The State of Ransomware: October 2026

 1.  Saber Healthcare, an Ohio-based provider of skilled nursing, long-term care and rehabilitation services, disclosed a significant data breach affecting 282,727 individuals. The incident, discovered on July 27, 2026, involved unauthorized access to a company server, putting at risk sensitive personal, medical and financial information. Compromised data may have included names, dates of birth, Social Security numbers, health insurance details, financial account information and identification documents. Although Saber Healthcare reported no evidence of data misuse, the breach raised concerns about identity theft and fraud, particularly given the highly sensitive nature of healthcare records.

2.  The City of McMinnville, Oregon, suffered a ransomware attack claimed by the RansomHouse group, resulting in sensitive government and law enforcement data being published on the dark web. The attack was detected in July 2026, exposed files reportedly containing police investigation records, employee personnel information, internal affairs documents and details identifying crime victims and anonymous informants. The stolen information also reportedly included medical records, addresses, phone numbers and potentially sensitive law enforcement credentials. RansomHouse listed the city on its leak site in early August, with stolen files subsequently released. The city later confirmed that personal information, including Social Security and driver’s license numbers, may have been compromised.

3.  Municipal operations in Vicksburg, Mississippi, were disrupted following a ransomware attack on October 1, 2026, which forced the city to take several computer systems offline. Although emergency services, law enforcement and utilities continued operating, the incident affected administrative functions, including residents’ ability to make in-person utility payments. City officials enlisted outside cybersecurity experts and worked alongside federal authorities, including the FBI and Department of Homeland Security, to investigate the attack and restore affected systems. Concerns also emerged over the potential exposure of sensitive information belonging to residents, employees and business partners, although the extent of any data compromise remained unconfirmed. No ransomware group has publicly claimed responsibility.

4.  Texas-based home health and hospice management company AngMar Management Services fell victim to an apparent ransomware attack in July 2026, exposing the personal and medical records of 126,196 individuals. The incident, discovered on July 20, involved unauthorized access to company systems, with attackers potentially stealing files containing Social Security numbers, medical records, health insurance details, diagnoses, prescription information and patient histories. The Interlock ransomware group claimed responsibility for the attack, listing AngMar on its dark web leak site in August and alleging the theft of 710 GB of data.

5.  Swiss medical technology company Medela became the target of a cyberattack in September 2026, with the ShinyHunters cybercriminal group claiming responsibility for the breach. The group listed Medela on its dark web leak site on September 7, threatening to publish stolen information unless the company responded to its demands. The data was subsequently released, exposing 423,947 accounts belonging primarily to healthcare professionals, Medela employees and business contacts. Compromised information included names, corporate email addresses, job titles, employer details, phone numbers, physical addresses and customer support tickets.

6.  Sensitive medical and financial information belonging to 56,197 individuals was possibly exposed following a cyberattack on Casper Orthopedic Associates, a Wyoming-based healthcare provider. The organization discovered the intrusion on May 23, 2026, when an unauthorized third party gained access to its systems and potentially acquired confidential patient records. The exposed information may have included names, dates of birth, Social Security numbers, driver’s license numbers, financial account details and medical information. Following an investigation involving outside cybersecurity experts, the healthcare provider began notifying affected individuals and introduced additional security safeguards.

7.  French healthcare training and consultancy organization Centre National de l’Expertise Hospitalière (CNEH) was named as a victim by the Kairos ransomware group. Established in 1974, CNEH provides training, expertise and support to healthcare professionals and medical institutions across France. The group listed the organization on its dark web leak site on September 30, claiming to have compromised its systems and obtained sensitive data. Even so, the amount and type of the allegedly stolen information remained undisclosed, and the breach had yet to be independently corroborated.

8.  The BYOD ransomware group claimed responsibility for a cyberattack targeting US telecommunications provider Trump Mobile, publishing the personal information of 3,615 individuals on its dark web leak site. The exposed records reportedly contained names, email addresses, phone numbers, home addresses and customer order details, raising concerns about targeted phishing, identity fraud and impersonation scams. According to the attackers, the breach originated through a compromised employee at Liberty Mobile, a third-party service provider, whose device was allegedly infected with information-stealing malware. The group also claimed that inadequate multi-factor authentication enabled access to Trump Mobile’s systems, although these details were not independently substantiated.

9.  Ukraine’s largest supermarket chain, ATB, confirmed a cyberattack after the DataSuckers hacking group posted a $400,000 ransom demand on the company’s website. The attackers claimed to have stolen sensitive information belonging to 7.9 million customers, including names, phone numbers, email addresses, physical addresses and password hashes, alongside employee passport details and records of more than 11 million orders. A countdown timer accompanying the ransom demand appeared on ATB’s website, which subsequently became unavailable, while several online services were temporarily taken offline. Despite the attackers publishing samples of the allegedly stolen information on Telegram, ATB denied that customer data had been compromised and maintained that its systems remained secure. The group later threatened to sell the stolen database rather than release it publicly.

10.  A ransomware attack targeting the Alabama Board of Nursing disrupted critical licensing services and potentially exposed personal and medical records belonging to nursing professionals. A forensic investigation identified suspicious activity on the Board’s servers in August 2026, with malicious activity continuing until September 1. Although officials took affected systems offline to contain the attack, investigators confirmed that cybercriminals had successfully accessed and downloaded data. Potentially compromised information included names, dates of birth, Social Security numbers, driver’s license details, professional licensing records and medical information. The disruption left approximately 80,000 nurses unable to renew their licenses online, while newly qualified nurses were forced to submit applications manually. The Board worked alongside the FBI and Alabama Law Enforcement Agency to investigate the incident and restore operations.

11.  Croatia’s Ministry of Agriculture, Forestry and Fisheries suffered a significant cyberattack on October 5, 2026, forcing employees to shut down their computers and temporarily disrupting government systems and online services. A crisis response team was established to assess the damage and restore operations, with most services returning online within days. Although the Ministry initially reported that no data had been compromised, it later confirmed unauthorized access to personal information belonging to registered beekeepers, including names, identification numbers and email addresses. The Barracuda ransomware group subsequently claimed responsibility, alleging that it had stolen 660 GB of sensitive government data and was offering the information for sale for $50,000.

12.  Camden Family Health, a network of community health centers serving West Virginia’s Mountain Lake Region, suffered a cyberattack in July 2026 that potentially exposed confidential patient information. The breach involved unauthorized access to the organization’s computer network, with attackers potentially obtaining confidential records belonging to patients of Camden-on-Gauley Medical Center. Compromised information may have included medical records and health insurance details, raising concerns about patient privacy and the potential misuse of sensitive healthcare data. While the total number of affected individuals remained undisclosed, the incident was reported to the US Department of Health and Human Services’ Office for Civil Rights with an initial estimate of at least 501 individuals. Camden Family Health subsequently secured its systems and launched an investigation to determine the extent of the breach.

