IBM's Cost of a Data Breach Report 2025 puts the average total cost of a ransomware incident at $5.08 million once downtime, remediation, legal work and business disruption are counted, while Verizon's 2026 DBIR pegs the median ransom payment at just $139,875. Datto's State of BCDR Report 2025 adds that while over 60% of organizations expect to recover within a day, only 35% actually do, and attackers increasingly target backup systems, forcing costly forensic and incident-response work when recovery options are compromised.
bleepingcomputer.com
· 2026-09-16
CISA has added a critical ScreenConnect vulnerability, now designated CVE-2026-84869, to its known exploited vulnerabilities catalog after confirming attackers are actively abusing it. The flaw stems from missing authorization checks that let low-privilege users transfer and execute files during active remote sessions without host confirmation, and it has been fixed in ScreenConnect 26.6.5. Federal agencies have been given three days to patch, while Shadowserver reports over 1,000 unpatched, internet-exposed ScreenConnect servers, mostly in North America and Europe.
bleepingcomputer.com
· 2026-09-16
A year-end review of 2026's major hacks highlights an unresolved controversy over the Department of Government Efficiency's access to Social Security Administration data. Ongoing federal lawsuits and a whistleblower's claims allege DOGE staff uploaded a live copy of the Social Security database to an unsecured third-party server, potentially exposing sensitive personal information tied to most living Americans. The broader roundup also notes a year marked by ransomware, nation-state attacks on infrastructure, and data weaponization by governments.
techcrunch.com
· 2026-09-15
CISA has updated its Known Exploited Vulnerabilities catalog to flag ransomware gangs actively exploiting a critical VMware vCenter directory traversal flaw, CVE-2026-59310, patched by Broadcom in July. The bug had already been abused by a suspected APT group to compromise over 361 IP addresses across 47 countries, and Shadowserver now tracks more than 450 exposed vCenter servers online.
bleepingcomputer.com
· 2026-09-15
Oleksii Oleksiyovych Lytvynenko, 44, was sentenced to four years in prison for participating in the Conti ransomware conspiracy as an intruder and malware developer. He pleaded guilty to conspiracy to commit wire fraud, admitting he controlled stolen data from 12 victim companies, sent extortion notes, and coded a loader tool used to launch attacks between 2020 and 2022. He was arrested in Ireland in 2023 and extradited to the U.S. to face charges.
bleepingcomputer.com
· 2026-09-11
Security firm Zimperium has identified a new Android malware called Mantax Otax that combines file encryption with data theft, distributed via malicious APKs outside Google Play through phishing lures aimed at Indonesian users. Once installed, it abuses Accessibility permissions to harvest device data, report to a GitHub-hosted command server, and on older Android versions (9 and below) encrypts files, replaces images with ransom notes, and opens a Firebase-hosted chat to negotiate payment. Researchers exploited a misconfigured Firebase server to expose the attackers' actual conversations with victims.
bleepingcomputer.com
· 2026-09-10
Cisco Talos reported that three distinct threat groups—including Qilin ransomware affiliates and state-sponsored actors—have been exploiting two vulnerabilities in Cisco Secure Firewall Management Center. The flaws, a maximum-severity authentication bypass (CVE-2026-20079) and a static credential issue (CVE-2026-20316), let attackers gain root access, deploy web shells, steal credentials, and in some cases install Qilin ransomware or Cyclops Blink malware. Cisco has issued hot fixes and urges immediate patching, with broader hardening updates planned next week.
bleepingcomputer.com
· 2026-09-10
CISA has updated its Known Exploited Vulnerabilities catalog to warn that ransomware operators are now actively abusing a critical remote-code-execution bug in WatchGuard Firebox firewalls, first flagged as exploited back in December. The flaw, an out-of-bounds write bug affecting multiple Fireware OS versions, lets unauthenticated attackers run code remotely, particularly on devices configured for IKEv2 VPN. Shadowserver data shows nearly 9,000 Firebox devices remain unpatched online nine months after fixes were released.
bleepingcomputer.com
· 2026-09-10
Veradigm, the Chicago-based healthcare technology firm formerly known as Allscripts, disclosed in an SEC filing that an attacker used stolen credentials from a third-party vendor to access a customer-service API and copy patient data. The exposed information includes personal details and Social Security numbers for a limited number of patients, though clinical records were not accessed. The Gentlemen ransomware group has claimed responsibility for the attack.
bleepingcomputer.com
· 2026-09-09
Acronis has published a checklist defining six required capabilities for MSP ransomware protection services, spanning exposure reduction, early detection, round-the-clock incident response, isolated backup preservation, clean recovery, and consistent enforcement across all client tenants. The guidance draws on Acronis's Cyberthreats Report, which documented 143 ransomware victims among MSPs, IT service providers and telecoms in 2025, with phishing responsible for 52% of initial breaches and unpatched systems for 27%.
bleepingcomputer.com
· 2026-09-02
New research from SentinelOne and Mimecast shows attackers are increasingly turning to employees with legitimate network access rather than relying solely on phishing or exploiting software flaws. SentinelOne found insider incidents now cost organizations an average of $19.5 million annually, with breaches involving privileged malicious insiders averaging $4.9 million per event. Mimecast separately reported a 42% year-over-year rise in malicious insider incidents.
darkreading.com
· 2026-09-01
Berlin officials confirmed cybercriminals are attempting to extort the city after the Rhysida ransomware gang publicly listed it on their leak site last Friday, following an intrusion discovered in mid-August. The attackers claim to have stolen nearly 1.44 million files totaling 5.79TB, including government, legal, financial, HR, and health records, along with credentials belonging to senior officials and infrastructure security assessments. Mayor Kai Wergner said Berlin will not pay, and law enforcement including the State Criminal Police Office and federal security agencies are investigating.
bleepingcomputer.com
· 2026-08-31
GoKawiil