Breach Watch
Written for risk decisions, not headlines.
Breach, ransomware, vulnerability, advisory and threat intelligence, classified by a founding sponsor's threat intelligence service and analyzed in an ADTP brief for every item.
Showing 20 of 201
BREACH WATCH BRIEF
Ransomware Attack Disrupts Wi‑Fi and Checkout Systems at Queens Public Library
A ransomware gang encrypted critical systems at Queens Public Library, shutting down Wi‑Fi, checkout kiosks, and digital services across 66 branches. The outage highlights the need for documented incident‑response and business‑continuity controls to satisfy audit and trust requirements.
BREACH WATCH BRIEF
3 AM Ransomware Hits 37 UK School Systems in Suspected AI‑Assisted Attack
A ransomware campaign encrypted 37 UK school workstations in the early morning, using AI‑driven timing to avoid detection. The event highlights the importance of tested incident‑response and backup controls for audit readiness.
BREACH WATCH BRIEF
AI‑Assisted 3AM Ransomware Encrypts 37 Machines in a UK School Estate
A 3AM ransomware affiliate used AI‑generated PowerShell commands to encrypt 37 workstations in a UK school estate, stealing credentials and financial data. The breach highlights the importance of credential protection and privileged‑account monitoring for audit readiness.
BREACH WATCH BRIEF
AI‑Driven Command Loops Used by 3AM Affiliate in Ransomware Attack on European School
A German secondary school was hit by 3AM Affiliate ransomware that leveraged an AI‑like loop to auto‑generate PowerShell commands, accelerating encryption and data exfiltration. The incident highlights the need for robust, continuously‑evidenced incident‑response controls across frameworks.
BREACH WATCH BRIEF
Ransomware Campaign Encrypts Data on Outdated Synology NAS Devices via Patched DSM Vulnerability
Synology reports that threat actors are encrypting files on NAS units still running pre‑December 2024 DSM versions. The attack underscores the importance of a robust vulnerability‑management control for audit readiness.
BREACH WATCH BRIEF
C3RB3R Ransomware Exploits Unpatched Synology DSM Versions to Encrypt NAS Data
Synology reports a wave of C3RB3R ransomware attacks that target NAS devices running outdated DSM software. The ransomware leverages a December 2024 patchable vulnerability to encrypt files, highlighting the need for robust patch‑management controls for audit readiness.
BREACH WATCH BRIEF
Ransomware Group BYOD Disrupts UNM Health Sciences Center, Diverts Ambulances and Exposes Student & Employee Data
A ransomware gang called BYOD crippled the University of New Mexico Health Sciences Center, forcing ambulance diversions, surgery cancellations, and the exposure of personal data for thousands of students and staff. The breach underscores the need for robust incident‑response and backup controls to meet audit‑readiness expectations.
BREACH WATCH BRIEF
Ransomware Gang BYOD Disrupts UNM Health Sciences Center, Forces Hospital System Shutdown
A ransomware group called BYOD crippled the University of New Mexico Health Sciences Center, shutting down hospital systems and threatening stolen patient data. The breach highlights the importance of incident‑response controls and security‑awareness training for healthcare organizations.
BREACH WATCH BRIEF
Hive Affiliate Sentenced to 70 Months for Ransomware Attacks on Hospitals and Government Agencies
Ukrainian cyber‑criminal Artem Stryzhak, a Hive affiliate, received a 70‑month prison term for ransomware attacks that encrypted systems at hospitals, government agencies, and businesses worldwide. The case underscores the need for robust incident‑response and recovery controls to satisfy audit and trust requirements.
BREACH WATCH BRIEF
Hive Affiliate Sentenced to 70 Months for Global Ransomware Campaign
Artem Stryzhak was sentenced for operating as an affiliate of Hive/Nefilim ransomware, encrypting networks worldwide and stealing data to force ransom payments. The case highlights the importance of incident‑response controls for audit readiness.
BREACH WATCH BRIEF
Japan’s GMO Group Offers $1 M Bounty After Hackers Compromise 26,739 VPS Customers and Demand ¥8 Billion Ransom
GMO Group’s cloud‑hosting platform was breached, exposing over 26,000 virtual servers, stealing trading credentials, and prompting an ¥8 billion extortion demand. The incident highlights the need for robust access controls and continuous monitoring to satisfy audit‑readiness across frameworks.
