January 13, 2026
Week 02 of 2026 saw continued high-volume ransomware activity with Qilin emerging as the dominant threat group. Notable incidents include attacks on Romania’s critical infrastructure (water authority and energy producer), US government contractor Sedgwick, and multiple healthcare organizations. Two US cybersecurity professionals pleaded guilty to conducting BlackCat/ALPHV ransomware attacks, highlighting insider threats in the industry. The ransomware landscape continues evolving toward exfiltration-only attacks, with publicly reported attacks rising 47% year-over-year to 7,200 in 2025.
Key Statistics: - Global: 8,000+ ransomware victims claimed in 2025 (50%+ increase from 2023); 7,200 publicly reported attacks - US: Multiple government contractors and healthcare organizations targeted; North Carolina saw 50% surge in attacks - Europe: Romania’s water authority (~1,000 systems encrypted) and Oltenia Energy hit in coordinated holiday campaign - Automotive: JLR continues recovery from September 2025 attack affecting 5,000+ supply chain businesses - Medical Devices: 89% of healthcare organizations have IoMT devices with known exploitable vulnerabilities
Sedgwick Government Solutions - TridentLocker Attack (December 31, 2025 - January 2026) - TridentLocker ransomware gang claimed attack, alleging 3.4 GB of data stolen - Provides claims and risk management services to DHS, ICE, CBP, USCIS, Department of Labor, and CISA - Incident limited to isolated file transfer system; no evidence of claims server access - Source: The Record
Dartmouth College - Clop Oracle E-Business Suite Exploitation (August 2025, disclosed January 2026) - Over 40,000 individuals affected including Social Security numbers and bank account information - Russian ransomware group Clop claimed responsibility via dark web leak site - Part of broader Oracle E-Business Suite zero-day campaign affecting 100+ organizations - Source: The Dartmouth
University of Hawaii Cancer Center (August 2025, disclosed January 12, 2026) - Ransomware gang breached Cancer Center, stealing research participant data - Documents from the 1990s containing Social Security numbers compromised - Source: BleepingComputer
US Bank Vendor Breach - Marquis Software (August 2025, disclosed January 2026) - Artisans’ Bank and VeraBank disclosed customer data exposure - Vendor breached via SonicWall vulnerability - Estimated 1.35 million people affected across dozens of financial institutions - Source: Integrity360
BlackCat/ALPHV Insider Convictions (January 2026) - Kevin Martin (TX) and Ryan Goldberg (GA) pleaded guilty to conspiracy to obstruct commerce by extortion - Martin: ransomware negotiator at DigitalMint; Goldberg: incident response manager at Sygnia - Conducted attacks on pharmaceutical, engineering, healthcare, and drone manufacturing companies (May-November 2023) - Ransom demands: $300,000 - $10 million; confirmed payments: $1.27 million - Face up to 20 years in prison; sentencing March 12, 2026 - Source: SecurityWeek
North Carolina Ransomware Surge - 50% increase: from 843 incidents to 1,215 in 2024 - Ransomware contributed to more than half of all data breaches in 2024 - Targets ranged from doctors’ offices to law firms to schools - Source: WRAL
Romania National Water Authority - BitLocker Attack (January 2026) - Administrația Națională ‘Apele Române’ hit by ransomware attack - ~1,000 computer systems locked out (workstations and servers) - Attackers used legitimate Windows BitLocker tool for encryption - Hydrotechnical infrastructure (dams, flood defenses) unaffected - Source: The Record
Oltenia Energy Complex - Gentlemen Ransomware (December 26, 2025) - Romania’s largest coal-based energy producer (30% of national electricity) - 19,000+ employees; 4 power plants with 3,900 MWh capacity - ERP systems, document management, email, website disrupted - Power supply and National Energy System remained stable - Systems restored from backups on new infrastructure - Attack timing: Christmas period for reduced operational readiness - Source: BleepingComputer
Hartford (France) - Lynx Ransomware (January 4-5, 2026) - French fashion retailer listed on Lynx data leak site - Threat to publish stolen data - Lynx: rebranded evolution of INC ransomware, active since mid-2024 - Source: CYFIRMA
European Hospitality Sector - PHALT#BLYX Campaign - Sophisticated ClickFix campaign targeting hospitality via fake Booking.com emails - Uses fake BSOD screens, PowerShell and MSBuild abuse to deploy DCRat - Lures tailored to hotel operations - Source: Check Point Research
Qilin Ransomware Victims (January 2026): - Bouygues Energies & Services (France) - January 10, 2026 - Cressi (Italy) - diving equipment manufacturer, Genoa-based - Multiple additional organizations across Europe
Iberia Airlines - Everest Ransomware (December 2025, ongoing) - Hackers demanding $6 million - 596 GB internal data + 430 GB booking-related files allegedly stolen - 77 GB of technical safety data and fleet information - Claim of long-term access including ability to edit bookings - Source: SecurityWeek
Sekisui House (Japan) - Infostealer Campaign - Japan’s largest homebuilder compromised via ShareFile portal - Part of broader campaign affecting 50+ global enterprises - No MFA enforcement enabled the attack - Source: The Register
Manage My Health (New Zealand) (January 3, 2026) - Healthcare software provider discovered unauthorized access - 400,000 medical documents of 120,000 patients compromised - Hospital discharge summaries, specialist referrals exposed - Source: SharkStriker
Qilin Ransomware Victims - Asia (January 2026): - Telstar-Hommel (South Korea) - automotive inspection equipment - PTS Goldkist Industries Sdn Bhd (Malaysia) - poultry processing - CSV Group (disclosed January 2, 2026)
LockBit5 Victims: - Eros Elevators (India) - elevator manufacturer
Zestix/Sentap Threat Actor - Stole data from 50+ global organizations via cloud credentials from infostealer malware - Victims include: - Pickett and Associates (US) - utility engineering - Sekisui House (Japan) - homebuilding - Iberia (Spain) - airline - CRRC MA, GreenBills, CiberC, K3G Solutions - All victims lacked MFA enforcement - Source: The Register
Coordinated attacks during Christmas period targeted: 1. Oltenia Energy Complex (December 26) - Gentlemen ransomware 2. Administrația Națională ‘Apele Române’ (December 20) - Water authority
This suggests deliberate timing during holiday periods of reduced operational readiness. While OT systems remained unaffected in both cases, the attacks demonstrate persistent threat actor interest in critical infrastructure. - Source: Industrial Cyber
Covenant Health - Qilin Ransomware (May 2025, disclosed January 2026) - 478,188 individuals affected - Qilin claimed theft of 850 GB of sensitive data - Impact on hospitals in Maine (St. Joseph, St. Mary’s Health System) and New Hampshire (St. Joseph) - Source: The Record
HealthBridge Chiropractic - Qilin Ransomware (January 6, 2026) - Systems and data compromised - Nature and quantity of data under investigation - Source: CYFIRMA
CrazyHunter Ransomware Targeting Taiwan Healthcare - Go-developed malware with advanced encryption - At least 6 known Taiwan healthcare organizations victimized - Specifically targets medical infrastructure - Source: CyberSecurityNews
FDA Quality System Regulation amendment (21 CFR Part 820) takes effect February 2, 2026: - Shift from pre-market paperwork to active operational execution auditing - Section 524B: Security controls in design, vulnerability management, SBOM required - Source: Medical Device Network