Ransomware

An independent, attributed roundup of the major cybersecurity incidents of October 2026 — from the PHP2Shell critical RCEs and the ConnectWise Cloud Backup supply-chain compromise to breaches at ETS, Denmark’s population register, Zeabur, Railway, Burger King Japan and more. Each item carries a verification status (confirmed, claimed or rumoured) and a clearly-labelled subjective editorial severity, with a defensive takeaway.

PwC has confirmed a cybersecurity incident at a third-party vendor that hosts its employee learning records, after the Everest extortion group listed PwC and claimed ~590.69 GB of data. What PwC actually confirmed, what Everest claims (still unverified), and the third-party / LMS lessons for security leaders.

KrebsOnSecurity reports (19 October 2026) that U.S. federal investigators suspect an executive at a U.S. consulting firm helped run the ShinyHunters extortion site "shinywire[.]com," and that investigators identified executives at two ransomware-negotiation firms with "unusually close relations" to ShinyHunters. Nothing here is proven against any named individual, and the suspected site-operator is unnamed and uncharged. For CISOs and IR leaders the lesson is structural: the negotiators, IR vendors and "recovery" brokers you bring in mid-incident are themselves a trust boundary. An independent, attributed read on what is alleged versus proven, and how to run conflict-checked, sanctions-screened due diligence on anyone you let into a live ransomware response.

A neutral, decision-framework comparison of four cyber-insurance carriers — Coalition and At-Bay (technology-led "active" insurtechs) versus AIG CyberEdge and Chubb (large traditional carriers). How they differ on underwriting and active monitoring, incident-response panels, ransomware and cyber-extortion coverage, pricing drivers, and healthcare-specific considerations. No invented prices or sublimits — a framework to take to a broker, plus the exact clauses and questions to verify on a quote. Not insurance advice; confirm current terms with a licensed broker.

A 2026 Semperis ransomware report, covered by The Register, finds 37% of ransomware attacks now involve psychological or physical threats against staff — doxxing, swatting, threats to families, even packages sent to investigators' homes. Here is what the numbers say, the caveats that come with a self-reported vendor survey, and what the shift from data-encryption to human coercion changes for incident-response planning and a security leader's duty of care.

A cyberattack rarely bankrupts a company via the ransom itself — it is the cascade: operations freeze, customers flee, remediation and notification costs pile up, lawsuits and regulators arrive, and lenders pull out, all at once. Here is a cited analysis of real companies that filed Chapter 11 or collapsed after a breach — AMCA, National Public Data, KNP Logistics, Stoli, ENGlobal — the pattern that killed them, who is most at risk, and what actually prevents it.

Within days, two European grocery giants were hit by very different cyber incidents that ended the same way — empty fresh-food shelves. Albert Heijn (Ahold Delhaize) took its websites, apps and logistics systems offline after a cybersecurity incident, halting online deliveries and stalling distribution centres; in France, attackers hijacked Danfoss refrigeration controllers and cooked the fridges. One is an IT/logistics failure, the other OT sabotage. Here is what is confirmed, how they differ, and why food retail is now critical infrastructure.

A dark-web monitoring account reports that the ransomware group "The Gentlemen" has named Deloitte on its extortion leak site, with the entry marked "Data info — soon." As of now this is an unverified claim: a listing appeared, no data or proof has been published, and Deloitte has not confirmed any incident. Here is what "being named" on a leak site actually means, why even a Big Four audit-and-cyber firm appearing matters, how to read these claims without panicking, and the exact playbook if you are a Deloitte client or sit in their supply chain.

An independent, attributed roundup of the major cybersecurity incidents of September 2026 — from the actively-exploited Citrix NetScaler and Arista VeloCloud zero-days to the Pentagon Defense Manpower Data Center breach, the Gyazo compromise, the Keio ransomware attack and the disputed ShinyHunters FBI-jobs claim. Each item carries a verification status (confirmed, claimed, reported or rumoured) and a clearly-labelled subjective editorial severity, with a defensive takeaway.

Citrix NetScaler keeps getting mass-exploited — Shitrix, CitrixBleed, CitrixBleed 2 and new zero-days. The durable reason, the CVE timeline, and the fix.

A vendor-neutral ransomware readiness assessment: the controls that actually decide whether an incident is a bad day or a business-ending one, grouped so you can score yourself and find the gaps.

Cl0p's dark-web leak site has listed four organizations as alleged victims. These are unverified extortion claims, not confirmed breaches. Here is how to read a leak-site listing, why Cl0p keeps hitting file-transfer software, and the defensive steps that actually matter.

