Uncle Henry’s
March 11, 2025
•[ ransomware, database deletion, extortion ]
On March 11 2025, Maine-based classified ads publisher Uncle Henrys suffered a ransomware-style attack that deleted its primary website database and took the site offline until April 15. Attackers demanded Bitcoin. Management stated only a few advertisement entries were copied and no personal data compromise was confirmed.
Laborers’ International Union of North America (LIUNA) Local 1184
November 17, 2024
•[ ransomware, data breach ]
On March 31, 2025, Laborers International Union of North America Local 1184 (LiUNA) filed a notice of data breach with the Attorney General of California after discovering that the organization was the target of a November 2024 ransomware attack.
Aigües de Mataró
April 21, 2025
•[ ransomware, encryption, service disruption ]
Ransomware encrypted Aiges de Matars corporate servers on April 21 2025, taking the website offline and delaying customer services. The utility reported no evidence of data exfiltration; water service and quality remained unaffected. No actor has claimed responsibility.
Office of the State’s Attorney for Baltimore City
March 19, 2025
•[ ransomware, data leak, unauthorized access ]
Following a March 2025 intrusion, the Kairos ransomware group stole internal legal and police records from the Baltimore City States Attorneys Office and later published portions online; the office reported no service disruption but confirmed investigation of unauthorized access.
Hamilton County Sheriff’s Office
April 14, 2025
•[ ransomware, data theft, extortion ]
Ransomware attack by the Qilin group encrypted internal systems and took the Hamilton County (Tennessee) Sheriffs Office website offline; attackers demanded $300,000 and claimed data theft, but no exfiltration has been verified; systems fully restored by early May 2025.
Real Academia Española
February 28, 2025
•[ ransomware, cyberattack ]
Spains language academy confirmed a ransomware attack affecting its systems.
Sam’s Club
March 28, 2025
•[ ransomware, data leak, cybersecurity investigation ]
Sams Club, a U.S. warehouse retail chain owned by Walmart Inc., is investigating claims by the ransomware group Clop that it breached the companys systems. Clop added Sams Club to its dark-web leak site but so far has not provided any proof of data exfiltration. Sams Club acknowledged awareness of the potential incident and emphasized protecting member information is a priority while its internal investigation continues.
Comercializadora S&E Perú
December 29, 2024
•[ data leak, ransomware, cyber attack ]
On December 29 2024, the criminal group Anubis listed the Peruvian engineering and construction company Comercializadora S&E Per on its leak site. KELA verified the listing and SecurityWeek later cited it as part of Anubiss first campaign. The group stole internal and client information; no encryption or operational outage was reported.
Curaçao Tax & Customs Administration
July 24, 2025
•[ ransomware, operational disruption, government ]
Ransomware attack on July 24, 2025 encrypted and paralyzed systems of Curaaos Tax & Customs Administration, disabling counters, phone lines, and internal operations. Online tax filing remained active. Services restored by August 4. No perpetrator identified; no data exfiltration reported.
Szpital MSWiA (Ministry of Interior Hospital) Kraków
March 8, 2025
•[ ransomware, cyberattack, healthcare ]
Cyberattack on the Ministry of Interior hospital in Krakw encrypted administrative and medical IT systems, fully paralyzing patient care and access to records. Hospital departments began restoring systems by March 11, indicating ~3 days of disruption. No data exfiltration or perpetrator identified.
Miljödata (IT supplier for municipalities)
August 23, 2025
•[ ransomware, data leak, personal data ]
Suspected ransomware attack against Swedish IT supplier Miljdata disrupted critical services for ~200 municipalities starting August 23, 2025. Systems were encrypted, and attackers threatened to leak stolen personal and medical data unless paid 1.5 BTC.
Beta – Dnevni evropski servis (DES)
August 7, 2025
•[ ransomware, cryptocurrency, encryption ]
Ransomware attack encrypted systems of Betas specialized European news service (DES), rendering its portal inaccessible. No data exfiltration was reported. Attackers demanded ransom in cryptocurrency; the incident occurred and was disclosed on August 7, 2025.
Alder Hey Children’s Hospital
November 28, 2024
•[ ransomware, data leak, healthcare ]
Alder Hey Childrens Hospital says it is investigating claims that its systems may have been breached and that patient records and other information was stolen, after the ransomware group INC Ransom adds Alder Hey to its leak site.
Refinadora Costarricense de Petróleo
November 27, 2024
•[ ransomware, energy, critical infrastructure ]
Refinadora Costarricense de Petrleo (RECOPE), the state-owned energy provider for Costa Rica is hit with a ransomware attack, requiring the company to shift to manual operations and call in help from abroad.
​Electrica Group
December 9, 2024
•[ ransomware, cyberattack, energy sector ]
Electrica Group, a key player in the Romanian electricity distribution and supply market, is investigating a ransomware attack.
Boston Children’s Health Physicians
September 10, 2024
•[ ransomware, cyber attack, data breach ]
Boston Childrens Health Physicians (BCHP) discloses to have suffered a cyber attack The BianLian ransomware operation claims responsibility for the attack.
Florida’s Sumter County Sheriff’s Office
August 6, 2024
•[ ransomware, Rhysida ransomware attack, cyberattack ]
Floridas Sumter County Sheriffs Office confirms that it experienced a Rhysida ransomware attack.
CDEK
May 23, 2024
•[ cyberattack, service disruption, ransomware ]
Head Mare, a little-known group, claims responsibility for an attack that has disrupted service for days at CDEK, one of Russias largest delivery companies.
Matadero de Gijón
January 5, 2024
•[ ransomware, data leak ]
The Matadero de Gijn is hit with a RansomHub ransomware attack.
Christie’s
May 9, 2024
•[ ransomware, cyber-attack, auction disruption ]
A cyber-attack disrupts auction house Christies attempts to sell art and other high-value items worth an estimated $840m. The RansomHub ransomware group claims responsibility for the attack.
