SafePay Ransomware Wipes Backups First

SafePay ransomware advisory AA26-293A: backups destroyed before encryption, October 2026

SafePay ransomware has compromised at least 600 organizations since August 2024, and a joint advisory published on October 20 says its operators halt shadow copies and reset backup storage before they encrypt anything. The FBI, CISA and the US Secret Service wrote it together with Germany’s Landeskriminalamt Rheinland-Pfalz and UK law enforcement (the National Crime…

Read More

IDC Frontier Ransomware: One Cloud, 495 Customers

IDC Frontier ransomware attack on a Japanese cloud provider affecting 495 customers, October 2026

One ransomware attack on one cloud region has hit 495 companies and local governments in Japan at once. IDC Frontier, a SoftBank subsidiary, said its IDCF Cloud service was struck by ransomware on October 7 at 3:40 a.m. local time, forcing it to shut down the network and systems of its East Japan Region 1.…

Read More

Warlock Ransomware SharePoint Attacks

Warlock ransomware SharePoint attacks hit a water utility and a telecom provider. Symantec saw an EDR killer on 40 hosts in two hours. Patch and hunt.

Warlock ransomware SharePoint attacks have reached a water utility, a telecom provider, a regional government body and a university, according to Symantec and Carbon Black. The China-linked group still gets in through on-premises SharePoint, switches off endpoint protection on dozens of machines within about two hours, and then launches ransomware from a share that every…

Read More

McKesson Breach: How the Okta Vishing Attack Happened

An Okta vishing attack gave ShinyHunters access to McKesson's Salesforce and Snowflake data, followed by a $55 million ransom demand.

An Okta vishing attack — a phone call, not a piece of malware — is how the extortion group ShinyHunters claims it broke into US healthcare and pharmaceutical distribution giant McKesson. McKesson has confirmed unauthorized access to third-party applications and data exfiltration, but has not confirmed the attack path itself: according to ShinyHunters’ own account,…

Read More

Berlin Ransomware Attack: State Refuses to Pay

Berlin ransomware attack 2026 — Rhysida extortion of German state government network

A Berlin ransomware attack has put Germany’s capital in the position every public-sector CISO dreads: a confirmed data breach, a seven-figure ransom demand, and an election three weeks away. The ransomware group Rhysida claims it stole 5.79 terabytes from Berlin’s state administrative network and is demanding 30 Bitcoin, roughly €2.05 million, with a seven-day auction…

Read More