Threat Intelligence Brief
Curated summary with source attribution
Source: krebsonsecurity.com
Threat Risk: Medium
Victim: The named organisation and its users
Incident: A 26-year-old Canadian man once described as one of the most consequential cybercrime threat actors of 2024 has pleaded guilty to computer fraud and conspiracy to hack and extort more than 165 organizations that used the cloud provider Snowflake.
Impact: Potential security impact depending on exposure.
Attacker: Unidentified threat actors
Analysis: The key concern for The named organisation and its users is the potential follow-on impact — Potential security impact depending on exposure. Treat this as a medium-priority item and validate the source details, exposure scope, and required defensive actions. Attribution is not yet specific, so defenders should validate exposure before assuming actor intent.
Recommendations: Review affected systems; Apply vendor guidance; Monitor for related indicators
Source: Original article link below
Editorial note: this post summarizes third-party reporting and links to the original source.
View Original Source
Latest Developments
Update — 2026-09-11 02:45 UTC
Sponsored by Hudson Rock – Use Hudson Rock’s free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks Description: Compromised Employees: 17 Compromised Users: 10 Third Party Employee Credentials: 22 External Attack Surface: 24 DNS Potential security impact depending on exposure. The key concern for The named organisation and its users is the potential follow-on impact — Potential security impact depending on exposure. Treat this as a medium-priority item and validate the source details, exposure scope, and required defensive actions. Attribution is not yet specific, so defenders should validate exposure before assuming actor intent.
Corroborating source: ransomware.live
Update — 2026-09-11 02:45 UTC
General Santos Doctors Hospital Description: General Santos Doctors Hospital 3.502.636 files, total volume ~2.44 TBPatient data (PHI) � name-tagged scans across department shares (surgical pathology, hemodialysis charts, admission records), cancer-center dossiers with PhilHealth Potential security impact depending on exposure. The key concern for The named organisation and its users is the potential follow-on impact — Potential security impact depending on exposure. Treat this as a medium-priority item and validate the source details, exposure scope, and required defensive actions. Attribution is not yet specific, so defenders should validate exposure before assuming actor intent.
Corroborating source: ransomware.live
Update — 2026-09-11 16:05 UTC
Sponsored by Hudson Rock – Use Hudson Rock’s free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks Description: Compromised Employees: 10 Compromised Users: 322 Third Party Employee Credentials: 34 External Attack Surface: 53 DNS Potential security impact depending on exposure. The key concern for The named organisation and its users is the potential follow-on impact — Potential security impact depending on exposure. Treat this as a medium-priority item and validate the source details, exposure scope, and required defensive actions. Attribution is not yet specific, so defenders should validate exposure before assuming actor intent.
Corroborating source: ransomware.live
Update — 2026-09-11 20:16 UTC
A 20-person engineering company in Port Melbourne is the latest business to find that a ransomware attack does not need to enter through its own systems. Potential security impact depending on exposure. The key concern for The named organisation and its users is the potential follow-on impact — Potential security impact depending on exposure. Treat this as a medium-priority item and validate the source details, exposure scope, and required defensive actions. Attribution is not yet specific, so defenders should validate exposure before assuming actor intent.
Corroborating source: insurancebusinessmag.com
Update — 2026-09-11 20:58 UTC
Stolen credentials are the cheapest one. Potential security impact depending on exposure. The key concern for The named organisation and its users is the potential follow-on impact — Potential security impact depending on exposure. Treat this as a medium-priority item and validate the source details, exposure scope, and required defensive actions. Attribution is not yet specific, so defenders should validate exposure before assuming actor intent.
Corroborating source: socradar.io
Update — 2026-09-11 22:21 UTC
GUEST RESEARCH: Check Point Research reveals a 22% year-on-year increase in global cyber attacks, a rise in phishing activity, and continued sensitive data exposure risks as enterprise GenAI use expands Check Point Research, the threat intelligence arm of Check Point® Software Te Potential security impact depending on exposure. The key concern for The named organisation and its users is the potential follow-on impact — Potential security impact depending on exposure. Treat this as a medium-priority item and validate the source details, exposure scope, and required defensive actions. Attribution is not yet specific, so defenders should validate exposure before assuming actor intent.
