ransomware

Law firms are investigating claims by hackers that they breached Rimrock Foundation, an addiction treatment provider, and stole sensitive patient and employee data. Attorneys are gathering information to assess whether victims may pursue legal action. Potential class action investigations typically follow ransomware extortion claims, and affected individuals are being urged to monitor for misuse of their personal information.

A new ransomware group calling itself Storm has published a leak-site post claiming the extortion of Allied Machine & Engineering, a US manufacturing company. A post titled 'Step By Step' with an unknown victim was also listed. The alerts were flagged by cybersecurity threat-intelligence trackers monitoring ransom group blogs.

Police have arrested a 16-year-old suspected of leading the KillSec ransomware group, according to Help Net Security. The arrest of a minor at the head of a ransomware operation has drawn attention to how young hackers have become involved in organized cybercrime, and to the growing activity of the KillSec group itself.

A previously untracked ransomware operation going by the name ImNotAVillain has set up a leak-site presence, publishing brief posts titled 'Notice' and 'Warning' with no stated target sector. Cyberthreat intelligence trackers flagged the new group's blog activity. Its motives, affiliates and victim base are not yet known, and security researchers will be watching for signs of actual extortion activity.

The ransomware group RansomHouse has listed Hospital Hermilio Valdizán in Peru as a new victim on its leak site, adding the healthcare facility to its portfolio of claimed attacks. If confirmed, patient data and hospital systems could be at risk. The claim is circulating among cybersecurity researchers tracking ransomware activity in Latin America's health sector.

The ransomware group Barracuda has added Automovil Club del Ecuador ANETA to its leak site, listing the Ecuadorian motoring organisation in the services sector. The claim was flagged by a cyber threat intelligence feed that tracks new posts from ransomware gangs. No details have been released about the volume of data allegedly taken or any ransom demand.

International law enforcement has seized the infrastructure of the KillSec extortion group and arrested three alleged members of the hacking crew. The takedown reportedly disrupts the group's ability to conduct extortion operations. The action highlights continued police pressure on ransomware and extortion networks, and details about the arrested suspects and the scale of the seized infrastructure have not yet been made public.

Two-thirds of schools in England now report recovering immediately from cyber incidents, suggesting improved resilience to attacks such as ransomware and phishing. Despite the progress, teachers remain divided over who bears responsibility for security and whose job security is at risk when breaches occur, with staff often left handling technical problems outside their expertise.

A ransomware group calling itself Netrunner has listed Main Place Mall as a new victim on its leak site, tagging the target in the retail sector. The claim surfaced alongside fresh postings from other extortion groups, including Booba Project, in a routinely monitored feed of ransomware activity. Security researchers track these listings as an early indicator of breaches, though the mall operator has not publicly confirmed any incident.

Flashpoint has announced a patented ransomware risk model designed to help organizations prioritize vulnerability patching. The scoring method assesses which vulnerabilities are most likely to be exploited in ransomware attacks, allowing security teams to focus remediation efforts where the threat of encryption-based extortion is highest. The announcement is drawing attention within the cybersecurity community as defenders seek better ways to manage growing vulnerability backlogs.

An international police operation has reportedly dismantled the KillSec ransomware group, whose alleged leader is a 16-year-old. The operation targeted members of the cybercrime gang, which is associated with ransomware attacks and data extortion. Discussion is focused on the involvement of teenage hackers in major ransomware operations and what the arrests mean for the group's activity.

Black Cat White Hat Security is asking businesses a blunt question: if ransomware struck tomorrow, would they know what to do? The firm says its Defend & Respond platform now includes a Ransomware Assessment, arguing that cybersecurity is not only about prevention but also about being prepared to respond when an attack happens.

Threat intelligence feeds are reporting a claim by the ransomware actor known as "lamashtu" involving Dr Damiel Pugliese, dated September 2026 and tracked by the monitoring service Yazoul. The claim is explicitly flagged as unverified and the scope of any breach is undisclosed. Cybersecurity observers are circulating it while awaiting confirmation.