J.C. Cannistraro, LLC
October 4, 2020
•[ ransomware, leak, manufacturing ]
J.C. Cannistraro discovered unusual activity in its computer network on October 4, 2020 and determined that the network had been encrypted by ransomware. The company notified personnel on October 7 and later learned that personal information had been disclosed to an unauthorized party; regulatory reporting lists 1,660 affected individuals, and a former employee later received an alert that his Social Security number was on the dark web. Avaddon listed J.C. Cannistraro on its leak site in November 2020, supporting group attribution, although the company did not publicly confirm the actor. The technical source of the stolen data is not established, so the exploitive subtype remains undetermined.
Undisclosed French business-software hosting company (Software; pseudonym)
June 24, 2021
•[ ransomware, financial, technology ]
During June 24-25, 2021, attackers encrypted files held by a French enterprise-software hosting provider and demanded ransom for decryption. The company restored hosted applications but could not recover certain data belonging to 14 customers because adequate off-site backups were absent. The case became public through reporting of a 2026 insurance judgment. Criminal/Financial is supported by the explicit ransomware demand; theft of files was not established. Software is a litigation pseudonym rather than the company's verified legal name.
Order Express, Inc.
July 29, 2022
•[ ransomware, finance, leak ]
An unauthorized actor accessed portions of Order Express's network between July 29 and September 7, 2022. Order Express discovered server connectivity problems on September 7 and shut down its network; investigators later determined that ransomware had encrypted just over half of its servers and that customer data had been accessed and exfiltrated. State breach filings identify 63,220 affected individuals. Contemporaneous public reporting attributed the incident to Cl0p, although Order Express itself described the attacker as unknown.
University of Health Sciences and Pharmacy in St. Louis
April 1, 2023
•[ ransomware, education, healthcare ]
The university's CIO/CISO dates LockBit's entry to April 1, 2023, using compromised employee credentials. About 13 days later, attackers encrypted servers and destroyed an onsite backup. They demanded US$1.25 million; the university did not pay. Stolen files were published around June 12. Cached server credentials were compromised. April 1 dates initial access, not encryption or confirmed extraction; the August 2026 interview describes a 2023 incident.
Brightly Software, Inc.
August 1, 2023
•[ insider, ransomware, technology ]
Cameron Curry, a contract data analyst, used his access to Brightly Software's payroll information and corporate data to remove sensitive files between August and December 2023. Beginning in December, he used the alias Loot to demand $2.5 million in cryptocurrency and threatened to publish the stolen information.
Southern Water
January 22, 2024
•[ ransomware, leak, technology ]
Black Basta ransomware group attacked UK water supplier Southern Water in January 2024, encrypting several IT systems and stealing customer and corporate data. The company later reported approximately 45 million in total expenses related to recovery, legal fees, and customer notification. The breach exposed nearly half a million customer records, and operations were temporarily disrupted though water services continued. Southern Water confirmed data exfiltration via its internal investigation and regulator notifications.
Undisclosed ransomware-as-a-service group
January 1, 2025
•[ ransomware, healthcare, transportation ]
CSE identified an undisclosed ransomware-as-a-service group responsible for more than 25 incidents affecting Canadian transportation, healthcare, pharmaceutical, and business organizations. Working with Five Eyes partners and law enforcement, CSE rendered the group's infrastructure inoperable and deleted a large amount of stolen data advertised for sale. CSE separately reported disruptions against parts of the infrastructure of 10 ransomware groups but did not state whether this group was included among them.
Excelsior Orthopaedics
January 7, 2025
•[ ransomware, healthcare, financial ]
Excelsior Orthopaedics suffered a ransomware attack attributed to the Monti threat group, which disrupted operations across all seven of its facilities in Western New York. The attackers exfiltrated approximately 300GB of sensitive data, including medical and financial records, and rendered core systems nonfunctional for several weeks, forcing staff to rely on manual processes during recocery
University of Oklahoma
January 15, 2025
•[ ransomware, education ]
The University of Oklahoma says it is taking steps to address unusual cyber activity it discovered on its network. The Fog ransomware group claims responsibility for the attack.
MassDevelopment
January 18, 2025
•[ ransomware, finance, government ]
MassDevelopment, the Massachusetts state development finance agency in Boston, was listed by the BianLian ransomware group on its leak site on Jan 18, 2025, which claimed theft of 4 TB of data. The agency has not publicly confirmed the claim.