Corroborating source: itwire.com
Update — 2026-09-14 05:13 UTC
Barracuda Targets i2i-systems in Ransomware Attack – Target – i2i-systems – Domain – i2i-systems.com – Country – Turkey – Attacking Group – Barracuda – Date Reported – September 13, 2026 Summary On September 13, 2026, the ransomware group Barracuda claimed responsibility for a si Potential security impact depending on exposure. The key concern for The named organisation and its users is the potential follow-on impact — Potential security impact depending on exposure. Treat this as a medium-priority item and validate the source details, exposure scope, and required defensive actions. Attribution is not yet specific, so defenders should validate exposure before assuming actor intent.
Corroborating source: dexpose.io
Update — 2026-09-14 09:09 UTC
What ‘The Pitt’ got right on a hospital ransomware attack Key Takeaways – Reverting to paper workflows can preserve clinical operations, but transfer coordination, census accuracy, and documentation integrity quickly become bottlenecks without rehearsed, role-specific downtime pr Potential security impact depending on exposure. The key concern for The named organisation and its users is the potential follow-on impact — Potential security impact depending on exposure. Treat this as a medium-priority item and validate the source details, exposure scope, and required defensive actions. Attribution is not yet specific, so defenders should validate exposure before assuming actor intent.
Corroborating source: chiefhealthcareexecutive.com
Update — 2026-09-14 12:27 UTC
Sponsored by Hudson Rock – Use Hudson Rock’s free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks Description: Compromised Employees: 0 Compromised Users: 10 Third Party Employee Credentials: 0 External Attack Surface: 6 DNS Rec Potential security impact depending on exposure. The key concern for The named organisation and its users is the potential follow-on impact — Potential security impact depending on exposure. Treat this as a medium-priority item and validate the source details, exposure scope, and required defensive actions. Attribution is not yet specific, so defenders should validate exposure before assuming actor intent.
Corroborating source: ransomware.live
Update — 2026-09-14 18:43 UTC
Atlas Ocean Voyages suffered a ransomware attack by a group known as Booba Project, which claims to have stolen 37 GB of data tied to customer travel arrangements. Potential security impact depending on exposure. The key concern for The named organisation and its users is the potential follow-on impact — Potential security impact depending on exposure. Treat this as a medium-priority item and validate the source details, exposure scope, and required defensive actions. Attribution is not yet specific, so defenders should validate exposure before assuming actor intent.
Corroborating source: databreachrights.com
Update — 2026-09-14 22:24 UTC
Qilin Strikes Alicotrans in Spain Ransomware Attack – Target – Alicotrans – Domain – alicotrans.com – Country – Spain – Attacking Group – Qilin – Date Reported – September 14, 2026 Summary On September 14, 2026, the notorious ransomware group Qilin claimed responsibility for a cy Potential security impact depending on exposure. The key concern for The named organisation and its users is the potential follow-on impact — Potential security impact depending on exposure. Treat this as a medium-priority item and validate the source details, exposure scope, and required defensive actions. Attribution is not yet specific, so defenders should validate exposure before assuming actor intent.
Corroborating source: dexpose.io
Update — 2026-09-15 10:56 UTC
Sponsored by Hudson Rock – Use Hudson Rock’s free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks Description: Compromised Employees: 0 Compromised Users: 26 Third Party Employee Credentials: 0 External Attack Surface: 17 DNS Re Potential security impact depending on exposure. The key concern for The named organisation and its users is the potential follow-on impact — Potential security impact depending on exposure. Treat this as a medium-priority item and validate the source details, exposure scope, and required defensive actions. Attribution is not yet specific, so defenders should validate exposure before assuming actor intent.
Corroborating source: ransomware.live
Update — 2026-09-15 12:07 UTC
Sponsored by Hudson Rock – Use Hudson Rock’s free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks Description: Compromised Employees: 0 Compromised Users: 12 Third Party Employee Credentials: 11 External Attack Surface: 17 DNS R Potential security impact depending on exposure. The key concern for The named organisation and its users is the potential follow-on impact — Potential security impact depending on exposure. Treat this as a medium-priority item and validate the source details, exposure scope, and required defensive actions. Attribution is not yet specific, so defenders should validate exposure before assuming actor intent.
