Skip to content

💰 Financial Services

Banking, insurance, fintech, payments, asset management · a shareable slice of the daily brief for stakeholders who only care about this industry · RSS feed

Victims L30D4▼ −2
Prior 30D6
Active actor L90DThe Gentlemen · 2
Active actor L90DQilin · 2
Active actor L90Diah6477 · 1

Today — 03 Nov 2026

No industry-tagged items in today's briefing — see recent activity below.

Last 14 days

A third independent blockchain-intelligence firm now ties the Binance theft to North Korea — still no government confirmation.CriticalFinancial ServicesChainalysis joined TRM Labs and Elliptic (Oct 29–30) in attributing the ~$6.3–6.4B heist to DPRK's TraderTraitor unit "with high confidence," citing real-time commingling of the funds taken from Binance with proceeds from September's Bitget hack. The FBI confirmed it is involved in the response, working with Binance and international partners, but its own statement made no attribution. Binance says it has found "no evidence" of a leaked private key and has since uncovered additional points of compromise beyond the originally-cited engineer laptop; it has not confirmed North Korea and has not yet published the full proof-of-reserves report it targeted for this week — treat that as pending until a primary source confirms it. Decrypt · Nextgov
Binance drained of ~$6.3–6.4B in the largest crypto heist on record — North Korea suspected, not confirmed.CriticalFinancial ServicesBetween 20:04 and 23:56 UTC on Oct 29, Binance's own withdrawal system signed away funds from 17 hot wallets across 9–10 blockchains to an attacker. Binance's initial read points to a compromised DevOps engineer's laptop rather than a leaked private key; Elliptic says North Korea is the likely actor and TRM Labs separately estimates ~$6.36B left Binance wallets, corroborating each other independently rather than resting on Binance's own statement alone — but neither Binance nor any government body has confirmed DPRK attribution. Tether and Circle froze roughly $2.7–3B in stablecoins; Binance paused withdrawals, says it will cover all losses from its SAFU fund and company funds, and plans a full proof-of-reserves before fully restoring service. Treat the North Korea attribution as an analyst claim, not a finding. Elliptic · Bitquery investigation · Decrypt
GMO Internet Group's Onamae.com "Desktop Cloud" service — company-confirmed breach with direct financial-market fallout.CriticalFinancial ServicesTechnology & SoftwareAttackers compromised the Windows VPS service retail FX/forex traders use to run automated trading bots, planting malware and using the access to place unauthorized trades on customer accounts; GMO says up to 26,739 servers may have been affected. The attacker demanded a reported $50M in crypto (single-sourced figure, flagged 🟥); GMO refused and reported the incident to police, and the attacker's leak/payment site was reportedly shut down Oct 28. GMO will cover realized customer trading losses, pay a flat ¥5,000 goodwill payment to every current customer of the affected service, and offer free alternative services for six months; further compensation details are due by Nov 6. GMO shares fell roughly 16% to a four-month low on the disclosure. More than 70 securities/FX firms were reportedly threatened with knock-on exposure — an attacker claim, not yet independently confirmed scope. Two named brokers surfaced in coverage: OANDA Securities Japan (precautionary withdrawal delays) and AvaTrade Japan (confirmed unauthorized account access, no confirmed technical link to GMO established yet). MLex · Euronews

Recent victim claims

Newest first, mapped to this industry from the victim database. Most are leak-site claims — verify before acting.

