial parts of SESAME’s IT environment, including virtual servers, scientific computing resources and backup systems. An isolated primary backup system remained unaffected, providing an important resource for recovery. The cloud-hosted email platform was also unaffected, although account lockouts disrupted access for some users.
SESAME’s incident response team continues to assess the damage, verify backup integrity and restore essential services. The immediate priority is to support the safe resumption of accelerator operations. Recovery work includes rebuilding core infrastructure, strengthening network security and assessing devices before reconnecting them to the new operational environment.
As of 26 October 2026, the team continues to work intensively, day and night, to restore operations. A significant milestone was reached the previous week with the recovery of the core control system functionality required to operate the Microtron, Booster and Storage Ring. Work is now focused on restoring and validating the beamline control systems. Progress is also being made in restoring public IT services, with some services now securely accessible to the public.
SESAME is receiving technical support and guidance from CERN and DESY. Jordan’s National Cyber Security Center has been informed and is providing technical assessment, investigation and advice. The Centre also acknowledges the extensive assistance provided by the private sector, including support outside normal working hours under exceptional circumstances, and recognizes the sustained efforts of its staff and incident response team.
Recovery remains a substantial undertaking. Services will be restored in phases, with security and system integrity guiding each stage. Technical corrective measures are being implemented, assessed and continuously refined as recovery progresses.
SESAME recognizes the disruption experienced by its staff, users and collaborators, and thanks them for their continued patience and cooperation. Further updates will be published as recovery progresses and verified information becomes available.
SESAME’s resilience today reflects the continued support of the international community. In particular, the support provided through the “W.E. HERAEUS Proposal for Resilient Cybersecurity Infrastructure” proved critical: the resulting infrastructure withstood the cyberattack and now serves as the foundation for restoring SESAME’s IT services and operations.
Services will continue to be restored in careful phases, with system security and data integrity guiding every step. SESAME sincerely appreciates the patience, flexibility, and support of its staff, international scientific user community, and global partners during this period. Further operational updates will be published as milestones are verified.