Extortion as an operating business: who lists whom, what the leak sites actually hold, and how disclosure language drifts from the evidence. We do not report ransom demands as fact and we never grade severity on the size of a demand.
Karen Vardanyan, an Armenian national, was sentenced in Oregon on 22 September for his part in the 2019 to 2020 Ryuk conspiracy. Restitution was $1.2 million. The wider operation collected about 1,160 bitcoin. The core operators remain where they were.
The API served the request as it would any other. The credential came from a vendor’s environment, and the vendor is the one party nobody has named.
The city kept its principle and the residents in 80,000 proceedings got the leak. Refusal was right, and this is what it costs.
Two hospitals, two weeks on paper, ambulances turned away, and no group claiming it. If no data left, there will be no record of any of this.
A listing with no samples, a declaration that notifies Congress, and a system reported to hold investigation targets.
One exposed platform, forty-plus listings, no encryption. The stolen category — engineering IP — triggers no notification law anywhere.
Two hundred more victims between two revisions of the same advisory. The health department signing on is the substantive part.
Conti’s leaked source is still producing operations four years on, and this one gets in through patched CVEs.
The resilience of a nation’s communications, held as a private company’s operational decision.
Encrypted five days before a change of government, a day after the national CERT warned about ransomware.
Four arrested over attacks assessed in the hundreds of millions. Three were teenagers, and the technique was a phone call.
Five million records from a platform none of the customers knew they were using. Correlated failure, uncorrelated disclosure.
Revenue-cycle software for thousands of hospitals. Billing data is clinical data wearing an accounting costume.
Command references published to a ledger nobody can delete. Seizure assumes there is an object in a jurisdiction to seize.
An authentication bypass on the appliance that decides who is inside. The intruder inherits every assumption built on it.
Legacy remote access at the entry point in 73% of intrusions, up from 38% in two years. The box keeps working, which is why it is still there.
Two disruptions survived, ~394,000 machines. Takedowns remove infrastructure; the code, operators and customer base persist.
326 servers and 142 domains seized, and 27 million credentials recovered. The credentials outlast the infrastructure.
A claimed 630 GB from a contract manufacturer — mostly documents belonging to customers who were never attacked and may never be notified.
Ambulatory cardiac data is continuous, and continuous physiology is a behavioural record collected for a clinical reason.
Two arrests at a laundering service. Intrusion capability is replaceable; banking relationships that move criminal proceeds are not.