October 2026

Oct 15 Alera Group iah6477 Ransomware · insurance · USA A ransomware group tracked as iah6477 claimed US insurance brokerage Alera Group on its leak site. No company statement or independent press corroboration found; a single tracker is the only source. Distinct from Alera's previously disclosed 2024 breach (156K records). Treat as an unverified claim. · Sources: SOCRadar
Oct 12 MoneyGram The Gentlemen Ransomware · financial services · USA The Gentlemen ransomware gang listed MoneyGram on its leak site Oct 12, setting a roughly one-week negotiation deadline and threatening data publication. No data sample has been released and MoneyGram has not confirmed any breach or ransomware involvement -- note the company separately disclosed an unrelated systems issue it said showed no evidence of ransomware; do not conflate the two. Claim-only, unverified. · Sources: Cybernews · Computing
Oct 07 Sompo Japan Unattributed Breach · Financial Services · Japan Insurer discloses its SMILING ROAD dashcam-service inquiry data potentially exposed (disclosed Oct 7) via unauthorized access to vendor Scala Communications' 'i-ask' FAQ/inquiry-management system (disclosed by Scala Inc. Oct 6; up to 713,126 inquiry records across all affected clients, a cumulative per-inquiry count, not a headcount). Company-confirmed vendor-chain exposure, no misuse confirmed. · Sources: Rescana
Oct 05 Daiwa Securities Unattributed Breach · Financial Services · Japan Securities brokerage discloses ~110,000 customers' names, email addresses and account numbers (~220,000 records incl. inquiries with no personal data) potentially exposed via the Scala Communications 'i-ask' FAQ/inquiry-system vendor breach; disclosed Oct 5. Same vendor incident that separately hit Sompo Japan and Citizen Watch. Company-confirmed, no misuse confirmed. · Sources: Rescana
Oct 03 Genesis Credit Management Qilin Ransomware · Financial Services · USA Debt-collection firm; group threatens to publish full leak soon. Unverified DLS claim. · Sources: HendryAdrian · DeXpose

September 2026

Sep 25 Taspen Life LockBit5 Ransomware · insurance · Indonesia Indonesian insurer (taspenlife.com) claimed by LockBit5 Sep 22, listed Sep 25; no company confirmation. · Sources: Ransomware.live
Sep 25 Majani Insurance Brokers Vexy Ransomware Ransomware · insurance · Kenya Kenyan insurance brokerage (majaninsure.com) listed on Vexy Ransomware's leak site; no company confirmation. · Sources: Ransomware.live
Sep 22 MLD Mortgage (The Money Store) Storm Ransomware · financial services · USA Storm ransomware group claimed New Jersey mortgage lender MLD Mortgage (The Money Store) on its leak site in late September, alleging exposure of Social Security numbers, financial-account data, loan-application and credit-history data. The claim itself remains uncorroborated by the company, but two proposed federal class actions (Turner v. MLD Mortgage; Chavez v. MLD Mortgage) were filed Oct 9 in New Jersey over the alleged exposure -- a material legal consequence even though the underlying breach itself is still an unverified claim. Catch-up record: this claim was not previously entered into the tracker. · Sources: MPA
Sep 18 STOKR (digital securities platform) N0n Ransomware · Financial Services · Luxembourg N0n listed STOKR, a Luxembourg-regulated digital securities platform for issuers, investors and intermediaries, on its leak site Sep 18 with a Sep 20 22:40 UTC deadline, claiming a KYC investor register (names, emails, countries, wallet addresses, tax IDs), identity-to-crypto-wallet mapping for KYC-accepted investors across seven countries, and an internal admin directory; the group says it will also deliver investor data to the tax authorities of investors' home countries. N0n is an emerging group; ransomware.live advises treating its claims cautiously pending corroboration. No company confirmation. DLS claim only. · Sources: Ransomware.live · RedPacket Security
Sep 12 Revolut Unknown Ransomware · financial services · UK Revolut confirms Sep 12, 2026 it disclosed customer identity documents (passports, driver's licenses), verification selfies, account statements and transaction/Bitcoin histories to an unauthorized third party after a sophisticated impersonation scam used a legitimate government-agency email domain to submit fraudulent information requests; company says a 'limited' number of customers affected, exact count undisclosed; blocked the sender, notified the impersonated agency, law enforcement and regulators · Sources: TechCrunch · The Block
Sep 04 Occidental Gunra Ransomware · insurance · Venezuela Venezuelan insurance company (~$157M revenue); Gunra DLS claim Sep 4; no data scope or operational impact disclosed; 🟥 DLS claim only; verify before treating as a breach · Sources: https://ransomware.live/id/T2NjaWRlbnRhbEBndW5yYQ== · https://www.redpacketsecurity.com/gunra-ransomware-victim-occidental/

