Clop Ransomware Gang Hit by Extortion Demand from Rival ShinyHunters Over the weekend, the notorious Clop ransomware group found itself on the receiving end of an extortion attack after rival cybercrime crew ShinyHunters hijacked its dark web leak site. The takeover, first noticed on Friday, saw Clop’s site defaced with a bold "DOMAIN SEIZED BY SHINYHUNTERS" banner, accompanied by a taunting tagline. ShinyHunters claimed to have exploited a vulnerability in the software powering Clop’s site, gaining extensive access to its infrastructure. The group told Reuters it now effectively "owns" Clop, though Clop has not publicly responded. Security researchers confirmed the breach appears legitimate, with The Register verifying the defaced site. The feud stems from Clop’s 2023 attacks on Oracle E-Business Suite (EBS) customers, where ShinyHunters alleges Clop stole and weaponized a zero-day exploit it had discovered first. On September 19, ShinyHunters demanded an eight-figure payout later escalating to "all the money" made from the EBS campaign, plus interest. The group also threatened to expose companies that paid Clop, including ransom amounts and Bitcoin addresses. By September 21, ShinyHunters intensified its demands, warning of daily increases in the ransom and demanding a public apology. The escalation underscores the high stakes: if ShinyHunters publishes payment records, it could undermine Clop’s reputation for secrecy, potentially exposing past victims who believed their deals remained confidential. Clop, known for high-profile attacks like the 2023 MOVEit campaign which breached thousands of organizations and compromised millions of records now faces reputational damage. Leak sites are critical for extortion groups to prove control over stolen data; having one hijacked by a rival is a severe blow. ShinyHunters, itself linked to major data theft and extortion operations, has vowed to keep raising the price until Clop responds. The incident marks a rare case of cybercriminals turning the tables on one another, with potential fallout for both the attackers and their past victims.

Dartmouth College has confirmed that a cybersecurity breach compromised the personal data of over 40,000 individuals, including nearly 32,000 in New Hampshire and more than 12,000 in Vermont, after hackers exploited a vulnerability in a widely used software system. The attack, which occurred over a three-day span in early August, targeted the Oracle eBusiness Suite, software used by Dartmouth and other institutions to manage operations. [RELATED: Dartmouth faculty denounce Trump admin’s higher ed compact as ‘fascist’ and ‘unconstitutional’] A known ransomware group has claimed responsibility for the breach according to Valley News, which has reportedly affected over 100 organizations. According to filings with state attorneys general, the compromised data includes names, Social Security numbers, and financial account details. Dartmouth began notifying victims by mail last week and is offering a year of free identity protection through Experian. [RELATED: Dartmouth president refuses to join Ivy League push against Trump, pledges institutional neutrality] Dartmouth says the breach was not caused by phishing or internal user error. After Oracle disclosed the issue in October, the college launched an investigation and confirmed on Oct. 30 that sensitive data had been accessed. Officials said time was needed to review affected files and identify impacted individuals. In response, Dartmouth has implemented all available security patches and set up a hotline for those affect

Ransomware Attacks on Schools Persist in 2025, Despite Slight Decline in Volume In 2025, ransomware attacks on educational institutions saw a marginal decrease in frequency but a sharp rise in severity, according to Comparitech’s Education Ransomware Roundup report. Cybercriminals targeted schools 251 times down only slightly from 240 incidents in 2024 yet the scale of data exposure grew, amplifying the impact on affected organizations. K-12 schools emerged as the most vulnerable targets, despite higher education institutions traditionally holding larger data troves. Limited cybersecurity resources and understaffed IT teams made primary and secondary schools prime targets, exposing sensitive student records, staff information, and financial data. The report highlights a critical gap in defenses, leaving smaller institutions disproportionately at risk. A major driver of breaches in 2025 was a zero-day vulnerability in Oracle E-Business Suite, exploited by the CLOP ransomware gang in August. The flaw led to data compromises at over five schools, underscoring persistent risks from unpatched software and supply-chain weaknesses. While attack volumes remained steady, ransom demands dropped significantly. The average minimum demand fell to $464,000 in 2025, down from $694,000 the previous year. Researchers suggest this shift may reflect a tactical adjustment by attackers, who recognize that lower demands increase the likelihood of payment from budget-constrained schools. The report also raises concerns about third-party mediators in ransom negotiations. Some intermediaries, who take a percentage of paid ransoms, may inadvertently encourage payments, fueling the ransomware economy. Comparitech’s Head of Research, Rebecca Moody, notes that many schools avoid disclosing attacks due to stigma, hindering collective defense efforts. Greater transparency, she argues, could help institutions share threat intelligence and adopt stronger mitigation strategies in an evolving cyber threat landscape.