Welcome to ISMG's Ransomware Resource Center!

Ransomware has rapidly become one of the world's most prevalent types of cybercrime. The lure for criminals is easy to see: Using highly automated and easily distributed crypto-locking malware to forcibly encrypt systems, attackers can demand bitcoin ransoms in exchange for decryption keys. Use this Ransomware Resource Center for the latest details on emerging ransomware variants, threat intelligence on attackers, plus best practices for detection, response and remediation.

Ransomware Hackers Look for New Tactics Amid Falling Profits

Mathew J. Schwartz • October 28, 2025

Collective efforts to bolster cybersecurity defenses have been taking a big bite out of ransomware groups' earnings, leading groups to reach for new strategies, including social engineering, supply chain attacks, extortion services and bribing insiders, warn incident response experts.

Fraud Management & Cybercrime

Medusa Ransomware Affiliates Tied to Fortra GoAnywhere Hacks

Latest

Business Continuity Management / Disaster Recovery

Planning for Cyber Chaos: Healthcare's Resilience Test

Marianne Kolbasuk McGee • October 30, 2025

When a hospital, healthcare system or one of their critical third-party vendors is hit with a ransomware attack, all hell can break loose quickly. That can mean diverted ambulances, cancelled patient appointments, business processes put on hold and other critical operations stopped.

Security Operations

Palo Alto Networks Bets Big on Agentic AI

Michael Novinson • October 28, 2025

With new products set to launch, Palo Alto Networks is expanding its AI cybersecurity footprint. Chairman and CEO Nikesh Arora introduced the AgentiX platform, a retooled cloud approach, identity enhancements and a deal making Palo Alto the core security provider for Oracle Cloud.

Data Breach Notification

Montana Officials Looking Into BCBS Breach Tied to Vendor

Marianne Kolbasuk McGee • October 23, 2025

Montana regulators are investigating a breach affecting 462,000 Blue Cross Blue Shield of Montana members involving one of the insurer's service providers. The vendor, Conduent, in April notified the SEC that the data theft affected numerous clients and a "significant number" of people.

Identity & Access Management

JumpCloud Acquires Breez to Enhance Access Control Strategy

Michael Novinson • October 23, 2025

Breez's approach to identity threat detection and data classification made it a strategic fit for JumpCloud, which aims to fully integrate ITDR into access workflows. The deal follows the Stack Identity acquisition and adds product leadership and engineering talent.

Agentic AI

Defakto Raises $30.75M to Lead Non-Human Identity Space

Michael Novinson • October 21, 2025

With $30.75 million in Series B funding, Defakto aims to strengthen non-human identity security across AI workloads and cloud platforms. The Silicon Valley-based startup plans to deepen discovery, governance and enterprise integrations, while expanding its go-to-market strategy.

Business Continuity Management / Disaster Recovery

Cyberattack Disrupts Services at 2 Massachusetts Hospitals

Marianne Kolbasuk McGee • October 20, 2025

A North Central Massachusetts nonprofit healthcare system with two community hospitals, a medical group and several other care facilities has taken its IT network offline and is diverting ambulance patients as it continues to respond to a cyberattack that hit last week.

Application Security & Online Fraud

Harness Purchases Qwiet AI to Strengthen AppSec Offerings

Michael Novinson • September 29, 2025

Harness is acquiring Qwiet AI to expand its application security capabilities with advanced static application testing and reachability analysis. The deal will bring true positive rates of 97%, native UI integration and runtime visibility through its existing Traceable acquisition.

Operational Technology (OT)

CS4CA: OT Security Strategies for Critical Infrastructure

Joshua Cunningham-Marsh • September 22, 2025

IT and OT teams at critical infrastructure companies face the imperative of balancing digitalization and automation with cybersecurity. In advance of the CS4CA Europe London Conference (Sept. 30 - Oct. 1, 2025), event speaker Marta Majtenyi previews some of the major themes.

Critical Infrastructure Security

CyberEdBoard Profiles in Leadership: Marcin Szczepanik

Anna Delaney • September 22, 2025

Marcin Szczepanik, head of information security at Electricity North West, built his leadership philosophy on empathy, visibility and trust. He believes security must align with business goals and treat resilience like safety, with practice, collaboration and shared accountability driving protection.

Artificial Intelligence & Machine Learning

Koi Raises $48M to Safeguard AI Models, Code and Extensions

Michael Novinson • September 10, 2025

With $48 million in funding, Koi is scaling up efforts to help enterprises secure browser extensions, AI models and package code often missed by legacy tools. CEO Amit Assaraf says Koi is the only firm offering centralized governance for this fast-growing risk category.

Healthcare

Feds Release Updated HIPAA Security Risk Analysis Tool

Marianne Kolbasuk McGee • September 10, 2025

Federal regulators have updated their HIPAA security risk assessment tool that's long been aimed at helping small and midsized providers and business associates with risk analysis - an activity that many healthcare organizations can't seem to get right.

Data Breach Notification

Georgia Hospital Notifying 163,000 of 2024 Ransomware Hack

Marianne Kolbasuk McGee • September 8, 2025

A public Georgia community hospital is notifying more than 163,000 individuals that their sensitive health information was compromised in a June 2024 ransomware attack. The cybercriminal gang Monti on its dark website last summer claimed Wayne Memorial Hospital as one of its victims.