Latest cybersecurity reporting from selected sources.

Hackers Constantly Break 'Confirmation of Data Destruction' PromisesWhen a business that stores children's personal data gets hit by data-leaking extortionists, what should it do? For Instructure, which develops online learning platform Canvas, the answer was to pay a ransom, and tell victims, straight-faced, to have "digital confirmation of data destruction."

Revenue From Supply-Chain Attacks by Clop Group Sharply Fell, Report InvestigatorsOnce lucrative steal-and-leak campaigns pioneered by Russian ransomware group Clop look set to go the way of the dinosaurs. While an estimated 25% of victims paid a ransom in the inaugural campaign five years ago, the number of victims that paid fell to zero by 2023, report ransomware responders.

Crackdown Targets Multiple Members of Cybercrime Group, Including 'Hash Crackers'Police raided two suspected members of the notorious Black Basta ransomware group - tied to over 600 victims worldwide and many millions in ransom payments - in Ukraine and issued an international arrest warrant for the Russian national suspected of being the operation's founder and ringleader.

Americans Extorted at Least 5 Firms, Earning $1 Million From a Medical Device MakerTwo American cybersecurity professionals who moonlighted as BlackCat ransomware gang affiliates pleaded guilty to using the crypto-locking malware to extort at least five victims in the United States, including a medical device maker that paid a cryptocurrency ransom worth over $1 million.

UN Says Southeast Asian Scam Centers Generate $41 Billion in Illicit Annual ProfitsSoutheast Asian scam centers tied to $41 billion in illicit annual profits gleaned from romance and investment scams, ongoing gambling, and holding some of the hundreds of thousands of victims trafficked to work at the centers to ransom, continue to fuel geopolitical conflict across the region.

Analysis of Seized LockBit Data Suggests Victims Who Pay Enjoy More Media CoverageBad news for any organization that's ever paid a ransom in a bid to avoid their breach coming to light, or for a promise from attackers to delete stolen data, with a study of seized LockBit data finding that victims who paid a ransom were more likely to see the attack get detailed in the media.

Innovation Continues, Although Sloppy Coding Can Still Leave Data UnrecoverableRansomware groups continue to display more innovation, persistence and planning in their quest to amass ransom-paying victims and maximize profits. This has included repeat supply-chain attacks, harvesting credentials to use in later campaigns, as well as launching their own affiliate programs.

DOJ: Suspects Hit 5 Firms, Including 3 in Healthcare, Netted $1.3M in Ransom MoneyThree former employees of two cybersecurity firms stand accused of using BlackCat ransomware in a conspiracy to extort five U.S. companies, including three in the healthcare sector. One of the victim companies paid nearly $1.3 million to the attackers, U.S. federal prosecutors said.

Criminals Behind Salesloft Breach Continue to Target Salesforce-Using CustomersCustomer relationship management software giant Salesforce has directly notified customers that it won't be complying with ransom demands issued by the data-stealing crime group ShinyHunters, which continues to pressure Salesforce-using customers who fell victim to the Salesloft breach.

UK and US Charge Suspects With Hitting Transport for London, Healthcare, OthersTwo English teenagers have been charged with disrupting London's transport network as part of a Scattered Spider cyberattack. One of the suspects has also been accused by the U.S. of helping to attack 120 other victims, generating $115 million in ransom payments.

Ransomware Gang Nova Poised to Leak Patient Data, Lab Stays Mum on NegotiationsWith ransomware gang Nova threatening to leak patient data on the darkweb, a Dutch laboratory that performs cervical cancer tests for a government screening program is mum about the ransom negotiations, but it says the cyberattack in July has affected 941,000 patients.

Operation Checkmate Disrupts One of the Large Russian-Speaking Ransomware GroupsAn international law enforcement operation has disrupted BlackSuit, a ransomware group tied to hundreds of victims and ransom demands that exceeded half a billion dollars. The takedown occurred as security experts tracked the rise of a new group called Chaos, which may be a BlackSuit rebrand.

FBI Accuses Ukrainian Man of Identifying Exploitable Flaws in Victims' NetworksA 33-year-old Armenian man, Karen Vardanyan, accused of facilitating Ryuk ransomware attacks against numerous organizations, is due to stand trial in the U.S. in August. The FBI said the Ryuk operation earned at least $15 million in cryptocurrency ransom payments from victims.

Incident Reporting Low, Government Study FindsRansomware attacks targeting U.K. organizations continued to rise last year concluded the British government despite a low reporting rate by victims. The findings come as the government is considering banning public sector organization from paying ransom and mandating incident reporting.

FBI Ties Group to Triple-Extortion Tactics Involving Follow-On Ransom DemandsThe Medusa ransomware group has been continuing to pummel critical infrastructure sectors across America, warns a joint U.S. government alert. The FBI said the group's tactics include triple extortion, meaning it continues to shake victims down for a ransom, even after they've paid.

Man Accused of Hacking 90 Organizations Globally Under a Variety of AliasesA suspected hacker tied to more than 90 global data breaches has been arrested in Thailand. The Royal Thai Police and the Singapore Police Force said the 39-year-old suspect used a variety of aliases, including Altdos, Desorden, Ghostr and 0mid16B, and attempted to pressure victims into paying a ransom.

Incident Response Firm Reports 25% of Victims Paid - Typically for a DecryptorThe slice of organizations opting to pay extortion after being hit by ransomware dropped to an all-time low of 25%. Underpinning the drop is a combination of better defenses, improved business resilience as well as organizations simply deciding to not pay criminals.

Cybercrime History Teaches That Paying a Ransom for Data Deletion is FoolishData breach victim PowerSchool, maker of a widely used K-12 student information system platform, has been attempting to assure schools, and parents and guardians, by saying its attacker has promised to delete the stolen data. What's the old saying about those who fail to learn from history?

New Law Calls for Better Reporting, Securing Devices and Critical InfrastructureThe Australian government's proposed cybersecurity legislation passed both houses of the Parliament on Monday, formalizing the government's strategy to boost ransomware payment reporting, mandate basic cybersecurity standards for connected devices and enhance critical infrastructure security.

Georgia-Based Memorial Hospital and Manor Among Embargo Group's Latest VictimsEmbargo, a newcomer group to the ransomware scene, is threatening to begin publishing 1.15 terabytes of data belonging to a small rural Georgia hospital and nursing home attacked last week unless a ransom is paid before Tuesday. Experts say the double extortion gang disables victims' security tools.