AIL Hospitality Group
March 7, 2025
•[ ransomware, leak, retail ]
PEAR listed AIL Hospitality Group on its leak site on August 5, 2025. DataBreach.com later indexed 11,086 records containing names and driver's license information and assigns March 7, 2025 as the breach date. Independent ransomware trackers estimate the compromise in early July 2025, so the precise intrusion date remains contested. No independently verified operational disruption has been established.
Autism Services of Saskatoon Inc.
March 20, 2025
•[ ransomware, healthcare, misconfiguration ]
Autism Services of Saskatoon discovered a ransomware attack on March 20, 2025 after certain systems became inaccessible. A forensic investigation determined that the threat actor likely accessed and exfiltrated information collected from clients and former employees, and a ransom demand was found on a desktop computer. Autism Services isolated affected systems, terminated network access, and began restoring servers the following day. The last observed unauthorized activity occurred March 20. The organization notified 2,168 affected individuals, and subsequent monitoring found no evidence that the copied information was published or used for fraud. Investigators could not conclusively identify the entry point or responsible actor, although a firewall vulnerability was considered the likely access path.
Optima Tax Relief
May 1, 2025
•[ ransomware, financial, leak ]
Ransomware operators infiltrated Optima Tax Reliefs network and stole client tax-case data before leaking samples online. The company confirmed exposure of 3,114 individuals SSNs and financial account details but reported no further operational disruption.
Academic Urology & Urogynecology of Arizona
May 18, 2025
•[ ransomware, healthcare, leak ]
Academic Urology detected unauthorized network access on May 22, 2025 and later determined that files may have been accessed or acquired between May 18 and May 22. INC claimed the incident on June 17, 2025, but the practice did not confirm that attribution. The practice notified 73,281 people after completing its review on January 30, 2026; no operational disruption was reported.
Madera Community Hospital
May 28, 2025
•[ ransomware, healthcare ]
An unauthorized third party accessed Madera Community Hospital's network on May 28 and May 29, 2025. The hospital later determined that files from part of its network were likely acquired, ultimately identifying 150,810 affected individuals. An unidentified extortion group claimed responsibility and demanded payment but later withdrew its demand after learning the victim was a hospital, stating that it did not want to harm patients. No known group has publicly identified itself as the perpetrator, and the hospital found no evidence that the compromised information was publicly released.
YES24
June 9, 2025
•[ ransomware, retail, technology ]
Ransomware encrypted internal servers at YES24 beginning June 9 2025, forcing nationwide outage of its ticketing, e-book, and online community services for four days; operations gradually restored; no confirmed data exfiltration.
Uganda Electricity Transmission Company Limited (UETCL)
August 1, 2025
•[ ransomware, energy, hack ]
In August 2025, Uganda Electricity Transmission Company Limited experienced a suspected ransomware incident that compromised monitoring systems for the national electricity transmission network; the service was restored through backup procedures, according to INTERPOL reporting cited in August 2026. Qilin claimed to have breached the utility on August 18, 2025 and to possess contracts, financial statements, identity documents and service agreements, but independent verification of those stolen files, encryption and the precise disruption date is unavailable. No confirmed manipulation of physical grid controls or nationwide blackout was established.
Norwest Venture Partners
August 9, 2025
•[ ransomware, finance, technology ]
Sinobi claimed an intrusion into Norwest Venture Partners dated 9 August 2025 and publicly listed the firm on 15 August, threatening to publish stolen data unless Norwest negotiated. The supplied breach database later indexed 4,156 email records. Norwest did not publicly confirm the incident, and no victim-specific evidence of encryption or operational disruption was found; disruption cannot be ruled out because Sinobi commonly deploys ransomware.
Comcast Corporation
September 29, 2025
•[ ransomware, technology, leak ]
Actors claimed and then released a 186 GB compressed archive (?834 GB uncompressed) said to originate from Comcast systems after failed extortion; impact is large-scale exposure of internal files rather than service downtime. Organization responses and regulator notifications anticipated.
Unlimited Technology Systems, LLC
October 5, 2025
•[ ransomware, healthcare, technology ]
An unauthorized actor accessed Unlimited Technology Systems' commercial data center from October 5 through October 10, 2025 and obtained copies of files containing personal and protected health information. Unlimited later confirmed the incident was ransomware and that several systems hosting its g4-Centricity for Vector platform were encrypted, prompting suspension of access to hosted systems. The incident ultimately affected 3,803,750 individuals. No ransomware group has publicly claimed responsibility.
