Skip to content
Submit incident

Ransomware and data extortion incidents

Definition

Ransomware and extortion incidents document attacks in which criminals encrypt systems or steal personal data and demand payment, often threatening to publish the data or publishing it on a leak site.

Included

  • Ransomware attacks that encrypted systems holding personal data
  • Data theft followed by an extortion demand, with or without encryption
  • Leak-site publication of stolen records after a refused ransom
  • Extortion of individuals whose data was taken in an attack

Excluded

  • Ransomware that, on the public record, touched no personal data
  • Claims by a criminal group that no other source has reported
Ransomware and extortion incidents over time
Documented incidents per year of occurrence. 2026 to date.
Unit: incidents · Source: Data Incident Index v2026.09 · Counts reflect documented incidents, not prevalence · *2026 to date

Incident records561

Nov 2026NM: Bernalillo offers $82,000 to hackers to resolve ransomware attackReportedRansomware and extortionDataBreaches.netkoat.comNov 2026HHS’ Office for Civil Rights Settles Ransomware Investigation of Lehigh Valley Health NetworkReportedRansomware and extortionDataBreaches.nethhs.govOct 2026UNM Health addresses cyberattack in New Mexico after ransomware group claims responsibilityReportedRansomware and extortionDataBreaches.netkoat.comOct 2026Ukrainian National Sentenced for Role in Hacking Hospitals, Businesses, and Governments as Part of Ransomware Conspiracies Causing Over $100 Million in LossesReportedRansomware and extortionDataBreaches.netjustice.govstate.govOct 2026Japanese internet giant GMO tells customers to shut down and disconnect PCs from the internet following data breach and ransomware threatReportedRansomware and extortionDataBreaches.nettechradar.comOct 2026FBI says SafePay ransomware gang ‘among most active’ with more than 600 victims since 2024ReportedRansomware and extortionDataBreaches.nettherecord.mediacisa.govOct 2026Qilin and INC Ransomware Groups Exploit Palo Alto Networks Flaw to Bypass MFAReportedRansomware and extortionDataBreaches.netunit42.paloaltonetworks.comthehackernews.comOct 2026Ransomware Attacks Intensify: Criminals Shift Focus to Target Employees and Their FamiliesReportedRansomware and extortionDataBreaches.netsemperis.comcybersecuritynews.comOct 2026Japan on Cyberattack Alert as Ransomware Wave Hits Major Brands and Exposes Millions of RecordsReportedRansomware and extortionDataBreaches.netibtimes.co.ukOct 2026ShinyHunters: Six Years of Cybercrime - Expert Analysis and Ransomware Group PerspectivesReportedRansomware and extortionDataBreaches.netsuspectfile.comOct 2026The Luna Moth Files Weren’t Hacked. Here’s How They Leaked.ReportedRansomware and extortionDataBreaches.netx.comOct 2026Known Cybersecurity Expert and Owner of Florida Ransomware Remediation Company Charged with Defrauding ClientsReportedRansomware and extortionDataBreaches.netcisa.govjustice.govOct 2026FBI Blames Contractor’s Missed Patch for ShinyHunters BreachReportedRansomware and extortionDataBreaches.netreuters.comsecurityweek.comOct 2026Ransomware group threatens to leak customer data from top insurance companies in South AfricaReportedRansomware and extortionDataBreaches.netmybroadband.co.zaOct 2026Slate Valley Unified School District voted not to pay ransom demand; Kairos likely to leak dataReportedRansomware and extortionDataBreaches.netrutlandherald.comSep 2026Hogan Lovells Cadwalader hacked by Silent Ransom Group; re-attacked after they wouldn’t payReportedRansomware and extortionDataBreaches.netSep 2026Former U.S. Soldier Sentenced for Hacking and Extortion Scheme That Exposed Sensitive Data of U.S. Government OfficialReportedRansomware and extortionDataBreaches.netjustice.govSep 2026Ryuk Ransomware Operator Sentenced to 24 Months in PrisonReportedRansomware and extortionDataBreaches.netcybersecuritynews.comSep 2026FBI Hack Exposed FBI’s Own Hacking UnitReportedRansomware and extortionDataBreaches.net404media.coSep 2026ShinyHunters hacks Clop leak site, threatens to extort ransomware gang (1)ReportedRansomware and extortionDataBreaches.netbleepingcomputer.comSep 2026Ransomware attack on Kansas county will affect some servicesReportedRansomware and extortionDataBreaches.netksn.comSep 2026Canada: Nipigon hospital hit by ransomware attackReportedRansomware and extortionDataBreaches.netsnnewswatch.comSep 