Latest cybersecurity reporting from selected sources.

Ransomware Group ShinyHunters' Victims: Schools, Universities, Ambulance ServiceThe Canvas learning management system with over 30 million active K-12 and higher-education student and teacher users worldwide has been breached by attackers, leading to operator Instructure temporarily taking the service offline. Cue homework and exam scheduling chaos.

Dragos' Dawn Cappelli on Evolving OT Threats and Safety Risks in ManufacturingAdversaries have moved from incidentally hitting operational technology environments to deliberately mapping industrial control loops to enable future disruption. Dawn Cappelli, director of OT-CERT at Dragos, warns that manufacturers must reckon with safety risks that go well beyond ransomware.

Ex-FBI Leader Cynthia Kaiser on Sanctions, Ecosystem Disruption, Stronger PoliciesU.S. cyber policy now treats ransomware gangs and fraud networks as transnational criminal organizations. Former FBI cyber leader Cynthia Kaiser explains how sanctions, infrastructure takedowns, and international cooperation could weaken cybercrime ecosystems and reduce attacks.

Also: Spanish Hacker Granted Russian Asylum, Microsoft Patches Zero-DaysThis week, a CISA warning, Nest footage in Nancy Guthrie case, Signal phishing. Spanish hacker, Russian asylum. Spanish ministry services offline. BYOVD ransomware. The Conduent breach hit Volvo. Microsoft patched zero-days. ZeroDayRAT targeted devices. The SmarterMail breach. Another Fortinet flaw.

Precision Agriculture Boost Yields but Opens Farmers to Cybersecurity RiskPrecision agriculture is transforming U.S. farming with sensors, drones and automation, boosting productivity yields. But growing digital dependence is also expanding the attack surface, exposing farms to ransomware, disruption and rising cybersecurity risk.

Criminals Claim Leak of Customer Data From Six Victims, Including Qantas AirlinesA ransomware group that's been extorting Salesforce customers leaked some stolen data, following the FBI disrupting its shakedown sites. ShinyHunters, part of the rebranded Scattered Lapsus$ Hunters group, after leaking data from six victims, declared its Salesforce customer shakedown over.

Support Portals Offline as Ransomware Gang Claims It Stolen DataBritish-based multinational telecom Colt Technology Services said a "cyber incident" is responsible for days-long disruptions to its customer portal and support services. The WarLock ransomware operation took responsibility for the hack, asserting it stole "1 million documents."

SafePay Ransomware Blamed for Prolonged System OutageGlobal tech distributor and service provider Ingram Micro confirmed days after a widespread IT outage that a ransomware attack disrupted internal systems. The firm disclosed the incident following reports that extortion demands associated with SafePay ransomware appeared on employee devices.

Erie Insurance and Philadelphia Insurance Still Recovering From Separate AttacksStatements by Erie Indemnity Co. and Philadelphia Insurance Companies indicate that voluntary decisions to disconnect their systems from the network - not ransomware encryption - have disrupted operations over the past 10 days since the carriers were hit with separate cyberattacks.

Erie Insurance and Philadelphia Insurance Still Recovering From Separate AttacksStatements by Erie Indemnity Co. and Philadelphia Insurance Companies indicate that voluntary decisions to disconnect their systems from the network - not ransomware encryption - have disrupted operations over the past 10 days since the carriers were hit with separate cyberattacks.

Experts Pointing a Finger at Interlock Ransomware Gang for Kettering Health AttackOhio-based Kettering Health is in its second day responding to a cyberattack that's disrupted patient care services and downed its IT systems, including its patient portal and phones. Some cybersecurity insiders say Interlock ransomware is responsible.

Retailer Continues to Recover From Ransomware IncidentBritish retailer Marks & Spencer was reportedly targeted by financial crime group Scattered Spider, who deployed ransomware on the company's VMware ESXi server. The retailer continues to recover from a cyber incident that disrupted operations in its online and offline stores.

Rising Attacks Masks Lowering Profits, Attention Economy CompetitionRansomware groups' collective power to command victims' attention and compel extortion is waning, notwithstanding the disruption and chaos that continues to be their hallmark. The criminal underground powering ransomware is a world in flux where old, established groups are giving way to new brands.

Biden-Era Cyber Aid Programs Are Still Available, But Future is UncertainEven though rural hospitals and other small healthcare providers don't have deep pockets, cybercriminals continue to target them with ransomware, often causing serious disruption and compromises affecting large swaths of patients. What can be done to help them strengthen cybersecurity?

So far, medical devices affected in ransomware attacks have mostly been a casualty of IT networks being taken offline. But the potential nightmare scenario is a targeted device attack in which cybercriminals threaten to kill patients, said Dr. Eric Liederman, CEO of consulting firm CyberSolutionsMD.

Ransomware Attack Taught Lessons on Health Sector Resiliency, Vendor RedundancyIt's been one year since hackers attacked IT services provider Change Healthcare, quickly shutting down critical processes for thousands healthcare entities, triggering a data breach affecting 190 million people. So what top lessons are emerging from that massive disruption and data compromise?

Experts on Ransomware, Deepfakes, AI Innovation and Cyber Defense the in Year AheadCrippling ransomware attacks, IT outages and relentless nation-state operations dominated headlines in 2024. Will 2025 bring even more disruption? Our panel of cybersecurity leaders, analysts and educators share their outlook for the top 10 trends to watch in the new year.

Looking Back on the Ransomware Attacks, Resilience Lessons and Tech TrendsIn the latest weekly update, ISMG editors discussed defining cybersecurity moments of 2024, from the CrowdStrike outage and its implications for vendor resilience to ransomware's continued evolution, and the shifting dynamics in the tech industry affecting startups and M&A activity.

IT Outage, Downtime Procedures Affecting Services at California Healthcare ProviderCybercriminals claim they stole 17 million patient records from a southern California regional healthcare provider that is still struggling with IT and phone systems outages that have been disrupting patient care since the organization was hit by a ransomware attack on Dec. 1.

Blue Yonder Outage Causing Disruptions for Starbucks, Major Grocery Store ChainsMajor grocery store chains, Starbucks and other large organizations are experiencing disruptions following a ransomware attack against supply chain management service provider Blue Yonder. The provider said it's continuing to probe the attack and has no timeline for service restoration.