Corroborating source: ransomware.live
Update — 2026-09-15 12:07 UTC
Sponsored by Hudson Rock – Use Hudson Rock’s free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks Description: Compromised Employees: 9 Compromised Users: 61 Third Party Employee Credentials: 1 External Attack Surface: 24 DNS Re Potential security impact depending on exposure. The key concern for The named organisation and its users is the potential follow-on impact — Potential security impact depending on exposure. Treat this as a medium-priority item and validate the source details, exposure scope, and required defensive actions. Attribution is not yet specific, so defenders should validate exposure before assuming actor intent.
Corroborating source: ransomware.live
Update — 2026-09-15 15:56 UTC
Payroll system of mosques, madrasahs hit by ransomware; staff details potentially compromised – The payroll system SmartHRMS, used by mosques and madrasahs under MUIS in Singapore, was hit by a ransomware attack in August, compromising sensitive staff salary and bank details. Potential security impact depending on exposure. The key concern for The named organisation and its users is the potential follow-on impact — Potential security impact depending on exposure. Treat this as a medium-priority item and validate the source details, exposure scope, and required defensive actions. Attribution is not yet specific, so defenders should validate exposure before assuming actor intent.
Corroborating source: straitstimes.com
Update — 2026-09-17 13:09 UTC
Sponsored by Hudson Rock – Use Hudson Rock’s free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks Description: Compromised Employees: 9 Compromised Users: 204 Third Party Employee Credentials: 0 External Attack Surface: 28 DNS R Potential security impact depending on exposure. The key concern for The named organisation and its users is the potential follow-on impact — Potential security impact depending on exposure. Treat this as a medium-priority item and validate the source details, exposure scope, and required defensive actions. Attribution is not yet specific, so defenders should validate exposure before assuming actor intent.
Corroborating source: ransomware.live
Update — 2026-09-17 14:02 UTC
No evidence a large amount of data compromised from HR system hit by ransomware, says MUIS – MUIS confirmed no large-scale data theft occurred after a ransomware attack on the SmartHRMS payroll system used by mosques and madrasahs. Potential security impact depending on exposure. The key concern for The named organisation and its users is the potential follow-on impact — Potential security impact depending on exposure. Treat this as a medium-priority item and validate the source details, exposure scope, and required defensive actions. Attribution is not yet specific, so defenders should validate exposure before assuming actor intent.
Corroborating source: straitstimes.com
Update — 2026-09-18 07:31 UTC
The Information Regulator says it is investigating a data breach at vehicle tracking company Cartrack, which suffered a ransomware incident in August. Potential security impact depending on exposure. The key concern for The named organisation and its users is the potential follow-on impact — Potential security impact depending on exposure. Treat this as a medium-priority item and validate the source details, exposure scope, and required defensive actions. Attribution is not yet specific, so defenders should validate exposure before assuming actor intent.
Corroborating source: sabcnews.com
Update — 2026-09-18 11:30 UTC
Revolut Hacker Launches Extortion Site Demanding $3M After 680 Customer Data Breach – Hackers behind the Revolut data breach are demanding $3 million in Monero and threatening to sell stolen customer records. Potential security impact depending on exposure. The key concern for The named organisation and its users is the potential follow-on impact — Potential security impact depending on exposure. Treat this as a medium-priority item and validate the source details, exposure scope, and required defensive actions. Attribution is not yet specific, so defenders should validate exposure before assuming actor intent.
Corroborating source: yahoo.com
Update — 2026-09-18 15:36 UTC
Sponsored by Hudson Rock – Use Hudson Rock’s free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks Description: Compromised Employees: 0 Compromised Users: 31 Third Party Employee Credentials: 0 External Attack Surface: 10 DNS Re Potential security impact depending on exposure. The key concern for The named organisation and its users is the potential follow-on impact — Potential security impact depending on exposure. Treat this as a medium-priority item and validate the source details, exposure scope, and required defensive actions. Attribution is not yet specific, so defenders should validate exposure before assuming actor intent.
