Extortion as an operating business: who lists whom, what the leak sites actually hold, and how disclosure language drifts from the evidence. We do not report ransom demands as fact and we never grade severity on the size of a demand.
A joint advisory from the FBI, CISA, NSA and three other agencies describes Gunra as a double-extortion operation built from Conti’s leaked source, now running as a service and getting in through two vulnerabilities that already have patches.
The resilience of a nation’s communications, held as a private company’s operational decision.
Encrypted five days before a change of government, a day after the national CERT warned about ransomware.
Four arrested over attacks assessed in the hundreds of millions. Three were teenagers, and the technique was a phone call.
Five million records from a platform none of the customers knew they were using. Correlated failure, uncorrelated disclosure.
Revenue-cycle software for thousands of hospitals. Billing data is clinical data wearing an accounting costume.
Command references published to a ledger nobody can delete. Seizure assumes there is an object in a jurisdiction to seize.
An authentication bypass on the appliance that decides who is inside. The intruder inherits every assumption built on it.
Legacy remote access at the entry point in 73% of intrusions, up from 38% in two years. The box keeps working, which is why it is still there.
Two disruptions survived, ~394,000 machines. Takedowns remove infrastructure; the code, operators and customer base persist.
326 servers and 142 domains seized, and 27 million credentials recovered. The credentials outlast the infrastructure.
A claimed 630 GB from a contract manufacturer — mostly documents belonging to customers who were never attacked and may never be notified.
Ambulatory cardiac data is continuous, and continuous physiology is a behavioural record collected for a clinical reason.
Two arrests at a laundering service. Intrusion capability is replaceable; banking relationships that move criminal proceeds are not.
A demand denominated in bitcoin changes value while the victim decides. Neither the price nor the volume is verified.
Two days closed, summer programmes cancelled. A school that cannot confirm who may collect a child cannot responsibly open.
Payments down 44%, claims up 40%. An ecosystem earning less per victim has an obvious incentive to increase volume.
17 million devices sold as residential addresses. This is the component that defeats impossible-travel checks and geographic risk scoring.
One anonymity service shared by 25 ransomware groups, watched for three years before seizure. The observation window has victims in it.
No intrusion of its own — a dependency with a deadline, hitting the one week in the academic year with no slack in it.
A month between attack and claim. Leak-site listings record negotiation failures, not attacks — and that biases everyone’s data.