August 2026

Aug 27 Providence Investments Qilin Ransomware · Financial Services · USA DLS posting Aug 27; no data volume or proof of exfiltration provided; 🟥 unverified claim · Sources: https://www.redpacketsecurity.com/qilin-ransomware-victim-providence-investments/ · https://ransomware.live/group/qilin
Aug 22 BOK Financial ShinyHunters Extortion · Financial Services · USA ShinyHunters DLS claim Aug 22 2026; BOK Financial is a major US financial holding company (NASDAQ: BOKF, ~$50B assets, Tulsa OK); ransom deadline August 24; data scope not disclosed; 🟥 unverified DLS claim · Sources: DEXpose · RansomLook
Aug 22 Tower Limited (Tower Insurance) CoinbaseCartel Ransomware · Financial Services · New Zealand Major NZ insurer named on the group's leak site (group's 207th+ named 2026 victim); claim dates to Aug 22 but only broke into mainstream NZ press Oct 2-3. Tower has only acknowledged 'unverified information circulating on cyber forums' -- no confirmation. Catch-up record, filed by true claim date. · Sources: Insurance Business NZ · Ransomware.live
Aug 21 Apollo Global Management Falcon/Helix/Pink/Redact Ransomware · Financial Services · USA Social engineering attack July 6-10 2026; SSNs, names, DOBs, home addresses compromised from cloud systems; part of wider wave targeting major financial firms including Blackstone, Bridgewater, Bain Capital; disclosed Aug 21 / notified California AG Aug 20 · Sources: https://techcrunch.com/2026/08/21/private-equity-firm-apollo-confirms-data-breach-amid-hacking-wave-targeting-financial-giants/
Aug 19 Senvest Capital The Gentlemen Ransomware · Financial Services · USA TheGentlemen ransomware group DLS claim Aug 19 2026 against international hedge fund and investment firm; data theft threatened; Senvest manages billions in public equities, private markets, and real estate; no public confirmation from Senvest · Sources: https://www.dexpose.io/thegentlemen-ransomware-targets-senvest-capital/
Aug 12 Fiserv Clop Extortion · Financial Technology · US Clop DLS claim August 12, 2026 against Fiserv (global fintech/payments processor); scope unconfirmed; first appeared in tracker August 14. · Sources: https://www.bleepingcomputer.com/news/security/
Aug 06 TechVentures Bank S.A. RansomHouse Ransomware · Financial Services · Unknown RansomHouse DLS listing Aug 6 2026; double extortion · Sources: https://www.ransomware.live/group/ransomhouse
Aug 05 FIS Global Clop Extortion · Financial Technology / Payment Infrastructure · USA Clop listed FIS Global (one of the world's largest financial technology providers, serving thousands of financial institutions) on its DLS on Aug 5, claiming 874GB of exfiltrated data including project files, CAD files, and Windchill-related engineering data — consistent with the PTC Windchill/FlexPLM campaign (CVE-2026-12569) that also hit Shell, GE, Philips, and Fiserv. FIS has not confirmed breach. DLS claim only — unverified. · Sources: https://malware.news/t/clop-ransomware-targets-fis-global/124620
Aug 01 Philippine Savings Bank The Gentlemen Ransomware · Finance · PH TheGentlemen claim on DLS August 1 2026; separate from January 2026 Qilin listing (different group, independent claim). No statement from PSBank; no data published. · Sources: https://www.redpacketsecurity.com/thegentlemen-ransomware-victim-philippine-savings-bank/

