Skip to content

Topic

Ransomware and Extortion Claims

Cyberattacks in which criminal groups encrypt or steal corporate data and demand payment, often naming victims publicly to pressure them.

Current stories

buildOne report1 publisher

Attackers are authenticating to unpatched Proxmox hosts with an arbitrary ticket value

Proxmox says multiple independent reports have attackers using PSA-2026-00043-1 to encrypt data for extortion. A port-8006 query returns 4,043,230 hosts; the Proxmox VE fingerprint returns 34,219, a factor of about 118 apart.

Publishers:dev.to

Reality

Evidence55
Adoption60
Hype gap−12
Incentives40
Confidence52
buildOne report1 publisher

A stolen supplier credential put Stadler's name on a CHF 10 million extortion demand

The compromise happened on a data-exchange platform Stadler shared with a supplier, using credentials from the supplier's side. Stadler got the CHF 10 million demand, refused it, and went to the cantonal police.

Publishers:dev.to

Reality

Evidence38
Adoption27
Hype gap+34
Incentives62
Confidence42
securityOne report1 publisher

Bitdefender counts 55.2% of breached practitioners asked to keep the incident quiet

The figure sits 13.2 points above the 2023 reading after three years of expanded disclosure rules. The survey captures the request itself, leaving the requester's identity, whether anyone complied, and whether the breach went unreported outside its scope.

Reality

Evidence28
Adoption
Not scored
Hype gap+27
Incentives88
Confidence56
securityConfirmed3 publishers

Nutex discloses stolen patient data breach to SEC, says it is still assessing what was taken

The Gentlemen gave the Houston hospital operator nine days to pay after an August 31 filing confirmed patient, employee and provider files were taken, and a class action had already landed on August 27.

Perspective Coverage

3 publishers
Builder
Builder 15%
Operator
Operator 57%
Investor
Investor 28%

Reality

Evidence68
Adoption62
Hype gap+8
Incentives76
Confidence72
buildOne report1 publisher

Clop's Windchill implant borrows the app's own keystore, so app logs are the only witness

ReliaQuest says a custom JSP web shell decrypts LDAP admin secrets with Windchill's own API and indexes the design vault over existing database connections. Network telemetry sees very little.

Publishers:dev.to

Reality

Evidence34
Adoption20
Hype gap+26
Incentives62
Confidence36