Corroborating source: ransomware.live
Update — 2026-09-18 15:36 UTC
Sponsored by Hudson Rock – Use Hudson Rock’s free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks Description: Compromised Employees: 1 Compromised Users: 214074 Third Party Employee Credentials: 2 External Attack Surface: 101 D Potential security impact depending on exposure. The key concern for The named organisation and its users is the potential follow-on impact — Potential security impact depending on exposure. Treat this as a medium-priority item and validate the source details, exposure scope, and required defensive actions. Attribution is not yet specific, so defenders should validate exposure before assuming actor intent.
Corroborating source: ransomware.live
Update — 2026-09-18 15:36 UTC
Sponsored by Hudson Rock – Use Hudson Rock’s free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks Description: Compromised Employees: 40 Compromised Users: 704 Third Party Employee Credentials: 666 External Attack Surface: 112 D Potential security impact depending on exposure. The key concern for The named organisation and its users is the potential follow-on impact — Potential security impact depending on exposure. Treat this as a medium-priority item and validate the source details, exposure scope, and required defensive actions. Attribution is not yet specific, so defenders should validate exposure before assuming actor intent.
Corroborating source: ransomware.live
Update — 2026-09-18 15:46 UTC
Ellis County is notifying residents that the county experienced a ransomware incident affecting portions of its information technology systems. Potential security impact depending on exposure. The key concern for The named organisation and its users is the potential follow-on impact — Potential security impact depending on exposure. Treat this as a medium-priority item and validate the source details, exposure scope, and required defensive actions. Attribution is not yet specific, so defenders should validate exposure before assuming actor intent.
Corroborating source: hayspost.com
Update — 2026-09-18 19:15 UTC
Metaencryptor Impacts Beckman Coulter in Ransomware Attack – Target – Beckman Coulter, Inc – Domain – beckmancoulter.com – Country – USA – Attacking Group – metaencryptor – Date Reported – September 17, 2026 Summary On September 17, 2026, the ransomware group metaencryptor claime Potential security impact depending on exposure. The key concern for The named organisation and its users is the potential follow-on impact — Potential security impact depending on exposure. Treat this as a medium-priority item and validate the source details, exposure scope, and required defensive actions. Attribution is not yet specific, so defenders should validate exposure before assuming actor intent.
Corroborating source: dexpose.io
Update — 2026-09-18 22:14 UTC
Ellis County investigating ransomware incident affecting IT systems HAYS, Kan. Potential security impact depending on exposure. The key concern for The named organisation and its users is the potential follow-on impact — Potential security impact depending on exposure. Treat this as a medium-priority item and validate the source details, exposure scope, and required defensive actions. Attribution is not yet specific, so defenders should validate exposure before assuming actor intent.
Corroborating source: kwch.com
Update — 2026-09-19 11:22 UTC
Sponsored by Hudson Rock – Use Hudson Rock’s free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks Description: Compromised Employees: 0 Compromised Users: 32 Third Party Employee Credentials: 0 External Attack Surface: 15 DNS Re Potential security impact depending on exposure. The key concern for The named organisation and its users is the potential follow-on impact — Potential security impact depending on exposure. Treat this as a medium-priority item and validate the source details, exposure scope, and required defensive actions. Attribution is not yet specific, so defenders should validate exposure before assuming actor intent.
Corroborating source: ransomware.live
Update — 2026-09-19 13:56 UTC
A lost laptop, an email sent to the wrong address, or a ransomware attack on a care management system are all personal data breaches — and under UK GDPR, a care provider can face a strict 72-hour clock the moment one is discovered. Potential security impact depending on exposure. The key concern for The named organisation and its users is the potential follow-on impact — Potential security impact depending on exposure. Treat this as a medium-priority item and validate the source details, exposure scope, and required defensive actions. Attribution is not yet specific, so defenders should validate exposure before assuming actor intent.
