Government is the least exposed sector we measure and 76.3% of 279 public bodies in 36 countries are still exposed, with 439 ChatGPT and 190 Okta logins among the records. Which countries’ public bodies are cleanest, why the sector is still the second most attacked, and what to check.
Ransomnews Research Team
Ransomnews Research Team
The Ransomnews Research Team is the collective byline used for collaborative pieces, editorial briefings, and articles drawing on contributions from multiple researchers. Coverage spans ransomware operations, breach economics, threat actor profiling, OSINT methodology, and emerging risks across security, privacy, and AI.
One infected laptop gives up every saved password. Inside the stealer logs of 707 large companies: 13,380 Salesforce logins, 4,438 Okta logins, 2,928 GitHub logins, 942 AWS consoles and the dashboards of the security tools meant to stop it.
295 universities in 36 countries, 99.3% exposed, a median of 127 stolen logins each, and half of all new stolen employee credentials in the month. Why students make campuses the softest target, what the logins open, and what to do about it.
98.6% of large US organisations have an employee login in stealer logs. Estonia is at 67.7%. We rank all 36 countries in the Ransomnews panel by stolen employee credentials, show where exposure is growing fastest right now, and link a data page for each.
Ransomnews has confirmed 55 ransomware attacks in September 2026, against 107 in August and 151 a year earlier. Provisional. Government led the sectors, Qilin and The Gentlemen the groups.
Two class actions over the Novo Nordisk data breach cite our FulcrumSec reporting for its scale, then skip how the attackers got in and what data was exposed.
Germany named Vitaly Kovalev as Conti’s boss in 2025. RAMP forum messages show the other end: a recruiter, a written hacking exam, and when the hiring stopped.
A forum listing advertises 120 million Telegram records. Ransomnews parsed the 3.7GB file: 63.1 million rows, 74% Iranian, and most of it dates to 2020.
Paying a ransomware ransom is usually legal, but sanctions can make it a crime, and 2026 rules are tightening fast. The law in the US, UK, EU and Australia, and what paying still does not buy.
Medusa is a ransomware-as-a-service crew active since 2021, with 300+ claimed victims and 161 confirmed by Ransomnews. Its targets, tactics, biggest breaches and the defences that stop it.