Ransomware Attacks This Week: 206 Victims Across 46 Groups (October 19 to 25 2026)

This is the Scrutex ransomware weekly for the October 19 to 25, 2026 window. Our CTI team tracked 206 unique ransomware and extortion victim postings across 46 active groups and 38 countries. That is down 32% from 302 for October 12 to 18. Most of the fall is last week's one-off: N0n's 38 firm maritime batch. Strip N0n out of both weeks and the count still eased, from 247 to 180, down 27%. The United States took 89 postings, 43% of the week. Manufacturing led the labelled sectors with 31, business services followed with 28.

The volume fell. The size of the names did not. Thirteen law firms were named on leak sites this week by nine different crews, among them Latham & Watkins, Kirkland & Ellis, White & Case, Baker Donelson, Weitz & Luxenberg and Porter Hedges. Silent Ransom Group, the crew best known for phoning law firm staff while posing as IT support, returned after a quiet week with nine listings, every one of them mirrored on a second leak site.

Outside the legal sector, the week's claims read like a list of household names: PwC (Everest, 590 GB claimed), OpenText and AVEVA (a new brand called Mimori), J.B. Hunt, Whirlpool and Hisense (another new brand, WhiteArmor), AB InBev (Emperador), Astrana Health (Falcon), GardaWorld and Ooredoo Myanmar (Qilin). One of them has said anything. OpenText told a UK security firm it detected unauthorised access to an employee account through social engineering.

That is the thread through this issue. The biggest names this week mostly did not arrive through an unpatched firewall. They arrived through a phone call, a help desk, or an employee account. Qilin, which led on volume with 34, is the exception, and on October 19 Palo Alto Networks' Unit 42 confirmed it is still getting in through a GlobalProtect flaw patched in May.

206 posts, 46 groups, 38 countries in a single week. Reading every one to find the three that touch your own organisation or your suppliers is most of a working day.

A note on how to read the numbers. Each count is a unique organisation named on a leak site during the window. We merge duplicate listings, count a relisted incident once, in the week it first appeared, and leave out postings that do not name an organisation. Counts reflect leak site postings, not confirmed compromises, and by the time a victim is posted the intrusion is usually 30 to 90 days old.

The week had no dominant batch. Monday took 30 postings, Tuesday 21, Wednesday 38, Thursday 22, Friday 45, Saturday 23 and Sunday 27. The alternating pattern comes from a handful of crews publishing on single days rather than from a sustained run.

Three days had a clear driver. Tuesday was Booba Project's six US listings, all posted together. Wednesday carried Brain Cipher's eight bare domains in one drop, with Everest's four alongside. Friday was the broadest day of the week: 45 postings from 21 crews, with Qilin's 12 the only cluster. Qilin posted on six of the seven days, which is the steady affiliate pattern we have seen from it for a month.

The top five groups took 86 of 206 postings, 42%, down from 49% last week. Below them, 30 groups posted three or fewer victims each, together accounting for 60. The long tail is a bigger share of a smaller week.

Law firms appear on leak sites most weeks. Thirteen in seven days, several of them among the largest firms in the world, is not a normal week.

Silent Ransom Group also posted six redacted names this week, initials and ellipses, the format it uses for firms still in negotiation. Given the group's history, assume most of them are legal or professional services firms.

Silent Ransom Group is the crew to brief on. It is also tracked as Luna Moth and Chatty Spider. It does not encrypt. It calls staff while posing as IT support, talks them into starting a remote session, and copies files out. The FBI warned in May 2026 that people posing as IT support were also physically entering US law offices. In early October a leak titled "The Luna Moth Files" published about 5,700 of what it says are the group's internal messages. The Register reports that the chats describe field agents recruited through Russian-language job boards to enter offices and copy files to USB drives, and claim about $207 million collected from 27 firms between April and September 2026. Chainalysis said some wallet addresses in the leak match its own intelligence, and that it could not authenticate the whole collection. The $207 million figure has not been verified by anyone outside the group.

