Search: “customer data”

10 stories in the last 30d

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Industry 90 Data breach 83 AI industry 79 Threat actor 65 Exploit / PoC 57 Tools 52 AI safety & security 52 Vulnerability 47 Malware 44 Policy & legal 31 Research 30 Phishing & fraud 25 Advisory 17 Model release 15

SeverityAll critical 40 high 198 medium 133 low 8 info 343

Pharmaceutical giant McKesson warns of 'service degradation' following cyberattack

Pharmaceutical giant McKesson disclosed a cyberattack on a third-party application that exfiltrated customer data, claimed by ShinyHunters.

McKesson reported a cybersecurity incident involving an unnamed third-party application, with attackers exfiltrating data tied to its oncology and surgical business units. The company filed with the SEC, offered credit monitoring, and said it had received reasonable assurance the attackers were no longer inside its systems. The ShinyHunters group claimed responsibility and threatened leaks; McKesson reported $106 billion in revenue last quarter and distributes about one-third of North American prescriptions.

The RecordAug 31, 12:59 UTC · 16d agoRansomware in the wild

Berlin Refuses to Pay Hackers Who Stole Data From the City's State Network

Berlin refuses ransom demands after Rhysida claimed stealing 5.79 TB from the city-state network, including mobility department data on 12,076 individuals.

Berlin's state government confirmed an extortion attempt following the August compromise of its state administrative network and said it will not pay. Forensics found data exfiltrated from the Senate Department for Mobility, Transport, Climate Protection and Environment between August 7 and 12, 2026; Rhysida's leak site claims 5.79 TB, 1.44 million files, and personal data on 12,076 individuals. State criminal police, prosecutors, and federal authorities are investigating, and officials say the September 20 Abgeordnetenhaus election environment remains unaffected. Separately, Manchester Airports Group confirmed theft of customer data including emails, phone numbers, and vehicle registrations across three airports.

The Hacker NewsAug 28, 21:30 UTC · 19d agoRansomware in the wildCVE-2020-1472

Harley-Davidson Alleged Breach – CL0P Ransomware Adds Motorcycle Maker to the List

CL0P ransomware group listed Harley-Davidson on its extortion leak site, claiming a compromise; the motorcycle maker has not confirmed any breach.

The CL0P ransomware operation added Harley-Davidson to its public extortion portal, a listing highlighted by the ransomNews monitoring account on September 10, 2026. Harley-Davidson has not confirmed any compromise, and the initial access method, affected business unit, timing, and volume of stolen data remain unknown, with no sample files or technical indicators published. The article stresses that leak-site listings alone do not confirm a breach and can serve as negotiation pressure in double-extortion schemes. If verified, stolen data could fuel downstream phishing, BEC, credential-stuffing, and invoice fraud targeting dealers, suppliers, and customers.

Cyber Security NewsSep 11, 07:26 UTC · 6d agoRansomware

Ransomware attackers are zeroing in on mid-market companies

Black Kite found mid-market firms were 73% of disclosed ransomware victims in North America and Europe from January 2023 to June 2026.

Black Kite analyzed 13,336 publicly disclosed ransomware and data-extortion incidents with known revenue between January 2023 and June 2026, finding mid-market companies (annual revenue $10M-$1B) accounted for 73% of victims in North America and Europe, consistently between 72% and 75%. Manufacturing was the most affected sector, followed by professional, scientific, and technical services and construction. Of more than 120,000 assessed mid-market organizations, 54.7% had at least one significant patch-management issue on a public-facing system, over a quarter had a known-exploited vulnerability, and nearly one-third had stealer-log credential findings.

Help Net SecurityAug 24, 00:00 UTC · 24d agoRansomware

Nutex Health Says Patient Data Stolen, Hackers Threaten Leak

The Gentlemen ransomware gang claims breach of US healthcare provider Nutex Health, exfiltrating patient and employee data and threatening publication.

Nutex Health disclosed in an SEC 8-K filing that an unauthorized third party accessed and exfiltrated patient, employee, credentialed provider, business, and financial data from company servers, and threatened to publish it. The Gentlemen ransomware group listed Nutex on its leak site; a class action was filed August 27 and Edelson Lechtzin LLP is separately investigating. Nutex operates over 27 facilities in 12 states and served nearly 100,000 patients in the first half of 2026, with no material operational impact identified so far.

Infosecurity MagazineSep 2, 10:45 UTC · 14d agoRansomware

Cl0p Targets 40+ Organizations Through PTC Windchill Flaw

Cl0p claims over 40 organizations including Shell and Philips were breached by exploiting critical RCE CVE-2026-12569 in PTC Windchill and FlexPLM.