Corroborating source: learnsignal.com
Update — 2026-09-19 15:19 UTC
Anubis Ransomware Attack on Quest Group – Target – Quest Group – Domain – questgroupint.com – Country – USA – Attacking Group – Anubis – Date Reported – September 18, 2026 Summary On September 18, 2026, the notorious ransomware group Anubis claimed responsibility for a cyberattac Potential security impact depending on exposure. The key concern for The named organisation and its users is the potential follow-on impact — Potential security impact depending on exposure. Treat this as a medium-priority item and validate the source details, exposure scope, and required defensive actions. Attribution is not yet specific, so defenders should validate exposure before assuming actor intent.
Corroborating source: dexpose.io
Update — 2026-09-19 15:19 UTC
AuditTeam Ransomware Attack on TD Group – Target – TD Group – Domain – tdgroup.com – Country – Not Available – Attacking Group – AuditTeam – Date Reported – September 19, 2026 Summary On September 19, 2026, the notorious ransomware group AuditTeam claimed responsibility for a cyb Potential security impact depending on exposure. The key concern for The named organisation and its users is the potential follow-on impact — Potential security impact depending on exposure. Treat this as a medium-priority item and validate the source details, exposure scope, and required defensive actions. Attribution is not yet specific, so defenders should validate exposure before assuming actor intent.
Corroborating source: dexpose.io
Update — 2026-09-19 16:01 UTC
Fallstudie A critical healthcare provider in their region, this large non-profit hospital and healthcare system is home to nearly 10,000 employees and manages more than 14,000 endpoints. Potential security impact depending on exposure. The key concern for The named organisation and its users is the potential follow-on impact — Potential security impact depending on exposure. Treat this as a medium-priority item and validate the source details, exposure scope, and required defensive actions. Attribution is not yet specific, so defenders should validate exposure before assuming actor intent.
Corroborating source: zscaler.com
Update — 2026-09-21 08:03 UTC
the recovery costs of a <b>ransomware attack</b> in sa is over $1 million – hypertext – htxt Content could not be extracted. Potential security impact depending on exposure. The key concern for The named organisation and its users is the potential follow-on impact — Potential security impact depending on exposure. Treat this as a medium-priority item and validate the source details, exposure scope, and required defensive actions. Attribution is not yet specific, so defenders should validate exposure before assuming actor intent.
Corroborating source: htxt.co.za
Update — 2026-09-21 12:33 UTC
Appliance Factory & Mattress Kingdom suffered a ransomware attack by the group IncRansom, with notifications sent in September 2026. Potential security impact depending on exposure. The key concern for The named organisation and its users is the potential follow-on impact — Potential security impact depending on exposure. Treat this as a medium-priority item and validate the source details, exposure scope, and required defensive actions. Attribution is not yet specific, so defenders should validate exposure before assuming actor intent.
Corroborating source: databreachrights.com
Update — 2026-09-21 13:17 UTC
Sponsored by Hudson Rock – Use Hudson Rock’s free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks Description: Compromised Employees: 20 Compromised Users: 1507 Third Party Employee Credentials: 40 External Attack Surface: 75 DN Potential security impact depending on exposure. The key concern for The named organisation and its users is the potential follow-on impact — Potential security impact depending on exposure. Treat this as a medium-priority item and validate the source details, exposure scope, and required defensive actions. Attribution is not yet specific, so defenders should validate exposure before assuming actor intent.
Corroborating source: ransomware.live
Update — 2026-09-21 18:57 UTC
Sponsored by Hudson Rock – Use Hudson Rock’s free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks Description: Compromised Employees: 13 Compromised Users: 4 Third Party Employee Credentials: 17 External Attack Surface: 19 DNS R Potential security impact depending on exposure. The key concern for The named organisation and its users is the potential follow-on impact — Potential security impact depending on exposure. Treat this as a medium-priority item and validate the source details, exposure scope, and required defensive actions. Attribution is not yet specific, so defenders should validate exposure before assuming actor intent.
Corroborating source: ransomware.live
Update — 2026-09-22 00:23 UTC
Back to Ransomware Tracker No tracked victim disclosure found for “maryann kriger incransom”. Potential security impact depending on exposure. The key concern for The named organisation and its users is the potential follow-on impact — Potential security impact depending on exposure. Treat this as a medium-priority item and validate the source details, exposure scope, and required defensive actions. Attribution is not yet specific, so defenders should validate exposure before assuming actor intent.
