Conti’s leaked source is still producing operations four years on, and this one gets in through patched CVEs.
Encrypted five days before a change of government, a day after the national CERT warned about ransomware.
The final count on the Conduent intrusion landed above 62 million people — third-largest in US healthcare history, at a processor most of them have never heard of.
A claimed 630 GB from a contract manufacturer — mostly documents belonging to customers who were never attacked and may never be notified.
A demand denominated in bitcoin changes value while the victim decides. Neither the price nor the volume is verified.
Two days closed, summer programmes cancelled. A school that cannot confirm who may collect a child cannot responsibly open.
Payments down 44%, claims up 40%. An ecosystem earning less per victim has an obvious incentive to increase volume.
One anonymity service shared by 25 ransomware groups, watched for three years before seizure. The observation window has victims in it.
A month between attack and claim. Leak-site listings record negotiation failures, not attacks — and that biases everyone’s data.
The group claimed 8 TB and named customers. Nothing beyond the claim is established, and we are not reprinting the customer list.
Ransomware is 28% of claims and 52% of the money. BEC is the most frequent and among the cheapest. They need separate budgets.
A global shutdown days after detection. From outside it reads as catastrophe; inside an incident it is often the correct call.
Hospitals flat, their suppliers up ~35%. Hardening one class of victim redistributes attacks rather than preventing them.
Ambulances diverted, chemotherapy infusions cancelled, a fortnight on paper. The affected people experienced it as a phone call.
The calculation is not that a city has money. It is that a city has visible pain and a decision-maker accountable to the people feeling it.
Permits, licences, records and billing offline by morning; 911 untouched. The separation that held is the kind budget reviews question.
$900,000 a day against demands in the low millions. Printing those two numbers together constructs the attacker’s argument for them.
Education fails closed while other sectors degrade. The fix is not detection — it is an offline copy of the data needed to open safely.
Generic manufacturing runs at high utilisation with no buffer stock. There is nothing in reserve when a plant stops.
About 92,000 people at a Puerto Rico hospital. Diversion planning assumes somewhere to divert to.
A components maker warning of shipment delays. Qualification rules mean a medical supply chain cannot route around a supplier quickly.
Business systems encrypted; the segmented membership server untouched. Our database is mostly a record of controls that failed.
A reported $100 million demand against a Japanese teaching hospital, and about 131,700 people. Only one of those numbers means anything.
No data taken, no notification owed, 70,000 people unable to pay a bill. Availability fails independently of confidentiality.
Two cities, two attacks, dispatch survived both. The cost is annual and questioned; the benefit is a disaster that cannot be evidenced.
Sixty institutions down through one provider. Pooling technology is what lets small member-owned banks exist, and it concentrates the risk.
Two days on manual processes with essential services maintained. The difference between a continuity document and a capability shows in the first hour.
Group-based threat intelligence assumes a manageable set of adversaries. The number of groups is approaching the number of incidents.
A hospital carries the operational-technology problem of a utility alongside the data-protection problem of a bank.
A shift from the transaction that sometimes works to the one this corpus has never seen work.
This figure measures the category every disclosure-based count excludes by construction: the attacks that were stopped.
Five names, five sectors, one explanation. A list of five describes the head of a very long distribution.
The visibility explanation this desk applies elsewhere is much weaker here. A leak site names whoever the attacker chose to name.
The corpus should be as suspicious of numbers that agree for no visible reason as of numbers that disagree.
Blocking more attempts and losing more data are the same finding. A manufacturer can lose its entire engineering position with no duty to tell anyone.
Around 30% of 2025 breaches originated with a third party. The boundary an organisation defends stopped being the boundary that determines its exposure.
Knowing this operation is active tells a defender nothing, because it is active everywhere. Naming it is naming the weather.
The only reliable incident costs in this corpus come from organisations that had no choice but to publish them.
Corporate IT, a production line, and a connected product you can still reach after sale. Few industries carry all three.
Where disclosure is not mandatory, the regional picture is assembled almost entirely from what attackers chose to publish.
An ecosystem-wide long tail alongside sector concentration. Both are true, and it complicates the corpus’s own argument.
A fivefold rise is affiliate recruitment, not innovation. Which makes affiliate confidence the scarce asset worth attacking.
