ransomware

13 articles · newest first

A person typing on a laptop keyboard in a dimly lit room with code visible on screen

There's a new group extorting ransomware victims — and it's not the ransomware gang

GuidePoint's threat intel team says the 'recovery firm' emailing breached companies with a $60,000 fix is running the same infrastructure as the original attack.

Priya Nair · 9h ago · 6 min

Industrial factory assembly line representing manufacturing sectors hit by the Windchill breach campaign

Software

Cl0p just named Shell and Philips as ransomware victims — a bug with no login let them in

More than 40 companies have been named so far in a campaign that chains two flaws in PTC's Windchill and FlexPLM software into unauthenticated remote code execution.

Priya Nair · 3d ago · 8 min

Hospital entrance signage, representing the AnMed Health ransomware attack

Software

a ransomware gang hijacked a hospital's Facebook page to brag about what it stole

AnMed Health closed 83 facilities after a July cyberattack. Two weeks later, the hackers posted the proof themselves — from AnMed's own account.

Priya Nair · Aug 16 · 6 min

Rows of medical record file folders, representing the DentaQuest data breach

Software

shinyhunters just leaked 15 million people's dental records because DentaQuest wouldn't pay

The same crew behind the Snowflake and Salesforce mega-breaches just handed the US its biggest healthcare data breach of 2026 — and the number keeps climbing.

Priya Nair · Aug 16 · 6 min

Abstract visualization of interconnected blockchain network nodes

Web3

this ransomware gang can't be shut down the normal way — their servers live on the blockchain now

DeadLock skips throwaway domains entirely. Its victim chat and leak blog run on Polygon smart contracts, and Microsoft says that's exactly why takedown notices don't work on it anymore.

Sam Okafor · Aug 15 · 7 min

IT administrator monitoring network servers on a control room screen

Software

a hacker doesn't need your password anymore to own the tool that protects your whole network

CVE-2026-18577 is what happens when a patch gets patched — China-linked Storm-1175 found a bypass for an already-fixed N-able N-central bug and used it to skip straight to full admin access, no login required.

Priya Nair · Aug 15 · 6 min

A firewall appliance mounted in a server rack, representative of Fortinet FortiOS/FortiProxy edge devices

Software

this ransomware gang doesn't crack your MFA. it just tells the server to say yes

Six government agencies just confirmed a ransomware crew is rewriting authentication files on Fortinet VPN portals so a single fake one-time code logs in every time — MFA included.

Priya Nair · Aug 14 · 6 min

Exterior of a community bank building, illustrating the ransomware attack disclosed by River Financial Corporation

Software

river bank got ransomwared, then did something wild: it trusted the hackers' word

River Financial Corporation says the attackers who breached its network in June have 'represented' that the stolen data was deleted — which is not the same thing as proof.

Priya Nair · Aug 9 · 6 min

Data center backup infrastructure racks, representing the Veeam ONE monitoring platform affected by CVE-2026-64633

Software

the software that's supposed to save you from ransomware just scored a perfect 10

Veeam disclosed six vulnerabilities in Veeam ONE, and the worst one lets a stranger run code on your backup monitoring server with zero credentials — exactly the kind of hole ransomware crews go looking for first.

Priya Nair · Aug 6 · 7 min

Close-up of a circuit board populated with semiconductor chips, the kind of components Analog Devices manufactures

Hardware

a chip maker whose parts are inside your GPU just admitted hackers stole its files

Analog Devices confirmed a June intrusion with data theft; days later, an extortion crew calling itself ExfilSquad — the same group that hit Allstate — claimed 570,000 stolen records.

Ravi Malhotra · Aug 6 · 6 min

Stacks of medical billing paperwork and folders on a desk

Software

A billing company most patients never heard of just leaked 1.26 million people's medical records

Medical Computer Business Services never treated a single patient — it just processed the bill. That was enough for the PEAR ransomware group to walk off with Social Security numbers, diagnoses and 3.3 terabytes of data.

Priya Nair · Aug 4 · 6 min

Exterior of a modern corporate insurance office building

Software

A ransomware gang says it stole 657,000 Allstate records. Allstate still won't say how many

ExfilSquad posted 15.1GB of alleged Allstate data to its leak site on July 26 — recruitment files, licensing records, employee accounts. The insurer has confirmed an incident but not the scope.

Priya Nair · Aug 4 · 6 min

Interior of a large-scale dairy processing and bottling facility

Software

Coca-Cola just confirmed hackers stole its data — the ransom clock said two hours

Fairlife's dairy plants went dark, a group called Anubis claimed a terabyte of files, and Coca-Cola's own filing still won't say what's actually in them.

Priya Nair · Aug 3 · 7 min