Qilin listed Joliet Public Schools District 86 on 14 October 2026, two years after LockBit claimed the same Illinois district. No data or deadline has been posted.

RAMP’s administrator ran its escrow, bought US network access daily and offered LockBit the XSS admin’s identity for 10 BTC. Dancho Danchev reads the record.

Rhysida claims 2.6 TB and 814,500 files from Anne Arundel County, Maryland, including health and background-check records. The county has not responded.

The Gentlemen ransomware group listed Deloitte, KFC, MoneyGram, Confluent, BigID, Placer.ai and the Royal Thai Air Force in 32 hours. None has confirmed a breach.

The Seven Deadly Sins claims 230m+ rows from Canva, Harness, iHeartJane, Verano, Cradlewise, Globeia and Hospital Sírio-Libanês. Only Canva has confirmed any loss.

Extortion group n0n listed 38 port, terminal and shipping companies in one batch on 12 October 2026, demanding $2.4m to $14m. No listed company has confirmed a breach.

Government is the least exposed sector we measure and 76.3% of 279 public bodies in 36 countries are still exposed, with 439 ChatGPT and 190 Okta logins among the records. Which countries’ public bodies are cleanest, why the sector is still the second most attacked, and what to check.

One infected laptop gives up every saved password. Inside the stealer logs of 707 large companies: 13,380 Salesforce logins, 4,438 Okta logins, 2,928 GitHub logins, 942 AWS consoles and the dashboards of the security tools meant to stop it.

295 universities in 36 countries, 99.3% exposed, a median of 127 stolen logins each, and half of all new stolen employee credentials in the month. Why students make campuses the softest target, what the logins open, and what to do about it.

98.6% of large US organisations have an employee login in stealer logs. Estonia is at 67.7%. We rank all 36 countries in the Ransomnews panel by stolen employee credentials, show where exposure is growing fastest right now, and link a data page for each.