Undisclosed ransomware-as-a-service group
January 1, 2025
•[ ransomware, healthcare, transportation ]
CSE identified an undisclosed ransomware-as-a-service group responsible for more than 25 incidents affecting Canadian transportation, healthcare, pharmaceutical, and business organizations. Working with Five Eyes partners and law enforcement, CSE rendered the group's infrastructure inoperable and deleted a large amount of stolen data advertised for sale. CSE separately reported disruptions against parts of the infrastructure of 10 ransomware groups but did not state whether this group was included among them.
Excelsior Orthopaedics
January 7, 2025
•[ ransomware, healthcare, financial ]
Excelsior Orthopaedics suffered a ransomware attack attributed to the Monti threat group, which disrupted operations across all seven of its facilities in Western New York. The attackers exfiltrated approximately 300GB of sensitive data, including medical and financial records, and rendered core systems nonfunctional for several weeks, forcing staff to rely on manual processes during recocery
University of Oklahoma
January 15, 2025
•[ ransomware, education ]
The University of Oklahoma says it is taking steps to address unusual cyber activity it discovered on its network. The Fog ransomware group claims responsibility for the attack.
MassDevelopment
January 18, 2025
•[ ransomware, finance, government ]
MassDevelopment, the Massachusetts state development finance agency in Boston, was listed by the BianLian ransomware group on its leak site on Jan 18, 2025, which claimed theft of 4 TB of data. The agency has not publicly confirmed the claim.
AIL Hospitality Group
March 7, 2025
•[ ransomware, leak, retail ]
PEAR listed AIL Hospitality Group on its leak site on August 5, 2025. DataBreach.com later indexed 11,086 records containing names and driver's license information and assigns March 7, 2025 as the breach date. Independent ransomware trackers estimate the compromise in early July 2025, so the precise intrusion date remains contested. No independently verified operational disruption has been established.
Autism Services of Saskatoon Inc.
March 20, 2025
•[ ransomware, healthcare, misconfiguration ]
Autism Services of Saskatoon discovered a ransomware attack on March 20, 2025 after certain systems became inaccessible. A forensic investigation determined that the threat actor likely accessed and exfiltrated information collected from clients and former employees, and a ransom demand was found on a desktop computer. Autism Services isolated affected systems, terminated network access, and began restoring servers the following day. The last observed unauthorized activity occurred March 20. The organization notified 2,168 affected individuals, and subsequent monitoring found no evidence that the copied information was published or used for fraud. Investigators could not conclusively identify the entry point or responsible actor, although a firewall vulnerability was considered the likely access path.
Optima Tax Relief
May 1, 2025
•[ ransomware, financial, leak ]
Ransomware operators infiltrated Optima Tax Reliefs network and stole client tax-case data before leaking samples online. The company confirmed exposure of 3,114 individuals SSNs and financial account details but reported no further operational disruption.
Academic Urology & Urogynecology of Arizona
May 18, 2025
•[ ransomware, healthcare, leak ]
Academic Urology detected unauthorized network access on May 22, 2025 and later determined that files may have been accessed or acquired between May 18 and May 22. INC claimed the incident on June 17, 2025, but the practice did not confirm that attribution. The practice notified 73,281 people after completing its review on January 30, 2026; no operational disruption was reported.
Madera Community Hospital
May 28, 2025
•[ ransomware, healthcare ]
An unauthorized third party accessed Madera Community Hospital's network on May 28 and May 29, 2025. The hospital later determined that files from part of its network were likely acquired, ultimately identifying 150,810 affected individuals. An unidentified extortion group claimed responsibility and demanded payment but later withdrew its demand after learning the victim was a hospital, stating that it did not want to harm patients. No known group has publicly identified itself as the perpetrator, and the hospital found no evidence that the compromised information was publicly released.
YES24
June 9, 2025
•[ ransomware, retail, technology ]
Ransomware encrypted internal servers at YES24 beginning June 9 2025, forcing nationwide outage of its ticketing, e-book, and online community services for four days; operations gradually restored; no confirmed data exfiltration.
