#ransomware
#ransomware

Information security

Two US Security Experts Sentenced to Prison for Helping Ransomware Gang

Information security

Two Cybersecurity Professionals Get 4-Year Sentences in BlackCat Ransomware Attacks

Information security

New Research: AI-Driven Cybercrime Led to a 389% Increase in Ransomware Victims

Information security

UK business breach rate stuck at 43%... blame the phishing

Ransomware Responsible for 90% of Manufacturing Cyber Losses

Manufacturing sector faces significant cyber risks, with ransomware causing 90% of financial losses despite being only 12% of claims.

Cyber Insurance Data Gives CISOs New Ammo for Budget Talks

CFOs and boards must understand cybersecurity risks in financial terms, which can be achieved through insurance data and analysis.

Two US Security Experts Sentenced to Prison for Helping Ransomware Gang

Two cybersecurity experts were sentenced to four years in prison for their involvement in ransomware attacks.

Two Cybersecurity Professionals Get 4-Year Sentences in BlackCat Ransomware Attacks

Two cybersecurity professionals were sentenced to four years for facilitating BlackCat ransomware attacks in 2023.

New Research: AI-Driven Cybercrime Led to a 389% Increase in Ransomware Victims

Cybercriminals are using AI to enhance efficiency, leading to fewer brute force attempts and a rise in exploitation and ransomware incidents.

UK business breach rate stuck at 43%... blame the phishing

43% of UK businesses experienced a cyber incident in the past year, primarily due to phishing attacks.

Ransomware Responsible for 90% of Manufacturing Cyber Losses

Manufacturing sector faces significant cyber risks, with ransomware causing 90% of financial losses despite being only 12% of claims.

Cyber Insurance Data Gives CISOs New Ammo for Budget Talks

CFOs and boards must understand cybersecurity risks in financial terms, which can be achieved through insurance data and analysis.

Sandhills Medical Says Ransomware Breach Affects 170,000

Sandhills Medical Foundation experienced a data breach affecting nearly 170,000 individuals due to a ransomware attack discovered on May 8, 2025.

Data Breaches at Healthcare Organizations in Illinois and Texas Affect 600,000

Three US healthcare organizations reported data breaches affecting nearly 600,000 individuals, with significant incidents in Texas and Illinois.

Data Breach at Tennessee Hospital Affects 337,000

Cookeville Regional Medical Center experienced a ransomware attack, compromising data of over 337,000 individuals, including sensitive personal and medical information.

McGraw Hill linked to 13.5M-record data leak

McGraw Hill experienced a data breach exposing 13.5 million records due to a Salesforce misconfiguration, leading to personal information circulating online.

Los Angeles

fromLos Angeles Times

How thousands of sensitive LAPD files got leaked online - and what happens next

A significant data breach exposed sensitive LAPD files and other records, attributed to the hacking group WorldLeaks.

Wynn Resorts Says 21,000 Employees Affected by ShinyHunters Hack

Wynn Resorts confirmed a data breach affecting over 21,000 individuals, with hackers stealing employee data and likely receiving ransom payment.

Sandhills Medical Says Ransomware Breach Affects 170,000

Sandhills Medical Foundation experienced a data breach affecting nearly 170,000 individuals due to a ransomware attack discovered on May 8, 2025.

Data Breaches at Healthcare Organizations in Illinois and Texas Affect 600,000

Three US healthcare organizations reported data breaches affecting nearly 600,000 individuals, with significant incidents in Texas and Illinois.

Data Breach at Tennessee Hospital Affects 337,000

Cookeville Regional Medical Center experienced a ransomware attack, compromising data of over 337,000 individuals, including sensitive personal and medical information.

McGraw Hill linked to 13.5M-record data leak

McGraw Hill experienced a data breach exposing 13.5 million records due to a Salesforce misconfiguration, leading to personal information circulating online.

Los Angeles

fromLos Angeles Times

How thousands of sensitive LAPD files got leaked online - and what happens next

A significant data breach exposed sensitive LAPD files and other records, attributed to the hacking group WorldLeaks.

Wynn Resorts Says 21,000 Employees Affected by ShinyHunters Hack

Wynn Resorts confirmed a data breach affecting over 21,000 individuals, with hackers stealing employee data and likely receiving ransom payment.

more#data-breach

Stolen patient data from Dutch firm ChipSoft destroyed after cyberattack

ChipSoft confirmed that all data stolen in the ransomware attack has been destroyed in a technically sound manner, although the specifics of this process remain undisclosed.

Privacy professionals

Don't pay VECT a ransom - your big files are likely gone

Organizations affected by Trivy and LiteLLM compromises that paid Vect likely received little data recovery, according to Check Point Research.

fromComputerWeekly.com

Vect ransomware actually destructive wiper malware | Computer Weekly

Vect ransomware acts as a data wiper for files over 128KB, making recovery impossible even if a ransom is paid.

3 days ago

Nearly every SME has at least one compromised user

89% of SMEs faced compromised login credentials; AI-driven attacks exploit identity issues and weak authentication.

fromArs Technica

Now, even ransomware is using post-quantum cryptography

Kyber's use of PQC key-exchange algorithms serves more as a marketing tactic than a practical security measure against imminent quantum threats.

fromIT Brew

Asking around: When does ransomware threat intelligence become noise?

