Ransomware’s Double Trouble: Why Victims Are Being Claimed Twice in 2026 In 2026, a troubling trend has emerged in the ransomware landscape: the same victim organizations are appearing on leak sites under two different ransomware group names. Bitdefender’s analysis of five months of data tracking 98 claims across 49 distinct victims reveals that this phenomenon is not a fluke but a systemic issue with multiple underlying causes. ### The Mechanics Behind Duplicate Claims The median gap between the first and second claim is 12 days, with a mean of 23 days and some cases stretching up to 96 days. Only five cases were posted simultaneously, suggesting that most duplicates stem from staggered rather than coordinated attacks. The patterns vary, but four primary explanations account for the trend: 1. One Attack, Two Brands Some groups operate under multiple names within the same criminal network. For example, the DragonForce cartel absorbed affiliates from defunct operations like RansomHub, leading to the same victim appearing under both Qilin and DragonForce. Similarly, Hunters International rebranded as World Leaks, yet victims were listed under both names. In these cases, the breach is singular, but the leak site postings double-count the incident. 2. Recycled Data, Second Extortion When affiliates don’t receive their cut of a ransom payment, they may relist the stolen data under a new group. The Change Healthcare breach, initially claimed by ALPHV/BlackCat, later resurfaced under RansomHub after an affiliate dispute. This creates two distinct extortion attempts from the same dataset, with the second group operating independently of the first. 3. Two Real Breaches, Same Victim Some organizations are breached twice sometimes through the same vulnerability, other times through a different but equally unpatched weakness. In 16 of the 49 cases analyzed, the gap between claims exceeded 31 days, suggesting separate intrusions. Often, the root cause isn’t a single missed patch but systemic security failures: unchanged credentials, unenforced multi-factor authentication, or undetected network access. Access brokers exacerbate this by reselling stolen credentials to multiple threat actors. 4. No Breach at All Some claims are outright fabrications. Groups like 0APT and Dispossessor have been caught reposting victim lists from other leak sites or inventing attacks entirely. After Operation Cronos disrupted LockBit, the group falsely claimed the Federal Reserve as a victim, later revealed to be data from Evolve Bank. These fake claims waste resources, as organizations may respond to a non-existent breach. ### The Impact on Statistics and Response The prevalence of duplicate and fabricated claims distorts ransomware statistics. For instance, Q1 2026’s raw leak site data showed a 15% increase in victims year-over-year. However, removing 0APT’s 549 fake claims reversed the trend, revealing a 6% decline. This noise complicates threat assessments and incident response. For victims, distinguishing between these scenarios is critical: - Same breach, two groups? Treat it as one negotiation. - Recycled data? Paying the second group doesn’t silence the first. - Two real breaches? The issue isn’t just the breach it’s the security posture that allowed it. - No breach at all? Verification is key before taking action. The rise of duplicate claims underscores the need for defenders to look beyond surface-level leak site postings. Context timing, group relationships, and data authenticity determines the appropriate response. Without it, organizations risk misallocating resources, overpaying ransoms, or failing to address the real vulnerabilities that led to repeat victimization.

New DOJ Documents Reveal Epstein’s Alleged Ties to a "Personal Hacker" Recently unsealed Justice Department documents part of the so-called "Epstein Files" have exposed a previously undisclosed claim: in 2017, an FBI informant alleged that convicted sex offender Jeffrey Epstein employed a "personal hacker" within his inner circle. The revelation adds a cybersecurity dimension to the ongoing investigations into Epstein’s operations, though the hacker’s exact role remains unclear. The implications of such an association are significant. A personal hacker could have enabled Epstein to: - Gather sensitive information, including intercepted communications or private data. - Orchestrate security breaches, potentially targeting rivals or individuals seeking to expose his activities. - Manipulate digital evidence, possibly altering records to obscure his tracks. The FBI’s investigation into Epstein’s network now appears to extend beyond physical crimes into the digital realm, suggesting a level of sophistication that may have helped sustain his operations. The disclosure also raises broader concerns about the intersection of cybercrime and high-profile criminal enterprises, particularly regarding victim privacy and the role of digital forensics in modern investigations. As more details emerge, the alleged hacker’s involvement could provide critical insights into how Epstein maintained control over his network and how cyber tools may have been weaponized in support of his crimes. The case continues to underscore the growing importance of cybersecurity in uncovering and dismantling complex criminal organizations.