ransomware

University Hospitals has disconnected systems following a cybersecurity incident, according to local reporting. The health system took network disconnection measures as a containment step, a move that can disrupt access to electronic records and some hospital services. Patients in the affected Ohio region may experience delays while the investigation continues.

A federal grand jury has indicted Zohar Pinhasi, CEO of the cybersecurity firm MonsterCloud, for allegedly defrauding clients of millions of dollars through his ransomware data recovery business. The charges came a month earlier and followed a 2019 ProPublica investigation into the company's practices. Prosecutors allege the firm exploited desperate ransomware victims who were seeking help recovering their encrypted data.

The chief executive of a Florida cybersecurity firm that promised clients help recovering data hit by ransomware has been indicted for fraud. ProPublica reported in 2019 that the company was secretly paying hackers behind the attacks while charging clients hefty fees for recovery services. The indictment follows years of scrutiny of the firm's practices, and the case raises fresh questions about the largely opaque ransomware negotiation industry and whether victims were misled about who they were really dealing with.

Japanese internet and cryptocurrency company GMO Internet has issued a warning to its users about an impending ransomware attack. Details about the scale of the threat, which customers are affected, and what protective measures the company is taking were not immediately provided. The alert comes amid a broader wave of ransomware incidents targeting Japanese companies and service providers.

GMO, a major Japanese internet and payment company, suffered an unauthorized access incident widely reported as a ransomware attack, with Nikkei highlighting blind spots in centralized cloud management. Commentators warn the case shows how attacks on cloud service providers can threaten everyday infrastructure like payments and communications, urging stronger security across Japan's digital lifelines.

PwC has confirmed it is dealing with a cyber incident, after the Everest ransomware group claimed to have stolen 590 GB of data from the firm. The professional services giant says it is responding to the incident, though details on what data was taken and how many clients may be affected remain limited. The claim from Everest has drawn attention to the potential exposure of sensitive client information.

A cybersecurity threat at the University of New Mexico's health system has disrupted operations, with ambulances being diverted away from its hospitals and some clinics closing. Students have been sent home as the institution responds to the incident. The outage is affecting patient care services across the UNM Health network in Albuquerque, and the extent of the disruption or any data breach remains to be confirmed.

A new analysis of the Emperador ransomware operation reports that brewing giant AB InBev suffered a data breach involving its Microsoft Azure cloud environment, with exposed PKI certificates said to be part of the incident. The report, dated October 2026, examines how attackers allegedly accessed cloud-hosted data. The full scope of the breach and any company response remain unclear.

Japanese internet services company GMO Internet has issued a warning about a ransomware group known as Noon, which is reportedly demanding $50 million. The alert, dated 2026, highlights the growing threat posed by the group and its high-value extortion demands, drawing attention from cybersecurity observers and businesses concerned about potential attacks.

A ransomware attack encrypted the database of Telangana's TG-iPASS portal, the state government's platform for industrial approvals, forcing it offline. The Telangana Cyber Security Bureau has launched an investigation, and officials are working to restore access for businesses that rely on the portal for clearances. The incident has drawn attention to the vulnerability of state digital services to cybercrime.

A wave of 716 healthcare cyberattacks is being reported in connection with a breach at Quest Diagnostics' laboratory operations. Security analysts are examining whether the incidents are part of a coordinated campaign targeting health data, amid growing concern over patient record exposure across the sector. The reported figure underscores how heavily hospitals and labs remain targets for ransomware and data theft.

The ransomware group N0n has published a new victim entry naming Ingelectus Innovative Electrical Solutions S.L., a Spain-based company in the energy and utilities sector. The post adds the firm to the group's extortion leak site, a pattern typically followed by data publication if a ransom is not paid. Spanish energy-sector suppliers have become frequent targets for ransomware operators, and security researchers are tracking the claim.

Japanese game publisher Capcom has confirmed a data breach affecting 11.7 million email addresses, according to a report by Security Affairs. The incident adds to a string of cybersecurity problems for the company, which previously suffered a major ransomware attack. Gamers and security watchers are discussing what personal data was exposed and what risks affected users now face.

Japanese game publisher Capcom has reportedly suffered another cyberattack, with 11.77 million user accounts said to be exposed. The reported breach is drawing attention because Capcom previously suffered a major ransomware attack in 2020 that exposed customer and corporate data, making this a repeat incident for the company.

Japanese game publisher Capcom has confirmed a data breach affecting more than 11.7 million users, expanding earlier estimates tied to a ransomware attack on its systems. The breach reportedly exposed personal information including names, addresses and in some cases purchase history. It ranks among the largest breaches to hit a major games company, prompting questions about Capcom's data security and its handling of the incident.

A ProPublica article on the indictment of Zohar Pinhasi, linked to the ransomware recovery firm MonsterCloud, is circulating with sarcastic commentary about 'vendor due diligence.' Commenters mock firms that hired such recovery companies only after incidents, suggesting scrutiny of negotiators and third-party vendors comes too late once ransomware victims are already entangled. The tone mixes ridicule with frustration over weak vetting in the cybersecurity industry.

The DragonForce ransomware group has published a new victim post naming Inside Passage Electric Cooperative, a US energy and utilities provider, as its latest target. The post, flagged by cyber threat intelligence watchers, suggests the gang claims to have exfiltrated data from the cooperative. Attack claims against small regional utilities draw attention because of the potential impact on local power services and the ongoing concern over ransomware targeting critical infrastructure.

The Qilin ransomware group has added new victims to its leak site, naming Hossner-Textil GmbH, a German manufacturing company, and White & Case, a major US-based law firm. Listings on such sites typically follow ransom payment deadlines, with stolen data threatened for release. Cybersecurity analysts track these disclosures as indicators of ongoing extortion campaigns against companies across multiple sectors and countries.

The Payload ransomware group has added new victims to its leak blog, naming Edelstahl-Mechanik GmbH, a German manufacturing company, and Miletic GmbH, a German construction firm. Both companies are listed with Germany as their location. Threat intelligence monitors flagged the disclosures, which suggest the gang is actively targeting small and mid-sized German industrial businesses, though neither company has publicly confirmed an attack.