The group posted nothing in our previous window. This week it posted nine, all between October 19 and 22, and every one of them also appeared, the same day and in the same form, on a second site labelled LeakedData. We count each firm once.

Three more of the 13 may be one crew. Redact (Baker Donelson), Falcon (Weitz & Luxenberg) and Helix are all brands that the incident response firm MOXFIVE suspects belong to one data-theft operation, alongside BlackFile and Pink. Google's threat intelligence group tracks the activity as UNC6671 and assesses that a common group is likely behind the brands, while noting other explanations remain possible. Its method is close to Silent Ransom Group's: a phone call impersonating IT support, a lookalike MFA or passkey enrolment page, and SaaS access within minutes. MOXFIVE says the cluster moved toward financial and legal targets from July because the leverage is higher. Across the three brands this week: Baker Donelson, Weitz & Luxenberg, Astrana Health, Hypertherm, Westrock Coffee and American Campus. Last week Helix and Redact together posted nine, including Eversource Energy, ONEOK and Parker-Hannifin. The Falcon brand is not connected to CrowdStrike's product of the same name.

Why law firms, and why now. A law firm holds other companies' secrets: deal documents, litigation strategy, privileged advice, and client medical and settlement records in mass tort practices like Weitz & Luxenberg's. That makes the firm a pressure point on its clients, and a firm will pay to keep a client relationship. The access route explains the rest. Large firms run mature perimeter security. Their help desks still take calls from people who say they are from IT.

What to do if you are a law firm, or a law firm's client. For firms: no help desk agent should reset MFA or start a remote session on an inbound call, and no member of staff should accept a remote session they did not request. Verify any "IT support" contact through a number from your own directory. Restrict MFA enrolment to managed devices. For clients: ask outside counsel, in writing, how they verify help desk requests and whether they have been contacted by anyone claiming to hold your matter data. A firm that cannot answer the first question quickly has not fixed the access route this week's crews are using.

The top five groups produced 86 of 206 postings, 42% of the week. Below them, 30 groups posted three or fewer victims each, together accounting for 60.

Also active: Payload (5, all German), Aurora, The Gentlemen, WhiteArmor and Kazu (4 each), Global Secret Group, Helix, INC Ransom, Storm, Bravox, HYFLOCK, Interlock, Rhysida, Audit Team and Cloak (3 each), and a long tail of FulcrumSec, Anubis, Dark Project, Mimori, Pear, DeadLock, MajinaHanashi, Orova, Panzer, Falcon, Redact, Cl0p, Nitrogen, Space Bears, Chaos, Doommageddon, Sarcoma, Scarlett Group, WallStreet and Securotrop, each with one or two listings.

Four observations:

Qilin is the steady centre of the chart. 34 listings, up from 29, and its count has now risen three weeks running: 14, 23, 29, 34. It posted on six days across 19 countries, with only five in the United States. The victim mix is broad and institutional: a global law firm, a Canadian security services multinational, Italy's largest retail cooperative consortium and one of its member cooperatives, a Myanmar mobile operator, a Utah city, a US community bank, a Bangladeshi cancer hospital and a historic English estate. Unit 42's October 19 update explains part of the steadiness. Qilin affiliates are still exploiting CVE-2026-0257 on PAN-OS GlobalProtect, five months after the patch. More in the CVE section.

N0n has halved, and the anonymous slots are back in proportion. 26 named listings against 55 last week, plus 18 numbered "Company #" slots (#93 to #110) that identify nobody and that we do not count. That puts its true weekly activity at around 44 postings, close to last week's level once the maritime batch is set aside. The named victims are back to the mid market US profile it ran in September: a payments fintech, an endoscopy centre, a senior living operator, a Ford dealer, a family law practice. The exception is Hanjin Information Systems & Telecommunication, a South Korean IT services firm, listed as "NOT PAID, EXPOSED" with a staff directory and a list of which personnel are seconded to which client organisations. That second item matters more than the first. It is a map of who has access inside Hanjin's customers.

