Welcome to ISMG's Ransomware Resource Center!

Ransomware has rapidly become one of the world's most prevalent types of cybercrime. The lure for criminals is easy to see: Using highly automated and easily distributed crypto-locking malware to forcibly encrypt systems, attackers can demand bitcoin ransoms in exchange for decryption keys. Use this Ransomware Resource Center for the latest details on emerging ransomware variants, threat intelligence on attackers, plus best practices for detection, response and remediation.

2 Cyber Pros Admit to Being BlackCat Ransomware Affiliates

Mathew J. Schwartz • December 30, 2025

Two American cybersecurity professionals who moonlighted as BlackCat ransomware gang affiliates pleaded guilty to using the crypto-locking malware to extort at least five victims in the United States, including a medical device maker that paid a cryptocurrency ransom worth over $1 million.

Cybercrime

US, Allies Sanction Russian Bulletproof Ransomware Host

Latest

Cybercrime

2025 in Health Data Breaches and Predictions for 2026

Marianne Kolbasuk McGee • December 30, 2025

If 2025 lacked a signature attack, hundreds of hospitals, health systems, clinics, physician practices, business associates and other vendors nonetheless experienced breaches in 2025 that cumulatively affected tens of millions of Americans. Hackers will try again harder in 2026.

Fraud Management & Cybercrime

Georgia Hospital Settles Lawsuit in Alleged Embargo Hack

Marianne Kolbasuk McGee • December 11, 2025

A small, rural county-owned Georgia community hospital has agreed to settle consolidated class action litigation involving a 2024 hacking incident in which ransomware gang Embargo claimed to have stolen 1.15 terabytes of the organization's data and leaked it on the darkweb.

Scattered Lapsus$ Hunters Tied to Targeting of Zendesk Users

Akshaya Asokan • November 28, 2025

Continuing its targeting of customer data, the cybercrime group Scattered Lapsus$ Hunters appears to be gearing up for large-scale attacks involving typosquatted domains that lead to phishing domains designed to steal Zendesk users' valid credentials, warn security researchers.

Cyber Insurance

Cyber Risk Redefines the Bottom Line for FIs

Anna Delaney • November 13, 2025

FIs face rising cyber complexity as threat actors evolve and insurers raise the bar. David Anderson, vice president of cyber at Woodruff Sawyer, a Gallagher company, explains how proactive defense, governance and privacy controls define the new economics of cyber risk.

Data Security

UK NHS Named in Clop Gang's Exploits of Oracle Zero-Days

Marianne Kolbasuk McGee • November 13, 2025

Ransomware gang Clop has claimed the United Kingdom's National Health Service among its latest victims. The NHS confirmed that it is listed on a cybercriminal group's dark website, but did not comment on Clop's claims. The hack attack appears tied to Oracle E-Business Suite exploits.

Government

Small County, Same Cyber Risks

Anna Delaney • November 12, 2025

Small counties across the U.S. continue to face cyber risks from foreign sources, relying on the limited tools and resources they have to defend their communities. Local governments are barely keeping pace with the sophisticated nature of modern cyberattacks.

Business Continuity Management / Disaster Recovery

Planning for Cyber Chaos: Healthcare's Resilience Test

Marianne Kolbasuk McGee • October 30, 2025

When a hospital, healthcare system or one of their critical third-party vendors is hit with a ransomware attack, all hell can break loose quickly. That can mean diverted ambulances, cancelled patient appointments, business processes put on hold and other critical operations stopped.

Security Operations

Palo Alto Networks Bets Big on Agentic AI

Michael Novinson • October 28, 2025

With new products set to launch, Palo Alto Networks is expanding its AI cybersecurity footprint. Chairman and CEO Nikesh Arora introduced the AgentiX platform, a retooled cloud approach, identity enhancements and a deal making Palo Alto the core security provider for Oracle Cloud.

Data Breach Notification

Montana Officials Looking Into BCBS Breach Tied to Vendor

Marianne Kolbasuk McGee • October 23, 2025

Montana regulators are investigating a breach affecting 462,000 Blue Cross Blue Shield of Montana members involving one of the insurer's service providers. The vendor, Conduent, in April notified the SEC that the data theft affected numerous clients and a "significant number" of people.

Identity & Access Management

JumpCloud Acquires Breez to Enhance Access Control Strategy

Michael Novinson • October 23, 2025

Breez's approach to identity threat detection and data classification made it a strategic fit for JumpCloud, which aims to fully integrate ITDR into access workflows. The deal follows the Stack Identity acquisition and adds product leadership and engineering talent.

Agentic AI

Defakto Raises $30.75M to Lead Non-Human Identity Space

Michael Novinson • October 21, 2025

With $30.75 million in Series B funding, Defakto aims to strengthen non-human identity security across AI workloads and cloud platforms. The Silicon Valley-based startup plans to deepen discovery, governance and enterprise integrations, while expanding its go-to-market strategy.

Business Continuity Management / Disaster Recovery

Cyberattack Disrupts Services at 2 Massachusetts Hospitals

Marianne Kolbasuk McGee • October 20, 2025

A North Central Massachusetts nonprofit healthcare system with two community hospitals, a medical group and several other care facilities has taken its IT network offline and is diverting ambulance patients as it continues to respond to a cyberattack that hit last week.