Effective threat intelligence requires filtering information relevant to specific market segments to avoid overwhelming alerts.

SystemBC C2 Server Reveals 1,570+ Victims in The Gentlemen Ransomware Operation

The Gentlemen ransomware group uses SystemBC malware to target over 1,570 victims, employing sophisticated tactics for initial access and lateral movement.

#cybercrime

fromTechCrunch

Information security

Ransomware negotiator pleads guilty to helping ransomware gang | TechCrunch

Law

Ransomware Negotiator Pleads Guilty to Aiding BlackCat Attacks in 2023

A ransomware negotiator pleaded guilty to aiding BlackCat ransomware attacks against U.S. companies in 2023.

Information security

German Police Unmask REvil Ransomware Leader

Don't glamorize cybercrims, roast them instead

Cybercrime groups should not be glamorized; they are ordinary individuals using computers for theft, not mythical entities.

Information security

Russian Cybercriminal Gets 2-Year Prison Sentence in US

Russian Hacker Sentenced to 2 Years for TA551 Botnet-Driven Ransomware Attacks

A Russian national was sentenced to two years for managing a botnet used in ransomware attacks against U.S. companies.

fromTechCrunch

Information security

Ransomware negotiator pleads guilty to helping ransomware gang | TechCrunch

Law

Ransomware Negotiator Pleads Guilty to Aiding BlackCat Attacks in 2023

A ransomware negotiator pleaded guilty to aiding BlackCat ransomware attacks against U.S. companies in 2023.

Information security

German Police Unmask REvil Ransomware Leader

Don't glamorize cybercrims, roast them instead

Cybercrime groups should not be glamorized; they are ordinary individuals using computers for theft, not mythical entities.

Information security

Russian Cybercriminal Gets 2-Year Prison Sentence in US

Russian Hacker Sentenced to 2 Years for TA551 Botnet-Driven Ransomware Attacks

A Russian national was sentenced to two years for managing a botnet used in ransomware attacks against U.S. companies.

Adaptavist Group breach: Ransomware crew claims mega-haul

Adaptavist Group is investigating a security breach involving stolen credentials, while a ransomware group claims to have accessed extensive data.

Hackers Abuse QEMU for Defense Evasion

Threat actors are exploiting QEMU for ransomware and remote access tool deployment, with increased activity observed since late 2025.

Autovista blames ransomware for service disruption

"We know that getting this resolved quickly is important to you. Our top priority is to securely restore impacted applications, although we do not have a firm timeline on this yet."

EU data protection

Ransomware scum, other crims exploit 4 old Microsoft bugs

Four Microsoft vulnerabilities are actively exploited, including one from 2012, prompting CISA to urge federal agencies to patch them within two weeks.

ThreatsDay Bulletin: Hybrid P2P Botnet, 13-Year-Old Apache RCE and 18 More Stories

A new variant of the Phorpiex botnet combines traditional and peer-to-peer communication, facilitating sophisticated malware operations and high-volume spam.

Ransomware knocks Dutch healthcare software vendor offline

On April 7, 2026, Z-CERT received notification that ChipSoft has fallen victim to a ransomware attack. Z-CERT is in contact with ChipSoft, healthcare institutions, and our partners. We are working hard to assess the impact of the incident.

Healthcare

Germany news

BKA Identifies REvil Leaders Behind 130 German Ransomware Attacks

Germany's BKA identified Daniil Shchukin and Anatoly Kravchuk as key figures behind the REvil ransomware operation, linked to numerous attacks and significant financial losses.

Toy Giant Hasbro Hit by Cyberattack

Hasbro experienced a cyberattack disrupting operations, prompting an investigation and implementation of business continuity plans.

East Bay (California)

Bay Area city remains paralyzed week after cyberattack

Foster City is experiencing a significant disruption due to a ransomware cyberattack, affecting communication and services for over a week.

Bay Area city paralyzed by cyberattack

A ransomware attack has paralyzed Foster City's government and potentially compromised public data, prompting officials to declare a state of emergency.

Information security

Public Prosecutor's Office launches investigation into Odido hack

4 weeks ago

Toy Giant Hasbro Hit by Cyberattack

Hasbro experienced a cyberattack disrupting operations, prompting an investigation and implementation of business continuity plans.

East Bay (California)

Bay Area city remains paralyzed week after cyberattack

Foster City is experiencing a significant disruption due to a ransomware cyberattack, affecting communication and services for over a week.

Bay Area city paralyzed by cyberattack

A ransomware attack has paralyzed Foster City's government and potentially compromised public data, prompting officials to declare a state of emergency.

Information security

Public Prosecutor's Office launches investigation into Odido hack

Stolen Logins Are Fueling Everything From Ransomware to Nation-State Cyberattacks

Stolen credentials significantly enhance ransomware attacks, enabling illegitimate access and operational disruption within networks.

Tax Search Ads Deliver ScreenConnect Malware Using Huawei Driver to Disable EDR

A malvertising campaign targets U.S. individuals searching for tax documents, delivering rogue installers that blind security programs using BYOVD techniques.