Uganda Electricity Transmission Company Limited (UETCL)
August 1, 2025
•[ ransomware, energy, hack ]
In August 2025, Uganda Electricity Transmission Company Limited experienced a suspected ransomware incident that compromised monitoring systems for the national electricity transmission network; the service was restored through backup procedures, according to INTERPOL reporting cited in August 2026. Qilin claimed to have breached the utility on August 18, 2025 and to possess contracts, financial statements, identity documents and service agreements, but independent verification of those stolen files, encryption and the precise disruption date is unavailable. No confirmed manipulation of physical grid controls or nationwide blackout was established.
Norwest Venture Partners
August 9, 2025
•[ ransomware, finance, technology ]
Sinobi claimed an intrusion into Norwest Venture Partners dated 9 August 2025 and publicly listed the firm on 15 August, threatening to publish stolen data unless Norwest negotiated. The supplied breach database later indexed 4,156 email records. Norwest did not publicly confirm the incident, and no victim-specific evidence of encryption or operational disruption was found; disruption cannot be ruled out because Sinobi commonly deploys ransomware.
Comcast Corporation
September 29, 2025
•[ ransomware, technology, leak ]
Actors claimed and then released a 186 GB compressed archive (?834 GB uncompressed) said to originate from Comcast systems after failed extortion; impact is large-scale exposure of internal files rather than service downtime. Organization responses and regulator notifications anticipated.
Unlimited Technology Systems, LLC
October 5, 2025
•[ ransomware, healthcare, technology ]
An unauthorized actor accessed Unlimited Technology Systems' commercial data center from October 5 through October 10, 2025 and obtained copies of files containing personal and protected health information. Unlimited later confirmed the incident was ransomware and that several systems hosting its g4-Centricity for Vector platform were encrypted, prompting suspension of access to hosted systems. The incident ultimately affected 3,803,750 individuals. No ransomware group has publicly claimed responsibility.
Bennett College
October 27, 2025
•[ ransomware, education ]
Bennett College, a private HBCU for women in Greensboro, N.C., had network data accessed Oct. 27-Nov. 15, 2025, affecting 30,065 people. INC Ransom listed the college on its leak site Dec. 6; the college notified the state AG and offered credit monitoring.
Cornerstone Staffing Solutions, Inc.
November 13, 2025
•[ ransomware, technology ]
Qilin listed Cornerstone Staffing Solutions on November 13, 2025 and displayed samples from recruitment databases and company files while threatening publication. Cornerstone had not publicly confirmed the claim, and no operational disruption was reported.
Under Armour
November 17, 2025
•[ ransomware, retail, technology ]
Everest ransomware group claims to have breached Under Armour systems and exfiltrated 343GB of data including detailed product records internal corporate files and extensive customer information and has issued a short deadline for the company to make contact while threatening to leak the data if there is no response
National Association on Drug Abuse Problems (NADAP)
November 26, 2025
•[ ransomware, healthcare ]
Unauthorized access to NADAP's network occurred on or around November 26, 2025 and was discovered on January 10, 2026. NADAP isolated and took impacted systems offline as a containment measure. Genesis claimed responsibility on March 6, 2026 and said it stole approximately 2 TB of medical and HR data. NYC Health + Hospitals confirmed that 5,086 of its patients were among those whose protected health information was accessed.
Undisclosed U.S. services company
December 1, 2025
•[ ransomware, sqlinjection, technology ]
In December 2025, DragonForce-affiliated operators gained access to an undisclosed U.S. services company, likely through an unknown SQL or MSSQL server vulnerability or purchased access. During a dwell time of approximately one to two months, the attackers modified firewall rules, used DLL sideloading and vulnerable-driver techniques, deployed the Go-based Backdoor.Turn remote-access tool using Microsoft Teams TURN relays for command and control, stole confidential files, and ultimately encrypted systems with DragonForce ransomware. The exact intrusion day, affected systems, operational impact, and contents of the stolen data were not disclosed.
Anatomic and Clinical Laboratory Associates, P.C.
December 1, 2025
•[ ransomware, healthcare, leak ]
Anatomic and Clinical Laboratory Associates detected potential unauthorized activity on December 1, 2025. Its investigation found that an unauthorized actor may have accessed its network and downloaded files. Insomnia later claimed responsibility, but the laboratory did not publicly attribute the incident to the group. No encryption or operational disruption was reported.
