Ransomware attacks continue to evolve with double-extortion tactics and targeted enterprise campaigns. This section analyzes ransomware groups, attack patterns, and defensive strategies CISOs must understand.
76 articles
An unnamed organization suffered a high-severity Akira ransomware attack in August 2026, involving credential-spraying against a SonicWall SSL VPN and Safe Mode EDR evasion. Data was exfiltrated and ransomware deployed, but encryption failed due to system constraints.
An unknown organization suffered a ransomware attack by an Akira affiliate, resulting in data and credential theft after EDR was disabled via Safe Mode, though encryption failed.
DeadLock ransomware compromised 80 organizations across Europe, stealing and encrypting sensitive data. The group leveraged blockchain and decentralized networks to evade takedown.
Four San Diego hospitals suffered a ransomware attack in 2021, crippling operations and causing severe patient care disruptions. The incident led to a 48% increase in wait times and a 128% rise in patients leaving without care.
Signature Services, a US-based professional services provider, suffered a ransomware attack attributed to the Play group, resulting in file encryption and operational disruption. The incident was publicly claimed by the attackers, though the organization has not confirmed details.
Preferred Financial Group suffered a ransomware attack attributed to the Play group, resulting in unauthorized access and operational disruption. The incident was publicly claimed by the threat actor, though the organization has not confirmed the breach.
Centro Universitário CESMAC in Brazil suffered a ransomware attack attributed to the krybit group, resulting in potential IT system encryption and service disruption. The incident was publicly claimed by the threat actor on their darknet blog.
naskdoorinc.com, a US-based manufacturing company, suffered a ransomware attack by the safepay group, causing operational disruption across southeastern Pennsylvania and northern Delaware. The incident may involve data encryption or theft, though technical specifics remain unconfirmed.
Minnesota water utilities suffered a coordinated ransomware attack impacting over 30 organizations, including Braham and Plymouth Water Utilities. Attackers exploited exposed PLCs, resulting in operational outages and boil water notices.
Vernon & Waldrep, a Texas-based healthcare organization, suffered a ransomware attack by Global Secret Group, resulting in the compromise of 274 GB of data. Over 56,000 files, including sensitive healthcare and mental health specialist information, were exposed.
MBM Law, a South Carolina-based law firm, suffered a ransomware attack attributed to the threat actor dragonforce. The incident resulted in operational disruption and a ransomware claim against the firm.
L3Harris, a US-based aerospace and defense technology company, suffered operational disruption following a ransomware attack attributed to Kyber Group. The incident targeted US operations and was publicly claimed by the threat actor.