Security Blueprints
Advisory

Tag / 11 entries / page 1 of 2 / feed available

Ransomware

11 of the 76 analyses in Data Breaches carry this tag. All 11 are scored against the four invariants; the matrix below is that evidence.

How this tag scores against the four invariants

BreachHSFPECEGRSCA
Change Healthcare February 2024 Data Breach
Los Angeles Unified School District (LAUSD) Ransomware Breach
British Library Ransomware Attack October 2023
MGM Grand Data Breach - September 2023
Yum! Brands Ransomware Data Breach
Norsk Hydro Ransomware Attack - March 2019
PharMerica Data Breach March 2023
Conduent Business Services Data Breach (January 2025)
JADEPUFFER Agentic Ransomware Campaign via Langflow CVE-2025-3248 (2026)
NotPetya Ransomware Attack
MOVEit Data Breach June 2023

HSF · PEC · EGR · SCA — filled where the invariant would have prevented or contained the breach

076

JADEPUFFER Agentic Ransomware Campaign via Langflow CVE-2025-3248 (2026)

Contained by: PEC, EGR

JADEPUFFER exploited an internet-exposed Langflow deployment vulnerable to CVE-2025-3248, then accessed MinIO, PostgreSQL, MySQL, and Alibaba Nacos environments. The operation encrypted exactly 1,342 Nacos configuration items, deleted original tables, and attempted additional database destruction; a later ENCFORGE payload targeted AI and machine-learning files. No victim organization or affected-person count was publicly reported, and the degree of human involvement in the agentic campaign remains unresolved.

073

Conduent Business Services Data Breach (January 2025)

Contained by: EGR

Conduent Business Services discovered unauthorized access to a limited portion of its environment on January 13, 2025, after access that began on October 21, 2024. The actor exfiltrated client-associated files containing personal, medical, health-insurance, claims, and Social Security information; SafePay claimed responsibility and alleged theft of 8.5 terabytes, but the role and volume were not independently confirmed. Publicly reported impact reached at least 25 million people, while later HHS OCR figures and state reports remained inconsistent and unresolved.

065

Change Healthcare February 2024 Data Breach

Prevented by: HSF, PEC, EGR

The Change Healthcare breach in February 2024 involved a ransomware attack by the BlackCat group, significantly disrupting pharmacy operations. Approximately 6TB of sensitive data, including health records, was potentially compromised. The attack exploited vulnerabilities in Citrix remote-access software, highlighting security weaknesses in multi-factor authentication.

060

British Library Ransomware Attack October 2023

Prevented by: HSF, PEC · Contained by: EGR

In October 2023, the British Library was targeted by the Rhysida ransomware group, resulting in the encryption and leak of approximately 490,191 files, amounting to 573 GB of data. The breach illustrated vulnerabilities in security protocols due to compromised credentials and the absence of Multi-Factor Authentication (MFA), significantly disrupting library operations and potentially exposing sensitive internal data.

058

MGM Grand Data Breach - September 2023

Prevented by: HSF, PEC · Contained by: EGR

In September 2023, MGM Resorts International experienced a major cyberattack orchestrated by the Scattered Spider group, leading to significant operational disruptions and an estimated $80 million in financial losses. The attackers exploited social engineering methods, particularly vishing, to breach MGM’s systems and compromise personal data including names, driver’s license numbers, and Social Security numbers. This attack underscores vulnerabilities in service desk operations and highlights the use of sophisticated ransomware tactics.

056

MOVEit Data Breach June 2023

Contained by: PEC

The June 2023 MOVEit data breach began with the exploitation of a zero-day SQL injection vulnerability (CVE-2023-34362) in the MOVEit Transfer software; over 200 organizations were confirmed affected within the first weeks, a toll that climbed to more than 2,700 organizations and over 95 million individuals as disclosures continued into 2024. The Clop ransomware group was responsible, utilizing web shell deployment and data exfiltration methods to access and steal personal and sensitive information, highlighting substantial risks in application security and third-party systems.

053

Yum! Brands Ransomware Data Breach

Prevented by: PEC, EGR · Contained by: HSF

In January 2023, Yum! Brands, owner of KFC, Taco Bell, and Pizza Hut, experienced a data breach following a ransomware attack. The breach exposed sensitive employee information, including names and Social Security Numbers. While corporate data was compromised, no customer data was initially reported as affected. Unknown cybercriminals were responsible for the attack, which led to temporary closures of restaurants in the UK.

050

PharMerica Data Breach March 2023

Prevented by: PEC, EGR

In March 2023, PharMerica experienced a major data breach affecting approximately 5.8 million individuals. The incident involved the compromise of extensive patient data, including Social Security numbers, health records, and insurance information. The breach was executed by the Money Message ransomware group using double extortion tactics, leading to significant privacy risks and identity theft concerns.

041

Los Angeles Unified School District (LAUSD) Ransomware Breach

Prevented by: HSF, PEC, EGR

In September 2022, the Los Angeles Unified School District (LAUSD) suffered a ransomware attack by the Vice Society, which impacted over 1,000 schools and around 600,000 students. The breach compromised approximately 500 GB of data, including sensitive personal and educational records, due to exploited vulnerabilities such as lack of multi-factor authentication.

027

Norsk Hydro Ransomware Attack - March 2019

Prevented by: HSF, PEC

In March 2019, Norsk Hydro, one of the world’s largest aluminum producers, was hit by the LockerGoga ransomware attack. This incident caused significant operational disruptions and financial losses due to the encryption of critical systems and manual operation deployments. The attack exploited Active Directory vulnerabilities, although the exact perpetrators remain unidentified.

RSS feed for this tag →

Now playing Bandcamp