Skip to content
HACKTECH

Cyber news digest

What broke, and what we check because of it.

Breaches, exploited vulnerabilities, supply chain compromises and new rules, written up for the people who buy security work, with what each one means for an organisation that runs the same kind of systems. Every item cites at least two sources and was verified against them before publication.

52 items214 cited sourcesLatest item 5 November 2026

Showing 4 items in Ransomware & extortion. Show all 52 items

October 2026

4 items

  • Ransomware & extortion

    Coveware Q3 2026: median ransom rises to $400,000; leak questions paying for silence

    Coveware's quarterly ransomware report for Q3 2026, published on 28 October 2026, said the median ransom payment rose 167% to $400,000 while the average payment fell 45% to $1,025,278, and that nearly 80% of incidents were resolved without payment. The report centred on a leak of internal chat logs attributed to the Silent Ransom Group, which Coveware said identified several victims that had paid a ransom to keep their incident out of the public domain. Check Point, which analysed the leaked 'Luna Moth Files' (Luna Moth is another name for the group), described a phone-based data-extortion operation focused on law firms and said it treats the archive's claims as unverified unless independent sources back them up.

    • Social engineering assessment
    • Incident response
    • Cloud configuration review
  • Ransomware & extortion

    Cyberattack claimed by BYOD gang forces UNM Health to divert ambulances

    A cyberattack on the University of New Mexico Health Sciences Center on 26 October 2026 led UNM Health to divert ambulance traffic for two hours, suspend outpatient surgeries and appointments for the rest of the day, and cancel classes at four health sciences colleges the following day. UNM said the event affected some end-user devices but did not penetrate core systems or servers, that clinical operations were fully functional by 28 October, and that it did not make concessions with any group behind the threat. A new ransomware gang known as BYOD claimed the attack, and The Record later reported that the gang also claimed an incident at Michigan State University.

    • Incident response
    • Network & infrastructure testing
    • Threat modelling
  • Ransomware & extortion

    Owner of ransomware recovery firm MonsterCloud charged over undisclosed ransom payments

    The US Justice Department said on 7 October 2026 that the owner of MonsterCloud, a Florida-based ransomware remediation company, had been arraigned in the Eastern District of New York on two counts of wire fraud and one count of wire fraud conspiracy. According to the indictment, the company told clients it could recover data without paying ransoms, but the owner allegedly paid the attackers for decryption keys without telling clients and charged them substantially more than the ransom. Prosecutors allege he charged clients more than $19 million and paid more than $8 million in ransom payments over the course of the scheme.

    • Incident response
    • Threat modelling
  • Ransomware & extortion

    Eurojust and Europol action on KillSec extortion group: three arrests, servers seized

    Eurojust and Europol announced on 1 October 2026 an international action against the KillSec data-extortion group, part of a German-led investigation that Europol named Operation KillSwitch. Three suspects were provisionally arrested and eight house searches were carried out in Spain, Greece, the United Kingdom and Romania; investigators identified a 16-year-old as the group's suspected main operator, and CyberScoop reported that the alleged leader was among those arrested. Authorities seized five servers and KillSec-operated domains, took control of its leak site and secured at least 110 terabytes of data. Eurojust linked the group, active since 2024, to almost 1,000 attacks worldwide, of which Europol said around 500 have so far been identified as successful.

    • Cloud configuration review
    • Database security audit
    • Incident response

Run the checks against your own systems

We pick the checks that apply to your systems. A 45-minute scoping call ends with a fixed quote and a proposed start date; the written scope follows by email.

Book the scoping callHow incident response works