grep -rl "extortion" ./articles
ThreatLabz's 2026 report says ransomware attacks rose more than 275% in the year to March, with 896.2 terabytes stolen and 328 million dollars in traced payments. In the same release, the number of victims named on leak sites fell 3% to 7,366. One figure is Zscaler's own telemetry of attempts; the other is what criminals chose to publish.
McKesson has confirmed a breach involving third-party applications. ShinyHunters claims a terabyte and 284 million records including Social Security numbers and medical histories, and demanded $55.236 million. The group has also clarified that the figure counts records, not individuals. Nobody knows how many people are affected, including them.
Berlin's state network was breached on 7 August and data flowed out until departments were disconnected on the 14th. The governing mayor says the state is being blackmailed and will not pay. The attackers claim 5.79 terabytes and 1.44 million files. Berlin has published no figures of its own, which leaves one source for every number in circulation.
Qilin listed the Bureau of Alcohol, Tobacco, Firearms and Explosives on its leak site on 26 August. The ATF confirmed an intrusion into a standalone system it disconnected, and says its mission is unaffected. It also confirmed that senior Justice Department officials designated the event a major incident — a federal threshold with a definition.
Someone using the name Cyberleek has released gameplay clips and the full map from what appears to be a complete, unreleased build of Grand Theft Auto VI, three months before launch. They say it is a protest against digital-only selling, and that the releases continue until Rockstar issues a public apology. That demand has no definition of being met.
CVE-2026-12569 in PTC Windchill and FlexPLM is in CISA's exploited catalogue, and ReliaQuest has pulled apart the JSP implant Clop is dropping through it. One command decrypts the LDAP manager password out of the keystore, which turns a PLM compromise into a directory compromise.
Ransom Busters says it has spent three years breaking into ransomware operators' servers and can get your files back. GuidePoint responded to two of these incidents and found the same backdoor password, the same attacker hostname and the same toolkit in both — which points somewhere much less heroic.
Cameron Curry emailed dozens of Brightly Software employees demanding $2.5 million in crypto, with a $100,000 monthly escalation. The company paid $7,540 before reporting it. He got two years.
UNC6671 runs four extortion brands off one set of domains. The pretext is a security upgrade — FIDO2 enrolment, MFA migration — and the payoff is an adversary-in-the-middle portal. Average settled payment: $750,000.
Two law firms, an equine hospital, a mental health charity and three metal companies, published in batches with a two-day gap between attack and leak. It shares a name with Microsoft's Storm-1175, which is a different actor entirely.
Microsoft's analysis describes two Polygon wallet addresses holding proxy URLs and leak-blog posts, with negotiation over Session. There is no hosting provider to serve, because there is no hosting.
Attack volume jumped nearly 20% month over month. Qilin alone accounted for 372 incidents across Europe, hitting 26 of 31 countries analyzed.