Q3 2026 Sets New Record for Ransomware Attacks
Comparitech recorded a record 2,627 claimed ransomware attacks in Q3 2026, up 27% from Q2, led by Qilin and The Gentlemen with triple extortion rising.
55
- Mentions · 7d0
- Mentions · 30d3
- All mentions25
- First seenAug 19, 2026
- Last mentioned21d ago
Timeline
25 articles · newest firstAnother ShinyHunters suspect arrested
Authorities arrested a teenage ShinyHunters suspect in Jordan, the second member detained after a Dutch arrest.
74
ShinyHunters hacker reportedly detained in Jordan, aiding FBI
Jordan reportedly detained ShinyHunters suspect Saif al-Din Khader, who is helping the FBI find other members.
67
Kiteworks patches critical flaw, brings customer systems online
Kiteworks patched a critical flaw and lifted a global shutdown advisory after finding no compromise.
66
Dutch police confirm arrest in ShinyHunters hacking investigation
Dutch police confirmed a 24-year-old Amsterdam man was arrested in a ShinyHunters hacking investigation.
62
FBI agents’ blood tests and doctors’ notes surface after breach
Stolen FBI agents’ medical exams surfaced after ShinyHunters claimed a breach of about 60,000 staff.
90
Kiteworks Urges Customers to Shut Down Systems for 9 Hours Over Possible Cyber Attack
Kiteworks urged a nine-hour customer shutdown after a federal warning of a possible attack.
71
ShinyHunters hacked Clop leak site using Grav CMS path traversal flaw
ShinyHunters defaced Clop's leak site via unpatched Grav CMS path traversal CVE-2026-42608; Grav patched the 1.7 branch.
74
Kiteworks urges customers to stop using platform after warning from federal intelligence agencies
Kiteworks told customers to shut systems down after federal intel warned of possible targeting.
82
ShinyHunters Claims Access to FBI Systems
ShinyHunters claims it breached FBI systems, defaced a recruitment site, and stole sensitive information.
80
ShinyHunters claims FBI breach was revenge for “false” report
ShinyHunters claims it breached the FBI and stole personal data on agents and job applicants.
84
Ransomware Attacks Reach Record High for 2026
NCC Group reports a record 1,073 organizations hit by ransomware in August 2026, with Qilin and The Gentlemen the most prolific groups.
62
ShinyHunters Claims FBI Breach, Says It Stole Data on Agents and Job Applicants
ShinyHunters claims it breached the FBI via an Oracle PeopleSoft zero-day RCE, stealing sensitive data on agents and job applicants.
82
ShinyHunters Hacked Clop. Now What About Clop's Victims?
ShinyHunters defaced Clop's leak site and claims stolen victim data could enable new extortion.
64
Clop Hack: ShinyHunters Hijacks Data Leak Site
ShinyHunters hijacked and defaced rival ransomware gang Clop's dark-web leak site.
61
Clop gets a taste of its own medicine after ShinyHunters hijack leak site
ShinyHunters hijacked rival Clop's leak site, demanding an eight-figure ransom and threatening to expose past victims.
72
ShinyHunters Claim Hack of Rival Ransomware Gang Clop
ShinyHunters hacked rival ransomware gang Clop, defacing its leak site and claiming to have stolen operational data and private keys.
70
ShinyHunters hacks rival extortion gang and takes over its dark web site
ShinyHunters claims it hacked rival extortion gang Clop's leak site via a Grav CMS flaw and seized its onion domain.
55
ShinyHunters hacks Clop leak site, threatens to extort ransomware gang
Extortion group ShinyHunters hacked the Clop ransomware gang's leak site, defacing it and stealing server data and onion service private keys.
62
ShinyHunters hacks Clop leak site, threatens to extort ransomware gang
ShinyHunters exploited a Grav CMS file upload flaw to breach and deface the Clop ransomware gang's leak site, claiming theft of source code, logs, and Tor private keys.
65
Ransomware Attacks on Manufacturers Surge as Supply Chain Risk Grows
Black Kite reports manufacturing ransomware incidents up 40% in 2026, with new gang The Gentlemen responsible for 12% of attacks.
55
PaperCut NG/MF vulnerabilities exploited in zero-day attacks
PaperCut warns of active zero-day exploitation chaining CVE-2026-81578 and CVE-2026-82078 for pre-auth remote code execution in NG/MF print management.
75
PaperCut warns of hackers using printer management software flaw in attacks
PaperCut warns of active exploitation of CVE-2026-82078 and CVE-2026-81578 in NG/MF print management software used by universities, corporations, and governments.
78
Clop-Linked Windchill Web Shell Decrypts Credentials and Maps Engineering Data
ReliaQuest details a bespoke JSP web shell that Clop deploys on hacked PTC Windchill and FlexPLM servers after exploiting CVE-2026-12569.
76
The long tail of Clop’s PTC hack is just beginning to emerge
Clop mass-exploited CVE-2026-12569 in PTC Windchill and FlexPLM in early June, claiming data theft from dozens of large organizations.
85
Related CVEs
by mentions- CVE-2025-61882100%9.8Unauthenticated Takeover of Oracle E-Business Suite Concurrent Processing
- CVE-2026-8207861%9.4Unsafe Reflection RCE in PaperCut NG/MF, Chained with Auth Bypass in Attacks
- CVE-2026-1256946%9.3Unauthenticated RCE in PTC Windchill and FlexPLM
- CVE-2026-8157884%8.8Missing Authentication for Critical Function in PaperCut NG/MF Web Interface
- CVE-2023-27350100%9.8Authentication Bypass Leading to SYSTEM RCE in PaperCut MF/NG
- CVE-2026-3527397%9.8Unauthenticated Takeover Flaw in Oracle PeopleSoft Enterprise PeopleTools
- CVE-2023-2735178%7.5Authentication Bypass in PaperCut NG/MF Print Management Software
- CVE-2026-42608<1%8.8Grav: There is a Path Traversal vulnerability within the FormFlash core component. By manipulating the session_id (passed as…
Appears with
- ShinyHuntersthreat actor · 15
- FBIorganization · 6
- Oraclevendor · 5
- FBIvictim · 5
- Kiteworksvendor · 3
- Qilinthreat actor · 3
- The Gentlementhreat actor · 3
- Instructurevictim · 3
- Oracle E-Business Suiteproduct · 3
- Scattered Lapsus$ Huntersthreat actor · 3
- Grav CMSvendor · 3
- Shellvictim · 3
- Kiteworksorganization · 3
- Accellionorganization · 3
- CISAorganization · 3
- Huntressvendor · 2
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.