July 2026

Jul 31 Kuveyt Turk / Finansbank / Anadolubank / Turkish Airlines (THY) CRPxO Ransomware · Finance / Aviation · Turkey CRPxO ransomware posted wave of Turkish targets July 31: Kuveyt Turk (0.8 GB), Finansbank (2.3 GB), Anadolubank (0.4 GB), Turkish Airlines/THY (4.2 GB); also claimed Johnson & Johnson, Dogan Holding, Anadolu Sigorta, Hyundai · Sources: https://www.ransomware.live/
Jul 24 Bank of Baroda Triple X Ransomware · banking · India Triple X DLS claim July 24; ~1 TB data alleged exfiltrated; estimated attack date May 12, 2026; government-owned second-largest public-sector bank in India. Unverified DLS claim. · Sources: https://www.ransomware.live/
Jul 10 Eurodefi Qilin Ransomware · financial services · EU Qilin DLS claim July 10, 2026; data scope and impact unconfirmed; 🟥 unverified · https://www.ransomware.live/group/qilin · Sources: [ransomware.live]
Jul 10 Finance Yorkshire CMD Ransomware · financial services · UK UK regional finance provider supporting business growth across Yorkshire and the Humber; CMD DLS claim July 10, 2026; data scope and impact unconfirmed; 🟥 unverified · https://www.ransomware.live/group/cmdorganization · Sources: [ransomware.live]
Jul 06 Arabia Falcon Insurance Company The Gentlemen Ransomware · insurance · Oman The Gentlemen DLS claim July 6, 2026; data scope and impact unconfirmed; 🟥 unverified · https://www.ransomware.live/group/thegentlemen · Sources: [ransomware.live]
Jul 04 TQ Financial Services Qilin Ransomware · financial services · unknown Qilin DLS claim July 3–4, 2026; data scope and impact unconfirmed; 🟥 unverified · https://www.ransomware.live/group/qilin · Sources: [ransomware.live]
Jul 04 Silvestri & Associates Insurance Play Ransomware · financial services · insurance/US Play DLS claim July 4, 2026; data leak threatened; data scope and impact unconfirmed; 🟥 unverified · https://www.dexpose.io/play-ransomware-targets-silvestri-associates-insurance/ · Sources: [DeXpose]
Jul 04 Deutsche Bank UnSafe Ransomware · banking · financial services/Germany UnSafe DLS claim July 4–6, 2026; Deutsche Bank is Germany's largest bank by assets; UnSafe is a brand-new group with no established track record or prior leak history; data scope, attack vector, and impact entirely unconfirmed; 🟥 EXTREMELY LOW CONFIDENCE — verify through Deutsche Bank communications only before treating as breach · https://www.ransomware.live/ · Sources: [ransomware.live]
Jul 03 CUI Agency The Gentlemen Ransomware · insurance · US US insurance agency based in Utah; The Gentlemen DLS claim July 3, 2026; data scope and impact unconfirmed; 🟥 unverified · https://www.dexpose.io/ · Sources: [DeXpose]
Jul 01 Roundshield Partners LLP INC Ransom Ransomware · financial services · private equity/UK UK-based private equity firm focused on special situations and credit investments; INC Ransom DLS claim July 1, 2026; 400 GB exfiltrated claimed; data scope and impact unconfirmed; 🟥 unverified · https://www.dexpose.io/ · Sources: [DeXpose]
Jul 01 Marquis Software Unknown Ransomware · Financial Services / Software · US Financial software company serving community banks; ransomware attack compromised data for 670,000+ individuals across dozens of bank customers including Artisans Bank and VeraBank; no ransomware group claimed credit publicly (suggesting possible payment); attack date not precisely specified · Sources: https://therecord.media/marquis-bank-vendor-data-breach

