Breach Watch

BREACH WATCH BRIEF

Byod Ransomware Compromises 36,000 Systems at UNM Health, Disrupting Patient Care and Surgeries

UNM Health confirmed a ransomware attack that forced the suspension of admissions, surgeries, and classes while exposing personal, payroll, and EHR data. The breach highlights the importance of incident‑response controls that generate defensible audit evidence.

BREACH WATCH BRIEF

Hive Ransomware Operator Sentenced to 70 Months for Hospital and Government Attacks

A former affiliate of the Nefilim and Hive ransomware groups received a 70‑month prison sentence after pleading guilty to attacks on hospitals, government entities, and businesses across 80 countries. The case underscores how ransomware can cripple patient care and cause massive financial loss. Organizations must ensure incident‑response controls are auditable and continuously monitored to demonstrate trust and control assurance.

BREACH WATCH BRIEF

SafePay ransomware campaign compromises over 600 critical‑infrastructure organizations worldwide

CISA and partner agencies report that the SafePay ransomware gang has breached more than 600 critical‑infrastructure entities since 2024, using VPN credential theft and exploited edge‑device flaws. The incident underscores the need for continuous identity‑access controls and auditable backup protection for compliance readiness.

BREACH WATCH BRIEF

SafePay Ransomware Gang Compromises Over 600 Organizations Across the U.S. and Europe

The FBI and European partners warned that the SafePay ransomware gang has breached at least 600 organizations since August 2024, using password guessing, known vulnerabilities and phishing. The incident underscores the need for continuous credential monitoring, patch management and a documented ransomware response plan for audit readiness.

BREACH WATCH BRIEF

SafePay Ransomware Campaign Exploits Multiple CVEs to Target Global Enterprises

CISA warns that the SafePay ransomware group is actively exploiting five known CVEs and credential‑theft techniques to encrypt files across multiple continents. Organizations must tighten access controls and prove incident‑response readiness to meet audit expectations.

BREACH WATCH BRIEF

Qilin Ransomware Attack on Synnovis Leads to Patient Death, Suspect Arrested in Germany

German authorities detained a suspected Qilin ransomware operative after the group’s 2024 attack crippled Synnovis’s pathology systems, causing service disruption and a patient’s death. The incident underscores the need for robust incident‑response controls and continuous audit evidence.

BREACH WATCH BRIEF

City of Columbia Hit by Ransomware Attack, State Law Enforcement Investigates

On 25 Oct 2026 the municipal government of Columbia, SC confirmed a ransomware breach that locked critical services and prompted a state law‑enforcement investigation. The event highlights the need for robust incident‑response controls that satisfy multiple compliance frameworks.

BREACH WATCH BRIEF

IronChain Ransomware Threatens Businesses with Permanent Data Loss and Costly Downtime

IronChain ransomware is actively encrypting enterprise data and threatening permanent deletion, causing extended downtime. The incident underscores the need for immutable backups and a documented ransomware response plan to satisfy audit and trust requirements.

BREACH WATCH BRIEF

Krybit Ransomware-as-a-Service Targets Global Enterprises, Exfiltrates Data Before Encryption

Krybit, a ransomware‑as‑a‑service platform active since early 2026, encrypts files, exfiltrates data and demands US $40‑100 k in cryptocurrency. Victims span IT services, finance, transportation and public registries across Europe, Asia and the Americas, highlighting the need for robust incident‑response controls.

BREACH WATCH BRIEF

Data‑Leaking Ransomware Claims 854 Victims in 93 Countries in September 2026

BREACH WATCH BRIEF

Silent Ransom Group Extorted $207 Million from 27 Law Firms Using Phone‑Based Social Engineering

Silent Ransom demanded $207 M from 27 law firms through phone intimidation, bypassing ransomware encryption. The episode highlights gaps in security‑awareness and incident‑response controls that continuous‑monitoring programs must address.

BREACH WATCH BRIEF

MonsterCloud CEO Accused of Paying Ransomware Gangs While Defrauding Victims

The DOJ alleges MonsterCloud’s CEO secretly paid ransomware groups for decryption keys while overcharging victims. The case illustrates how undisclosed vendor actions can undermine trust and audit readiness, emphasizing the need for transparent incident‑response and third‑party oversight.

BREACH WATCH BRIEF

Ransomware Attack Disrupts Japan’s IDCF Cloud, Affecting 495 Companies and Government Clients

A ransomware group breached IDC Frontier’s IDCF Cloud service, encrypting 3.6 PB of data and shutting down management consoles for 495 corporate and government customers. The incident highlights the need for continuous third‑party monitoring and auditable incident‑response evidence.

BREACH WATCH BRIEF

MonsterCloud Owner Charged With Secretly Paying Ransomware Demands and Over‑Billing Clients

The owner of a ransomware‑recovery firm allegedly paid attackers on behalf of clients while inflating invoices by up to twenty‑fold, leading to a federal wire‑fraud charge. This highlights the need for robust third‑party oversight and auditable ransom‑payment processes for compliance readiness.

BREACH WATCH BRIEF

Ransomware Attack Stole PII from Advantest, Global Semiconductor Test‑Equipment Maker

Advantest disclosed that a February 2026 ransomware breach exfiltrated personal data—including SSNs, passports, and medical records—from its corporate network. The incident underscores the importance of incident‑response and privacy controls for audit readiness.

BREACH WATCH BRIEF

Osaka Metropolitan University Halts Classes After Suspected Ransomware Attack Exposing 130,000 Records

Osaka Metropolitan University shut down 500 servers after a suspected ransomware incident that disrupted email, academic, and administrative systems and may have exposed personal data of 130 000 individuals. The event underscores the need for continuous monitoring, incident‑response evidence, and security‑awareness training to meet audit‑readiness expectations.

BREACH WATCH BRIEF

Ransomware Gang Booba Steals 344 GB from University of Illinois Chicago College of Medicine

A ransomware group called Booba breached the University of Illinois Chicago’s College of Medicine, encrypting systems and exfiltrating 344 GB of data. The incident highlights the need for auditable incident‑response controls and continuous monitoring to satisfy multiple compliance frameworks.

BREACH WATCH BRIEF

Warlock Ransomware Targets Water and Telecom Operators, Disrupting Critical Services

Warlock ransomware leveraged legacy SharePoint flaws to encrypt data on water utility and telecom networks, leading to service outages. The incident underscores the need for continuous patch management and auditable incident‑response evidence.

BREACH WATCH BRIEF

Warlock Ransomware Exploits Unpatched SharePoint Flaws to Target Critical Infrastructure

Warlock ransomware (Longlegs) continues to breach water utilities, telecoms, governments and universities by exploiting legacy SharePoint vulnerabilities. The attacks highlight the need for robust vulnerability‑management controls and audit‑ready evidence for compliance programs.

BREACH WATCH BRIEF

Warlock Ransomware Exploits Zero‑Day SharePoint Flaws to Hit Water Utility, Telecom Operator and Others

Warlock ransomware leveraged four SharePoint zero‑day vulnerabilities to compromise a water utility, telecom provider, regional government and university, disabling AV/EDR on dozens of hosts before encrypting data. The incident highlights the need for continuous vulnerability management and auditable patch‑remediation evidence for compliance readiness.