13.  US-based tax and financial advisory firm Andersen Group confirmed a cybersecurity incident involving unauthorized access to sensitive client information, with Silent Ransom Group subsequently claiming responsibility for the attack. The group listed Andersen on its dark web leak site, following a social engineering attack that compromised a single employee’s account and allowed unauthorized access to company files. Andersen launched a forensic investigation and notified law enforcement, confirming that the breach affected a limited number of clients but did not disrupt business operations or compromise its wider systems.

14.  German IT services giant T-Systems, a subsidiary of Deutsche Telekom, was targeted by the SafePay ransomware group, which listed the company on its dark web leak site. The attackers threatened to publish allegedly stolen information unless ransom negotiations began within two days. Deutsche Telekom subsequently confirmed that ransomware had been discovered on a small test system in September but maintained that the affected environment was quickly isolated and cleaned before significant damage occurred. The company acknowledged that some files had been stolen, primarily project presentation slides and system logs, but insisted that no sensitive information was compromised.

15.  The University of Illinois Chicago (UIC) confirmed a ransomware attack targeting its College of Medicine, resulting in the theft of data and temporary disruption to several internal systems. The intrusion, which occurred in August 2026, was claimed by the emerging Booba ransomware group, which alleged that it had stolen 344 GB of information from the university’s servers. While the university confirmed that data had been accessed and stolen, investigators were still determining the full scope of the breach, with concerns surrounding the potential exposure of personal, medical, research and academic information. UIC confirmed that its main university network remained unaffected and that patient care services continued without disruption. The affected systems were subsequently restored, and additional security measures were implemented.

16.  A suspected ransomware attack on Japan’s Osaka Metropolitan University caused widespread disruption, forcing the institution to suspend classes across all faculties and take approximately 500 servers and associated systems offline. The attack severely impacted the university’s core network, encrypting much of its backup data and leaving essential services, including email, digital student IDs, class schedules and assignment submission platforms, inaccessible. The university also launched an investigation into the potential exposure of personal information belonging to at least 130,000 students, graduates and employees, although investigators had not confirmed data theft. Classes were canceled for several days while restoration efforts continued. Authorities had not named a ransomware group, and it remains unclear whether a ransom demand had been issued.

17.  Dubai-based airline FlyDubai was named as a victim by the Everest ransomware group, which claimed to have stolen 4.36 GB of sensitive information, including personal records belonging to 2,862 employees. The group listed the airline on its dark web leak site, threatening to publish the stolen data unless ransom negotiations began within six days. The allegedly compromised information included employee names, identification numbers, job titles and training records, alongside confidential pilot training materials and operational procedures. More concerningly, Everest claimed to have obtained proprietary Boeing software source code, including thousands of files associated with aircraft performance calculations and flight planning. The full extent of the alleged breach were not independently substantiated, with FlyDubai yet to publicly confirm the incident.

18.  Japanese electronics manufacturer Ikegami Tsushinki was forced to postpone the publication of its interim financial results following a cyberattack that disrupted internal systems and potentially exposed confidential corporate information. The incident involved unauthorized access to company servers, prompting the manufacturer to shut down its main internal systems and isolate accounting servers to prevent further damage. In October, Ikegami confirmed that information apparently belonging to the company had appeared on a dark web leak site, raising concerns about data theft and extortion. The disruption significantly affected financial reporting processes, delaying the company’s accounting procedures and external audit review. While the nature and volume of the exposed information remained under investigation, Ikegami warned that restoring its systems would take time, with no confirmed date for the publication of its financial results.

19.  Patient care at Green Clinic, a healthcare provider based in Ruston, Louisiana, was severely disrupted following a suspected cyberattack. The incident left medical staff unable to access electronic patient records, appointment schedules and contact information, forcing some doctors to cancel consultations while others resorted to paper-based documentation. Reports suggested that the Wallstreet cybercriminal group may have been involved, with sources claiming the attackers had contacted the clinic electronically. Nevertheless, neither the group’s involvement nor a ransom demand was independently verified. Green Clinic, which operates under Allegiance Health Management, remained open throughout the disruption, although the impact on its wider network of facilities was unclear.

20.  Springfield Public Schools in Massachusetts suffered a major ransomware attack in September 2026, forcing schools to close for several days and disrupting access to critical systems, including email, computers and student medical records. The attack, attributed by federal investigators to the Interlock ransomware group, resulted in the theft of sensitive information belonging to current and former employees, students, retirees, volunteers and contractors, with some records dating back more than two decades. In October, investigators revealed that the breach was more extensive than initially believed, with Social Security numbers, medical information, student disciplinary records and other personal data possibly exposed. Stolen district files were also published on the dark web, despite reports that the district refused to pay the ransom demand. Springfield Public Schools subsequently expanded its identity protection services and continued restoring more than 20,000 affected devices.

21.  Irish animal feed manufacturer Corby Rock Mill, based in County Monaghan, suffered a significant cyberattack that severely disrupted production and left its computer systems inoperable. The incident forced the company to rely on telephone calls and WhatsApp messages for communication, while its poultry feed mill operated at reduced capacity and its ruminant feed facility remained shut down. Other feed suppliers reportedly stepped in to fulfill orders, raising concerns about potential disruption to Ireland’s agricultural supply chain, particularly as Corby Rock is one of only two producers of specialized chicken feed on the island. The Qilin ransomware group claimed responsibility for the attack, listing the company on its dark web leak site in early October. Corby Rock declined to confirm the nature of the incident.

22.  Canadian Mennonite University (CMU), based in Winnipeg, suffered a cyberattack that exposed sensitive personal and financial information belonging to thousands of current and former students and employees. The breach involved unauthorized access to university systems, with attackers stealing tax documents, employment records and student information dating back more than a decade. Compromised data included names, home addresses, Social Insurance Numbers, dates of birth, earnings information and tuition records, placing affected individuals at risk of identity theft and financial fraud. The DragonForce ransomware group subsequently claimed responsibility, listing the university on its dark web leak site. While CMU confirmed that information had been stolen, it did not publicly attribute the attack to the group. The university launched an investigation, notified law enforcement and offered affected individuals two years of complimentary credit monitoring services.

23.  A ransomware attack targeting IDC Frontier, a subsidiary of Japanese telecommunications giant SoftBank, caused widespread disruption across 495 companies and local government organizations. The attack compromised the company’s corporate cloud service infrastructure, triggering outages that extended far beyond its own operations. Among those affected were the Ibaraki Prefectural Government and police headquarters, whose official websites became inaccessible, while a subsidiary of seafood giant Nissui was forced to suspend inbound and outbound shipments across all 17 of its logistics facilities nationwide. Used car sales platform Auto Server also experienced service disruptions. IDC Frontier shut down affected systems to contain the attack and prevent further damage while investigating the possibility of data theft. No ransomware group has publicly claimed responsibility for the attack.

