Vector: Ransomware attack on ChipSoft's cloud infrastructure (SaaS Patient Portal and GP software tenant); threat actor group not yet publicly identified as of disclosure

Vector: Ransomware or destructive cyberattack on the Massachusetts healthcare system's IT infrastructure; the attack forced the organisation to take clinical systems offline and revert to paper-based downtime procedures; emergency services were diverted to protect patient safety

Vector: Qilin ransomware compromised Die Linke's network IT infrastructure; specific initial access vector not publicly disclosed

Vector: Interlock ransomware group exploited a critical vulnerability (CVSS 10.0) in Cisco ASA/FTD firewalls to gain initial access to victim networks weeks before deploying ransomware

Vector: Handala (Iran-linked hacktivist group) deployed a wiper attack against Stryker's Microsoft Intune MDM infrastructure; subsequent lawsuits and ongoing recovery documented

Vector: Ransomware attack on the University of Hawaii Cancer Center's research data infrastructure in August 2025

Vector: Not disclosed; Qilin listed Malaysia Airlines on its dark web victim site with no file samples or proof of data theft published

Vector: Medusa ransomware group breached UMMC; initial vector not publicly disclosed

Vector: Unknown; ransomware deployed against BridgePay's payment processing infrastructure

Vector: LockBit ransomware group attacked Capital Health's network infrastructure

Vector: Law enforcement action: police raided suspected Black Basta members and are seeking the group's leadership

Vector: TridentLocker ransomware group breached Sedgwick Government Solutions via an isolated file transfer system; initial access vector not publicly disclosed

Vector: Everest ransomware group claimed unauthorized access to Under Armour systems, alleging exfiltration of 343 GB of data; initial access vector not publicly disclosed

Vector: Unauthorized actor exploited a previously unknown vulnerability in GoAnywhere (a managed file transfer tool) used by Insightin Health, gaining access to servers for approximately 6 days

Vector: Ransomware attack targeting servers supporting the UH Cancer Center's Epidemiology Division research operations; initial access vector not publicly disclosed

Vector: Vishing (voice phishing) campaign weeks before the attack tricked employees into disclosing credentials; attackers posing as internal IT staff. Subsequent credential abuse and lateral movement into production and manufacturing systems.

Vector: Ransomware attack on Insight Hospital and Medical Center's IT environment; unauthorized access persisted for approximately 20 days before discovery

Vector: Akira ransomware exploited CVE-2024-40766 (SonicWall VPN improper access control) to breach Marquis Software's network; attackers also bypassed MFA

Vector: INC Ransom exploited CVE-2025-5777 (Citrix Bleed 2, critical) in public-facing Citrix NetScaler appliances at the Pennsylvania Attorney General's Office

Vector: Unknown; attack described as sophisticated; Interlock typically uses drive-by downloads and ClickFix social engineering

Vector: SafePay ransomware gained initial access via Ingram Micro's GlobalProtect VPN platform, likely through leaked credentials or password-spraying

Vector: Drive-by download from compromised legitimate website; ClickFix technique (fake CAPTCHA prompting users to run malicious code via Windows Run dialog)

Vector: Qilin ransomware group gained unauthorized access to Covenant Health's IT environment; initial vector not publicly disclosed

Vector: CWE-306: Missing Authentication for Critical Function / social engineering (Scattered Spider affiliates used vishing and employee impersonation to bypass MFA and conduct service-desk password resets)

Vector: Spear phishing emails targeting employees, followed by exploitation of vulnerabilities on a third-party internet-facing file transfer platform

Vector: CWE-284: Improper Access Control

Vector: Social engineering via Microsoft Teams: attacker impersonated an internal IT worker to gain access to an employee's laptop

Vector: CWE-306: Missing Authentication for Critical Function / social engineering (attackers impersonated an M&S employee and called the third-party service desk to perform a password reset; obtained NTDS.dit to crack hashes offline)

Vector: Ransomware attack targeting a shared network drive; attackers gained unauthorized access to a shared drive containing sensitive patient information (separate from the EMR system)

Vector: CWE-284: Improper Access Control

Vector: SimonMed was alerted on January 27 by a vendor experiencing a security issue; suspicious activity was detected on SimonMed's own systems the following day, suggesting possible supply chain or third-party initial access

Vector: Unknown; Hunters International typically uses phishing and exploits internet-facing systems

Vector: unknown

Vector: INC Ransom ransomware-as-a-service operation; initial access vector not publicly confirmed; INC Ransom commonly exploits Citrix NetScaler vulnerabilities and phishing

