Ransomware 

Share

Latest news on ransomware, covering ransomware attacks, ransomware gangs, cyberextortion (cyber extortion), double extortion, data leak sites, ransom payments, ransomware-as-a-service (RaaS), LockBit, DarkSide, WannaCry, NotPetya, Colonial Pipeline, backups and recovery.

Ransomware is a type of malware that takes a victim's data or systems hostage until a ransom is paid. It may encrypt files, threaten to publish stolen data, or do both. Targets range from home users to hospitals, councils, schools, manufacturers and retailers, and payment is usually demanded in cryptocurrency.

Many gangs now use double extortion, stealing data before encrypting it and threatening to leak it on dark web sites, while some skip the encryption altogether. Ransomware-as-a-service lets developers rent their malware to affiliates who carry out the attacks. In April 2025 cyber attacks hit UK retailers including Marks and Spencer and the Co-op. In July 2025 the UK government confirmed plans for a targeted ban on ransom payments by public sector bodies and critical national infrastructure operators.

Defence relies on offline backups that attackers cannot reach, prompt software updates, multi-factor authentication, network segmentation and careful handling of email links and attachments. Organisations rehearse incident response plans so that they can restore systems quickly, and intact backups often mean a victim can recover without paying.

When systems go down, the people affected include hospital patients, council tenants, pupils and the staff who must work without computers. Debate continues over whether victims should pay: payment does not guarantee that data is returned, and critics say it funds further attacks, while some victims pay to restore services quickly. Supporters of payment bans say they would remove the incentive, and others worry about the burden on victims.

The first known ransomware, the AIDS Trojan, was distributed on floppy disks in 1989 by Joseph Popp. CryptoLocker collected ransoms in Bitcoin from September 2013, and the WannaCry outbreak of May 2017 infected well over 200,000 computers in about 150 countries, including NHS systems. The NotPetya attack of June 2017 hit Ukraine hardest, and on 7 May 2021 the DarkSide gang attacked Colonial Pipeline and was paid 75 Bitcoin, worth about 4.4 million dollars at the time. In February 2024 an international operation disrupted the LockBit gang.

One attack can shut a hospital, a factory or a high street chain. Our NewsNow ransomware news feed brings together the latest headlines on ransomware attacks, gangs, cyber extortion, data leaks, ransom payments and recovery from reliable sources worldwide, so you have a comprehensive, up-to-date view.