24.  The City of Big Spring, Texas, experienced a significant network disruption affecting municipal systems and temporarily preventing residents from making electronic utility payments. The incident forced officials to suspend online payment services, waive late fees and introduce alternative payment arrangements while outside cybersecurity experts investigated the disruption. The Booba ransomware group claimed responsibility for an attack on the city, alleging that it had stolen 151 GB of government administrative data. Even so, the group’s claims were not independently substantiated, and city officials had not confirmed whether sensitive information had been compromised. The city took steps to secure its systems and restore affected services while continuing to investigate the incident.

25.  Connecticut-based orthopedic practice Comprehensive Orthopaedics & Musculoskeletal Care disclosed a data breach affecting 21,897 individuals, after an unauthorized party accessed its network in February 2026. The incident potentially exposed highly confidential patient information, including Social Security numbers, financial account details, payment card information, government-issued identification numbers, medical records and health insurance information. The Crypto24 ransomware group claimed responsibility for the attack, alleging that it had stolen confidential patient data, which was subsequently published on its dark web leak site.

26.  Bacon County Health Services, a nonprofit healthcare organization based in Georgia, disclosed a cyberattack involving the theft of confidential patient information from its computer network. The organization, which operates Bacon County Hospital, Twin Oaks Convalescent Center and a rural health clinic, discovered suspicious activity in July 2026, with investigators confirming that unauthorized individuals had accessed its systems over a 17-day period. The attackers successfully exfiltrated files containing patient information, although the nature of the stolen data and the total number of affected individuals remained undetermined. The incident was reported to the US Department of Health and Human Services’ Office for Civil Rights with an initial estimate of at least 501 individuals affected. While no evidence of data misuse had been identified, Bacon County Health Services warned patients to remain vigilant against identity theft and fraud as investigations continued.

27.  Dutch coffee machine manufacturer Bravilor Bonamat confirmed a cybersecurity incident that disrupted business operations and potentially delayed customer deliveries and payment processing. The company began investigating with outside cybersecurity experts to determine the extent of the attack and contain the damage. The Akira ransomware group subsequently claimed responsibility, listing Bravilor Bonamat on its dark web leak site and alleging the theft of 100 GB of sensitive corporate information. According to the attackers, the stolen data included employee passports, driver’s licenses, customer information, contracts, confidential business documents and non-disclosure agreements.

28.  Desert Orthopaedic Center, an orthopedic medical group operating five locations across Las Vegas and Henderson, Nevada, disclosed a cybersecurity incident that possibly exposed confidential patient information. The unauthorized access, discovered in August 2026, may have resulted in the theft of personal and medical records, including Social Security numbers, medical histories, diagnoses, prescription information, health insurance details and Medicare/Medicaid identification numbers. The healthcare provider began notifying affected patients in October, offering complimentary credit monitoring and identity theft protection services to help mitigate potential risks.

29.  Egypt’s Beni Suef Technological University was named as a victim by the UmBra ransomware group, with the cybercriminals claiming to have stolen approximately 900 GB of data from the institution. The group listed the university on its dark web leak site, threatening to publish the allegedly stolen information unless ransom negotiations began. While the nature of the compromised data remained undisclosed, the potential exposure raised concerns about the security of student records, employee information, academic research and administrative documents. Even so, the university had not publicly confirmed the incident, and neither the alleged breach nor the volume of stolen data had been independently verified.

30.  Pennsylvania-based medical management and billing provider Secure Healthcare Information Management, LLC, disclosed a cybersecurity incident that exposed the personal and medical records of 6,810 individuals. The intrusion, which occurred in July 2026, involved unauthorized access to the company’s network over a ten-day period, potentially allowing cybercriminals to steal confidential patient records. Compromised information included names, dates of birth, Social Security numbers, driver’s license numbers, medical information and health insurance details. The company began notifying affected individuals in October and offered complimentary identity protection services to help mitigate the risks of identity theft and fraud.

31.  Global fast-food giant KFC was named as a potential ransomware victim after The Gentlemen ransomware group listed the company on its dark web leak site. The attackers threatened to publish allegedly stolen information unless KFC entered ransom negotiations, although no samples of the purportedly compromised data were provided. KFC has not publicly confirmed the incident, and the attackers’ claims were not independently substantiated, with no details available regarding the nature or volume of potentially stolen information.

32.  Saskatoon Tribal Council (STC), a Canadian organization representing seven First Nations in Saskatchewan, disclosed a cybersecurity incident that potentially exposed highly sensitive personal information belonging to members of its community. The attack, identified in August, involved unauthorized access to its network, with possibly exposed information including government-issued identification, health records, child and family service documents, employment records and financial information. The Gentlemen ransomware group claimed responsibility, listing the organization on its dark web leak site in early October, although STC did not publicly attribute the attack to the group. The organization engaged cybersecurity specialists and law enforcement to investigate the breach, with efforts to assess and restore affected systems continuing.

33.  US supermarket chain Winn-Dixie disclosed a data breach involving the exposure of sensitive personal information, including Social Security numbers. The Jacksonville, Florida-based retailer was previously targeted by the Anubis ransomware group, which claimed responsibility for stealing confidential company information in August. The attackers alleged that it had obtained internal corporate documents, sales and revenue figures, store performance data, inventory records and sensitive business intelligence. While the total number of individuals affected remained undisclosed, Winn-Dixie confirmed the exposure of Social Security numbers in its breach notification and offered affected individuals 24 months of complimentary identity protection services.

34.  Global supermarket operator Ahold Delhaize, the parent company of major US grocery chains including Food Lion, Stop & Shop and Hannaford, disclosed a cybersecurity incident that forced it to take several systems offline to contain the threat. The Netherlands-based retail giant, which operates thousands of stores across Europe and the United States, confirmed that the attack affected certain internal systems and disrupted some corporate and operational processes. Despite the disruption, its supermarkets remained open and continued serving customers, although some pharmacies and e-commerce services experienced difficulties. The company engaged outside cybersecurity experts to investigate the incident and restore affected systems while implementing measures to protect its network.

35.  Global money transfer provider MoneyGram was reportedly targeted by The Gentlemen ransomware group, which claimed to have compromised the company’s systems and obtained sensitive information. The alleged attack raised concerns about the security of data held by financial services organizations, particularly those handling international transactions and personal customer information. Even so, the extent of any potential breach remained unclear, and the attackers’ claims could not be independently verified. There was also no confirmed evidence that ransomware had been deployed or that MoneyGram’s money transfer services had been disrupted.

36.  Australian independent school All Souls St Gabriels School, located in Charters Towers, Queensland, reportedly launched an investigation into a cybersecurity incident following claims that it had been targeted by a ransomware group. The school was named in a cybercriminal group’s alleged victim disclosures, putting the focus on possible exposure of sensitive information held by the institution. The extent of the alleged compromise remained unclear, with no independently verified details regarding the volume or nature of any potentially stolen information.