Vector: Unknown; RansomHub noted lack of security controls on the club's network

Vector: Hellcat ransomware group accessed Schneider Electric's Atlassian Jira instance using the MiniOrange REST API to extract data

Vector: CWE-284: Improper Access Control

Vector: Unknown initial access; attackers had persistent access from October 21, 2024 to January 13, 2025

Vector: SafePay ransomware gang gained unauthorized access to Conduent's systems and maintained persistence for approximately three months before triggering an operational disruption

Vector: Unauthorized remote access; specific initial access vector not publicly disclosed

Vector: Unknown; systems disrupted between September 17–29, 2024

Vector: CWE-798: Use of Hard-coded Credentials / phishing (phishing emails delivering malicious links; subsequent credential theft and lateral movement)

Vector: Unknown; Hunters International typically uses phishing and exploits vulnerable internet-facing systems

Vector: unknown

Vector: CWE-284: Improper Access Control

Vector: CWE-1391: Use of Weak Credentials (social engineering; exact initial vector not fully disclosed)

Vector: Phishing email compromised an employee account, leading to BlackSuit ransomware deployment across Kadokawa corporate infrastructure and Niconico video-sharing platform

Vector: RansomHub threat actor impersonated a Rite Aid employee to obtain business credentials; gained access to certain business systems; incident detected within 12 hours

Vector: unknown

Vector: CWE-601: URL Redirection to Untrusted Site (phishing link clicked by employee)

Vector: unknown

Vector: CWE-522: Insufficiently Protected Credentials (stolen VPN credentials)

Vector: Ransomware attack on Landmark Admin with data encrypted and exfiltrated; initial access vector not publicly confirmed

Vector: CWE-494: Download of Code Without Integrity Check (employee downloaded malicious file believing it legitimate)

Vector: Unknown; Black Basta typically uses phishing emails and exploited vulnerabilities for initial access

Vector: unknown

Vector: RansomHub ransomware operation gained initial access to Frontier Communications systems; RansomHub typically focuses on data-theft extortion without file encryption

Vector: CWE-284: Improper Access Control

Vector: CWE-284: Improper Access Control

Vector: CWE-284: Improper Access Control

Vector: See original Change Healthcare ALPHV/BlackCat ransomware breach record (2024-02-12): MFA-less Citrix remote access portal exploited by ALPHV affiliates using stolen credentials

Vector: CWE-308: Use of Single-Factor Authentication (compromised Citrix remote access lacking MFA)

Vector: ALPHV/BlackCat ransomware gained unauthorized access to Prudential Financial administrative and user data; initial access vector not publicly disclosed

Vector: CWE-1391: Use of Weak Credentials (exact vector not publicly disclosed)

Vector: CWE-522: Insufficiently Protected Credentials

Vector: Money Message ransomware gained access to Anna Jaques Hospital network; initial access vector not publicly disclosed

Vector: Threat actors gained access to First American Financial systems and exfiltrated non-production data before encrypting it; initial access vector not publicly disclosed

Vector: unknown

Vector: Attackers exploited a Citrix Bleed vulnerability (CVE-2023-4966) in DP World's Citrix NetScaler infrastructure to gain unauthorized access to the company's network; the vulnerability allowed session token hijacking without authentication

Vector: Unknown attacker (ALPHV/BlackCat ransomware suspected) gained access to DP World Australia's internal IT network by exploiting a vulnerability in internet-facing systems; the attack disrupted the operational technology systems managing container movements

Vector: Exploitation of a Citrix workspace software vulnerability to gain network access

Vector: CWE-200: Exposure of Sensitive Information (Citrix Bleed - memory disclosure of valid session tokens enabling auth bypass)

Vector: Dark Angels ransomware group gained access to Johnson Controls' internal network via a compromised subsidiary (Asia-Pacific offices); established persistent access and exfiltrated approximately 27TB of data before deploying ransomware

Vector: ALPHV/BlackCat ransomware affiliates (Scattered Spider) gained access to Clorox's network; the attack used the same social engineering techniques deployed against MGM and Caesars — helpdesk vishing and MFA fatigue to impersonate employees and gain network access

Vector: Ransomware attack on Rapattoni Corp. cloud infrastructure hosting MLS software as a service; initial vector not publicly disclosed

Vector: ALPHV/BlackCat ransomware-as-a-service affiliates compromised HWL Ebsworth's network via unknown initial access vector; spent time in the network exfiltrating approximately 4 terabytes of data before being detected

Vector: Phishing email leading to malware download; threat actor then escalated privileges over 58 hours before deploying ransomware (critical 58-hour delay in quarantining the initially infected device)