The Gentlemen fell from 37 to 4. Its single mid week batch, which it had run every week since early September, did not appear. It posted two masked names on October 20 and revealed them, with two more, on October 23. One quiet week is not a trend. If the batch returns next week, read this as a pause in publishing, not in intrusions.

Five of the top eleven posted nothing last week. Silent Ransom Group, Brain Cipher, Lamashtu, Booba Project and KryBit all appear from zero. Eighteen brands in this week's figures were absent from last week's, and the brands that dropped out include Play (9 last week), IAH647 (8), Settra (8) and The Seven Deadly Sins (7). That churn is the ordinary rhythm of leak sites. A site publishes when an affiliate finishes a negotiation, not when an intrusion happens.

Eighteen brands appear in this week's figures that were absent from last week's. Most posted once or twice. Five are worth naming.

WhiteArmor. Four listings and four large names: Whirlpool on October 21, J.B. Hunt on October 23, Hisense on October 24 and Brazil's Partido Liberal on October 25. Each post is written like a sales pitch: what the group holds, a demand in Bitcoin or Monero ($140,000 for Whirlpool, $500,000 for Hisense, $5 million for J.B. Hunt), a Proton Mail address and a Session ID. The J.B. Hunt post claims 140,838 employee records, 1.7 million carrier contacts, 38.2 million invoices and 973 Microsoft 365 mailboxes, and links samples. There is no claim of encryption anywhere. This is a data extortion crew, and its published contact details are the same across every post. The site also padded its page with an "Updates." notice, its own initials, its own domain and a link to its X profile, which we excluded. None of the four organisations has commented.

The Partido Liberal listing deserves a separate note. It is the party of the Bolsonaro family, the post claims 79,000 member records with national ID numbers and photographs, 374 working election-portal credentials and internal party dossiers, and it was published on October 25, the date of Brazil's scheduled presidential runoff. A political party's member data, released on election day, is a political act whether or not the crew intended one. Our upstream feed tagged it as Argentina. It is Brazil.

Mimori. Two listings on October 20, both major enterprise software vendors: OpenText in Canada (94,306 files claimed, publication planned October 29) and AVEVA in the UK (177,234 files claimed, publication planned October 23). No samples, no volume in gigabytes, no ransom amount. OpenText gave the UK firm CyPro a statement on October 22: "We recently detected unauthorized access to an employee account resulting from a social engineering attempt," adding that its investigation into potential impact remains ongoing. That is not a confirmation of Mimori's claim, but it is the only statement any named organisation made this week, and it points to the same entry route as the law firm crews. AVEVA has not commented. If you run AVEVA or OpenText software, the question to ask is not whether your licence data is in an archive. It is whether either vendor's support staff hold standing access to your environment.

Lamashtu. Seven listings, five German and two French, mostly manufacturing: a chemicals firm, a timber construction firm, a Freising brewery, a Münster energy supplier, a French precision engineering firm and a French wine house. SOCRadar dates the brand to April 2026 and tracks about 34 victims. Breachsense's earlier data put France as its most frequent country and manufacturing as its main sector. This week it shifted toward Germany, and with Payload's five German manufacturers it accounts for half of Germany's 21 postings.

Booba Project. Six listings on one day, all US, under two brand spellings that we merged. The mix is municipal and clinical: the Research Foundation of the City University of New York (295 GB claimed), Everett, Massachusetts city hall (15 GB), the City of Mt. Angel in Oregon, a vein clinic, a paediatrics practice and a neuropsychiatric centre. Two small local governments in one drop is worth noting. Municipal IT is often shared or outsourced, and a single managed provider can account for both.

