Breach Watch
Written for risk decisions, not headlines.
Breach, ransomware, vulnerability, advisory and threat intelligence, classified by LiveThreat and analysed in an ADTP brief for every item.
Showing 20 of 186
BREACH WATCH BRIEF
SafePay ransomware campaign compromises over 600 critical‑infrastructure organizations worldwide
CISA and partner agencies report that the SafePay ransomware gang has breached more than 600 critical‑infrastructure entities since 2024, using VPN credential theft and exploited edge‑device flaws. The incident underscores the need for continuous identity‑access controls and auditable backup protection for compliance readiness.
BREACH WATCH BRIEF
SafePay Ransomware Gang Compromises Over 600 Organizations Across the U.S. and Europe
The FBI and European partners warned that the SafePay ransomware gang has breached at least 600 organizations since August 2024, using password guessing, known vulnerabilities and phishing. The incident underscores the need for continuous credential monitoring, patch management and a documented ransomware response plan for audit readiness.
BREACH WATCH BRIEF
SafePay Ransomware Campaign Exploits Multiple CVEs to Target Global Enterprises
CISA warns that the SafePay ransomware group is actively exploiting five known CVEs and credential‑theft techniques to encrypt files across multiple continents. Organizations must tighten access controls and prove incident‑response readiness to meet audit expectations.
BREACH WATCH BRIEF
Qilin Ransomware Attack on Synnovis Leads to Patient Death, Suspect Arrested in Germany
German authorities detained a suspected Qilin ransomware operative after the group’s 2024 attack crippled Synnovis’s pathology systems, causing service disruption and a patient’s death. The incident underscores the need for robust incident‑response controls and continuous audit evidence.
BREACH WATCH BRIEF
Ransomware Encrypts Telangana’s TG‑iPASS Government Portal Database, Service Shut Down
A ransomware campaign compromised the Telangana state iPASS portal on 25 Oct 2026, encrypting the citizen‑identity database and forcing the service offline. The incident underscores the need for auditable incident‑response and backup controls to satisfy multiple compliance frameworks.
BREACH WATCH BRIEF
IronChain Ransomware Threatens Businesses with Permanent Data Loss and Costly Downtime
IronChain ransomware is actively encrypting enterprise data and threatening permanent deletion, causing extended downtime. The incident underscores the need for immutable backups and a documented ransomware response plan to satisfy audit and trust requirements.
BREACH WATCH BRIEF
Krybit Ransomware-as-a-Service Targets Global Enterprises, Exfiltrates Data Before Encryption
Krybit, a ransomware‑as‑a‑service platform active since early 2026, encrypts files, exfiltrates data and demands US $40‑100 k in cryptocurrency. Victims span IT services, finance, transportation and public registries across Europe, Asia and the Americas, highlighting the need for robust incident‑response controls.
BREACH WATCH BRIEF
Data‑Leaking Ransomware Operators Compromise 854 Victims in 93 Countries (Sept 2026)
In September 2026, 84 ransomware groups—among them 11 newly‑active operators—affected 854 organizations in 93 countries, including 347 U.S. victims. The breach underscores the need for auditable incident‑response controls that satisfy multiple compliance frameworks.
BREACH WATCH BRIEF
Silent Ransom Group Extorted $207 Million from 27 Law Firms Using Phone‑Based Social Engineering
Silent Ransom demanded $207 M from 27 law firms through phone intimidation, bypassing ransomware encryption. The episode highlights gaps in security‑awareness and incident‑response controls that continuous‑monitoring programs must address.
BREACH WATCH BRIEF
MonsterCloud CEO Accused of Paying Ransomware Gangs While Defrauding Victims
The DOJ alleges MonsterCloud’s CEO secretly paid ransomware groups for decryption keys while overcharging victims. The case illustrates how undisclosed vendor actions can undermine trust and audit readiness, emphasizing the need for transparent incident‑response and third‑party oversight.
BREACH WATCH BRIEF
Ransomware Attack Disrupts Japan’s IDCF Cloud, Affecting 495 Companies and Government Clients
A ransomware group breached IDC Frontier’s IDCF Cloud service, encrypting 3.6 PB of data and shutting down management consoles for 495 corporate and government customers. The incident highlights the need for continuous third‑party monitoring and auditable incident‑response evidence.
