Ransomware encrypts or steals data to disrupt operations and extort victims, making backups, access controls, and incident response essential.
Search across headline titles and summaries.
Background for this topic.
Ransomware is malware used to deny access to systems or data, usually by encrypting files and demanding payment for decryption. Many operations also steal sensitive information and threaten to publish it, so an attack can create both an availability crisis and a privacy or disclosure risk. Initial access may involve phishing, stolen credentials, exposed remote services, or exploitation of unpatched vulnerabilities; attackers may then move through the network before deploying the payload.
Defenses should combine vulnerability management, phishing-resistant authentication where practical, endpoint and network monitoring, and backups that are isolated from routine administrator access and regularly tested for recovery. Organizations should also limit privileges and segment critical systems to reduce the blast radius. An incident requires rapid containment, preservation of forensic evidence, restoration from known-good backups, and assessment of notification, legal, and regulatory obligations. Threat intelligence can help identify relevant criminal infrastructure or tactics, but it does not replace sound access control, patching, detection, and recovery practices.
Barts Health NHS Trust has announced that Clop ransomware actors have stolen files from a database by exploiting a vulnerability in its Oracle E-business Suite software. [...]
Also: More HIPAA Challenges, the Growing AI Gap for Small- to Medium-Sized FirmsIn this week's panel, four ISMG editors discussed the latest shifts in ransomware tactics, a major development in the Texas challenge to the HIPAA Privacy Rule related to reproductive rights, and how SMBs navigating AI are facing very different challenges than large enterprises.
Laptop maker says a vendor breach exposed some phone camera code, but not its own systems Asus has admitted that a third-party supplier was popped by cybercrims after the Everest ransomware gang claimed it had rifled through the tech titan's internal files.…
American pharmaceutical firm Inotiv is notifying thousands of people that they're personal information was stolen in an August 2025 ransomware attack. [...]
Marquis Software Solutions Says Ransomware Group Hit SonicWall Device, Stole DataMarketing and compliance software maker Marquis Software Solutions, which counts over 700 banks and credit unions as customers, said a ransomware group breached its SonicWall firewall and stole hundreds of thousands of individuals' personal details, including Social Security numbers.
DragonForce expanded its ransomware operation in 2025 by working with English-speaking hackers known for advanced social engineering and initial access. Acronis explains how the "Scattered Spider" collaboration enables coordinated, multistage intrusions across major environments. [...]
Ransomware groups target enterprises during off-hours, weekends, and holidays when security teams are stretched thin and response times lag.
The UK government’s proposed ransomware payment ban for public sector and critical infrastructure will come with national security exemptions
Japan’s Askul still can’t run all its sites, but at least the fax line held up OK Japanese e-tailer Askul has resumed online sales, 45 days after a ransomware attack.…
Rapid7's Christiaan Beek on Ransomware Tactics and How to Mitigate Attacks in 2026Ransomware attacks are reaching record highs, and 2026 may be even worse, said Christiaan Beek, senior director of threat intel and analytics at Rapid7. He warns that hackers are exploiting vulnerabilities as soon as they're disclosed, and they're focusing on flaws in devices on the network edge.
The Inc ransomware gang took responsibility for the attack earlier this month and claimed it stole sensitive subscriber data.
Multiple European law enforcement agencies recently disrupted Cryptomixer, a service allegedly used by cybercriminals to launder ill-gotten gains from ransomware and other cyber activities.
At least one London council has had data compromised after a suspected ransomware attack last week