June 2026

Jun 30 Aflac Life Insurance Japan Ltd. Scattered Spider Extortion · insurance · Japan unauthorized access June 15–25, 2026; 4.38M customer records exposed (names, addresses, phone numbers; bank account details for ~230K); access vector undisclosed; actor officially unattributed but TTPs consistent with Scattered Spider per industry analysis; Aflac disclosed June 30, 2026; Japan FSA and police notified; no misuse confirmed at disclosure; 🟥 unverified attribution · https://www.securityweek.com/aflac-japan-data-breach-impacts-4-38-million/ · https://www.bleepingcomputer.com/news/security/insurance-giant-aflac-discloses-data-breach-after-subsidiary-hack/ · https://www.japantimes.co.jp/business/2026/06/30/aflac-hack-4-million/ · Sources: [SecurityWeek] · [BleepingComputer] · [Japan Times]
Jun 30 Abans Group BlackNevas Ransomware · financial services · multinational diversified global financial services conglomerate; BlackNevas DLS claim June 30, 2026; estimated attack date June 29, 2026; data scope and impact unconfirmed; 🟥 unverified · https://ransomware.live/id/QWJhbnMgR3JvdXBAYmxhY2tuZXZhcw== · https://www.breachsense.com/breaches/2026/june/ · Sources: [ransomware.live] · [Breachsense]
Jun 28 FCCI Insurance Group REDACT Ransomware · insurance · financial services/US specialty commercial insurance company; REDACT DLS claim June 28, 2026; data scope and impact unconfirmed; 🟥 unverified · https://www.ransomware.live/group/redact · https://www.redpacketsecurity.com/redact-ransomware-victim-fcci-insurance-group/ · Sources: [ransomware.live] · [RedPacket Security]
Jun 26 Payload Corporation Payload Ransomware · fintech · payments/US B2B automated payment processing platform serving real estate, legal, insurance, and SaaS sectors (founded 2019; co-founders Ian Halpern and Ryan Rybolt); Payload DLS claim June 26, 2026; data scope unconfirmed; 🟥 unverified — no victim statement · https://www.dexpose.io/payload-ransomware-breach-at-payload-corporation/ · https://www.ransomware.live/group/payload · Sources: [DeXpose] · [ransomware.live]
Jun 26 MagMutual Insurance Company LeakNet Ransomware · insurance · US mutual insurance company focused on healthcare professionals; LeakNet DLS claim June 26, 2026; data scope and impact unconfirmed; 🟥 unverified · https://www.breachsense.com/breaches/2026/june/ · Sources: [Breachsense]
Jun 24 Cash Canada Qilin Ransomware · financial services · Canada DLS claim June 24, 2026; data scope and impact unconfirmed · https://www.redpacketsecurity.com/qilin-ransomware-victim-cash-canada/ · https://www.ransomware.live/group/qilin · Sources: [RedPacket Security] · [ransomware.live]
Jun 23 Belpointe Asset Management INC Ransom Ransomware · financial advisory · investment/US https://www.breachsense.com/breaches/ · https://www.ransomware.live/ · Sources: [Breachsense] · [ransomware.live]
Jun 23 GIA Partners LLC The Gentlemen Ransomware · financial services · US https://www.breachsense.com/breaches/ · https://www.ransomware.live/ · Sources: [Breachsense] · [ransomware.live]
Jun 23 AYA Bank Lapsus$ Ransomware · banking · financial services/Myanmar claimed full dump of main banking platform + customer PII; Lapsus$ stated data will be sold on dark markets if ransom not paid; AYA Bank has not issued a public statement; 🟥 unverified — treat as claimed only · https://www.ransomware.live/id/QVlBIEJBTktAbGFwc3VzJA · https://www.redpacketsecurity.com/lapsus-ransomware-victim-aya-bank/ · https://www.hookphish.com/blog/ransomware-group-lapsus-hits-aya-bank/ · Sources: [ransomware.live] · [RedPacket Security] · [HookPhish]
Jun 22 Central Bank of Libya Qilin Ransomware · banking · central bank/Libya ransomware confirmed; SWIFT payment system components targeted; virtual infrastructure and internal systems hit; CBL isolated affected systems June 22; investigations ongoing; no confirmed customer data breach or correspondent bank data exposure · https://www.ransomware.live/id/Q2VudHJhbCBCYW5rIG9mIExpYnlhQHFpbGlu · https://libyaobserver.ly/news/cbl-cyberattack-contained-investigations-ongoing-no-signs-impact-customer-accounts · Sources: [ransomware.live] · [Libya Observer]
Jun 22 NationsBuilders Insurance Services Aur0ra Ransomware · insurance · US US-based specialty insurance risk management firm offering surplus and specialty lines coverage; Aur0ra DLS claim June 22, 2026; over 2.7 million file-tree entries compromised claimed; data scope and victim statement not confirmed · https://www.dexpose.io/aurora-ransomware-attack-on-nationsbuilders-insurance-services/ · Sources: [DeXpose]
Jun 22 Insurity Icarus Ransomware · insurance software · US Salesforce CRM data · https://www.bleepingcomputer.com/news/security/klue-oauth-breach-linked-to-icarus-salesforce-data-theft-attacks/ · Sources: [BleepingComputer]
Jun 22 KTR Real Estate Advisors Anubis Ransomware · financial services · real estate advisory/US client database claimed; attack est. 2026-06-19 · https://www.dexpose.io/anubis-ransomware-group-strikes-ktr-real-estate-advisors/ · https://www.redpacketsecurity.com/anubis-ransomware-victim-ktr-real-estate-advisors/ · Sources: [DeXpose] · [RedPacket Security]
Jun 19 Aflac Scattered Spider Extortion · insurance · US June 2025 social-engineering intrusion; 22.6M people notified (≥13.9M with PHI) · Sources: The Record / HIPAA Journal
Jun 16 River Bank & Trust Unattributed Breach · banking · financial services/US ransomware attack June 16, 2026; SEC 8-K filed June 25, 2026; PII of customers and employees potentially exposed; investigation ongoing; operational impact not disclosed; actor unattributed · https://www.sec.gov/Archives/edgar/data/1641601/000119312526282946/ck0001641601-20260619.htm · https://1819news.com/news/item/river-bank-trust-hit-by-ransomware-attack-from-unauthorized-threat-actor · Sources: [SEC 8-K] · [1819 News]
Jun 12 Lucanet Icarus Ransomware · financial performance management software · Germany Salesforce CRM data accessed via Klue OAuth integration; disclosed June 30, 2026 · Sources: [SecurityWeek]
Jun 10 Liberty Insurance Corporation Krybit Ransomware · insurance · Philippines Sources: ransomware.live DLS
Jun 09 M1xchange WorldLeaks Ransomware · fintech · India Sources: ransomware.live DLS
Jun 09 Philadelphia Insurance Companies Ethics Ransomware · Insurance · USA DLS claim by new group Ethics (debuted Aug 12, 2026); one of 3 simultaneous inaugural postings; estimated attack date Jun 2026; scope unverified · Sources: https://www.dexpose.io/ethics-ransomware-group-targets-philadelphia-insurance-companies/
Jun 01 RRCA Accounts Management Unattributed Breach · collections · US 115,837 individuals affected