Vector: Money Message ransomware group gained access to PharMerica's network via unknown initial access vector; the group exfiltrated patient data and deployed ransomware; PharMerica is a major pharmacy benefits management company operating in long-term care facilities

Vector: Black Basta ransomware group attacked Dish Network's internal network; specific initial access vector not publicly disclosed; the attack encrypted internal systems and exfiltrated data

Vector: Attackers used compromised VPN credentials to access Dish Network's Windows Active Directory domain, then moved laterally and deployed ransomware across Dish's IT infrastructure

Vector: CWE-1391: Use of Weak Credentials (compromised credentials; exact initial vector not publicly disclosed)

Vector: Play ransomware group exploited CVE-2022-41080 (OWASSRF — Microsoft Exchange Server ProxyNotShell bypass) combined with CVE-2022-41082 to achieve remote code execution on Rackspace's Hosted Exchange environment; the vulnerability bypassed existing mitigations Rackspace had applied for ProxyNotShell

Vector: Hive ransomware group gained access to CommonSpirit's internal network via compromised credentials; attackers had access from 16 September through 3 October 2022 before the attack was detected; specific initial access vector (likely phishing or RDP) was not fully disclosed

Vector: Vice Society ransomware group gained access to LAUSD's network; initial access vector not officially confirmed but consistent with credential theft or exploitation of internet-facing systems; attackers exfiltrated approximately 500GB of data before deploying ransomware over the Labor Day weekend

Vector: CWE-308: Use of Single-Factor Authentication (stolen VPN credentials; VPN lacked MFA, only requiring device certificate or username/password)

Vector: Ransomware group breached Yuma Regional Medical Center's network, gaining access to systems containing patient information; the specific initial access vector was not publicly disclosed

Vector: CWE-506: Embedded Malicious Code (ransomware; attack vector not publicly disclosed by UKG)

Vector: Unknown ransomware group compromised UKG/Kronos's cloud-based workforce management platform (Kronos Private Cloud); specific initial access vector was not disclosed; the attack encrypted the Kronos Private Cloud environment requiring several weeks to restore

Vector: Unknown ransomware group attacked Eye Care Leaders' myCare Integrity EHR platform — a managed service ophthalmology-specific EHR system used by hundreds of practices; attackers encrypted data and deliberately deleted database tables and audit logs, making it impossible to determine the full scope of data access

Vector: Ransomware attackers compromised Lincoln College's systems in December 2021, encrypting systems critical to student recruitment, retention, and fundraising operations; the attack prevented access to all institutional data for several months

Vector: Ransomware group (Vice Society) gained access to Eskenazi Health's network during a dwell period prior to the attempted encryption; Eskenazi detected the encryption attempt and brought systems offline before full encryption was completed; however, attackers had already exfiltrated patient data during the dwell period

Vector: Ransomware group breached Roper St. Francis Healthcare's network and accessed a scheduling application containing patient demographic and appointment data; the specific initial access vector was not publicly disclosed

Vector: CWE-521: Weak Password Requirements (brute-forced or leaked credentials; poor overall security posture confirmed by DHS internal review)

Vector: REvil ransomware-as-a-service affiliate obtained credentials to JBS's VPN; specific initial access vector was compromised remote access credentials; the attack targeted JBS's North American and Australian operations simultaneously

Vector: Phishing email delivered to a workstation on March 16, 2021; the workstation had a Cobalt Strike beacon installed, enabling remote access; attackers spent 8 weeks conducting reconnaissance before deploying Conti ransomware on May 14, 2021

Vector: CWE-308: Use of Single-Factor Authentication (compromised VPN account lacking MFA)

Vector: CWE-312: Cleartext Storage of Sensitive Information (DarkSide actors purchased stolen credentials to access the corporate network)

Vector: Conti ransomware operators gained access to Scripps Health's network on April 26, 2021; exfiltrated patient data before deploying ransomware on May 1, 2021, taking Scripps systems offline; a Russian national (Maksim Galochkin) was later federally indicted in connection with the attack as part of the Conti/TrickBot prosecution

Vector: DoppelPaymer ransomware group breached Reproductive Biology Associates' network, encrypted a file server containing embryology data, and exfiltrated patient data including highly sensitive fertility treatment records and embryo storage information

Vector: Conti ransomware group attacked Nine Entertainment via unknown initial access vector; the attack encrypted systems across Nine's network including broadcast and production systems

Vector: Evil Corp-affiliated attackers used a fake browser update (SocGholish/FakeUpdates malware) delivered via a watering hole or malicious website to gain initial access; deployed Phoenix CryptoLocker (a variant of WastedLocker) across CNA's network