2026Ransomware group claims attack on Missouri’s Cedar County Memorial Hospital after IT outageReportedRansomware and extortionDataBreaches.netdysruptionhub.comSep 2026Payroll system of mosques, madrasahs hit by ransomware; staff details potentially compromisedReportedRansomware and extortionDataBreaches.netstraitstimes.comSep 2026Silent Ransom Group Hacked Greenberg Traurig; Who notifies the 126k Affected? (1)ReportedRansomware and extortionDataBreaches.netoag.ca.govreuters.com+3Sep 2026Ukrainian National Sentenced to Four Years in Prison for Wire Fraud Conspiracy in Connection with Conti RansomwareReportedRansomware and extortionDataBreaches.netjustice.govSep 2026“Network outage” disrupts Westfield Public Schools in New Jersey as ransomware group posts samplesReportedRansomware and extortionDataBreaches.netapp.smore.comdysruptionhub.comSep 2026DaVita settles ransomware attack lawsuit for $15MReportedRansomware and extortionDataBreaches.nethealthexec.cominvestors.davita.comSep 2026Agentic Ransomware Took Down Enterprise in Ten Hours: AI Left 80-Page AuditReportedRansomware and extortionDataBreaches.netunit42.paloaltonetworks.comtechtimes.comAug 2026Time’s Up: Ransomware Group Claims 150,000+ Cardiology Patient Records. We’ve Seen the Data.ReportedRansomware and extortionDataBreaches.netAug 2026Winona County paid more than $128K following January ransomware attackReportedRansomware and extortionDataBreaches.netwxow.comAug 2026National Kidney Registry allegedly hacked by DireWolf ransomware groupReportedRansomware and extortionDataBreaches.netdarkentry.netAug 2026ShinyHunters provided no real proof they hacked ReliaQuest- because they didn’t get anywhere: ReliaQuestReportedRansomware and extortionDataBreaches.netreliaquest.comAug 2026Troutman Pepper Locke Silent as Threat Actors Leak Client Data, Tens of Thousands of SSNsReportedRansomware and extortionDataBreaches.netlaw.comic3.gov+3Aug 2026Beware the Ransomware Rescuer: Ransom BustersReportedRansomware and extortionDataBreaches.netguidepointsecurity.comAug 2026Medusa ransomware tallies hundreds of new victims, says updated advisory on group’s tacticsReportedRansomware and extortionDataBreaches.netcisa.govcyberscoop.comAug 2026Ransomware Attack Disables Canadian Hospital’s Doors, HVACReportedRansomware and extortionDataBreaches.netbankinfosecurity.comAug 2026CISA Advisory: #StopRansomware: Gunra RansomwareReportedRansomware and extortionDataBreaches.netcisa.govAug 2026Ransomware gangs skip the CEO, head straight for the 40-something IT managerReportedRansomware and extortionDataBreaches.netzscaler.comtheregister.comAug 2026City of Coweta hit with system-wide ransomware attack, has backupReportedRansomware and extortionDataBreaches.netktul.comcityofcoweta-ok.govAug 2026US cloud ‘kill switch’ is as dangerous as ransomware, European businesses fearReportedRansomware and extortionDataBreaches.netitpro.comgo.getproton.meAug 2026Brinks Home Confirms Data Breach Following ShinyHunters ClaimReportedRansomware and extortionDataBreaches.netcybersecuritynews.comAug 2026The double extortion of a Russian ransomware threatens the medical records that Diater has kept for 10 years.ReportedRansomware and extortionDataBreaches.netapdnoticies.comJul 2026North Korea’s Lazarus Group sharing tools with ransomware hackers, South Korean agencies warnReportedRansomware and extortionDataBreaches.netncsc.go.krimage.ahnlab.com+1Jul 2026Ransomware in Italy: RedACT report sheds light on an evolving threat environmentReportedRansomware and extortionDataBreaches.netsuspectfile.comransomnews.onlineJul 2026HHS OCR Settles Ransomware Investigation of OSF Healthcare System and Affiliated Covered EntitiesReportedRansomware and extortionDataBreaches.nethhs.govJul 2026Greedy ransomware crews return for seconds after victims cough up first extortion paymentsReportedRansomware and extortionDataBreaches.netproofpoint.comtheregister.comJul 2026Pay up or not? Ransomware surge has victims facing tough choices.ReportedRansomware and extortionDataBreaches.netarstechnica.comJul 2026Medical giant Abbott investigates two cyber incidents as ShinyHunters and ShadowByt3$ both claim breachesReportedRansomware and extortionDataBreaches.netabbott.comcybernews.comJul 2026WilmerHale Sued Over Client Personal Information Data BreachReportedRansomware and extortionDataBreaches.netbloomberglaw.comnews.bloomberglaw.com+1
50 of 561 shownFilter all 561 in Explore →
Browse all incidents →