37.  Japanese company Kissei Shoji, a subsidiary of pharmaceutical manufacturer Kissei Pharmaceutical, disclosed a cybersecurity incident in October involving unauthorized access to its systems. The Everest ransomware group subsequently claimed responsibility, listing the company on its dark web leak site and alleging the theft of approximately 323 GB of data comprising more than 278,000 files. The allegedly stolen information included confidential business documents, financial records, manufacturing data, customer information and internal operational files. Kissei Shoji confirmed that it was investigating the potential exposure of sensitive corporate and personal information, working with outside cybersecurity experts to determine the extent of the breach. Even so, the company had not verified Everest’s claims regarding the volume or nature of the stolen data. No significant operational disruption was reported.

38.  Mandurah State Emergency Service (SES), a volunteer emergency response organization in Western Australia, confirmed a cybersecurity incident after The Gentlemen ransomware group listed the organization on its dark web leak site. The attack involved unauthorized access to a server containing historical records dating from before 2022, with the cybercriminal group subsequently publishing stolen information online. The leaked material reportedly included compressed backup files, historical operational records and planning documents. Mandurah SES confirmed that it had been notified of the breach by Western Australia’s Cyber Security Operations Centre and was working with government cybersecurity specialists to investigate the incident. Past and present members potentially affected by the exposure were contacted and provided with guidance on protecting their personal information. Importantly, the organization confirmed that its emergency response operations remained fully operational, with no evidence that other systems had been compromised.

39.  Australian healthcare provider Hunter Neurology, which operates three clinics across New South Wales, launched an investigation after the n0n ransomware group claimed to have stolen confidential patient information. The attackers alleged that it had obtained more than 15,000 patient images and scans, 11,800 medical letters and reports, laboratory results, patient records and four complete weekly backups of the practice’s medical records system. The allegedly compromised information included patient names, dates of birth and confidential clinical data. n0n threatened to publish the stolen information after claiming that its ransom demands had not been met, although it provided no evidence to substantiate the breach. Hunter Neurology confirmed that the allegations appeared to relate to a cybersecurity incident involving a third-party technology provider responsible for hosting and supporting its systems. The practice engaged forensic specialists and notified the Australian Cyber Security Centre while investigating the potential exposure.

40.  Colorado-based electricity provider Sangre de Cristo Electric Association (SDCEA) disclosed a cybersecurity incident after detecting unauthorized activity on its network in September. The intrusion forced the cooperative to shut down affected IT systems, temporarily disrupting customer billing and telephone services. The INC Ransom group claimed responsibility, alleging that it had stolen sensitive customer information, financial records and technical documentation relating to the cooperative’s electrical infrastructure. The group also claimed to possess system credentials, API keys and security configurations associated with electricity distribution systems, threatening further disruption after alleged ransom negotiations broke down. Even so, these claims were not independently substantiated, and SDCEA stated that it had found no evidence of sensitive personal or financial information being misused.

41.  Heber City, Utah, disclosed a cybersecurity incident after attackers gained unauthorized access to its municipal computer systems. The breach raised concerns about the potential exposure of sensitive information held by the local government, including records associated with city administration and public services. Officials began investigating the intrusion and assessing the extent of the compromise, including whether any confidential data had been accessed or stolen. The case underscored the cybersecurity challenges facing smaller municipalities, which rely on interconnected digital systems to deliver essential services and manage residents’ information. Even so, the identity of the attackers, the volume of possibly exposed data and the full operational impact remained unclear.

42.  Burnaby School District in British Columbia, Canada, confirmed that sensitive student and employee information had been stolen during a cyberattack in September. The Qilin ransomware group claimed responsibility for the incident, listing the district on its dark web leak site and alleging the theft of confidential information. The breach involved unauthorized access to district systems, exposing records potentially containing names, contact details, dates of birth, student identification numbers, registration documents and sensitive information relating to specialized learning support, including some medical diagnoses. The attack disrupted internal network services, school websites, telephone systems and online portals, although classroom learning continued. The district engaged cybersecurity specialists, notified law enforcement and British Columbia’s privacy commissioner, and worked to restore affected systems.

43.  Australian electrical equipment manufacturer Chadwick Switchboards was named as a ransomware victim after the Qilin ransomware group claimed responsibility for a cyberattack and published allegedly stolen company data on its dark web leak site. Based in New South Wales, the company manufactures electrical switchboards for a range of industries, including healthcare, telecommunications, retail and defense, with previous projects involving Australian military facilities and police stations. The leaked dataset reportedly contained administrative and financial records, employee folders, product information and directories associated with numerous customers, including childcare centers, nursing homes and law enforcement facilities. The exposed files appeared legitimate, although the full extent of the compromise were not independently substantiated. Chadwick Switchboards had not publicly responded to the allegations, and it had not been confirmed that ransomware encryption had occurred or that business operations had been disrupted.

44.  Kansas-based optometry practice Kannarr Eye Care disclosed a data breach affecting 14,003 individuals after an unauthorized third party gained access to its computer systems. Staff detected the incident in March 2026, and a forensic investigation determining that attackers had accessed or acquired files containing confidential patient information. A review of the compromised data, completed in August, confirmed that the exposed records included patient names, Social Security numbers and health insurance information, potentially placing affected individuals at risk of identity theft and fraud. Kannarr Eye Care notified affected patients in September and reported the breach to the US Department of Health and Human Services’ Office for Civil Rights. The attackers had not been identified.

45.  Mid Florida Dermatology & Plastic Surgery, a healthcare provider operating 33 locations across central Florida, disclosed a data breach affecting 85,585 individuals after an unauthorized party accessed its computer network. The intrusion occurred in March 2026, with attackers gaining access to systems containing confidential patient information over a five-day period. A forensic investigation determined that files containing personal and protected health information may have been viewed or stolen. Potentially compromised data included names, addresses, dates of birth, Social Security numbers, passport details, driver’s license numbers, Medicare information, financial account details, health insurance records and medical information. The types of information exposed varied between individuals. Authorities had not named a ransomware group.

46.  Chicago Vein Institute, a specialist healthcare provider in Illinois, disclosed a cybersecurity incident after its associated organization, Chicago Uptown Medical Center, experienced a network disruption in August. A forensic investigation determined that an unauthorized third party had accessed information stored on its network between July 26 and August 18. The Booba ransomware group subsequently claimed responsibility for the attack, listing Chicago Vein Institute on its dark web leak site and alleging the theft of approximately 3 GB of data. Even so, the nature of the allegedly stolen information remained unclear, and the group’s claims had yet to be independently corroborated. Chicago Uptown Medical Center engaged independent forensic specialists, changed network passwords and reviewed its security policies and procedures.

47.  German industrial services provider Leadec was reportedly targeted by the Anubis ransomware group, which claimed to have stolen approximately 4 TB of sensitive company data. The attackers allegedly demanded an initial ransom payment of $6 million, threatening to release the stolen information if its demands were not met. Leadec, which provides industrial maintenance, engineering and technical services to major manufacturers worldwide, became the subject of extortion claims that raised concerns about the potential exposure of confidential corporate and operational information. The alleged scale of the data theft suggested a potentially significant compromise, although the contents of the dataset and the full extent of the intrusion had yet to be independently corroborated.

