Date saved: 2026-10-22 18:00 (PDT)
Sources: BleepingComputer, The Hacker News, Data Breaches Digest, Nextgov, ThreatClaw, Reuters, CNN
Key findings
Record ransomware quarter and AI as a force multiplier
- Q3 2026 set a new record of 2,627 claimed ransomware attacks, the highest quarter ever recorded, per Cleartext's Week in Review. (Source)
- 84% of ransomware attacks now involve AI as cybercriminals escalate their tactics, according to Data Breaches Digest; the SafePay ransomware gang has breached over 600 critical infrastructure organizations worldwide since 2024, CISA says. (Source)
- CISA warned federal agencies that ransomware gangs are exploiting a critical JetBrains TeamCity vulnerability patched in July and a critical VMware vCenter vulnerability patched in July; the FBI is warning that FortiBleed attacks targeting exposed Fortinet FortiGate firewalls and SSL VPN gateways are still ongoing. (Source)
Law enforcement crackdowns and arrests
- INTERPOL's Operation Serengeti III disrupted nearly 11,000 cybercriminal networks and arrested more than 1,400 people across Africa, netting over $105 million; the operation targeted business email compromise, ransomware, and other cybercrimes. (Source)
- Germany arrested a Russian national suspected of being a leading member of the Qilin ransomware group following extradition from Japan; Spanish police arrested a 16-year-old suspected of running the KillSec ransomware group and seized its data leak site and servers as part of Operation KillSwitch. (Source)
- The FBI arrested Edward Dubrovsky, a Canadian cybersecurity executive and ransomware negotiator, in the Philadelphia area on October 8, 2026, in connection with the ShinyHunters investigation; a suspected member of ShinyHunters known as "Rey" was detained in Jordan on September 29 and is cooperating with the FBI to identify other group members. (Source)
- A suspected ShinyHunters leader was arrested by Dutch police in Amsterdam on September 15, 2026, on suspicion of playing a role in the group; sources suggest the group may already have a new leader. (Source)
Major breaches: FBI, Capcom, and critical infrastructure
- ShinyHunters claimed responsibility for breaching the FBI's jobs portal (FBIjobs.gov) and gaining access to the personal data of thousands of current and former FBI employees; the FBI has told employees to assume their data was compromised and to watch for suspicious calls and AI-generated voicemail scams; the breach reportedly went undetected for months. (Source)
- Capcom confirmed a data breach has affected over 11 million people, 11,774,247 Capcom ID accounts were accessed by a third party on October 19, 2026, exposing email addresses and login details. (Source)
- The MonsterCloud owner, Zohar Pinhasi, was charged with two counts of wire fraud and one count of wire fraud conspiracy for allegedly defrauding ransomware victims by secretly paying attackers for decryptors while claiming to use proprietary technology; the DOJ says he billed over $19 million. (Source)
- The FBI and DOJ seized seven domains supporting Microscan and FishHub hacking tools linked to China's Integrity Technology Group, a sanctioned firm operating the Flax Typhoon cyber operation; CISA added five Flax Typhoon-exploited CVEs to its Known Exploited Vulnerabilities catalog with an October 11 federal patch deadline. (Source)
Q3 2026 set a new record for claimed ransomware attacks (2,627, the highest quarter ever recorded), and the story behind that number is a ransomware ecosystem that has absorbed AI as a force multiplier: 84% of ransomware attacks now involve AI, according to Data Breaches Digest, as cybercriminals escalate their tactics. The SafePay ransomware gang alone has breached over 600 critical infrastructure organizations worldwide since 2024, according to CISA. At the same time, the law enforcement response has become genuinely international and unusually kinetic: INTERPOL's Operation Serengeti III disrupted nearly 11,000 cybercriminal networks and arrested more than 1,400 people; Germany arrested a Russian national suspected of being a leading member of the Qilin ransomware group following extradition from Japan; Spanish police arrested a 16-year-old suspected of running the KillSec ransomware group and seized its data leak site; and the FBI arrested a Canadian cybersecurity executive, a ransomware negotiator, not a hacker, in connection with the ShinyHunters group that breached the FBI's own jobs portal.
The FBI breach is the story that should concentrate every security team's attention: ShinyHunters claimed it accessed the personal information of nearly every FBI employee through the FBIjobs.gov portal, and the FBI has told employees to assume their data was compromised. The breach went undetected for months, and a missed Oracle PeopleSoft patch was the likely vector. That a ransomware negotiation firm co-founder was allegedly linked to the group that breached the FBI (and was charged with defrauding ransomware victims by secretly paying attackers for decryptors while claiming to use proprietary technology) is a double indictment of the ransomware remediation industry itself.
Source links
- BleepingComputer: Latest Ransomware news
- The Hacker News: Ransomware and cybercrime latest news
- Data Breaches Digest: Week 43 2026
- Nextgov: Data Breaches: FBI arrests another ShinyHunters suspect
- Cleartext: Week in Review October 10, 2026
- FBI Casebook: FBI Cyber Team Dismantles Ransomware Crew Inside a Real Hosting Firm
- Case Uncut: The Ransomware Negotiator Arrested: FBI Cuffs ShinyHunters Suspect