Brain Cipher. Not new, but back. The group, whose encryptor is reported to be built on the leaked LockBit 3.0 builder, went largely quiet after late 2025 and resurfaced once in May. This week it posted eight bare domains on October 21: three US healthcare providers, a sleep-device maker, a proxy solicitation firm (Sodali & Co), an accountancy, an Irish law firm and a UK group. Two days earlier it also published 26 file-archive names (StudioData, RedirectedFolders, SalesData split into parts) as if each were a victim. Those are one leak's file tree, not 26 organisations, and we excluded them.

55 of 206 postings carried no sector label and are excluded from the share column. That is a higher unlabelled share than last week (27% against 11%), driven by bare domains and redacted names.

Manufacturing is back on top, and it is a German story. 31 postings, and 9 of them are German or Swiss: chemicals, stainless steel fabrication, timber construction, textiles, electrical contracting. Lamashtu and Payload together account for most of them. Elsewhere the pattern is the usual mid market spread: a US circuit board assembler, a Dutch coffee machine maker, a Tunisian clothing manufacturer, a Mexican industrial group. Larger names include Whirlpool, Hypertherm, Lindauer Dornier and Hisense.

Business services is the law firm story. 28 postings, and 13 of them are law firms (covered above). The rest include PwC, a proxy solicitation firm, accountancies and a VinSolutions listing, the automotive dealer CRM platform. Legal and professional services firms are being chosen for leverage over their clients, not for their own data.

Healthcare fell to 19 from 30, across 11 crews, and two names are larger than the rest. Astrana Health, a NASDAQ-listed provider network (738 GB claimed by Falcon), and Labaid Cancer Hospital in Bangladesh (Qilin). The remainder is the familiar small practice pattern: endoscopy, dental, paediatrics, vein, urology, arthritis and orthopaedic clinics, plus a surgical robotics firm, Asensus, now part of KARL STORZ. Pakistan's Family Planning Association, a reproductive health charity, was listed by Panzer. Reproductive health records are among the most sensitive data a crew can hold.

Transportation and logistics fell back to six. Last week's 44 was N0n's maritime batch. This week's six are a more ordinary set, but one of them, J.B. Hunt, is among the largest freight carriers in North America, and WhiteArmor's claim of 1.7 million carrier contacts and 38 million invoices is exactly the material used for freight payment fraud. If you pay carriers through J.B. Hunt, verify any change of bank details out of band until the company says otherwise.

Financial services stayed low at six. A Portuguese lender, a US community bank (Qilin), a German firm labelled financial services, an insurance broker, a wealth adviser and a payments fintech. Large banks stay off leak sites. Their suppliers do not.

A further 28 countries carried one to three postings each: Portugal, Malaysia, Australia, Switzerland, Brazil, Netherlands, Turkey, UAE, India, Ireland, Vietnam, Gabon, South Korea, Colombia, Liechtenstein, Lebanon, Ethiopia, Tunisia, Taiwan, Pakistan, Chile, Bangladesh, Egypt, Belgium, Czech Republic, Bulgaria, Benin and Myanmar. 22 postings carried no country.

The US share rose to 43% from 36%. That is arithmetic again, in the opposite direction to last week. The maritime batch pushed most of its listings outside the US. Without it, the US share returns to its usual range. N0n alone contributed 17 of the 89.

Germany doubled, from 9 to 21, across nine crews. Lamashtu and Payload posted five each, Qilin three, Akira and Emperador two each, and INC Ransom, Everest, Rhysida and DeadLock one each. Unlike last week's South Korea and Sweden spikes, this is not one campaign. Nine crews independently landed on German mid market manufacturers in the same week. That is a broader signal than a single batch, and German firms in metals, chemicals and industrial supply should treat it as one.

Brazil appears for Partido Liberal, not volume. Two postings, down from 16, but one of them is the opposition Partido Liberal's member database, published on election day.

Every entry below is a claim the actor posted. None is a confirmed breach unless the named organisation or an authority has said so.

