Latest cybersecurity reporting from selected sources.

Hackers Constantly Break 'Confirmation of Data Destruction' PromisesWhen a business that stores children's personal data gets hit by data-leaking extortionists, what should it do? For Instructure, which develops online learning platform Canvas, the answer was to pay a ransom, and tell victims, straight-faced, to have "digital confirmation of data destruction."

Revenue From Supply-Chain Attacks by Clop Group Sharply Fell, Report InvestigatorsOnce lucrative steal-and-leak campaigns pioneered by Russian ransomware group Clop look set to go the way of the dinosaurs. While an estimated 25% of victims paid a ransom in the inaugural campaign five years ago, the number of victims that paid fell to zero by 2023, report ransomware responders.

Russia-Linked Ransomware Group Dumps Customer Data After Failed Extortion AttemptUnder Armour may trade on the "blood, sweat, respect" slogan, but a Russia-linked ransomware group hasn't been abiding, after they stole data pertaining to 72.7 million of the athleisure giant's customers, then leaked it on darkweb sites after saying the retailer refused to pay a ransom.

More Than 100,000 Affected by Hack Detected on Dec. 30The New Zealand government is probing a year-end ransomware hack of private healthcare service provider Manage My Health that impacted thousands of patients. Digital extortion group Kazu has claimed responsibility and threatened to leak the data on Jan. 15 unless it receives a $60,000 ransom.

Kazu Demands $200K Ransom, Begins Leaking 1.2M Stolen Patient RecordsKazu, a relative newcomer among cybercrime gangs, is threatening to post 353 gigabytes of data allegedly stolen in recent weeks from Doctor Alliance, a Texas-based company that provides document and billing management technology and services to physician practices. The attack appears to be the gang's first in North America.

Ransomware Gang Nova Poised to Leak Patient Data, Lab Stays Mum on NegotiationsWith ransomware gang Nova threatening to leak patient data on the darkweb, a Dutch laboratory that performs cervical cancer tests for a government screening program is mum about the ransom negotiations, but it says the cyberattack in July has affected 941,000 patients.

Firm Admits Paying Ransom in Exchange of Hacker's Promise to Delete Stolen InfoTwo Florida-based law firms with offices in other states are notifying 282,100 people whose healthcare and other information was potentially compromised in separate data theft incidents. One of the firms admitted to paying a ransom to prevent its data from being leaked on the dark web.

7.2 Million Individuals' Personal Data Being Held to Ransom by Threat ActorA data-leak group extortion is shaking down the government of Paraguay for a ransom payment worth $7.4 million, or $1 for every one of the country's citizens. The group, calling itself Brigada Cyber PMC, claims the stolen data includes people's personally identifiable information.

'Lite Panel' Offering Easy Access to Anyone for Just $777 Confirmed by ResearcherRansomware groups continue to find innovative new ways to shake down organizations large and small in their pursuit of ransom payoffs. For the LockBit group, one tweak was to debut a "lite" version of its ransomware portal that appears to have amassed dozens of very inexperienced business partners.

Inc Ransom is Leaking Stolen Data in At Least 2 Attacks, Including Pediatric InfoAt least three United Kingdom National Health Service hospitals are responding to recent cyber incidents, including a children's hospital and a heart and chest specialty hospital are both located in Liverpool and share IT systems. Inc Ransom claims to have stolen data from those two hospitals.

Embargo Group Threatens to Leak Nearly 1.5TB of Drug Collaborative's DataRansomware group Embargo is threatening to publish nearly 1.5 terabytes of data allegedly stolen in an attack on American Associated Pharmacies, a collaborative of 2,000 independent pharmacies. The gang is shaking down AAP for the second installment of an alleged agreed-up ransom deal.

Georgia-Based Memorial Hospital and Manor Among Embargo Group's Latest VictimsEmbargo, a newcomer group to the ransomware scene, is threatening to begin publishing 1.15 terabytes of data belonging to a small rural Georgia hospital and nursing home attacked last week unless a ransom is paid before Tuesday. Experts say the double extortion gang disables victims' security tools.

Crowded Leak Site May Be a Weakness and Fewer New Players a Sign of Higher QualityHow many ransomware victims pay their attackers a ransom precisely to avoid having their names listed - or their stolen data dumped - on a ransomware group's data leak blog? We don't know, but leak site posts don't correlate well with security firms' telemetry data.

Attackers Demanding Up to $5 Million to Delete Stolen Data, Investigators ReportAttackers who stole terabytes of data from customers of Snowflake have been not only offering the data for sale on data leak marketplaces but also extorting some of the victims, demanding a ransom of $300,000 to $5 million each, security researchers report.

Russian-Speaking Gang Follows Typical Playbook; Critical Services Still DisruptedThe ransomware attack that disrupted U.K. pathology services provider Synnovis, continuing to cause thousands of canceled and delayed operations and appointments across London, reportedly featured a $50 million ransom demand from attackers, backed by the typical threat to leak stolen data.

Canadian Retail Pharmacy Chain Says It's Reviewing Exposed Data on Gang's Leak SiteLockBit has begun to leak on its dark web site files of data the Russian-speaking cybercriminal gang claims to have stolen in an April attack on London Drugs. The group had threatened to publish the exfiltrated data if the Canadian retail pharmacy chain does not pay a $25 million ransom demand.

Threatens to Leak Stolen Data; Attack Temporarily Shut Down Retail Pharmacy StoresLockBit cybercriminals demanded a $25 million ransom from Canadian pharmacy retail chain London Drugs following an attack detected in late April that forced the company to temporarily close its 79 stores across western Canada for more than a week.

US and UK Water Giants Report Network Breaches and Data Leaks, But No EncryptionTwo major water providers in the U.S. and U.K. report that they recently fell victim to ransomware attacks. In both cases, attackers appear to have stolen employee or customer data that they're now holding to ransom. Ransomware trackers say known attacks, affecting all sectors, have been surging.