Sponsored by Hudson Rock Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

Enjoying ransomware.live? Help us keep tracking ransomware gangs and shipping new features. Support us
Search v2
before

Prefix a filter with + to require it, or - to exclude it — e.g. +country:us only shows US victims, -country:us hides them. Mix several with free-text words; everything is combined with AND (so hospital +country:us -group:lockbit3 means: text "hospital", country is US, group is not lockbit3). Repeating + on the same field is OR'd together (+country:us +country:ca → US or Canada); repeating - excludes all of them. Wrap multi-word values in quotes, e.g. +sector:"public sector". infostealer, press and multipleclaims take a bare +/- with no value: +infostealer / -infostealer filter on infostealer data, while +press searches press articles only and -press hides press coverage; +multipleclaims restricts to victims claimed by more than one group (cross-referenced) and -multipleclaims keeps only single-claim victims; +campaign:fortibleed / -campaign:fortibleed filter on domains found in the FortiBleed leaked-credential dataset; before:/after: take a date directly with no +/- prefix, as shown below.

+country:only this country — opens a picker
-country:exclude this country — opens a picker
+group:only this group — opens a picker
-group:exclude this group — opens a picker
+website:example.comonly this website
+sector:only this sector — opens a picker
-sector:exclude this sector — opens a picker
+infostealerhas infostealer data
-infostealerno infostealer data
+presssearch press articles only
-presshide press coverage
+multipleclaimsclaimed by more than one group (cross-ref only)
-multipleclaimsclaimed by a single group only
+campaign:fortibleeddomain found in the FortiBleed dataset
-campaign:fortibleeddomain not in the FortiBleed dataset
after:2025-01-01discovered/attacked on or after
before:2026-01-01discovered/attacked on or before
2 victims matched
Logo
Discovered: 2023-10-04 (2y ago)
DESCRIPTION…
Logo
Discovered: 2023-09-29 (2y ago)
/…
Press Coverage 3
McLaren Health Care
2024-08-05

McLaren Health Care suffered a cybersecurity attack by an international ransomware group, resulting in unauthorized access to their network between July 17, 2024, and August 3, 2024. The breach may have exposed personal information and protected health information of individuals, including name, Social Security number, driver's license number, medical information, and health insurance information. McLaren is offering identity theft protection services through IDX to affected individuals.

Read article
McLaren Health Care
2024-08-05

Le système de santé McLaren Health Care du Michigan fait face à une attaque de ransomware qui perturbe les opérations dans ses 13 hôpitaux, centres de chirurgie ambulatoire, cabinets de médecins et autres installations. L'attaque, qui implique INC Ransom, a causé des problèmes pour planifier des rendez-vous, accéder aux résultats de tests et maintenir les communications via les systèmes téléphoniques et les sites web de l'hôpital. McLaren travaille à enquêter sur la perturbation et à restaurer les services, après avoir déjà été victime d'une attaque de ransomware en 2023.

Read article
McLaren Health
2023-08-30

McLaren Health Care a fermé le réseau informatique de ses 14 hôpitaux du Michigan la semaine dernière par précaution, après avoir découvert une activité suspecte lors de la surveillance de routine de son équipe de sécurité informatique. L'incident a affecté au moins les systèmes de facturation et les dossiers médicaux électroniques de l'organisation, obligeant parfois les employés à utiliser leurs téléphones portables personnels pour communiquer. McLaren n'a pas confirmé les systèmes spécifiquement touchés, si les informations de santé protégées des patients ont été compromises ou quand la menace a été identifiée.

Read article