Cohesity embeds Sophos malware scanning in Data Cloud

Cohesity integrates Sophos malware scanning into Data Cloud to detect hidden threats in backup data, enhancing recovery confidence post-cyberattacks.

54 EDR Killers Use BYOVD to Exploit 34 Signed Vulnerable Drivers and Disable Security

Ransomware gangs, especially those with ransomware-as-a-service (RaaS) programs, frequently produce new builds of their encryptors, and ensuring that each new build is reliably undetected can be time-consuming. More importantly, encryptors are inherently very noisy (as they inherently need to modify a large number of files in a short period); making such malware undetected is rather challenging.

Information security

Cisco Firewall Vulnerability Exploited as Zero-Day in Interlock Ransomware Attacks

Cisco firewall vulnerability CVE-2026-20131 was exploited as a zero-day by Interlock cybercrime group since January 26, before the March 4 patch announcement.

Interlock Ransomware Exploits Cisco FMC Zero-Day CVE-2026-20131 for Root Access

Interlock ransomware exploits critical Cisco Secure Firewall vulnerability CVE-2026-20131 as zero-day since January 26, 2026, enabling unauthenticated remote code execution with root privileges.

Hive0163 Uses AI-Assisted Slopoly Malware for Persistent Access in Ransomware Attacks

AI-generated malware Slopoly enables threat actors to develop malware frameworks significantly faster, demonstrating the weaponization of AI for cybercriminal purposes.

CISA Flags SolarWinds, Ivanti, and Workspace One Vulnerabilities as Actively Exploited

CISA added three actively exploited vulnerabilities to its KEV catalog, including critical flaws in SolarWinds Web Help Desk, Omnissa Workspace One UEM, and Ivanti Endpoint Manager, with federal agencies required to patch by mid-to-late March 2026.

US news

Russian Ransomware Operator Pleads Guilty in US

Russian national Evgenii Ptitsyn pleaded guilty to wire fraud conspiracy for his role in the Phobos ransomware operation, facing up to 20 years in prison.

Fake Tech Support Spam Deploys Customized Havoc C2 Across Organizations

Threat actors impersonate IT support via email and phone calls to deliver Havoc C2 framework for data exfiltration or ransomware attacks across multiple organizations.

Double whammy: Steaelite RAT bundles data theft, ransomware

Steaelite, a new remote access trojan sold on cybercrime networks, enables double extortion attacks on Windows machines through ransomware, data theft, credential stealing, and live surveillance controlled via a centralized browser-based dashboard.

fromDataBreaches.Net

Extorting the Extorters? Moscow man accused of posing as FSB officer to extort Conti ransomware gang - DataBreaches.Net

A Moscow resident was accused of extorting money from the Conti ransomware group by impersonating an FSB officer and threatening criminal prosecution.

#healthcare-cybersecurity

Why cyberattacks don't require advanced hacking

Poor cyber hygiene, weak identity security, overdue IT maintenance, and incomplete logging make organizations vulnerable to financially motivated attacks such as ransomware and email fraud.

Public health

Mississippi Hospital System Closes All Clinics After Ransomware Attack

fromwww.npr.org

Healthcare

Mississippi health system shuts down clinics statewide after ransomware attack

Public health

Mississippi Hospital System Closes All Clinics After Ransomware Attack

fromwww.npr.org

more#healthcare-cybersecurity

Healthcare

Mississippi health system shuts down clinics statewide after ransomware attack

fromFuturism

AI Is Destroying Grocery Supply Chains

Whole Foods shelves sit empty after a data breach shut down its wholesale distributor. Meat packers working for JBS Foods are paralyzed as an $11 million ransomware attack takes out their processing facilities. Some 2.2 million workers at Stop & Shop and Hannaford have their personal data exposed as the result of a cyberattack on parent company Ahold Delhaize USA. These scenarios, straight from a William Gibson novel, are becoming increasingly common in supply chains across the world.

Food & drink

#cve-2026-1731

fromDataBreaches.Net

Information security

Hospitals at Risk of BeyondTrust Ransomware Hacks - DataBreaches.Net

Information security

BeyondTrust Vulnerability Exploited in Ransomware Attacks

fromDataBreaches.Net

Information security

Hospitals at Risk of BeyondTrust Ransomware Hacks - DataBreaches.Net

Information security

BeyondTrust Vulnerability Exploited in Ransomware Attacks

Oklahoma Cheyenne and Arapaho Tribes say ransomware disrupted tribal systems - DataBreaches.Net

Ransomware attack forced Cheyenne and Arapaho Tribes to shut down tribal networks, disrupting communications and suspending some operations while recovery and investigation proceed.

Cyber attackers hide their tracks by exploiting firewalls

Firewall vulnerabilities enabled 90% of ransomware incidents in 2025, with some attacks encrypting data within three hours and old CVE exploits still active.

Polish cops arrest 47-year-old man in Phobos ransomware raid

Polish police arrested a 47-year-old suspected of ties to Phobos after seizing devices containing credentials, payment data, server IPs, and encrypted communications.