A defensive threat-intelligence explainer on the venue types that power the ransomware economy - forums, RaaS portals, initial-access brokers, leak sites - and how defenders and law enforcement monitor and disrupt them.

A defensive awareness briefing for CISOs and staff on how ransomware operations recruit affiliates and insiders, the traits they hunt for as red flags, the manipulation tactics they use, the legal and personal consequences, and how to recognize and avoid being pulled in.

An analytical look at the ransomware business: the RaaS affiliate model and revenue splits, how demands are sized and negotiated, the crypto rails crews use -- and how blockchain analysis and law enforcement follow and seize the money.

Inside the operational security ransomware operators use to stay anonymous, and the recurring OPSEC mistakes, blockchain tracing, infrastructure seizures and leaks that keep unmasking them anyway.

An independent, defensive roundup of August 2026’s biggest cyber incidents: the BeyondTrust Remote Support zero-day (CVE-2026-102764) exploited by a China-nexus actor from late August, the McKesson and Manchester Airports Group breaches, a record 997 ransomware claims, social-engineering hits on Apollo, RingCentral and Carhartt, OT attacks on energy and water, and the AI angle. Each item carries a status label (Confirmed / Claimed / Reported) and a subjective 1–10 severity read.

An independent, defensive roundup of the major cyber incidents reported in July 2026 — the Fairlife/Coca-Cola ransomware shutdown, Clop's PTC Windchill data-theft campaign, the 12-million-record KDDI breach, Accenture's source-code incident, a coordinated OT attack on 30+ Minnesota water utilities, and the actively-exploited ColdFusion and Langflow flaws. Each item carries a status label (Confirmed / Claimed / Reported) and a subjective 1–10 severity read, with a defensive takeaway.

An independent, attributed roundup of the major cybersecurity incidents of June 2026 — from the Oracle PeopleSoft zero-day (CVE-2026-35273) that ShinyHunters used against 100-plus universities and Microsoft’s record ~206-CVE Patch Tuesday to breaches at iRhythm, Novo Nordisk, Tata Electronics and Kodak and a wave of npm supply-chain compromises. Each item carries a verification status (confirmed, claimed or reported) and a clearly-labelled subjective editorial severity, with a defensive takeaway.

An independent, attributed roundup of the major cybersecurity incidents of May 2026 — from the ShinyHunters Canvas/Instructure extortion and the TanStack supply-chain worm that reached OpenAI to the DigiCert code-signing abuse, a suspected Iranian attack on US gas-station tank gauges, and breaches at Carnival, Charter/Spectrum, West Pharmaceutical and more. Each item carries a verification status (confirmed, claimed or reported) and a clearly-labelled subjective editorial severity, with a defensive takeaway.

An independent, attributed roundup of the major cybersecurity incidents of April 2026 — from the ShinyHunters Salesforce extortion wave hitting Charter/Spectrum, ADT, Pitney Bowes, Vimeo and Medtronic, to the ChipSoft ransomware attack on Dutch hospitals, the France Titres (ANTS) identity-portal breach, a Microsoft SharePoint zero-day and the ~$290M Kelp DAO crypto theft. Each item carries a verification status (confirmed, claimed or reported) and a clearly-labelled subjective editorial severity, with a defensive takeaway.

An independent, attributed roundup of the major cybersecurity incidents of March 2026 — from the TeamPCP supply-chain campaign that poisoned LiteLLM and security-scanner packages on PyPI, to the Handala wiper that erased 200,000+ Stryker devices, the Cl0p Oracle E-Business Suite extortion wave, and breaches at Cegedim Sante, Navia, Aura, Crunchyroll and Telus. Each item carries a verification status (confirmed, claimed or rumoured) and a clearly-labelled subjective editorial severity, with a defensive takeaway.

An independent, attributed roundup of the major cybersecurity incidents of February 2026 — from Microsoft’s six actively-exploited zero-days and the BeyondTrust and Ivanti EPMM flaws to breaches at the University of Mississippi Medical Center, France’s national bank account registry (FICOBA), CarGurus, Figure, Advantest and Singapore’s four telcos. Each item carries a verification status (confirmed, reported or claimed) and a clearly-labelled subjective editorial severity, with a defensive takeaway.

An independent, attributed roundup of the major cybersecurity incidents of January 2026 — the ShinyHunters wave against Match Group, Bumble and Crunchbase, a 149-million-credential infostealer dump, large healthcare and regulator breaches disclosed this month (Covenant Health, CIRO, Under Armour), and the actively-exploited vulnerabilities CISA added to its KEV catalog (Zimbra, Versa Concerto and more). Each item carries a verification status (confirmed, claimed or reported) and a clearly-labelled subjective editorial severity, with a defensive takeaway.