Corroborating source: ervik.as
Update — 2026-09-22 16:13 UTC
Termite Ransomware Strikes TruAmerica Multifamily – Target – TruAmerica Multifamily – Domain – truamerica.com – Country – USA – Attacking Group – Termite – Date Reported – September 22, 2026 Summary On September 22, 2026, the ransomware group Termite publicly claimed responsibili Potential security impact depending on exposure. The key concern for The named organisation and its users is the potential follow-on impact — Potential security impact depending on exposure. Treat this as a medium-priority item and validate the source details, exposure scope, and required defensive actions. Attribution is not yet specific, so defenders should validate exposure before assuming actor intent.
Corroborating source: dexpose.io
Update — 2026-09-22 18:53 UTC
Termite Ransomware Strikes Sealcon USA – Target – Sealcon – Domain – sealconusa.com – Country – USA – Attacking Group – Termite – Date Reported – September 22, 2026 Summary On September 22, 2026, the notorious ransomware group Termite claimed responsibility for a cyberattack agai Potential security impact depending on exposure. The key concern for The named organisation and its users is the potential follow-on impact — Potential security impact depending on exposure. Treat this as a medium-priority item and validate the source details, exposure scope, and required defensive actions. Attribution is not yet specific, so defenders should validate exposure before assuming actor intent.
Corroborating source: dexpose.io
Update — 2026-09-22 19:15 UTC
ShinyHunters hackers say they breached FBI, stole employee data ShinyHunters says it retaliating for a May FBI warning about the hacking group The digital extortion group known as ShinyHunters says it has breached the Federal Bureau of Investigation and claims to have stolen data Potential security impact depending on exposure. The key concern for The named organisation and its users is the potential follow-on impact — Potential security impact depending on exposure. Treat this as a medium-priority item and validate the source details, exposure scope, and required defensive actions. Attribution is not yet specific, so defenders should validate exposure before assuming actor intent.
Corroborating source: cbc.ca
Update — 2026-09-22 20:10 UTC
ShinyHunters, a prolific cybercriminal group known for large-scale data theft and extortion, says it has breached the FBI and stolen data on thousands of agents and applicants. Potential security impact depending on exposure. The key concern for The named organisation and its users is the potential follow-on impact — Potential security impact depending on exposure. Treat this as a medium-priority item and validate the source details, exposure scope, and required defensive actions. Attribution is not yet specific, so defenders should validate exposure before assuming actor intent.
Corroborating source: techcrunch.com
Update — 2026-09-22 21:01 UTC
<b>ransomware</b> attack by n0n – socradar Content could not be extracted. Potential security impact depending on exposure. The key concern for The named organisation and its users is the potential follow-on impact — Potential security impact depending on exposure. Treat this as a medium-priority item and validate the source details, exposure scope, and required defensive actions. Attribution is not yet specific, so defenders should validate exposure before assuming actor intent.
Corroborating source: socradar.io
Update — 2026-09-22 21:56 UTC
AuditTeam Executes Ransomware Attack on Pr***IT – Target – Pr***IT – Domain – Unavailable – Country – Non Disponibile – Attacking Group – AuditTeam – Date Reported – September 22, 2026 Summary On September 22, 2026, the ransomware group AuditTeam claimed responsibility for a cybe Potential security impact depending on exposure. The key concern for The named organisation and its users is the potential follow-on impact — Potential security impact depending on exposure. Treat this as a medium-priority item and validate the source details, exposure scope, and required defensive actions. Attribution is not yet specific, so defenders should validate exposure before assuming actor intent.
Corroborating source: dexpose.io
Update — 2026-09-23 09:05 UTC
Termite Ransomware Attack on theLender – Target – theLender – Domain – thelender.com – Country – USA – Attacking Group – Termite – Date Reported – September 22, 2026 Summary On September 22, 2026, the ransomware group Termite claimed responsibility for a cyberattack against theLe Potential security impact depending on exposure. The key concern for The named organisation and its users is the potential follow-on impact — Potential security impact depending on exposure. Treat this as a medium-priority item and validate the source details, exposure scope, and required defensive actions. Attribution is not yet specific, so defenders should validate exposure before assuming actor intent.