48.  Anne Arundel County in Maryland, United States, confirmed a cybersecurity incident after the Rhysida ransomware group claimed to have stolen approximately 2.6 TB of sensitive government data. The group demanded a $2 million ransom, threatening to publish the allegedly stolen files if its demands were not met. County officials detected suspicious network activity in August and subsequently determined that an unauthorized third party had accessed a limited number of government systems and copied files. The county notified federal law enforcement and launched an investigation to determine the scope of the compromised information, including whether residents’ personal data had been exposed. While the data theft was confirmed, officials declined to verify Rhysida’s claims regarding the volume of information stolen.

49.  Colorado County in Texas reported significant disruption to its government information systems, raising concerns about the continuity of essential public services. County officials issued emergency notices warning that the disruption posed an imminent threat to public health and safety, including systems supporting public safety operations. The NightSpire ransomware group subsequently emerged as a potential threat actor after listing a victim identified as “Colorado Texas” on its dark web leak site. Even so, the connection between the group’s claim and the county’s systems disruption remained unconfirmed. County Judge Ty Prause convened emergency meetings to address system restoration, network security, operational continuity and the potential need for external cybersecurity assistance. Officials had not publicly identified the cause of the disruption or confirmed whether sensitive information had been accessed or stolen.

50.  Japanese consumer electronics retailer Joshin Electronics disclosed a cybersecurity incident after detecting unauthorized access to its corporate network. The company, which operates the Joshin chain of electronics stores across Japan, responded by restricting external network access to contain the intrusion, resulting in the temporary suspension of certain services. Joshin engaged outside cybersecurity experts to investigate the attack, determine the extent of the compromise and establish whether sensitive information had been accessed or stolen. Although the company could not rule out the possibility of a personal data breach, it had not confirmed any information theft or disclosed the number of potentially affected individuals. As a precaution, Joshin submitted an initial report to Japan’s Personal Information Protection Commission and committed to notifying affected parties if data exposure was confirmed. Efforts to restore suspended services and strengthen security measures remained ongoing.

51.  Australian accounting and business advisory firm Poole Group disclosed a cybersecurity incident after the LockBit ransomware group claimed responsibility for an attack on its systems. LockBit listed Poole Group on its dark web leak site, threatening to publish allegedly stolen information unless its demands were met. Even so, the group did not disclose the volume or nature of the purportedly stolen data or specify a ransom amount. Poole Group confirmed that the incident had affected part of its IT environment and immediately implemented containment measures while engaging outside cybersecurity experts to investigate the breach. The firm also notified the Office of the Australian Information Commissioner, Australian Cyber Security Centre and Australian Taxation Office. Investigations into the extent of the compromise remained ongoing, with the company committing to notify affected individuals if personal information was found to have been exposed.

52.  Central Ohio Primary Care Physicians (COPC), one of the largest independent physician-owned medical groups in the United States, disclosed a significant data breach affecting approximately 1.4 million current and former patients and employees. The Ohio-based healthcare provider, which operates more than 80 locations, fell victim to a voice phishing attack in August 2026 that allowed cybercriminals to obtain credentials and gain unauthorized access to internal systems. The attackers successfully exfiltrated files containing personal and medical records, including names, addresses, Social Security numbers, financial details and patient health records. The Chaos ransomware group claimed responsibility, listing COPC on its dark web leak site and threatening to publish the stolen information unless its demands were met. Nevertheless, COPC did not publicly confirm the group’s involvement.

53.  Global recruitment software provider Bullhorn confirmed that it was responding to a cybersecurity incident, putting the focus on possible exposure of sensitive information held by its recruitment technology platform. The US-based company provides applicant tracking, customer relationship management and AI-powered recruitment solutions to staffing agencies worldwide, processing substantial volumes of candidate, employee and business information. Following reports that the company had been targeted by cybercriminals, Bullhorn acknowledged the incident and began investigating the extent of the potential compromise. Nevertheless, details regarding the nature of the intrusion, the systems affected and whether customer or candidate information had been accessed remained unclear. The company had not publicly confirmed the involvement of a specific ransomware group or disclosed whether any data had been stolen.

54.  Japanese industrial equipment manufacturer Koike Sanso Kogyo disclosed a cybersecurity incident that disrupted its administrative operations and forced the company to postpone the publication of its interim financial results. The company, which specialises in industrial gas equipment, cutting machinery and welding technology, reported that the attack affected systems required for financial reporting, preventing it from completing its accounts within the originally scheduled timeframe. The case brought attention to the operational impact of cyberattacks on manufacturing businesses, particularly where compromised IT infrastructure supports essential corporate processes. Koike Sanso Kogyo began investigating the disruption and working to restore affected systems while assessing the potential consequences for its business operations. Even so, the company had not publicly confirmed whether sensitive information had been accessed or stolen, and no ransomware group was identified as responsible.

55.  India’s largest lender, State Bank of India (SBI), disclosed a cybersecurity incident involving the exposure of approximately 375,000 records on the dark web. A preliminary investigation identified 3,897 records containing personally identifiable customer information, including names, mobile numbers, dates of birth, email addresses, residential addresses, customer identifiers and loan-related information. The bank was alerted to the suspected breach by cybersecurity authorities and threat intelligence providers, prompting the activation of its incident response and containment procedures. SBI engaged an independent cybersecurity agency to investigate the source and extent of the leak while implementing additional security measures. The bank reassured customers that their account balances remained secure and confirmed that the incident had not materially affected its financial performance, business operations or service availability. Authorities had not named a ransomware group.

56.  Haitian financial institution Capital Bank experienced a cybersecurity incident that disrupted banking operations and temporarily restricted customers’ access to essential financial services. The bank subsequently resumed some services, although its online banking platform remained unavailable as recovery efforts continued. The disruption created difficulties for customers attempting to access their accounts and conduct transactions digitally, highlighting the operational consequences of cyberattacks targeting financial institutions. Capital Bank worked to restore affected systems and maintain access to banking services while addressing the incident. Even so, the full extent of the compromise remained unclear, including whether sensitive customer information had been accessed or stolen.

57.  Jerome School District in Idaho, United States, suffered a ransomware attack that forced the closure of all eight schools for two days after cybercriminals compromised critical infrastructure. The district, which serves approximately 4,000 students, discovered the intrusion after staff reported network problems. Attackers gained control of surveillance cameras, electronic door locks and heating, ventilation and air-conditioning systems, creating significant safety concerns for students and employees. The cybercriminals also accessed student information and threatened to release stolen data unless an undisclosed ransom was paid. Even so, the district believed that most student records had not been compromised, and the full extent of the exposure remained under investigation. Superintendent Brent Johnson confirmed that IT teams were working with cybersecurity specialists and law enforcement to contain the attack, restore affected systems and protect sensitive information.