BREACH WATCH BRIEF
Hive Ransomware Affiliate Sentenced After FBI Infiltration Saves Victims $130M
Artem Stryzhak, a Hive ransomware affiliate, received a 70‑month U.S. sentence after the FBI secretly breached Hive’s infrastructure in 2022 and supplied decryption keys to victims, averting roughly US $130 million in ransom payments. The case highlights why organizations must maintain auditable incident‑response and evidence‑preservation controls.
BREACH WATCH BRIEF
Ransomware Affiliate Sentenced to 70 Months for Hospital & Government Attacks
A Ukrainian national received a 70‑month prison term for facilitating Nefilim and Hive ransomware attacks on hospitals, government bodies and high‑revenue firms. The case highlights the importance of incident‑response controls and audit‑ready evidence for ransomware readiness.
BREACH WATCH BRIEF
Byod Ransomware Compromises 36,000 Systems at UNM Health, Disrupting Patient Care and Surgeries
UNM Health confirmed a ransomware attack that forced the suspension of admissions, surgeries, and classes while exposing personal, payroll, and EHR data. The breach highlights the importance of incident‑response controls that generate defensible audit evidence.
BREACH WATCH BRIEF
Hive Ransomware Operator Sentenced to 70 Months for Hospital and Government Attacks
A former affiliate of the Nefilim and Hive ransomware groups received a 70‑month prison sentence after pleading guilty to attacks on hospitals, government entities, and businesses across 80 countries. The case underscores how ransomware can cripple patient care and cause massive financial loss. Organizations must ensure incident‑response controls are auditable and continuously monitored to demonstrate trust and control assurance.
BREACH WATCH BRIEF
SafePay ransomware campaign compromises over 600 critical‑infrastructure organizations worldwide
CISA and partner agencies report that the SafePay ransomware gang has breached more than 600 critical‑infrastructure entities since 2024, using VPN credential theft and exploited edge‑device flaws. The incident underscores the need for continuous identity‑access controls and auditable backup protection for compliance readiness.
BREACH WATCH BRIEF
SafePay Ransomware Gang Compromises Over 600 Organizations Across the U.S. and Europe
The FBI and European partners warned that the SafePay ransomware gang has breached at least 600 organizations since August 2024, using password guessing, known vulnerabilities and phishing. The incident underscores the need for continuous credential monitoring, patch management and a documented ransomware response plan for audit readiness.
BREACH WATCH BRIEF
SafePay Ransomware Campaign Exploits Multiple CVEs to Target Global Enterprises
CISA warns that the SafePay ransomware group is actively exploiting five known CVEs and credential‑theft techniques to encrypt files across multiple continents. Organizations must tighten access controls and prove incident‑response readiness to meet audit expectations.
BREACH WATCH BRIEF
Qilin Ransomware Attack on Synnovis Leads to Patient Death, Suspect Arrested in Germany
German authorities detained a suspected Qilin ransomware operative after the group’s 2024 attack crippled Synnovis’s pathology systems, causing service disruption and a patient’s death. The incident underscores the need for robust incident‑response controls and continuous audit evidence.
BREACH WATCH BRIEF
Ransomware Attack Hits City of Columbia, South Carolina, Prompting State Investigation
The City of Columbia confirmed a ransomware intrusion that encrypted critical municipal services on 25 Oct 2026, triggering a state‑led investigation. The breach highlights the importance of incident‑response controls and audit‑ready evidence for public‑sector organizations.
Breach Watch intelligence is provided by a founding sponsor of the Association. Every ADTP brief carries the sponsor's analysis and links the original source.
Practitioner briefings
Written by the association: what the week's intelligence means for the controls you run.
Reading a vendor's breach notice for what it does not say
A practitioner checklist for turning a supplier notification into an evidence request and a monitoring change.
Where AI inventory efforts stall, and the control that unblocks them
Findings from practitioner roundtables on AI governance programs in their first year.
Evidence reuse across customer diligence and audit
How practitioners are organizing one evidence base to serve buyers and auditors at the same time.
Global Privacy Control signals and state opt-out obligations
What a site must do when it sees a GPC signal, and how to evidence it.
Get the digest
No membership required. Confirm by email; unsubscribe in one click.