Corroborating source: dexpose.io
Update — 2026-09-23 14:33 UTC
Sponsored by Hudson Rock – Use Hudson Rock’s free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks Description: Compromised Employees: 1 Compromised Users: 445 Third Party Employee Credentials: 5 External Attack Surface: 39 DNS R Potential security impact depending on exposure. The key concern for The named organisation and its users is the potential follow-on impact — Potential security impact depending on exposure. Treat this as a medium-priority item and validate the source details, exposure scope, and required defensive actions. Attribution is not yet specific, so defenders should validate exposure before assuming actor intent.
Corroborating source: ransomware.live
Update — 2026-09-30 10:17 UTC
A complete dossier of the firm’s criminal defense practice covering ~175+ clients: felonies (an undercover sex sting involving a minor – Ramirez; domestic violence robbery – Valderrama, involving a 4-year-old child; felony DUI – Segula; fraud – B. Potential security impact depending on exposure. The key concern for The named organisation and its users is the potential follow-on impact — Potential security impact depending on exposure. Treat this as a medium-priority item and validate the source details, exposure scope, and required defensive actions. Attribution is not yet specific, so defenders should validate exposure before assuming actor intent.
Corroborating source: ransomware.live
Update — 2026-09-30 13:43 UTC
Sponsored by Hudson Rock – Use Hudson Rock’s free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks Description: Compromised Employees: 0 Compromised Users: 8 Third Party Employee Credentials: 0 External Attack Surface: 6 DNS Reco Potential security impact depending on exposure. The key concern for The named organisation and its users is the potential follow-on impact — Potential security impact depending on exposure. Treat this as a medium-priority item and validate the source details, exposure scope, and required defensive actions. Attribution is not yet specific, so defenders should validate exposure before assuming actor intent.
Corroborating source: ransomware.live
Update — 2026-09-30 18:42 UTC
Medela Data Breach What Happened In September 2026, Swiss medical device company Medela was the target of a ShinyHunters “pay or leak” extortion campaign. Potential security impact depending on exposure. The key concern for The named organisation and its users is the potential follow-on impact — Potential security impact depending on exposure. Treat this as a medium-priority item and validate the source details, exposure scope, and required defensive actions. Attribution is not yet specific, so defenders should validate exposure before assuming actor intent.
Corroborating source: haveibeenpwned.com
Update — 2026-09-30 18:52 UTC
Ransomware gangs steal 896 terabytes, Zscaler says Wed, 30th Sep 2026 (Today)Zscaler has published research showing ransomware attackers exfiltrated 896.2 terabytes of data over a year, a 275.8% increase year on year. Potential security impact depending on exposure. The key concern for The named organisation and its users is the potential follow-on impact — Potential security impact depending on exposure. Treat this as a medium-priority item and validate the source details, exposure scope, and required defensive actions. Attribution is not yet specific, so defenders should validate exposure before assuming actor intent.
Corroborating source: itbrief.co.uk
Update — 2026-09-30 18:52 UTC
<b>ransomware</b> leverage is growing by the terabyte: takeaways from threatlabz 2026 … Potential security impact depending on exposure. The key concern for The named organisation and its users is the potential follow-on impact — Potential security impact depending on exposure. Treat this as a medium-priority item and validate the source details, exposure scope, and required defensive actions. Attribution is not yet specific, so defenders should validate exposure before assuming actor intent.
Corroborating source: securityboulevard.com
Update — 2026-09-30 20:59 UTC
Sponsored by Hudson Rock – Use Hudson Rock’s free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks Description: Compromised Employees: 1 Compromised Users: 20 Third Party Employee Credentials: 13 External Attack Surface: 14 DNS R Potential security impact depending on exposure. The key concern for The named organisation and its users is the potential follow-on impact — Potential security impact depending on exposure. Treat this as a medium-priority item and validate the source details, exposure scope, and required defensive actions. Attribution is not yet specific, so defenders should validate exposure before assuming actor intent.
Corroborating source: ransomware.live