Silent Ransom Group lists Latham & Watkins, Porter Hedges and Kirkland & Ellis. Posted October 19, 21 and 22, alongside six redacted names, and mirrored on LeakedData. No volumes or samples on any of the three. Confidence: Medium that the group has had some access to legal sector targets this month, given its documented method, its FBI warning, and the leaked chats describing payments from 27 firms. Low on each individual firm, because none has commented, the listings carry no evidence, and some trackers have flagged unverified entries on this group's site before. If you are a client of any of the three, ask your relationship partner directly.

Everest lists PwC. Posted October 22. Everest claims 590 GB, and the monitoring firm Hackmanac describes about 108,000 files from internal HR and learning systems covering operations in Australia, China, Canada and the UK. The directory named in the listing points to a Cornerstone OnDemand learning platform instance, a third-party system, not PwC's core network. A secondary news summary reports that PwC said it was aware of an incident involving a third-party vendor that hosts employee learning records, and that the affected location does not store client data. We have seen that statement only in one secondary summary. Confidence: Medium that a third-party learning platform was accessed. Low that client data is involved.

Mimori lists OpenText and AVEVA. Covered above. Confidence: Medium for OpenText that some unauthorised access occurred, because the company has said so. Low on Mimori's file count and on any link between OpenText's statement and the listing. Low for AVEVA.

WhiteArmor lists J.B. Hunt, Whirlpool and Hisense. Covered above. Confidence: Low to Medium. The posts are specific, carry samples and name data categories that fit each company. None of the three has confirmed, and a brand-new crew opening with large names is a familiar way to build notoriety.

Emperador lists AB InBev. Posted October 25 with a $1 million Bitcoin demand. The listing claims 329,244 social-listening alerts, 2,510 corporate emails, 19,000 access logs, internal PKI certificates and 3.2 GB of Azure blob storage. The data described is small for the world's largest brewer and reads like the contents of a marketing tool and a storage account, not a corporate network. Confidence: Low. AB InBev has not commented. If the PKI claim is true, the useful action is certificate rotation, not a breach notice.

Falcon lists Astrana Health and Weitz & Luxenberg. Both posted October 25 with the same closing line: "Contacted us then timewasted, re-attacks incoming." Falcon claims 738 GB from Astrana, including regulatory audit reports, reimbursement tables and employee PII, and 82 GB from Weitz & Luxenberg, including privileged client communications and client rosters with medical conditions. Confidence: Low for each, though the threat of "re-attacks" matters: MOXFIVE notes this cluster often returns weeks after containment. Astrana is NASDAQ-listed. If the claim is material, an SEC filing would follow.

Qilin lists White & Case and GardaWorld. White & Case on October 25, GardaWorld on October 19. Neither listing carries volume or evidence, and neither company has commented. Confidence: Low on each. Qilin's broad affiliate base and confirmed PAN-OS exploitation make the claims plausible, not proven.

Low signal claims this week. 24 postings are a bare domain and 10 are redacted to a few characters, so 172 of 206, 83%, name an organisation in words. That is down slightly from last week's 88%. Brain Cipher, KryBit and LockBit account for most of the bare domains. Kazu's four listings name public-sector platforms in the Democratic Republic of Congo, Mozambique and South Africa, plus a Spanish driving school platform, with no data description. Ethics posted two site pages ("Guarantee" and "Support") as victims, which we excluded.

Updates on last week's claims. N0n's maritime deadline expired on October 19, and multiple outlets including Security Boulevard and Cyware report that data for most of the 38 firms was posted after victims refused to pay. CyberLogitec reportedly told Korean customers its systems are operating normally. The shared-vendor theory remains unconfirmed by the vendor. Cydome advises any CyberLogitec customer to list every vendor support and remote access account and review that account activity from July 2026 onward. Canva, Eversource Energy, ONEOK and Parker-Hannifin have published nothing further on their listings. Redact, which listed the last three, is now part of the UNC6671 cluster described above.

The table covers this week's active groups where a named source supports the attribution. Scores are the published base scores. Where sources disagree, we say so.

