Ransomware Attacks Rise in May 2026, With Education and Retail Sectors Hit Hardest Ransomware attacks increased by 3% in May 2026, with 661 incidents recorded up from 640 in April though still below the higher volumes seen earlier in the year. While overall activity remained relatively stable, certain sectors experienced sharp spikes, while others saw notable declines. ### Sector-Specific Trends - Education saw the most dramatic surge, with attacks jumping 54% (from 13 to 20). - Food and beverage (+80%), retail (+19%), transportation (+20%), and technology (+29%) also faced significant increases. - Healthcare and utilities saw the steepest drops, with attacks falling 21% and 29%, respectively. Of the 48 confirmed attacks in May: - 35 targeted businesses, including 11 in manufacturing the most affected subsector. - 7 hit government entities, with France, Spain, Croatia, Senegal, and Thailand among the victims. - 5 impacted educational institutions, including Universitat de València (Spain) and Delano Public Schools (US). - 1 affected a healthcare provider Central Medical Services of Westrock (CMSW) in the US, breached by INC, which later auctioned 200–300 GB of stolen data. ### Most Active Ransomware Groups - Qilin led with 97 attacks, including 9 confirmed targeting entities in Australia, France, Germany, Spain, and the US. - The Gentlemen followed with 71 attacks (4 confirmed), while DragonForce claimed 51 attacks, allegedly stealing 20.8 TB of data the largest volume reported. - Other groups with notable activity included SafePay (+160%), Nova/RALord (+213%), Play (+325%), and Genesis (+1600%). ### Geographic Impact The US remained the top target, accounting for 272 attacks (+6% from April), followed by Canada (31), the UK (28), and Germany (26). Spain saw a 28% increase, while the UK and Germany experienced declines. ### Data Breaches and Financial Demands - Nearly 115 TB of data was stolen across all attacks in May. - Manufacturing firms faced high ransom demands, including $4.48 million from an Italian company (UnoAerre Industries) and 8 TB of stolen data from Foxconn North America (claimed by Nitrogen). - Notable breaches included: - Unimed (Germany): 120,000+ affected, including 54,000 patients from Baden-Württemberg hospitals. - Cardinal Services (US): Two separate attacks (June and August 2025) impacted 142,000+ people. - Western Orthopaedics (US): 113,000+ patients notified after a 1.7 TB data theft in September 2025. ### Year-to-Date Trends - Businesses saw 3,090 attacks (Jan–May 2026), a 13% increase from the same period in 2025. - Healthcare recorded 208 attacks (+10% YoY), while government attacks dropped 21% (145 total). - Education experienced 88 attacks (-25% YoY). The data highlights shifting ransomware tactics, with threat actors increasingly targeting high-impact sectors while some industries see temporary reprieves.

North Korean Operatives Exploit Real LinkedIn Profiles in Sophisticated Remote Job Fraud Scheme A new wave of identity fraud targeting the remote job market has emerged, with North Korean (DPRK) operatives adopting a more advanced tactic to evade hiring screens. Unlike previous methods such as AI-generated profiles and fabricated resumes these actors now hijack or mimic legitimate LinkedIn accounts, leveraging the credibility of real individuals to bypass detection. Security researchers have identified DPRK IT workers impersonating verified LinkedIn profiles, often complete with workplace email verifications and identity badges. By assuming the professional history and connections of genuine users, these operatives apply for remote software development and IT roles at Western tech firms. The scheme aims to generate revenue for the DPRK regime while posing an insider threat, potentially enabling intellectual property theft or malware deployment. Despite the sophistication of the approach, red flags persist. Hiring managers have noted inconsistencies such as refusal to participate in video calls, mismatched IP addresses, discrepancies in technical skills during interviews, and unusual urgency around salary payments routed through irregular channels. The shift underscores the need for enhanced identity verification in hiring processes, as reliance on social media badges alone is no longer sufficient. Companies are advised to implement live video interviews and multi-factor authentication to confirm candidate identities. The trend was highlighted in a February 2026 alert from Security Alliance (@_SEAL_Org).

Western Sydney University (WSU) was targeted by a mass phishing scam where fraudulent emails were sent to students and alumni, falsely claiming their degrees had been revoked or their enrolments terminated. The emails, sent from compromised or spoofed university accounts, caused widespread panic among recipients, including graduates and current students. One email referenced a fabricated 'Parking Permits' breach, alleging a student exploited system vulnerabilities to create fake permits and access email addresses—highlighting potential security flaws in WSU’s infrastructure. While the university confirmed the emails were fraudulent and notified NSW Police, the incident raised concerns about data integrity, reputational damage, and psychological distress among affected individuals. The attack follows a prior breach earlier in the year, where a former student leaked personal data of ~10,000 students on the dark web. Though no confirmation exists of additional data being stolen in this scam, the repeated targeting underscores systemic vulnerabilities. The university’s response focused on damage control, apologizing for the distress and assuring victims of the emails’ illegitimacy, but operational disruptions (e.g., helpdesk inquiries, media scrutiny) and erosion of trust in institutional communications were inevitable.

Australian Businesses Face Rising Ransomware Threats as Costs and Attacks Surge Australia has become a prime target for ransomware attacks, with 69% of domestic organizations experiencing an incident in the past five years up from 56% the previous year according to the Australian Cyber Network’s (ACN) State of the Industry 2024 report. The financial toll is severe: the average ransom payment has climbed to $1.35 million, a 31% increase from 2023, and 84% of affected businesses opted to pay. While self-reported cybercrime costs for businesses dipped by 18%, experts warn this may reflect underreporting or internal absorption of incidents rather than improved security. Small businesses saw an 8% rise in average costs ($49,600 per incident), while individuals faced a 17% increase ($30,700 per report) due to fraud and identity theft. Critical infrastructure under siege Australia ranks as the fourth most targeted nation for cyber threats against critical infrastructure, behind the U.S., Sweden, and Germany. State-aligned and organized cybercrime groups repeatedly exploit vulnerabilities, viewing Australian systems as "soft targets" in a geopolitically significant country. Recent attacks on Western Sydney University and AustralianSuper highlight disparities in security preparedness, with well-funded sectors like finance and healthcare faring better than under-resourced institutions such as regional universities and smaller utilities. Cybersecurity sector grows amid funding gaps Despite the threats, Australia’s cybersecurity industry contributed $9.99 billion to gross value added (GVA) in 2024, with $348 million in investment and a 9.27% increase in workforce employment (137,453 workers). Female representation in the sector has also surged, rising from 8% in 2021 to 25% in 2024. However, ACN co-founder Jason Murrell warns that cybersecurity remains "underfunded, under-coordinated, and under-prioritized" at the national level, despite its critical role in national security. In response to the escalating threat, the Australian government introduced mandatory ransomware reporting requirements in November 2024, aiming to improve visibility and collaboration. Yet, cybersecurity has been notably absent from national policy debates, even as attacks disrupt universities, superannuation funds, courts, and healthcare providers. The ACN urges urgent political action to align strategy with the growing threat landscape.

WSU has faced multiple security incidents exposing personal data of its community members. Access to demographic, enrollment, and progression information of roughly 10,000 current and former students was gained via an SSO system breach. A separate dark web leak included names, contact details, birth dates, health data, government IDs, and bank info of 7,500 individuals. Hackers held network access from July 9, 2023, to March 16, 2024, accessing 580 TB of data.