
Q3 2026 Sets New Record for Ransomware Attacks
Comparitech recorded a record 2,627 claimed ransomware attacks in Q3 2026, up 27% from Q2, led by Qilin and The Gentlemen with triple extortion rising.
20 stories, newest first · one card per story

Comparitech recorded a record 2,627 claimed ransomware attacks in Q3 2026, up 27% from Q2, led by Qilin and The Gentlemen with triple extortion rising.

Kiteworks patched a critical flaw and lifted a global shutdown advisory after finding no compromise.

Dutch police confirmed a 24-year-old Amsterdam man was arrested in a ShinyHunters hacking investigation.

Stolen FBI agents’ medical exams surfaced after ShinyHunters claimed a breach of about 60,000 staff.

Kiteworks urged a nine-hour customer shutdown after a federal warning of a possible attack.

ShinyHunters defaced Clop's leak site via unpatched Grav CMS path traversal CVE-2026-42608; Grav patched the 1.7 branch.
Kiteworks told customers to shut systems down after federal intel warned of possible targeting.

ShinyHunters claims it breached FBI systems, defaced a recruitment site, and stole sensitive information.

ShinyHunters claims it breached the FBI and stole personal data on agents and job applicants.
NCC Group reports a record 1,073 organizations hit by ransomware in August 2026, with Qilin and The Gentlemen the most prolific groups.

ShinyHunters defaced Clop's leak site and claims stolen victim data could enable new extortion.

ShinyHunters hijacked and defaced rival ransomware gang Clop's dark-web leak site.
ShinyHunters hijacked rival Clop's leak site, demanding an eight-figure ransom and threatening to expose past victims.

ShinyHunters hacked rival ransomware gang Clop, defacing its leak site and claiming to have stolen operational data and private keys.

ShinyHunters claims it hacked rival extortion gang Clop's leak site via a Grav CMS flaw and seized its onion domain.
Extortion group ShinyHunters hacked the Clop ransomware gang's leak site, defacing it and stealing server data and onion service private keys.

ShinyHunters exploited a Grav CMS file upload flaw to breach and deface the Clop ransomware gang's leak site, claiming theft of source code, logs, and Tor private keys.

PaperCut warns that a zero-day in NG and MF print management products is being actively exploited, shipping emergency patches with no CVE assigned yet.

ReliaQuest details a bespoke JSP web shell that Clop deploys on hacked PTC Windchill and FlexPLM servers after exploiting CVE-2026-12569.

Clop mass-exploited CVE-2026-12569 in PTC Windchill and FlexPLM in early June, claiming data theft from dozens of large organizations.
Today 1.5K readers · 2.4K views · 757 reads · all time 189K views