May 2026

May 28 VVO Finance Everest Ransomware · financial services · Germany Everest DLS May 28, 2026; data scope undisclosed; no victim statement; 🟥 unverified · https://www.hookphish.com/blog/ransomware-group-everest-hits-vvo-finance/ · https://www.redpacketsecurity.com/everest-ransomware-victim-vvo-finance/ · Sources: [HookPhish] · [RedPacket Security]
May 03 Fiserv Inc. Everest Ransomware · fintech · US powers core banking systems, digital platforms, merchant acquiring, and Clover POS for thousands of financial institutions worldwide; Everest DLS May 3, 2026; no ransom demand stated; Fiserv has not confirmed; 🟥 unverified · https://www.dexpose.io/everest-ransomware-attack-targets-financial-tech-leader-fiserv/ · https://www.redpacketsecurity.com/everest-ransomware-victim-fiserv/ · https://www.breachsense.com/breaches/fiserv-data-breach/ · Sources: [DeXpose] · [RedPacket Security] · [Breachsense]
May 02 TSYS Everest Ransomware · payment processing · US Global Payments' core payment-processing and card-issuer subsidiary; Everest DLS May 2, 2026; data scope undisclosed; no victim statement; 🟥 unverified · https://www.hookphish.com/blog/ransomware-group-everest-hits-tsys/ · https://www.redpacketsecurity.com/everest-ransomware-victim-tsys/ · Sources: [HookPhish] · [RedPacket Security]

