Black Basta
February 11, 2025
•[ ransomware, data leak ]
ExploitWhispers leaked internal data from the Black Basta ransomware groups server, exposing details of its operations and communications.
Supreme Administrative Court of Bulgaria
February 20, 2025
•[ ransomware, data leak ]
RansomHouse used White Rabbit ransomware against Bulgarias Supreme Administrative Court on Jan 27, encrypting ~140 computers; group posted employee-related files as proof of data theft. Court remained operational via paper processes; investigation into data leakage ongoing.
Insight Partners
January 16, 2025
•[ ransomware, social engineering, data leak ]
On January 16, 2025, Insight Partners detected a cyberattack following a social engineering intrusion first traced to October 2024. Attackers exfiltrated sensitive files related to funds, management companies, portfolio companies, banking and tax records, and personally identifiable data of employees, partners, and investors. More than 12,000 individuals were affected. The incident escalated into a ransomware attack, with systems partially encrypted before containment. No named threat group has been identified, but the actor is criminal and financially motivated.
Penn-Harris-Madison School Corporation
March 3, 2025
•[ ransomware ]
Indiana school district reported ransomware network breach and service interruptions.
Pennsylvania State Education Association
July 6, 2024
•[ ransomware, data leak ]
Teachers union reports july 2024 breach with rhysida claim and mass notifications.
Ascom
March 16, 2025
•[ ransomware, data leak ]
Hellcat claims theft from ascom; company confirms ticketing system incident.
WideOpenWest (Wow!)
March 26, 2025
•[ ransomware, data leak ]
Arkana security claims ransomware attack on wow with data theft.
Pulmonary Physicians Of South Florida
February 19, 2025
•[ ransomware, data leak ]
Ransomware Group Listed Provider And Posted Screenshots Suggesting Patient Records Exposure.
Bell & Graham
January 16, 2025
•[ ransomware, data leak ]
On 2025-01-16, Bell & Graham confirmed that the SafePay ransomware group stole approximately 15 GB of client data from its on-premises servers. The firm stated that files were taken but not encrypted, and live cloud systems were unaffected.
Undisclosed U.S. Engineering and Construction Firm
December 29, 2024
•[ ransomware, data leak ]
On December 29 2024, Anubis listed an unnamed U.S. firm from the engineering and construction sector on its leak site. KELA reported the inclusion, and SecurityWeek referenced the finding. Stolen material reportedly included project and client documentation. No encryption or service interruption confirmed.
the private provider (contractor) supplying NHS services
February 20, 2025
•[ ransomware, data leak ]
A private provider serving the NHS was hit by ransomware, disrupting network operations and potentially exposing patient or internal data, causing service interruptions in NHS operations dependent on it.
Assa Abloy
March 31, 2025
•[ ransomware ]
Swedish lock manufacturer reported ransomware affecting operations; investigation and recovery ongoing.
Brydens Lawyers
February 25, 2025
•[ ransomware, data leak ]
Sydney law firm reported ransomware with alleged 600GB data leak under investigation.
Hometeamns
February 25, 2025
•[ ransomware ]
Ransomware hit Singapores HomeTeamNS; no evidence of data extraction.
Cobb County Government
March 22, 2025
•[ ransomware ]
Cobb County took servers offline after breach; online systems restored after several days.
Whitman Hospital & Medical Clinics
February 28, 2025
•[ ransomware ]
Hospital Reported Internal Electronic Systems Down Following Cyberattack; Care Continued With Delays.
Sam’s Club
March 28, 2025
•[ ransomware, data leak ]
Sams Club, a U.S. warehouse retail chain owned by Walmart Inc., is investigating claims by the ransomware group Clop that it breached the companys systems. Clop added Sams Club to its dark-web leak site but so far has not provided any proof of data exfiltration. Sams Club acknowledged awareness of the potential incident and emphasized protecting member information is a priority while its internal investigation continues.
Undisclosed Riyadh-based real estate and construction company
February 14, 2025
•[ ransomware, data leak ]
The DragonForce ransomware group attacked a major Riyadh-based real estate and construction firm, exfiltrating over 6 TB of internal corporate data and encrypting systems as part of a double-extortion campaign. The group demanded ransom payment by February 27, 2025, ahead of Ramadan, and later leaked the stolen data when unpaid.
Ministry of Health and Human Services (Palau)
February 17, 2025
•[ ransomware, data leak ]
The Ministry of Health and Human Services of Palau suffered a ransomware-attributed data breach by the Qilin group on February 17, 2025. The attackers exfiltrated patient and hospital data from internal servers but no encryption of systems was confirmed. Authorities reported service restoration and an investigation into the scope of data theft.
LANIT Group
February 21, 2025
•[ ransomware ]
On 2025-02-21, LANIT Group, a major Russian IT service provider, suffered a cyber incident that encrypted portions of its internal infrastructure and prompted a national warning to financial institutions using its subsidiaries. Authorities confirmed encryption and service isolation but no verified data exfiltration.