23 casos · pág. 1/2
A still-unknown actor hacked thousands of remote-controlled refrigeration systems across hundreds of French grocery stores, spiking temperatures, spoiling food and sparking fires. The incident fits a broader trend of extortionists and other attackers going after physical systems to maximise real-world pressure on victims. Earlier examples…
The UK Information Commissioner's Office (ICO) has reprimanded Data Cymru (Local Government Data Unit – Wales) and its IT provider Ogi Networks Limited (ONL) over a November 2024 ransomware attack. The attackers gained access through a legacy test account, 'Test 2', which had existed for more than 12 years and was protected only by the pa…
In July 2026, 77 large healthcare data breaches (500+ individuals) were reported to the HHS Office for Civil Rights (OCR), a 10% month-over-month increase and the third consecutive monthly rise. At least 33,485,970 individuals were affected, up 642% from June and 154% above the 12-month average. January-July 2026 totals 67.4 million affec…
An $80 million settlement has been proposed to resolve the consolidated class action In Re Conduent Business Services Data Breach Litigation, pending in the U.S. District Court for the District of New Jersey. The suit stems from the 2024 breach at Conduent Business Services, LLC, in which an unauthorized party had network access from Octo…
The Semperis 2026 Ransomware Risk Report, published on October 14, warns that ransomware operators are increasingly threatening the physical safety of CISOs, executives and other senior staff at victim organizations to force payment. The report says a quarter of ransomware campaigns now involve psychological or physical threats against em…
The UK Information Commission's Office (ICO) issued reprimands, not fines, to Ogi Networks Limited (ONL) and the Local Government Data Unit – Wales (Data Cymru) after a ransomware attack on 1 November 2024. The intruder used a forgotten test account, Test2, created in January 2012 with the password "Password1", to enter Data Cymru's netwo…
A Cisco blog post by Renato Morais compares past landmark threats with the emerging risk from autonomous AI agents, then presents Cisco's agentic security reference architecture. It recounts the ILOVEYOU worm (2000), a social-engineering email worm, and WannaCry (2017), a ransomware worm using EternalBlue against unpatched Windows systems…
Objective-See analyzed Heartbreaker, a previously unknown macOS ransomware sample (ad hoc-signed ARM64 Mach-O written in Rust). It was uploaded to VirusTotal in May 2025 and remains undetected by all AV engines. It was found by researcher Megan Carney. It encrypts files in ~/Downloads with AES-256-GCM, renames them to .heartbreaker, drops…
Trend Micro published its annual threat report, Calibrating Expansion, covering 2023. It reports 161 billion threats blocked, a 10% annual increase. Attackers appear to be targeting fewer, higher-value victims with more sophisticated methods. Email and web reputation blocks fell 47% and 2%, while File Reputation Service detections rose 35…
SentinelOne argues that "EDR killer" covers four different techniques, and a single driver-load rule leaves blind spots. The four are bring-your-own-vulnerable-driver (BYOVD), bring-your-own-installer, admin-to-kernel, and driverless suspension. The article gives hunt logic for each and recommends rolling them out in order of signal quali…
Resilience's report Cyber risk in energy and utilities analyzes cyber insurance claims filed between Jan. 1, 2023 and Sept. 5, 2026. Email compromise made up 21% of energy and utilities claims, against 10% across the rest of the portfolio. Ransomware was only 9% of claims but about 70% of incurred losses including reserves. In several cas…
A Flare analysis argues that Scattered Spider, LAPSUS$ and ShinyHunters are distinct intrusion clusters within The Com, a decentralized, mostly English-speaking cybercriminal subculture, and not interchangeable names for one group. It describes SP1D3R HUNTERS (also called Scattered LAPSUS$ Hunters, SLH) as a shared brand and coordination …
CISA, the FBI, the U.S. Secret Service, Germany's Landeskriminalamt Rheinland-Pfalz and the UK's National Crime Agency and North West Regional Organised Crime Unit issued a joint advisory on the SafePay ransomware group. SafePay has breached at least 600 critical infrastructure organizations across North America, South America, Europe and…
Huntress reports that manufacturing accounted for about 17% of cyber attacks in 2025, up from 9% in 2024, citing its own cyber threat report. The article is a vendor trends piece rather than an incident report. It argues that ransomware operators now target production uptime and operational technology (OT), not just data, because manufact…
A Huntress thought-leadership post sets out five priorities for security leaders in 2026: abuse of trusted IT tools, AI-enabled cybercrime, social engineering, multi-extortion ransomware and identity-based attacks including BEC. The article cites internal Huntress telemetry showing RMM abuse rising roughly 277% year over year, with Screen…
Zscaler ThreatLabz's 2026 Ransomware Report describes ransomware operators using generative AI to sharpen phishing, speed up reconnaissance and pick out the most sensitive corporate data to steal. The report records 896.2 TB exfiltrated by the top 10 ransomware groups between April 2025 and March 2026. The article cites a 275.8% annual in…
Multiple ransomware groups, including Qilin and INC, are exploiting CVE-2026-0257, an authentication bypass in Palo Alto Networks PAN-OS GlobalProtect portals and gateways. Unit 42 has been investigating intrusions since early June across many sectors, including finance, healthcare and manufacturing. The flaw was patched on May 13 and ini…
Palo Alto Networks Unit 42 reports active exploitation of CVE-2026-0257, an authentication bypass in the portal and gateway components of PAN-OS GlobalProtect. The flaw lets unauthorized attackers circumvent security controls and open VPN connections. The October 19 update says Unit 42 continues to see exploitation attempts by ransomware …
Acronis Threat Research Unit found that the Gentlemen ransomware operation is using the BYOVD (bring your own vulnerable driver) technique with legitimate Lenovo and Safetica kernel drivers to terminate endpoint security software before encrypting files. Two custom dropper samples were recovered from a recent incident. They install the dr…
A joint advisory from US, German and UK government agencies, including CISA, says the SafePay ransomware group has compromised at least 600 critical infrastructure organizations since emerging in August 2024. Victims are in North America, South America, Europe and Australia. SafePay has been one of the most active ransomware groups in 202…