The headline is that most of this week's largest claims have no CVE at all. Silent Ransom Group uses callback phishing and, according to the FBI, people in offices. The UNC6671 brands (Helix, Falcon, Redact) use voice phishing and fake MFA enrolment pages. OpenText's own statement points to social engineering. N0n's activity has been described as stolen credentials and administrative tools. WhiteArmor, Mimori and Emperador have no published access route. Of this week's top eleven groups, only Qilin and Akira have an access CVE backed by current named research. Patching the edge is necessary. This week it would not have stopped most of the names in this report.

This week's KEV additions. CISA added seven flaws to its Known Exploited Vulnerabilities catalogue between October 19 and 25. None is flagged for known ransomware use.

Attribution accuracy note. We only list a group against a CVE where a named source supports it. Akira's SonicWall link and The Gentlemen's Fortinet and Veeam links are carried forward from published research and were not re-observed this week. CVE-2026-0257 shows how late ransomware attribution arrives: patched in May, tied to Qilin in June, and still producing Qilin and INC intrusions in October.

Mirror leak sites. Silent Ransom Group's nine posts appeared on a second site, LeakedData, the same day and in the same form, including the redacted names. A crew running two sites gets two sets of tracker coverage and two sets of headlines from one claim. Counted naively, it doubles the crew's apparent activity. We count each organisation once. If you compare our numbers with a feed that does not merge across sites, this is one reason they differ.

Masked names, revealed later. The Gentlemen posted "C**** Technologies" and "P**** Products" on October 20 and the full names, Conax Technologies and Penco Products, on October 23. Silent Ransom Group revealed one redacted name a letter at a time across three posts over two days. Partial reveals are a pressure tactic: the victim knows which card is theirs, and each reveal is a countdown. For counting, we merge each masked entry with its reveal. For a defender, an entry that looks like your name with letters missing should go to your incident team the day it appears, not the day the name is complete.

File-tree publishing. Brain Cipher listed 26 archive names on October 19 (StudioData.part01.rar to part14, RedirectedFolders parts one to seven, and others). Panzer posted "Samples.zip" on October 25. These are the contents of a leak, not victims, and we exclude them. Counted as posted, Brain Cipher would have finished the week second, ahead of N0n.

"Contacted us then timewasted." Falcon's two posts close with the same line, followed by "re-attacks incoming." Extortion crews that do not encrypt have one lever: publication. Threatening to come back gives them a second. MOXFIVE's guidance is to recheck for the actor several weeks after containment. Treat a Falcon or Helix listing as an open incident, not a closed one.

Lock down the help desk this week. Thirteen law firms and most of this week's household names were claimed by crews that get in by phone. No agent should reset MFA, enrol a new device or start a remote session on an inbound call. Verify callers through a number from your own directory, restrict MFA enrolment to managed devices, and alert on any enrolment that follows a failed sign-in.

Move to phishing-resistant MFA where it matters most. Passkeys or FIDO2 keys for administrators, help desk staff, finance and anyone with access to client matter files. Close the fallbacks: SMS codes and self-service reset paths are the routes these crews use once the main door is locked.

If you run PAN-OS GlobalProtect, hunt, do not just patch. Unit 42 confirms Qilin and INC are still exploiting CVE-2026-0257 five months after the fix. Check for unexpected VPN sessions, changes to ESXi execInstalledOnly, access to domain controller VMDK files, and Veeam CVE-2023-27532 exposure. Rotate credentials and sessions that passed through a gateway while it was unpatched.

Ask your law firms how they verify IT support calls. Outside counsel hold your deal documents, litigation strategy and privileged advice. Put the question in writing, and ask whether they have been contacted by anyone claiming to hold your matter data.

If you pay freight carriers, verify bank detail changes out of band. WhiteArmor claims 1.7 million carrier contacts and 38 million invoices from J.B. Hunt. That is the raw material for payment redirection fraud whether or not the claim proves true.

