The traditional 3-2-1 backup rule—three copies of data, on two different media types, with one copy stored offsite—is being reinterpreted by users as technology changes, with CDs largely abandoned in favor of external drives and cloud services like iCloud and Google Cloud. Reporting notes that cloud sync settings can sometimes delete files from the cloud when removed locally, and that offsite backups can still be vulnerable to ransomware if the storage device remains networked.
engadget.com
· 2026-10-10
FBI agents arrested Edward Dubrovsky, co-founder of Canadian ransomware-negotiation firm Cypfer and now with CyberSteward, in Pennsylvania on cyber extortion and conspiracy charges, according to sources speaking to KrebsOnSecurity. The arrest ties into an investigation of the ShinyHunters hacking group, which recently stole sensitive FBI data on thousands of agents; Dubrovsky was reportedly attending a cyber insurance conference in Philadelphia at the time.
krebsonsecurity.com
· 2026-10-10
Federal prosecutors have indicted Zohar Pinhasi, CEO of cybersecurity firm MonsterCloud, alleging his company charged ransomware victims millions of dollars for proprietary decryption technology that did not actually exist. According to the indictment, MonsterCloud instead secretly paid hackers a much smaller sum to obtain decryption keys, while telling clients it had cracked the encryption itself.
gizmodo.com
· 2026-10-09
Japanese authorities confirmed that a Russian national wanted by Germany on an arrest warrant tied to a ransomware incident was detained upon entering Japan as a tourist and has now been extradited to Germany. The suspect is alleged to be a core member of the Qilin ransomware-as-a-service group, which has hit more than 2,350 organizations in 62 countries since emerging in 2022, including Nissan, Asahi, Lee Enterprises and Court Services Victoria.
bleepingcomputer.com
· 2026-10-09
IDC Frontier, a SoftBank Group subsidiary, reported that its IDCF Cloud service suffered a ransomware attack beginning October 7 at 3:40 AM local time, disrupting its East Japan Region 1 data center cluster. The company said 495 businesses and local government bodies using the cloud platform were affected, and it has disabled management console access across all regions while checking security.
bleepingcomputer.com
· 2026-10-08
The US Department of Justice has charged Zohar Pinhasi, operating MonsterCloud, with fraud for allegedly deceiving clients by claiming to decrypt files without paying ransom. Instead, the company reportedly paid hackers a portion of the fees and kept the rest, charging over $19 million in total while paying just over $8 million in ransom payments. Evidence suggests MonsterCloud used samples from ransomware operators as proof of decryption ability, despite not having proprietary tools.
techspot.com
· 2026-10-08
Zohar Pinhasi, owner of Florida-based ransomware recovery firm MonsterCloud, was indicted on charges of conspiracy and wire fraud for allegedly paying cybercriminals for decryption keys while claiming to use proprietary technology. He surrendered to authorities, pleaded not guilty, and was released on a $2 million bond. Prosecutors assert that MonsterCloud's claims of decrypting data without paying ransom were false, and that the company often paid attackers directly to restore clients' files.
bleepingcomputer.com
· 2026-10-07
Security researchers and government advisories document a shift in ransomware tactics, with groups like BlackMatter and Gunra deliberately locating and destroying backup data before encrypting primary systems. The 2024 ALPHV/BlackCat attack on Change Healthcare exemplified the pattern: inadequate backup isolation contributed to UnitedHealth paying $22 million without recovering its data, with total costs reaching an estimated $1.6 billion. CISA, the FBI, and the NSA have jointly documented these methods across multiple incidents.
bleepingcomputer.com
· 2026-10-07
Advantest Corporation has notified affected individuals that a ransomware attack on February 15 resulted in theft of personally identifiable information, including Social Security numbers, national ID numbers, driver's licenses, passports, medical and financial data. The semiconductor test equipment maker had initially disclosed the breach without confirming data theft, but an October 6, 2026 notification confirms data was extracted from its servers. It remains unclear whether the stolen data belongs to customers, employees, or partners.
bleepingcomputer.com
· 2026-10-07
Daniel Rhyne, a former infrastructure engineer, received a 32-month prison sentence after remotely accessing his employer's network, locking thousands of devices, deleting admin accounts, and demanding a ransom. His actions included changing passwords, shutting down servers, and sending threatening emails to co-workers in late 2023.
bleepingcomputer.com
· 2026-10-06
A Reddit user known as Clean-Market5761 built a rough PC port of Marvel's Wolverine using source code stolen in the December 2023 Rhysida ransomware attack on Sony and Insomniac. The port is unfinished, with missing textures and Wolverine's head disabled because its PS5 shader library hasn't been ported over, and the developer says AI helped write scripts and automate asset conversion while manual trial and error handled the rest.
tomshardware.com
· 2026-10-05
Symantec and Carbon Black researchers say the China-linked Warlock group, also tracked as Longlegs, has compromised a water utility, a telecom provider, a regional government body and a university by exploiting on-premises SharePoint vulnerabilities, including the ToolShell exploit chain. In one July 22 intrusion, the attacker disabled security software on roughly 40 hosts within two hours and deployed Warlock ransomware to at least 33 machines, using a signed but vulnerable driver to kill endpoint defenses.
bleepingcomputer.com
· 2026-10-02
GoKawiil