Cyberattack knocks International Meteor Organization largely offline, with recovery expected to take several weeks

VoS NEWS DESK | SCIENCE & TECHNOLOGY | 18 September 2026

The International Meteor Organization plays an important role in the international observation of meteors and fireballs. Founded in 1988, the nonprofit brings together amateur and professional observers and maintains a large collection of meteor observations, including reports, photographs and video material. Its information is used by researchers and astronomy enthusiasts around the world.

The organisation recently reported that it had experienced a cyberattack that significantly affected its ageing infrastructure. Much of its website has been taken offline, leaving visitors with a simplified holding page while the organisation works on moving its services to new infrastructure. The IMO has warned that some services could remain unavailable for several weeks during the transition.

One of the organisation's immediate priorities has been restoring its fireball reporting system. Fireballs are exceptionally bright meteors that can be observed across large areas of the sky, and reports from observers help scientists document and analyse these events. The IMO has managed to restore this reporting function while other parts of its online infrastructure remain affected.

The incident has created difficulties for a scientific community that relies on the organisation's online resources to submit observations and access historical material. The IMO's databases contain extensive information collected over many years, including written observations, photographs and videos. Much of the material is publicly available, but the database remains an important resource for people studying meteor activity.

The organisation has not publicly disclosed exactly when the attackers entered its systems or how the intrusion was carried out. It has also not confirmed that data was stolen or encrypted. As of the latest reports, no group had publicly claimed responsibility for the attack and no known ransom demand had been reported. These unanswered questions mean that the full impact of the incident remains unclear while the organisation continues rebuilding its infrastructure.

The incident highlights a wider cybersecurity issue facing scientific organisations. Research institutions and scientific groups increasingly depend on websites, databases, cloud services and digital communication systems, even when their primary purpose is not commercial. Disruption to these systems can affect international research communities even when there is no immediate evidence of sensitive commercial information being targeted.

The IMO's situation is particularly notable because the organisation is a volunteer-run scientific body rather than a major government agency or large technology company. Its infrastructure was described as ageing, making the need to transition to new systems part of the organisation's recovery effort following the attack.

The cyberattack also comes shortly before the organisation's annual International Meteor Conference, scheduled to take place in Barcelonnette, France, later this month. The conference is expected to bring together participants interested in meteor observation and research, with remote participation also available.

There have been other cyber incidents affecting scientific and astronomy-related organisations in recent years. Ars Technica reported that a 2022 cyberattack disrupted the Atacama Large Millimeter/submillimeter Array in Chile, while the US National Science Foundation's NOIRLab facilities were targeted in 2023. These incidents demonstrate that scientific infrastructure can also become part of the broader cybersecurity threat environment.

However, there is currently no evidence publicly establishing that the IMO attack is connected to those earlier incidents or that it was carried out by the same individuals or group. The identity and motivation of the attackers remain undisclosed.

The organisation is now rebuilding its online infrastructure and restoring services progressively. Its decision to prioritise fireball reporting allows observers to continue submitting important observations while other services remain unavailable. The recovery process is expected to take several weeks, according to the organisation's own warning.

For the wider scientific community, the incident demonstrates how even relatively small international organisations can depend heavily on reliable digital infrastructure. A disruption lasting several weeks can affect data collection, communication and access to historical research material, particularly when an organisation serves contributors and researchers across multiple countries.

VoS STRATEGIC INSIGHT

The International Meteor Organization cyberattack illustrates that scientific data and research infrastructure are also part of the modern cybersecurity landscape. Although the organisation does not appear to have been targeted for a publicly disclosed commercial or financial motive, the disruption demonstrates how a cyber incident can interrupt international scientific collaboration.

The most significant unanswered questions concern the method of intrusion, whether any information was accessed or removed, and who was responsible. At present, the IMO has not publicly provided those details, so conclusions about the attackers' motive or the extent of any data compromise would be premature.

The recovery effort will now depend on the organisation's ability to migrate its services safely, restore its databases and maintain essential observation systems during the transition. The incident also underlines the importance of modernising ageing digital infrastructure and maintaining resilient backup and recovery systems, particularly for organisations whose data contributes to international scientific research.

Source: International Meteor Organization • Ars Technica • SOFX.