BRIEFRansomwarehighP50
Ransomware kairos publishes French hospital center CNEH
Le Centre National de l'Expertise Hospitalière (CNEH)
Detected30 September 2026 · 20:31 UTC
The ransomware group kairos published Le Centre National de l'Expertise Hospitalière (CNEH), a French healthcare training organization, as a new victim on its leak site. Healthcare ransomware disrupts patient-facing services and exposes sensitive data. Health-sector defenders should verify exposure and prepare for leaked records and extortion pressure.
CategoryRansomware
Severityhigh
Priority score50
Detected30 September 2026 · 20:31 UTC
RansomwarePriority 42
Ransomware Qilin publica al fabricante Kayaku Safety Systems MalaysiaThe Qilin ransomware group added Kayaku Safety Systems Malaysia, an automotive safety-components manufacturer, to its leak site with no data description published yet. Listing alone signals a claimed intrusion into an industrial supplier that sits in regional automotive supply chains. No samples or record counts are visible, so impact is unconfirmed but worth tracking for supply-chain risk.RansomwarePriority 66
Ransomware n0n publica datos de clientes de MM Insurance AgencyThe n0n group published records from a Canadian financial advisory firm, including signed registered-plan documents, investment summaries, insurance policies and identity documents such as driver licences, a marriage certificate and a death certificate. Client banking details and tax slips containing social insurance numbers are also exposed, along with a graph of 2,219 distinct client contacts. This is severe identity-theft material affecting named individuals and warrants notification and monitoring.RansomwarePriority 68
Ransomware n0n publica datos de la empresa estadounidense PollstarThe n0n ransomware group listed Pollstar, a US concert-trade data company, publishing 135,621 named contacts with phones, emails and addresses plus 26,527 quote and invoice documents. The stolen archive covers booking managers, venues, promoters and talent buyers, plus sales and box-office records. It matters because a B2B contact trove of this size enables highly targeted phishing and invoice fraud against live-events companies across the region.RansomwarePriority 57
Ransomware ScarlettGroup publica a la británica FittleworthThe ScarlettGroup ransomware crew has listed Fittleworth, a UK provider of home-delivered medical supplies and stoma/continence care, on its leak site. As a healthcare supplier handling sensitive patient logistics, disruption or data exposure can harm vulnerable patients. Defenders in healthcare supply chains should monitor for data publication and follow-on phishing.RansomwarePriority 70
Ransomware Barracuda publica a la maderera española FINSAThe Barracuda ransomware group listed FINSA, a large Spanish wood-processing company, claiming theft of 800 GB of production and internal files and disruption of its virtualization infrastructure. The post states that operations were halted, indicating a high-impact intrusion against an industrial firm. Spanish organizations and FINSA's business partners should assess exposure.RansomwarePriority 58
Ransomware Endzone publica a la operadora Momentum TelecomThe Endzone group listed Momentum Telecom, a US cloud-voice and SD-WAN provider with about $221M in revenue, claiming access through a compromised Multi-Service Operator provisioning tool. Provisioning and diagnostic systems sit close to customer call flows, so exposure can enable interception and downstream compromise of business clients. Carriers and resellers that depend on these services need to check third-party access.