58.  Richmond Public Schools in Virginia, United States, reported a ransomware attack after cybercriminals compromised its computer network and left a ransom note. The incident prompted the district to investigate the intrusion and assess the potential impact on its IT infrastructure, raising concerns about the security of sensitive student and employee information. Officials worked to contain the attack, determine which systems had been affected and establish whether confidential records had been accessed or stolen. While the discovery of a ransom note indicated an attempted extortion, the extent of any data theft and the attackers’ demands remained unclear. No specific ransomware group was publicly identified, and it had not been confirmed that a ransom had been paid.

59.  Sydney-based architectural visualisation company Virtual Ideas was named as a ransomware victim after the Lamashtu ransomware group claimed responsibility for a cyberattack. The Australian firm specialises in 3D architectural renderings, animations and digital visualisation services for property developers, architects and construction businesses. Lamashtu listed the company on its dark web leak site, alleging that it had compromised its systems and obtained confidential information. The alleged intrusion raised concerns about the potential exposure of commercially sensitive project files, client information and proprietary design materials. Even so, the nature and volume of any stolen data remained unclear, and the attackers’ claims had yet to be independently corroborated.

60.  Australian education provider Campbelltown Anglican Schools Council, which oversees Anglican schools in southwestern Sydney, launched an investigation into a potential cybersecurity incident following claims made by a ransomware group. The organization was reportedly listed on a cybercriminal group’s dark web leak site, raising concerns about the possible exposure of sensitive information relating to students, parents, employees and school administration. The council acknowledged the allegations and began investigating whether its systems had been compromised and whether any confidential information had been accessed or stolen. Even so, the extent of the alleged breach remained unclear, with no independently verified details regarding the volume or nature of any possibly exposed data.

61.  Oneonta City School District in New York, United States, suffered a ransomware attack that forced the cancellation of classes for two days while officials worked to contain the intrusion. The district, which operates five schools serving approximately 1,700 students, initially experienced what appeared to be internal technology problems before identifying unauthorized access to its network. Superintendent Thomas Brindley confirmed that ransomware was responsible, prompting the district’s IT team to implement containment measures and prevent further damage. Local, state and federal authorities launched investigations into the incident as staff worked to restore affected systems and prepare for students to return. While regular classes were suspended, certain regional education programs and scheduled athletic activities continued.

62.  Minnesota-based dental practice Persona Dental disclosed a data breach affecting 3,386 current and former patients after an unauthorized party accessed its computer network. The Sartell-based provider, which specialises in family and cosmetic dentistry, discovered suspicious activity in April 2026, and a forensic investigation confirming that an unauthorized third party had accessed its systems over a three-day period. A review of the affected files determined that confidential patient information had been compromised, including names, dates of birth, diagnosis and treatment details, and health insurance information. Social Security numbers were also exposed for certain individuals, increasing the potential risk of identity theft and fraud. Persona Dental secured its network, introduced additional cybersecurity safeguards and began notifying affected patients in September.

63.  Artistic Smiles, a dental practice in Longmont, Colorado, operated by Lift Dental PLLC, disclosed a data breach affecting 3,735 individuals after an unauthorized party accessed its computer systems. The intrusion occurred in June 2026, when an unauthorized third party gained access to the practice’s network over an eight-day period. A subsequent forensic investigation and data review confirmed that confidential patient information had been exposed, including names, addresses, dates of birth, and medical and dental treatment records. The NightSpire ransomware group claimed responsibility for the incident, listing Artistic Smiles on its dark web data leak site and alleging that it had compromised the organization’s systems.

64.  Italian supermarket giant Coop Italia was named as a potential ransomware victim after the Qilin ransomware group claimed responsibility for a cyberattack and alleged the theft of approximately 250 GB of sensitive information. The organization, which coordinates purchasing, product development and marketing for one of Italy’s largest supermarket networks, was listed on Qilin’s dark web leak site. According to samples shared by the attackers, the allegedly compromised data included corporate agreements, financial and sales reports, internal business documents, project presentations, operational spreadsheets and personal documents. The claims raised concerns about the potential exposure of confidential commercial information and personal data held by the retail consortium. Nevertheless, Coop Italia had not publicly confirmed the incident, and neither the volume nor the contents of the allegedly stolen information had been independently verified.

65.  UltraMobile Imaging, a mobile medical diagnostic services provider based in Rochester, New York, disclosed a data breach affecting approximately 75,000 individuals after a security incident in July 2026. The attack caused a network disruption that affected several computer systems, prompting the company to engage third-party forensic specialists to investigate. The investigation confirmed that an unauthorized third party had gained access to portions of its network, potentially compromising extensive patient information. Exposed data included names, addresses, phone numbers, dates of birth, diagnoses, laboratory results, medication details, medical procedures, physician information, insurance claims and financial account information. The company began notifying affected individuals following its investigation, although complimentary credit monitoring services were not mentioned in its breach notice. The initial date of the intrusion remained unknown, and no ransomware group was publicly identified.

66.  Llano Independent School District in Texas, United States, experienced significant technology disruptions, affecting internet connectivity and telephone services across its schools. The outages interfered with essential communications and administrative functions, prompting district officials to investigate the cause and work towards restoring affected systems. Despite the disruption, schools continued operating while staff implemented alternative arrangements to maintain communication with families and support daily activities. The case brought attention to the resilience of educational infrastructure, particularly where schools depend on interconnected networks for teaching, administration and emergency communications.

67.  Norwegian medical equipment manufacturer Laerdal Medical disclosed a cybersecurity incident after a cyberattack targeting one of its third-party software providers resulted in unauthorized access to employee personal information. The company, which specialises in resuscitation training and medical simulation technology, confirmed that it was investigating the extent of the breach and working to identify affected individuals. Meanwhile, the Everest ransomware group claimed responsibility for an attack against Laerdal, listing the company on its dark web leak site and threatening to publish allegedly stolen information unless its demands were addressed. Nevertheless, Laerdal did not confirm Everest’s involvement or whether ransomware had been deployed. The company stated that there was no indication that customer information, product data, intellectual property or transaction records had been compromised, and customer-facing services remained unaffected. External cybersecurity specialists were engaged to investigate, while relevant authorities were notified.

68.  Magna Hospitality Group, a US-based hotel investment and management company, disclosed a data breach approximately 17 months after the initial network intrusion. The Qilin ransomware group claimed responsibility for the attack, linking the hospitality company to its data extortion activities. Even so, the group’s involvement had yet to be independently corroborated, and it remained unclear whether ransomware had been deployed during the intrusion. The delayed disclosure raised concerns about the length of time potentially affected individuals remained unaware that their personal information may have been compromised. The incident involved unauthorized access to company systems, prompting an investigation into the extent of the breach and the information exposed.