Check your SD-WAN orchestrator. Arista VeloCloud Orchestrator has now had two exploited flaws in four months. Confirm on-premises instances are on a fixed release and review admin access logs.

Most of that work is triage before it is defence. Somebody has to read the week's postings, set aside the mirrors, the file trees and the masked duplicates, and work out which of the rest touch your organisation, your law firms or your suppliers.

Scrutex Threat Insights monitors ransomware leak sites and dark web sources continuously and maps what it finds against your own attack surface and your named suppliers, so a listing that names your domain, your outside counsel or a vendor's domain reaches you as an alert and not as a line in a weekly roundup. Data Exposure Insights watches for leaked employee credentials, the material voice phishing crews use to make their calls convincing. Vulnerability Insights prioritises flaws like CVE-2026-0257 by real-world exploitation against your exposed assets, not by raw CVSS. None of them will tell you whether a claim is true. All of them will tell you, quickly, whether it is about you.

Start at scrutex.ai/signup or read more at scrutex.ai/solution/threat.

How many ransomware attacks were there in the week of October 19 to 25, 2026? Scrutex tracked 206 unique victim postings across 46 active groups and 38 countries. That is down 32% from 302 for October 12 to 18, most of which reflects last week's one-off maritime batch. These are leak site postings, not confirmed compromises, and the underlying intrusion is usually 30 to 90 days older than the posting date.

Which ransomware group was most active? Qilin, with 34 listings across 19 countries, ahead of N0n with 26 and Emperador and Silent Ransom Group with nine each. Qilin's weekly count has risen three weeks in a row, and Unit 42 confirmed on October 19 that its affiliates are still exploiting the PAN-OS flaw CVE-2026-0257.

Why were so many law firms hit this week? Thirteen law firms were named by nine crews, including Latham & Watkins, Kirkland & Ellis, White & Case and Baker Donelson. Several of the crews involved, Silent Ransom Group and the Helix, Falcon and Redact brands, get in by phoning staff while posing as IT support rather than by exploiting software. Law firms hold their clients' most sensitive data, which gives an extortion crew leverage over both the firm and its clients. None of the named firms has confirmed a breach.

Was PwC hit by ransomware? Everest listed PwC on October 22, claiming 590 GB from HR and learning systems. The listing points to a third-party learning platform. A secondary news report says PwC acknowledged an incident at a vendor hosting employee learning records and said no client data was stored there. We rate the client data claim low confidence.

Was OpenText breached? A new group, Mimori, listed OpenText and AVEVA on October 20. OpenText told a UK security firm on October 22 that it detected unauthorised access to an employee account through social engineering and that its investigation is ongoing. That is not confirmation of Mimori's claim of 94,306 files. AVEVA has not commented.

Did J.B. Hunt suffer a data breach? A new data extortion crew, WhiteArmor, listed J.B. Hunt on October 23 with a $5 million demand, claiming employee records, carrier contacts and invoices. J.B. Hunt has not confirmed an incident. Carriers and shippers should verify any payment or bank detail change out of band.

Which CVEs should I patch this week? Start with PAN-OS GlobalProtect CVE-2026-0257, which Qilin and INC are still exploiting, and Veeam CVE-2023-27532, which they chain after it. CISA's KEV additions this week include Arista VeloCloud Orchestrator CVE-2026-114625, four Plex Media Server flaws, SiteGuard Server Edition and Siemens Software Center. None is flagged for ransomware use yet.

What happened with N0n's 38 maritime companies? The October 19 deadline passed and multiple outlets report that data for most of the firms was published after they refused to pay. The suspected shared vendor, CyberLogitec, has reportedly told Korean customers its systems are operating normally, and the link remains unconfirmed.

Where can I get this in real time instead of weekly? Scrutex Threat Insights monitors leak sites and dark web sources continuously and matches findings against your own asset inventory and your named suppliers, so a relevant listing reaches you when it is posted and not in the following Monday's roundup.