Ransomware

Ransomware group 'The Gentlemen' claims breach of 1,900 HKBU credentials

The Gentlemen, a ransomware-as-a-service group active since mid-2025, claims to have compromised 1,900 credentials from Hong Kong Baptist University. With no official breach notification yet filed, experts stress immediate forensic analysis, credential resets, and transparent communication to contain the damage.

Source: Danny Mok · South China Morning Post

Gunra Ransomware: 51 Victims After Exploiting 2 Fortinet & Schneider Flaws

A joint US-South Korea advisory reveals Gunra ransomware has hit 51 organizations by weaponizing CVE-2024-5559 in Schneider Electric gear and CVE-2025-24472 in Fortinet products. The group uses double extortion, phishing, and advanced encryption, having launched a formal RaaS program in January 2026.

Source: The Hacker News

Qilin Ransomware Tops H1 2026; 31K Firms Exposed in VwbP Breach

The Qilin ransomware group dominated attacks in the first half of 2026, crippling organizations via RaaS. Simultaneously, a massive data breach at the Register of Beneficial Owners exposed the records of 31,000 legal entities, and a separate leak from the Police National Legal Database compromised sensitive government contacts. These incidents highlight the growing convergence of ransomware and supply chain threats, demanding heightened third-party risk management and incident response capabilities across all sectors.

Source: Ashish Khaitan · The Cyber Express

Coca-Cola's Fairlife Shuts 100% of US Dairy Production in Ransomware Attack

A ransomware attack forced Coca-Cola's Fairlife to halt all U.S. dairy production, triggering an SEC disclosure and law enforcement involvement. The incident underscores the escalating threat of cyberattacks on operational technology in the food sector, with unknown supply chain consequences.

Source: wsoctv.com · wgauradio.com

Ransomware Hits Top-3 US Milk Brand: Fairlife OT Attack Exposes Food Sector Risk

The ransomware breach that forced Fairlife to shut down all U.S. production reveals how threat actors are targeting operational technology in critical food manufacturing. Security teams must assess the convergence of IT and OT, as this incident could signal a new wave of attacks against agriculture and beverage infrastructure.

Source: kiss1027fm.iheart.com · wyht.iheart.com

Ransomware Forces Coca-Cola to Halt 100% of Fairlife US Production

Coca-Cola confirms a ransomware attack on its Fairlife subsidiary, suspending all U.S. production. The incident highlights the escalating threat to food manufacturers, with no group yet claiming responsibility and data exfiltration status unknown.

Source: beveragedaily.com · finance.yahoo.com

Ransomware Breaches Fairlife's Production Systems, Halting $3B Dairy Giant

Fairlife, a $3B dairy brand under Coca-Cola, suffered a ransomware attack that specifically breached its production systems, prompting an immediate shutdown of all US manufacturing. The incident highlights the growing threat of ransomware to operational technology (OT) in the food and beverage sector, as attackers increasingly target critical infrastructure for maximum disruption.

Source: castanetkamloops.net · citizensvoice.com

Scattered Spider teens jailed 5.5 years for £29M TfL attack – extradition looms

Two UK teenagers, core members of the Scattered Spider hacking group, have been sentenced to 5.5 years for a £29 million cyber attack on Transport for London. The case demonstrates the group’s social engineering prowess and the role of cryptocurrency tracing in identifying attackers, while one hacker now faces extradition to the US for $87 million in extortion.

Source: Editor (GB)

Fairlife ransomware attack halts production: No gang claims $4B Coca-Cola unit

The ransomware attack on Coca-Cola's Fairlife subsidiary has shut down US dairy production, with the company's SEC filing revealing a breach of production systems. No threat actor has claimed responsibility, and the investigation is ongoing, raising questions about data exfiltration and potential extortion. Cybersecurity experts note parallels to past food sector attacks that caused weeks of disruption.

Source: BleepingComputer · TechCrunch

AI-run ransomware encrypts 1,300+ configs in 31-second attack

Sysdig’s JadePuffer attack marks the first agentic ransomware, with an AI autonomously encrypting over 1,300 records in a real incident. Human operators still set up the infrastructure, signaling a new era of human-AI teaming in cybercrime. Defenders must prepare for machine-speed attacks that adapt within seconds.

Ransomware hits Kee Wah Bakery: 3 data categories at risk in Hong Kong

Hong Kong’s Kee Wah Bakery suffers a ransomware attack, potentially exposing employee, partner and customer data. The incident, reported to regulators, highlights growing supply chain and third‑party risks in the region’s digitally connected food retail sector.

Source: Edith Lin (hk) · Edith Lin (cn)

Ransomware Paradox: Global Volume Drops as CL0P and The Gentlemen Surge

While global ransomware incident volume has seen a notable decline in early 2026, specialized threat actors like CL0P and The Gentlemen are bucking the trend with aggressive campaigns. This shift indicates a strategic move away from high-volume encryption toward sophisticated, high-value data exfiltration and targeted extortion.

Source: itbrief.co.nz · itbrief.news

Ransomware Payment Rates Hit Record Low of 28% Amid Surge in Attacks

The percentage of ransomware victims opting to pay ransoms has plummeted to an all-time low of 28%, even as the total volume of attacks continues to climb. This trend signals a major shift in corporate resilience and a growing refusal to fund the cybercriminal ecosystem.

Source: BleepingComputer · BleepingComputer

UMMC Ransomware Attack Forces Statewide Clinic Closures and Surgery Delays

The University of Mississippi Medical Center has shuttered approximately 36 clinics and canceled elective procedures following a major ransomware attack. The disruption, entering its second day, highlights the critical vulnerability of regional healthcare infrastructure to digital extortion.

UMMC Shuts Down All Clinics Following Major Ransomware Attack

The University of Mississippi Medical Center (UMMC) has suspended operations across its entire clinic network following a disruptive ransomware attack. The shutdown highlights the critical vulnerability of academic medical centers and the extreme measures required to contain modern cyber threats.

UMMC Shuts Down Statewide Clinics Following Major Ransomware Attack

The University of Mississippi Medical Center (UMMC) has suspended operations across its entire network of clinics following a disruptive ransomware attack. The incident has forced the state's only academic medical center to transition to manual processes and divert non-emergency patients, highlighting the persistent vulnerability of critical healthcare infrastructure.

Source: BleepingComputer · BleepingComputer

Advantest Responds to Ransomware Attack on Semiconductor Testing Systems

Japanese semiconductor testing giant Advantest has confirmed a ransomware incident affecting its corporate network and potentially compromising sensitive data. The company is currently investigating the scope of the breach and has pledged direct notification to any affected customers or employees.

Source: marketscreener.com · Dow Jones (fr)

LockBit 5.0 Debuts as 0APT Claims Massive Unverified Ransomware Campaign

The ransomware landscape is undergoing a significant shift as the LockBit cartel launches its 5.0 iteration with cross-platform capabilities, while a mysterious new entity, 0APT, claims over 200 victims without providing proof of data theft. These developments highlight a dual-track evolution of high-end technical sophistication and aggressive, volume-based psychological warfare.

Source: Cyber Press · Cyber Press