69.  The City of Columbia, South Carolina, confirmed a ransomware attack following a security incident disrupted several municipal online services. City officials acknowledged the attack on October 24, with the disruption affecting residents’ ability to access certain digital services and conduct routine business with local government departments. The incident prompted an investigation involving the South Carolina Law Enforcement Division (SLED), with federal authorities, including the FBI, also involved in the response. Officials worked to assess the extent of the intrusion, secure affected systems and restore services while limiting further disruption to municipal operations. Although ransomware was confirmed, the identity of the group responsible had not been publicly established, and it remained unclear whether sensitive information had been accessed or stolen. Details of any ransom demand were also not confirmed. The attack demonstrated.

70.  Telangana’s TG-iPASS business clearance portal in India suffered a ransomware attack disrupting government services and encrypting data associated with approximately 35,000 companies. Cybercriminals breached the portal on October 22, encrypting records belonging to 28,000 registered businesses and another 7,000 companies seeking trade license renewals. The attack rendered the platform unavailable for approximately 48 hours, preventing businesses from accessing essential regulatory services. Attackers left an email address for communication but did not specify a ransom demand. Initial recovery attempts were unsuccessful, prompting the Telangana government to enlist cybersecurity specialists who eventually decrypted the affected information. Officials confirmed that no data had been lost and announced plans to strengthen firewall protections and restore normal operations. The Telangana Cyber Security Bureau launched a criminal investigation, with authorities suspecting that the attackers may have been operating outside India.

71.  Amagi Media Labs, an India-founded cloud-based broadcasting and advertising technology company, was named as a cyberattack victim after the n0n ransomware group claimed to have stolen internal operational data. The company provides cloud infrastructure and software services to broadcasters, streaming platforms and content distributors worldwide, putting the focus on possible exposure of sensitive business information. The attackers alleged that they had obtained company records, although the precise volume and categories of compromised information remained unclear. The claim had yet to be independently corroborated, and there was no confirmed evidence that customer information had been exposed or that Amagi’s broadcasting and streaming services had experienced disruption.

72.  Chinese electronics manufacturer Hisense was named as an alleged cyberattack victim after the emerging WhiteArmor ransomware and extortion group claimed to have stolen approximately 19 GB of confidential corporate information. The group listed Hisense on its dark web leak site and demanded $5 million in Bitcoin, threatening to publish the allegedly stolen data if its demands were not met. According to WhiteArmor, the compromised information included customer records, warranty claims relating to Malaysia and Singapore, personal identification details, invoices, contracts and information concerning 2,549 suppliers. The attackers also claimed to possess files from Hisense’s internal customer relationship management systems. Nevertheless, Hisense had not publicly confirmed the breach, and the authenticity and extent of the allegedly stolen information were not independently substantiated.

73.  Anheuser-Busch InBev (AB InBev), the global brewing company behind Budweiser, Corona and Stella Artois, was named as an alleged ransomware victim after the Emperador ransomware group claimed to have stolen approximately 3.9 GB of corporate data. The group listed the company on its dark web leak site and reportedly demanded $1 million in Bitcoin. According to the attackers, the compromised information included more than 329,000 social media monitoring alerts, approximately 2,500 corporate emails, 19,000 access logs, internal business service records, digital certificates and files stored in Microsoft Azure. The claims raised concerns about the potential exposure of sensitive corporate information and internal infrastructure details. Nevertheless, AB InBev had not publicly confirmed the breach, and the authenticity of the allegedly stolen data were not independently substantiated.

74.  Global professional services firm PricewaterhouseCoopers (PwC) confirmed a cybersecurity incident involving a third-party vendor responsible for hosting employee learning records. The disclosure followed claims by the Everest ransomware group that it had stolen approximately 590 GB of company data. Everest listed PwC on its dark web leak site, alleging that the compromised information included regional HR records, employee training data, integration documentation, software components and e-learning materials. The group also claimed to possess personal information, including names, email addresses, telephone numbers, physical addresses and employment histories, threatening to release the data if its demands were not met. Nevertheless, PwC did not verify the group’s claims or the alleged volume of stolen information. According to the company, the affected vendor platform did not contain client data, sensitive personal information or financial records.

75.  The University of Copenhagen, Denmark’s oldest university, confirmed a major cybersecurity breach after hackers accessed a test environment containing personal information belonging to approximately 525,000 current and former students, employees and affiliated individuals. The intrusion, detected on October 20, exposed sensitive information including names, Danish national identification numbers (CPR), telephone numbers and email addresses. The university subsequently revealed that access card PIN codes belonging to approximately 20,000 staff and students had also been compromised, prompting temporary restrictions on access to certain campus buildings while replacement codes were issued. Investigators determined that attackers had exploited a configuration error in the test environment, allowing unauthorized access to the database. The university blocked further access, launched an investigation and notified the Danish Data Protection Agency and police. Although some administrative systems experienced precautionary shutdowns, there was no evidence that attackers had accessed core operational systems or confidential research data.

76.  Bathurst RSL Club, a hospitality and community organization in New South Wales, Australia, confirmed a cybersecurity incident after the Qilin ransomware group claimed responsibility for an attack against the organization. Qilin listed the club on its dark web leak site on October 22, publishing approximately 30 documents as evidence of the alleged breach. The exposed samples reportedly included passport scans, passport applications and other personal information believed to relate to club employees. Bathurst RSL CEO Peter Sargent confirmed that the organization had engaged cybersecurity specialists, contained the incident and notified the relevant authorities. He also stated that the club’s gaming and membership management systems were unaffected and that normal operations had continued without disruption. The club began contacting individuals whose personal information was involved but declined to comment on Qilin’s claims.

77.  Cryptocurrency gambling platform Gamdom was targeted in an alleged data extortion attack after the WhiteArmor ransomware group claimed to have compromised sensitive information associated with approximately 15.42 million user accounts. The group demanded $15 million in Bitcoin to prevent the release of the allegedly stolen data, claiming to possess records containing 146 data fields per account. WhiteArmor reportedly published a small sample of the information as evidence of its claims, although the authenticity and full extent of the breach were not independently substantiated. The allegations emerged shortly after Gamdom disclosed a separate cryptocurrency wallet security incident that resulted in losses exceeding $3 million.

78.  Femern Link Contractors (FLC), the international construction consortium responsible for building the Fehmarnbelt tunnel between Denmark and Germany, confirmed a significant cyberattack that disrupted operations and compromised sensitive information. The incident, discovered on October 11, affected internal IT systems, reportedly disrupting site access controls, administrative functions and some construction activities. FLC immediately isolated affected servers and engaged outside cybersecurity experts. On October 27, the company confirmed that systems containing personal data had been compromised, while project owner Femern A/S separately confirmed that information had been stolen. The Barracuda ransomware group subsequently claimed responsibility, alleging that it had accessed FLC’s systems since September and stolen approximately 2.44 TB of data comprising more than 1.5 million files. The group claimed the information included contracts, financial records, employee information and confidential project documents, reportedly offering the data for sale for $500,000.