BREACH WATCH BRIEF
MonsterCloud Owner Charged With Secretly Paying Ransomware Demands and Over‑Billing Clients
The owner of a ransomware‑recovery firm allegedly paid attackers on behalf of clients while inflating invoices by up to twenty‑fold, leading to a federal wire‑fraud charge. This highlights the need for robust third‑party oversight and auditable ransom‑payment processes for compliance readiness.
BREACH WATCH BRIEF
Ransomware Attack Stole PII from Advantest, Global Semiconductor Test‑Equipment Maker
Advantest disclosed that a February 2026 ransomware breach exfiltrated personal data—including SSNs, passports, and medical records—from its corporate network. The incident underscores the importance of incident‑response and privacy controls for audit readiness.
BREACH WATCH BRIEF
Osaka Metropolitan University Halts Classes After Suspected Ransomware Attack Exposing 130,000 Records
Osaka Metropolitan University shut down 500 servers after a suspected ransomware incident that disrupted email, academic, and administrative systems and may have exposed personal data of 130 000 individuals. The event underscores the need for continuous monitoring, incident‑response evidence, and security‑awareness training to meet audit‑readiness expectations.
BREACH WATCH BRIEF
Ransomware Gang Booba Steals 344 GB from University of Illinois Chicago College of Medicine
A ransomware group called Booba breached the University of Illinois Chicago’s College of Medicine, encrypting systems and exfiltrating 344 GB of data. The incident highlights the need for auditable incident‑response controls and continuous monitoring to satisfy multiple compliance frameworks.
BREACH WATCH BRIEF
Warlock Ransomware Targets Water and Telecom Operators, Disrupting Critical Services
Warlock ransomware leveraged legacy SharePoint flaws to encrypt data on water utility and telecom networks, leading to service outages. The incident underscores the need for continuous patch management and auditable incident‑response evidence.
BREACH WATCH BRIEF
Warlock Ransomware Exploits Unpatched SharePoint Flaws to Target Critical Infrastructure
Warlock ransomware (Longlegs) continues to breach water utilities, telecoms, governments and universities by exploiting legacy SharePoint vulnerabilities. The attacks highlight the need for robust vulnerability‑management controls and audit‑ready evidence for compliance programs.
BREACH WATCH BRIEF
Warlock Ransomware Exploits Zero‑Day SharePoint Flaws to Hit Water Utility, Telecom Operator and Others
Warlock ransomware leveraged four SharePoint zero‑day vulnerabilities to compromise a water utility, telecom provider, regional government and university, disabling AV/EDR on dozens of hosts before encrypting data. The incident highlights the need for continuous vulnerability management and auditable patch‑remediation evidence for compliance readiness.
BREACH WATCH BRIEF
Warlock Ransomware Exploits Unpatched SharePoint Vulnerabilities in Critical Infrastructure Across Portuguese‑ and Spanish‑Speaking Nations
A China‑based group used the Warlock ransomware to breach water utilities, telecoms, universities, and regional governments by exploiting unpatched Microsoft SharePoint flaws. The campaign underscores the importance of robust vulnerability‑management and audit‑ready evidence for control assurance.
BREACH WATCH BRIEF
Spain Arrests 16‑Year‑Old Suspected Leader of KillSec Ransomware, Tied to ~1,000 Attacks and 110 TB of Stolen Data
Spanish authorities detained a 16‑year‑old alleged administrator of the KillSec ransomware group, which has been linked to nearly 1,000 attacks since 2024. The operation’s dark‑web site and over 110 TB of stolen files were seized, highlighting the scale of the threat and the importance of robust incident‑response controls for audit readiness.
Breach Watch intelligence is provided by LiveThreat, a product of a founding sponsor of the association. Every ADTP brief carries LiveThreat's analysis and links the original source.
Practitioner briefings
Written by the association: what the week's intelligence means for the controls you run.
Reading a vendor's breach notice for what it does not say
A practitioner checklist for turning a supplier notification into an evidence request and a monitoring change.
Where AI inventory efforts stall, and the control that unblocks them
Findings from practitioner roundtables on AI governance programs in their first year.
Evidence reuse across customer diligence and audit
How practitioners are organizing one evidence base to serve buyers and auditors at the same time.
Global Privacy Control signals and state opt-out obligations
What a site must do when it sees a GPC signal, and how to evidence it.
Get the digest
No membership required. Confirm by email; unsubscribe in one click.