Cl0p claims more than 40 organizations were victimized via CVE-2026-12569 (CVSS 9.3), a critical deserialization-based remote code execution flaw in PTC Windchill PDMlink and FlexPLM, affecting releases prior to 11.0 M030; CISA added the flaw to its KEV catalog in June. ReliaQuest found the group deployed a custom web shell that maps vault data, decrypts all credentials in the Windchill keystore, and includes a Java class loader enabling arbitrary code execution, lateral movement, persistence, and large-scale data exfiltration without extra tooling. Named victims include Shell, Philips, Fiserv, Zebra Technologies, Ingersoll Rand, Toast, Mindray, and Apple lens supplier Largan Precision, with stolen data ranging from one gigabyte to multiple terabytes per target. The campaign mirrors Cl0p's earlier mass-exploitation extortion operations against MOVEit, Cleo, GoAnywhere, and Oracle E-Business Suite.

Security AffairsAug 21, 07:15 UTC · 27d agoRansomware in the wildCVE-2026-12569

New pro-Ukraine hacker group targets Russian companies with custom ransomware

F6 links new pro-Ukraine ransomware group VantaCore, likely a Thor rebrand, to seven attacks on Russian firms using custom tooling and multimillion-dollar demands.

Russian cybersecurity firm F6 reports that VantaCore, a ransomware group believed to be a rebrand of pro-Ukrainian group Thor, has targeted at least seven Russian organizations with ransom demands reaching millions of dollars, operating as a ransomware-as-a-service operation with a Tor-based victim chat and a leak site. The group uses custom-built tooling including the VantaCore ransomware that encrypts servers and workstations, VantaCoreLoader for distribution, the VantaCoreRAT backdoor, and SnowKiller, which disables antivirus and security software. Initial access relies on poorly secured VPNs and remote-access tools, flaws in internet-facing applications, and credentials stolen from business partners. F6 notes pro-Ukrainian groups increasingly abandoned stock ransomware like LockBit 3 Black and Babuk in 2025-2026 in favor of custom malware.

The RecordSep 2, 15:11 UTC · 14d agoRansomware

Ransomware negotiation tactics have turned into a business process

Intel 471's Dave Ross details ransomware negotiation tactics, with demands typically set at 1-5% of annual revenue and specialized criminal service roles.

In a Help Net Security video, Intel 471 Senior Director Dave Ross explains how ransomware groups research a victim's revenue and insurance coverage, run test decryptions to prove they hold a working key, and set demands at roughly 1% to 5% of annual revenue. He describes negotiation dynamics with shifting deadlines and a criminal service economy supplying language skills, data review, and legal analysis. Multi-extortion methods include data theft, DDoS attacks, and direct contact with customers and journalists.

Help Net SecuritySep 8, 05:40 UTC · 9d agoRansomware

Cyberattack encrypts systems at Bavarian municipal utility

Hackers encrypted the central IT network of Bavarian utility Stadtwerke Landsberg, disrupting office systems but not electricity or water services.

Stadtwerke Landsberg said hackers encrypted its central IT network overnight on Sept. 1, prompting disconnection from the internet, crisis-team activation and external forensic support. Essential electricity and water services were unaffected, but staff availability was limited and customer data such as names, addresses and bank details may have been accessed. No ransomware group was named and no extortion demand was confirmed. The attack follows a similar late-June encryption incident at a North Rhine-Westphalia municipal utility, and the BSI consistently ranks ransomware among Germany's most serious cyber threats.

The RecordSep 8, 12:00 UTC · 8d agoRansomware in the wild

Medusa ransomware gang has hit over 500 organizations, CISA warns

FBI, CISA, and HHS warn Medusa ransomware has hit over 500 organizations across critical infrastructure since June 2021, using phishing and unpatched flaws.

An updated joint advisory from CISA, FBI, and HHS states Medusa ransomware has affected more than 500 organizations, spanning healthcare, defense, manufacturing, government, IT, financial services, education, insurance, and legal sectors. Since early 2023 Medusa has operated a ransomware-as-a-service affiliate model and buys access from initial access brokers for $100 to $1 million. Affiliates gain entry via phishing and unpatched internet-facing software, exploiting newly disclosed flaws in ScreenConnect, Fortinet EMS, Fortra GoAnywhere, and BeyondTrust within 24 hours. The group runs double extortion, giving victims 48 hours before leak-site publication, with $10,000 in cryptocurrency buying a one-day delay.

Help Net SecurityAug 19, 00:00 UTC · 29d agoRansomware in the wild