Armenian National Sentenced for Role in Global Ryuk Ransomware Attacks A U.S. federal court sentenced 35-year-old Armenian national Karen Vardanyan to two years in prison, followed by three years of supervised release, for his involvement in a massive ransomware campaign. Vardanyan, extradited from Ukraine in July 2025 after his arrest in Kyiv, was ordered to pay $1,219,106 in restitution to victims of the cyberattacks. Prosecutors identified Vardanyan as a key member of the Ryuk ransomware gang, which executed over 2,400 attacks worldwide, targeting state and local governments, businesses, and critical infrastructure. The attacks crippled victims by encrypting data and disrupting operations, with prosecutors highlighting severe impacts on public services and communications. During the 2020 COVID-19 pandemic, Ryuk actors aggressively targeted U.S. hospitals, including a devastating attack on Universal Health Services (UHS), which incurred $67 million in losses. The Department of Justice (DOJ) reported that Vardanyan and his associates extorted at least $15 million in ransoms over the years, with Vardanyan personally responsible for attacks netting over $1 million. First detected in August 2018, Ryuk has been linked to Russian cybercriminals, with U.S. authorities dismantling its money-laundering operations. The group has ties to Trickbot malware, a notorious banking trojan. Vardanyan pleaded guilty on July 8 to conspiracy and computer fraud charges. Other members of the Ryuk operation have faced legal consequences, including Levon Georgiyovych Avetisyan (another Armenian national) and two Ukrainians Oleg Nikolayevich Lyulyava and Andrii Leonydovich Prykhodchenko, both 53. In 2023, a Russian national pleaded guilty in Oregon to laundering Ryuk’s illicit funds over three years, acting as a middleman alongside 13 unnamed co-conspirators.

A ransomware attack occurred against ESO Solutions, a significant software provider for emergency services and healthcare. This incident resulted from unauthorised data access and system encryption across many enterprise platforms. Depending on the information patients have shared with their healthcare providers using ESO's software, a range of personal data was exposed in the hack. Among the compromised data are: complete names dates of birth Numbers to call Numbers for patient accounts and medical records Details of the injury, diagnosis, treatment, and procedure, and Social Security numbers. It was established that patient data connected to U.S. hospitals and clinics that ESO serves as a client was compromised. All notified parties will receive a year of identity monitoring services from Kroll through ESO to assist in reducing risks.

First Fatality Linked to Ransomware Attack Highlights Growing Threat to Hospitals On September 10, 2020, a ransomware attack on Düsseldorf University Clinic in Germany disrupted critical IT systems, forcing the hospital to divert emergency patients. A woman in need of urgent care was rerouted to another city for treatment delaying her admission by nearly an hour and later died. German authorities confirmed this as the first known death directly attributed to a ransomware attack. The incident underscores the escalating risks of cyberattacks on healthcare. While cybercriminals typically target hospitals for financial gain rather than patient harm, the consequences can be severe. In 2016, the Locky ransomware disrupted operations at Hollywood Presbyterian Medical Center in Los Angeles, halting radiation and oncology services. More recently, Universal Health Services a U.S. hospital chain with 250 facilities canceled surgeries and rerouted ambulances after a ransomware attack, though no patients were harmed. Ransomware attacks on healthcare providers have quadrupled over the past three years, despite repeated warnings from the FBI and cybersecurity experts. The financial toll is staggering: global damages from ransomware are projected to reach $20 billion by 2021, a 57-fold increase since 2015. Healthcare organizations, historically underinvested in cybersecurity, now face mounting pressure to bolster defenses. While other sectors like finance allocate around 15% of IT budgets to cybersecurity, hospitals have typically spent just 4–7%. In response, the healthcare industry is expected to invest $125 billion in cybersecurity between 2021 and 2025, with C-suite executives increasingly recognizing ransomware as both a patient safety and reputational risk. The Düsseldorf incident serves as a grim reminder of the real-world stakes as cyber threats continue to disrupt critical care.

The systems of the famous healthcare facility, Universal Health Services, were targeted by the Rayuk ransomware group in September 2020. The attackers hit the systems, disabled multiple antivirus programs, and logged the systems out. The attack caused the doctors to wait for a longer period for lab test results and even resulted in four casualties. The healthcare immediately took action and removed the encrypted files and restored the systems.