Ransomware leak-site victim claims rose 30% in Q3, but many may be false
RANSOMWAREReliaQuestredteam/daily · 1 source
- Severity
- Medium
- Sources
- 1
What happened
The number of organisations named on ransomware leak sites rose 30% in Q3 2026, and 43 groups that had never posted before drove 93% of the increase. ReliaQuest says the listings mix new attacks, rebrands, recycled data and unsupported claims, and that the ExfilSquad group appears to use limited access, likely from exposed GitHub credentials, to make a minor breach look large. Teams should treat each listing as unverified until their own logs and access records confirm or rule out an intrusion.
For IT people · Written by AI from 1 source · Wrong?
What to do
- Review internal logs, access records and any posted samples when your organisation is named on a leak site.
- Keep unverified claims marked as unverified and look for other sources of exposure before deciding.
- Audit code repositories for exposed keys and passwords, and rotate any that are found.
- Enforce Microsoft's vulnerable driver block list and alert on unexpected Group Policy changes.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
Cyber Security News
Who and what is in it
Companies