April 2026

Apr 30 Liberty Mutual Insurance Everest Ransomware · insurance · US 108 GB (52,429 files) dumped May 4 after ransom deadline; policyholder names, addresses, policy numbers, financial details; Liberty Mutual confirmed "third-party vendor" investigation and denied direct system compromise; 🟨 vendor breach confirmed · https://www.bankinfosecurity.com/everest-group-begins-leaking-alleged-liberty-mutual-data-a-31589 · https://cybernews.com/security/liberty-mutual-ransomware-attack-policyholder-data/ · Sources: [BankInfoSecurity] · [Cybernews]
Apr 20 Citizens Financial Group Everest Ransomware · banking · US shared statement-printing vendor compromised; 3.4M records (names, home addresses, account numbers, internal document flags; no SSNs confirmed); Everest DLS April 20, 2026; Citizens confirmed third-party vendor breach; class action filed US District Court Providence April 24; 🟨 vendor breach confirmed · https://www.scworld.com/brief/extensive-citizens-financial-group-frost-bank-breaches-claimed-by-everest-ransomware · https://www.americanbanker.com/news/citizens-frost-blame-vendor-after-data-breach-claim · Sources: [SC Media] · [American Banker]
Apr 20 Frost Bank Everest Ransomware · banking · US same shared vendor as Citizens Financial Group; 250K records incl. SSNs, tax IDs, mortgage rates, income data, home addresses; Everest DLS April 20, 2026; Frost confirmed third-party vendor breach; full data dumped after 6-day deadline; 🟨 vendor breach confirmed · https://www.scworld.com/brief/extensive-citizens-financial-group-frost-bank-breaches-claimed-by-everest-ransomware · https://cybernews.com/security/everest-ransomware-frost-citizens-bank-breach/ · Sources: [SC Media] · [Cybernews]
Apr 16 Empower Group DragonForce Ransomware · financial services · UAE UAE financial services firm; DragonForce DLS claim April 16, 2026; 316.38 GB exfiltrated claimed; data scope unconfirmed; previously uncaptured; 🟥 unverified · https://www.ransomware.live/group/dragonforce · https://www.dexpose.io/ · Sources: [ransomware.live] · [DeXpose]
Apr 16 Standard Bank Group PrinzEugen Ransomware · banking · financial services/South Africa 1.2 TB exfiltrated; 1 BTC ransom demanded and refused; Group is South Africa's largest bank by assets; DLS claim April 16; first widely documented Prinz Eugen victim (new Go-based strain analyzed June 20 by ThreatDown) · https://www.bleepingcomputer.com/news/security/new-prinz-eugen-ransomware-prioritizes-recent-files-for-encryption/ · https://www.threatdown.com/blog/prinz-eugen-ransomware-a-deep-dive-into-a-new-go-based-encryptor/ · Sources: [BleepingComputer] · [ThreatDown]

March 2026

Mar 17 AssuranceAmerica Unattributed Breach · insurance · auto/US 14-state auto insurer headquartered in Atlanta, GA; employee credential compromise allowed unauthorized access March 17 – June 15, 2026; 6,990,000+ individuals' driver's licence numbers exfiltrated across 14 states; notification letters began July 10, 2026; actor unattributed · https://www.bleepingcomputer.com/ · https://securityaffairs.com/ · https://www.technadu.com/ · Sources: [BleepingComputer] · [SecurityAffairs] · [TechNadu]

← All industries · Victim database →