Vector: Evil Corp affiliate used a fake browser update delivered via a legitimate website (watering hole / drive-by download) to deploy the Phoenix CryptoLocker ransomware; CNA employees were redirected to a malicious page that pushed a malicious update package

Vector: REvil gained initial access to Acer's network via the ProxyLogon Microsoft Exchange Server vulnerability (CVE-2021-26855) — exploiting the critical zero-day mere days after public disclosure

Vector: CWE-506: Embedded Malicious Code (DarkSide ransomware)

Vector: Ransomware attackers penetrated WestRock's network and deployed ransomware that affected both IT systems and operational technology (OT) systems, including manufacturing and operational systems at packaging production facilities

Vector: CWE-506: Embedded Malicious Code (DoppelPaymer ransomware; likely delivered via phishing)

Vector: DoppelPaymer ransomware group gained initial access via phishing email delivering the Emotet banking trojan, which subsequently dropped the Ryuk precursor; the attack targeted the University of Vermont Medical Center and its health network affiliate hospitals simultaneously

Vector: Phishing email leading to TrickBot banking trojan infection, which then delivered Emotet and ultimately Ryuk ransomware across UHS's network via lateral movement

Vector: Ransomware group exploited CVE-2019-19781 — a critical path traversal vulnerability in Citrix Application Delivery Controller (Citrix ADC / NetScaler) — to gain initial access to University Hospital Düsseldorf's network; the unpatched Citrix vulnerability had been known and widely exploited since January 2020

Vector: Evil Corp used FakeUpdates (SocGholish) — fake browser update JavaScript injected into compromised websites — to deliver a NetSupport RAT dropper that installed WastedLocker ransomware on Garmin's corporate network

Vector: CWE-506: Embedded Malicious Code (Maze ransomware; initial access vector not publicly confirmed, likely phishing or exploitation of exposed services)

Vector: Attackers sent a spear-phishing email impersonating a Magellan Health client, gaining access to a corporate server; exfiltrated data then deployed ransomware

Vector: Ransomware attackers sent a phishing email impersonating a Magellan Health client to a Magellan employee; the email installed malware that harvested login credentials; the attacker used stolen credentials to gain access to the Magellan server and deployed ransomware after exfiltrating data

Vector: CWE-506: Embedded Malicious Code (CLOP ransomware; initial vector not confirmed)

Vector: Ransomware group gained access to Blackbaud's self-hosted customer cloud environments; the attackers spent approximately five months conducting reconnaissance and exfiltrating data prior to deploying ransomware; initial access vector was not fully disclosed

Vector: Ransomware attack against Wood Ranch Medical Clinic's servers and electronic health record (EHR) backup systems; both primary and backup systems were encrypted, making recovery impossible without paying the ransom; the clinic did not have offline backups

Vector: CWE-522: Insufficiently Protected Credentials (Active Directory compromise via stolen credentials, possibly via prior phishing)

Vector: Ransomware (SamSam variant) infected LabCorp's network; the attack vector was consistent with SamSam group's known techniques of exploiting exposed RDP endpoints or leveraging JBOSS server vulnerabilities to gain initial access and then deploy ransomware across the network

Vector: SamSam ransomware variant delivered via exploitation of vulnerable internet-facing servers (likely via RDP brute force or exploitation of unpatched JBoss/Java application servers — the same TTPs used in other SamSam campaigns); the ransomware encrypted servers hosting Allscripts' Professional EHR and electronic prescriptions for controlled substances (EPCS) cloud-hosted services

Vector: SamSam ransomware attackers targeted Allscripts' data centers in Raleigh, NC and Malvern, PA; SamSam is deployed via brute force of RDP credentials or exploitation of server vulnerabilities (JBOSS, JMX); the attackers gained access and deployed ransomware across Allscripts' cloud hosting infrastructure

Vector: REvil (Sodinokibi) is a ransomware-as-a-service (RaaS) operation that evolved from the GandCrab RaaS (which ran 2018-2019 and claimed revenues of over $2 billion); the REvil core developer and administrator was identified through a multi-year international law enforcement investigation involving German BKA, FBI, Europol, and partner agencies

Vector: Self-propagating worm exploiting EternalBlue (CVE-2017-0144), an NSA-developed SMBv1 exploit leaked by Shadow Brokers on April 14, 2017; required no user interaction — propagated autonomously over TCP port 445 to vulnerable Windows systems

Vector: WannaCry ransomware worm exploited the EternalBlue NSA exploit (CVE-2017-0144) targeting unpatched Windows XP and Windows 7 systems across NHS organisations; many NHS trusts had not applied the March 2017 MS17-010 patch and were running legacy Windows XP systems no longer supported by Microsoft