A regulator saying “this is ransomware, we don’t yet know by whom” on day two serves everybody better than a complete account on day thirty.
Real, distributed across people who will never know, and deferred by years. No instrument here can see it.
A social services outage means a benefit application does not progress for somebody who applied because they had nothing.
The variable that predicts the outcome is not the payment decision. It is whether you could recover without them.
Heathrow, Brussels and Berlin degraded through one supplier none of them was attacked. The 2026 repeat is filed at 26-0406.
A company can raise prices. A county cannot — more security means visibly less of something a resident can see.
Removing the largest operator did not reduce the market. It redistributed it into smaller, less trackable operations.
Sixty agencies at once means something common to all of them fell. Consolidation working as designed, failing all at once.
A corpus assembled from disclosures records failures in detail and successes almost never.
A state-linked group running ransomware collapses the distinction the corpus is organised around — and from a defender’s position it is unresolvable in the moment.
Payments become known; refusals do not. The observable signal is biased towards paying, and it is the observable signal that sets expectations.
The published “we don’t hit hospitals” rules were positioning. An operation whose affiliates pick the victims cannot implement a sector exclusion.
A sector whose failure would degrade the response to every other incident in this database.
The sector best measured in one jurisdiction is thinly recorded in another — a statement about supervisory publication, not about the banks.
5.4 million through a subsidiary of the group that had already produced the largest healthcare breach on record.
An energy provider serving a population had an incident. The public record contains a group name and a month.
A second sample that confirmed the first would have been more satisfying and much less informative.
Somebody looked at the population of people who wanted to run ransomware, decided it was larger than the population who could, and built a product for the difference.
600 applications withdrawn in a live hospital. Most people guess a few dozen; nobody can say what each one would break.
One vendor incident becomes many provider notifications on different dates. Anyone counting breaches sees several small ones.
Hospitals reorder against expected supply. A delay of weeks means deferred procedures nobody will ever connect to a supplier’s IT incident.
Nineteen days inside a dialysis provider, 2.7 million records taken, and treatment never stopped. The continuity is the underreported part.
In a lawful market, removing the dominant supplier reduces volume because capacity is expensive to replace. Here the capacity is software.
Applying the rule to a ransomware leader is the case that tests whether it is a rule or a preference. If it only holds for sympathetic subjects it is not a rule.
Not “nearly three million” — 2,947,264. Healthcare produces exact counts because every affected person must be notified.
EMS already records diversion status and transport time. What does not exist is any mechanism connecting it to a cyber incident.
934,000 patients, a closed laboratory, and an internal emergency posture that already had a name for this.
Invoice records describe who supplies whom, on what terms — useful to a competitor and to a fraudster.
A resident who needs to pay a water bill has one counterparty and no alternative.
A restaurant chain without tills is not a degraded restaurant chain.
Ransomware has to announce itself. Malware that only copies succeeds by staying unremarkable.
Encryption is the moment the attacker chooses to be seen. It happens after the theft, because the theft is the leverage.
Diversion is the rare availability harm that produces a number — in minutes, measured by the ambulance service.
Settlement data proposed by USB stick, between two of the largest financial institutions on earth.
One number was filed with a securities regulator. The other two were published by the people doing the extorting.
The fatal injury was to cash flow, and it took two years to prove fatal.
The unit that matters is not the facility. It is the number of organisations that stop when it does.
A signing key burned into shipped hardware cannot be rotated the way a credential can.
The mechanism for reaching the company was part of the same incident.
A population the holder cannot notify without defeating the reason it holds the data.
The only instrument anyone had was a shopper noticing an absence.
The customer headline and the actual victim population were different groups.
No database at the centre of it. A national postal operator simply stopped being able to send a parcel abroad.
It held the information, had the means to publish, and every commercial reason not to.
623,700 had data exposed. The people actually harmed were the ones whose procedure moved.
Two small NATO members, two months apart, two entirely different instruments.
An attempt that stops a carrier’s morning departures has succeeded at everything but encryption.
Tax collection stopping is fiscal. Customs stopping means the containers do not move.
A backlog, a staffing problem, and trouble encrypting large files. It reads like a company.