Latest cybersecurity reporting from selected sources.

Also, US Sanction Cybercrime Enablers, Celine Dion Ticket ScamThis week, ransomware victims paying less, cybercrime sanctions, Celine Dion ticket scams, 23andMe to pay $18 million, a 13-year old Daixin infection, Spiral ransomware, Patch Tuesday, CISA ordered rapid SharePoint patching and Spanish police busted a cybercrime ring. Sore Egyptian World Cup losers.

Internal Communications Dumped Online, Revealing Fresh Victims, Repeat TacticsRansomware group The Gentlemen, a relative newcomer to the cybercrime scene, suffered a leak of its internal communications, revealing previously non-public victims, a variety of tactics, techniques and tools, and a relentless focus on popping backup and storage infrastructure.

Cybercrime Gang Claims to Have 108-Gbyte Trove of Insurer's Files, FoldersRansomware gang Everest Group claims to have stolen more than 108 gigabytes of data- including policyholder details - belonging to insurer Liberty Mutual. The cybercrime group began leaking the company's alleged data on Monday afternoon, saying the insurer "failed" to respond to the gang's demands.

Stan Duijf of Dutch National Police on Collaborative Law EnforcementGlobal law enforcement agencies are shifting tactics to disrupt ransomware earlier in the attack chain. Stan Duijf of the Dutch National Police describes how collaboration, threat intelligence and cryptocurrency seizures are making cybercrime more costly and less effective for criminals.

Ex-FBI Leader Cynthia Kaiser on Sanctions, Ecosystem Disruption, Stronger PoliciesU.S. cyber policy now treats ransomware gangs and fraud networks as transnational criminal organizations. Former FBI cyber leader Cynthia Kaiser explains how sanctions, infrastructure takedowns, and international cooperation could weaken cybercrime ecosystems and reduce attacks.

Cybercrime Gang Allegedly Stole 4.7 Terabytes of Data, Affecting 2.5MNorton Healthcare, which operates nine hospitals and other care facilities in Kentucky and Indiana, has agreed to pay $11 million to settle class action litigation stemming from a 2023 data theft attack by ransomware-as-a-service gang Alphv/BlackCat that affected nearly 2.5 million people.

Cybercrime Group First Listed Ohio Health System as a Data Theft Victim Last JuneOhio-based Kettering Health is notifying current and former patients and "affiliates" that their personal, health and financial information was potentially compromised in a May 2025 ransomware attack and data theft incident claimed by cybercriminal gang Interlock.

Crackdown Targets Multiple Members of Cybercrime Group, Including 'Hash Crackers'Police raided two suspected members of the notorious Black Basta ransomware group - tied to over 600 victims worldwide and many millions in ransom payments - in Ukraine and issued an international arrest warrant for the Russian national suspected of being the operation's founder and ringleader.

Also: SudamericaData Leak, RaccoonO365 Arrest and Nefilim Conspirator Pleads GuiltyThis week: Spotify metadata scraped, Nissan disclosed third-party breach, millions of Argentines exposed to data leak, African police arrested hundreds in a cybercrime sweep, Nigeria nabbed a phishing operator, the U.S. DOJ charged ATM jackpotting ring and Nefilim ransomware affiliate pleaded guilty.

Cybercrime Gang Rhysida Still Lists the Practice on Its Leak Site Among Its VictimsA Kansas medical group will pay $1.2 million to settle proposed class action litigation involving an attack that compromised the sensitive data of nearly 256,000 individuals. The Rhysida ransomware operation claimed responsibility and said it stole 3 terabytes.

Uncovered: Typosquatted Domains Linked to Suspected Ransomware Group CampaignContinuing its targeting of customer data, the cybercrime group Scattered Lapsus$ Hunters appears to be gearing up for large-scale attacks involving typosquatted domains that lead to phishing domains designed to steal Zendesk users' valid credentials, warn security researchers.

Treasury Links Russian Bulletproof Host Network to Prolific Ransomware OperationsThe U.S., U.K. and Australia sanctioned Russian bulletproof host Media Land for supporting major ransomware gangs, including LockBit and Play, a move paired with new global guidance urging internet service providers to tighten access controls and disrupt cybercrime infrastructure.

Moscow Crackdowns 'Less About Enforcement and More About Optics,' Say ExpertsChanging forces are reshaping the Russian cybercrime ecosystem, as the Kremlin takes a more direct role in leveraging ransomware and other groups for geopolitical influence, while not hesitating to occasionally burn lower-level players as a diplomatic token gesture, say researchers.

Reigning Ransomware Group Thrives in Part Through Affiliated Cybercrime ServicesSecurity experts say the greatest number of ransomware attacks in recent months has continued to trace to the long-running crime group Qilin, and that the group's reign is enabled in no small part through an apparently close affiliation with a network of bulletproof hosting providers.

Bayhealth Medical Center Was Among Cybercrime Group's Many 2024 Healthcare VictimsBayhealth Medical Center in Delaware - an alleged victim of a 2024 hack by the "notorious" and prolific ransomware gang Rhysida that resulted in a breach affecting nearly a half-million people - has agreed to a preliminary settlement in a proposed class action lawsuit stemming from the incident.

What's Left After Raking In Millions From Other People's Blood, Sweat and Tears?Things that continue to elude scientific observation: the Loch Ness Monster, Bigfoot and the ransomware hacker who voluntarily chose retirement. "There's no such thing as 'retirement' in cybercrime," despite some ransomware hackers dangling promises to leave the field.

Cybercrime Gang Monti Listed 84-Bed Rural Hospital Among Its Victims Last SummerA public Georgia community hospital is notifying more than 163,000 individuals that their sensitive health information was compromised in a June 2024 ransomware attack. The cybercriminal gang Monti on its dark website last summer claimed Wayne Memorial Hospital as one of its victims.

Hacking Group UNC6148 Steals Credentials With New OVERSTEP Rootkit, Google SaysA cybercrime group used a backdoor in a fully patched SonicWall appliance to steal credentials and may have sold the stolen data to ransomware groups as part of an ongoing campaign, Google Threat Intelligence Group found. The firm attributed the campaign to a cybercrime group it tracks as UNC6148.

Suspects Tied to April Ransomware Attacks Against Retailers M&S, Co-Op, HarrodsThe U.K.'s National Crime Agency on Thursday arrested in England four suspected members of the Scattered Spider cybercrime collective, as part of an ongoing investigation into major, disruptive hack attacks in April against major retailers Marks & Spencer, the Co-Op and Harrods.

Cybercrime Experts Greet Announcement With SkepticismHunters International said Thursday it closed shop, provoking skepticism among cybercrime experts who said it's more likely the Russian-speaking hackers behind the ransomware group will start up again under a new brand name. "Ransomware groups often rebrand themselves."