79.  Kamalnayan Bajaj Hospital in Chhatrapati Sambhajinagar, Maharashtra, India, suffered a ransomware attack that severely disrupted hospital operations, including patient billing, health insurance processing and government healthcare schemes. Staff detected the incident on October 18 when staff were unable to access the Hospital Management Information System (HMIS), preventing bills from being generated. An investigation revealed that all nine hospital servers had been compromised, with files reportedly encrypted and critical systems rendered inaccessible. A ransom note attributed to the Crypto24 Group claimed responsibility, alleging that sensitive hospital data had been stolen and threatening to publish it on a dark web leak site unless the attackers were contacted. The ransom amount was not disclosed, and the alleged data theft were not independently substantiated. Patients experienced delays in treatment, medication dispensing and insurance claims, although hospital officials confirmed that services had slowed rather than stopped entirely.

80.  The University of New Mexico Health Sciences Center (UNM Health) suffered a significant cyberattack, disrupting hospital operations, patient care and academic activities. The incident, detected on October 26, forced the healthcare provider to temporarily divert ambulances, suspend outpatient surgeries and cancel appointments, while classes across four health sciences schools were also canceled. The emerging Byod ransomware group claimed responsibility, alleging that it had compromised approximately 36,000 systems across the university and hospital networks. The attackers also claimed to have accessed sensitive student, employee and patient information, including Social Security numbers, payroll records, research data, medical appointments and electronic health records. Even so, these claims were not independently substantiated. UNM Health stated that its investigation found the incident had affected some end-user devices but had not penetrated core systems or servers. Critical electronic systems were restored by October 27, allowing hospitals and clinics to resume normal operations.

81.  VinSolutions, a customer relationship management (CRM) platform operated by Cox Automotive and used by approximately 7,000 car dealerships, was targeted in an alleged data extortion attack. The emerging Scarlett Group claimed responsibility, listing VinSolutions on its dark web leak site on October 23 and threatening to release allegedly stolen customer information. The attackers said they held sensitive records, including Social Security numbers, driver’s license details and vehicle financing applications, creating potential identity theft and financial fraud risks. Cox Automotive subsequently confirmed detecting suspicious activity affecting VinSolutions but stated that the incident had been quickly contained and appeared limited to a small subset of dealerships.

82.  Japanese internet services provider GMO Internet suffered a major cyberattack, compromising its Onamae.com Desktop Cloud platform and potentially affecting 26,739 customer servers. According to the company, attackers had exploited security weaknesses, gained unauthorized access and stolen customer information. Some users also reported unauthorized transactions involving their foreign exchange trading accounts. The attackers demanded approximately ¥8 billion ($50 million) and threatened to publish stolen information and launch a further ransomware attack. GMO refused to pay and issued an urgent warning advising customers to back up their data, disconnect their computers and secure their accounts. The company suspended the affected cloud service, confirmed it would not restart the compromised infrastructure and began arranging alternative services.

83.  Colmobil, Israel’s largest vehicle importer, suffered a cyberattack in October attributed to the Settra ransomware group, disrupting business operations and putting the focus on possible exposure of customer information. The incident was initially reported in mid-October, with the company confirming that it had identified suspicious activity, launched an investigation and notified relevant regulatory authorities. Sources familiar with the attack subsequently identified SETTRA as the group responsible, reporting that the attackers had threatened to publish customers’ personal information unless a ransom was paid. The disruption prompted Israel’s Ministry of Transport to temporarily block Colmobil’s access to the government system used to register imported vehicles, affecting essential administrative processes. Colmobil, which imports major automotive brands including Mercedes-Benz, Hyundai and Mitsubishi, later confirmed that it had resumed full operations.

84.  A technology enthusiast suffered a ransomware attack after cybercriminals exploited an unpatched vulnerability in an internet-accessible Synology network-attached storage (NAS) device. The intrusion reportedly took advantage of a remote code execution flaw that had been publicly known for approximately 18 months, highlighting the risks associated with exposing outdated storage systems directly to the internet. Attackers gained access to the device and encrypted stored files, leaving the owner unable to access important data. The incident was compounded by a series of security oversights, including neglected software updates and insufficient protection of the device against external access. Although the attack demonstrated how readily criminals can exploit known vulnerabilities, the identity of the ransomware operators was not established, and there was no confirmed evidence that data had been stolen.

85.  The Florida Department of Education disclosed a significant data breach, warning that the personal information of up to 4.9 million individuals may have been compromised. The incident involved unauthorized access to a website associated with the state’s financial aid services, putting at risk sensitive records belonging to students and other individuals who had used the system. The information at risk reportedly included names, Social Security numbers and other personally identifiable information, raising concerns about identity theft and financial fraud. The Florida Department of Law Enforcement and Florida Digital Service were involved in investigating the breach, assessing the extent of the intrusion and securing affected systems. Even so, the total number of individuals whose information was actually accessed or stolen had not been confirmed.

86.  Frontline Education, a US-based provider of administrative software used by school districts, was linked to a data security incident reported in October involving the exposure of sensitive student information. The breach reportedly affected records containing Social Security numbers and Medicaid identification numbers, raising concerns about identity theft and the misuse of personal information belonging to children. As a technology provider supporting school administration and student services, Frontline handles information that may be shared across educational institutions, potentially extending the consequences of a security incident beyond a single school district. Even so, the available details did not establish the total number of students affected, the full range of compromised information or whether the incident originated within Frontline’s systems or another part of the software environment.

87.  US energy infrastructure company ONEOK disclosed a cybersecurity incident after the Redact cyber extortion group allegedly gained access to confidential corporate information. A class action lawsuit filed by a former employee claimed that the company had been breached around October 16, with Redact reportedly leaking approximately 67.5 GB of data. The lawsuit alleged that possibly exposed information included names, addresses, Social Security numbers, dates of birth and financial records, raising concerns about identity theft and privacy risks. Nevertheless, ONEOK disputed the broader implications of the allegations, confirming that the incident involved unauthorized access to limited data from a very small number of cloud-based user accounts. The company stated that fewer than 70 individuals were affected and that all had been notified. ONEOK secured the affected accounts, engaged outside cybersecurity experts and notified federal law enforcement. According to the company, the incident had been resolved without any disruption to business operations.

88.  Travel technology provider Amadeus was linked to a cybersecurity incident reported that potentially exposed passenger information associated with four airlines. The case brought attention to the security of personal data processed through third-party systems supporting airline reservations and travel operations. Reports suggested that attackers had gained unauthorized access to information connected to airline customers, although the precise categories of possibly exposed data and the number of affected passengers remained unclear.

89.  Wellington College International School Bangkok, a British international school in Thailand, was named as an alleged ransomware victim after The Gentlemen ransomware group claimed responsibility for a cyberattack against the institution. The group reportedly listed the school on its dark web leak site, putting the focus on possible exposure of sensitive information relating to students, parents and employees. Even so, the extent of the alleged breach remained unclear, including whether personal records had been accessed or stolen and how many individuals might have been affected. There was also no confirmed information about ransom demands or disruption to teaching and administrative services. The school’s response to the allegations had not been established, and The Gentlemen’s claims were not independently substantiated.