Loading story…
BridgePay Network Solutions, a U.S. payment gateway and solutions provider, confirmed a ransomware attack forced it to take key systems offline, triggering a nationwide outage that disrupted card processing and related services for merchants and public-sector customers. The incident began on a Friday with degraded performance that escalated into a broad platform disruption, with monitoring first flagging issues around Gateway.Itstgate.com before cascading into a full outage.
BridgePay reported it engaged federal law enforcement, including the FBI and U.S. Secret Service, alongside external forensic and recovery teams. The company stated that initial forensic findings found no compromise of payment card data, and that any accessed files were encrypted, with “no evidence of usable data exposure,” while it continued restoration efforts across impacted services including BridgePay Gateway API (BridgeComm), PayGuardian Cloud API, MyBridgePay virtual terminal/reporting, hosted payment pages, and PathwayLink gateway/boarding portals; the responsible ransomware group was not publicly named in the reporting.
See attribution, scope, and your downstream exposure.
6 events from the most recent confirmed update back to the earliest known activity.
As of Monday, BridgePay said it was still securely restoring operations while the forensic investigation continued, and it had not provided an estimated time for full recovery. No ransomware group had publicly claimed responsibility at that time.
By the weekend and as of Monday reporting, outages tied to BridgePay had taken offline online payment portals for customers including the City of Palm Bay, Florida and the City of Frisco, Texas, while some merchants were forced to accept cash only.
In its initial forensic assessment, BridgePay said it found no evidence that payment card data was stolen or exposed, adding that any accessed files were encrypted and that integrators were not believed to face an active threat or vulnerability.
Late Friday, BridgePay confirmed that ransomware caused the outage and said it had engaged the FBI, the U.S. Secret Service, and external forensic and recovery teams to investigate and restore systems.
The incident developed into a widespread outage that disrupted card processing and related services for merchants and public-sector customers across the United States. Impacted services included BridgePay Gateway API, PayGuardian Cloud API, MyBridgePay, hosted payment pages, and PathwayLink portals.
On Friday, BridgePay began seeing degraded performance around 3:29 a.m. and took key systems offline as the disruption escalated into a broader outage affecting its payment platform.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
4 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourceteiss.co.uk
Open sourcetherecord.media
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A ransomware attack on UnitedHealth subsidiary **Change Healthcare** crippled prescription processing, billing, and claims services across the U.S., leaving pharmacies, hospitals, doctors, and therapists unable to process insurance transactions and creating severe cash-flow problems for providers. UnitedHealth disclosed the intrusion after isolating affected systems, and the **ALPHV/BlackCat** gang later claimed responsibility, saying it stole terabytes of data from the company’s environment. The outage highlighted Change Healthcare’s central role in the health sector, where it processes a huge share of medical and pharmacy transactions. UnitedHealth later acknowledged paying a ransom reportedly worth about **$22 million** in bitcoin, but the extortion did not end there: a second group, **RansomHub**, claimed it had obtained the stolen files and began leaking patient data online. Subsequent reporting said the breach likely included highly sensitive personal and health information, potentially affecting U.S. service members and eventually tens of millions of Americans, with later estimates rising to **100 million** and then **193 million** victims. Investigators and executives also said the attackers entered through a **Citrix portal without MFA**, turning the incident into one of the largest and most consequential healthcare data breaches on record.
Jun 29, 2026
Rome’s **La Sapienza University** shut down network systems as a precaution after a cyberattack caused widespread disruption and left its website offline; Italian media attributed the incident to a suspected ransomware operation linked to pro-Russian actor **Femwar02**, with reported tradecraft resembling **Bablock/Rorschach**-style fast encryption. Separately, Romania’s national oil pipeline operator **Conpet** reported a cyberattack that disrupted corporate IT and took down `www.conpet.ro` while leaving **OT/SCADA** and pipeline transport operations unaffected; **Qilin** claimed responsibility, alleging theft of nearly **1TB** of data and posting sample documents (including financial data and passport scans) to support extortion claims. In the U.S., government services contractor **Conduent** faced expanding breach impact from its January 2025 ransomware incident, with notifications indicating exposure potentially reaching **dozens of millions**; reported affected data includes **names, Social Security numbers, and medical/health insurance information**, with at least **15.4M** impacted in Texas and **10.5M** in Oregon per state disclosures. Additional healthcare-sector disclosures included a ransomware-linked intrusion at **Insightin Health** (unauthorized access in September 2025; **Medusa** claimed exfiltration of **378GB**) and a separate compromise at **Clinic Service Corporation** (August 2025 access window), while **Central Ozarks Medical Center** reported a criminal cyberattack affecting **11,818** individuals with exposure of PHI/PII (including SSNs and financial/insurance data). Other items in the set were not incident-specific: an **HHS-OIG** audit describing web application security weaknesses at a large hospital, and general guidance/education pieces on the value of medical records to attackers and **CISA** insider-threat guidance.
Jun 29, 2026
An Iran-linked **Pay2Key** ransomware operation targeted a U.S. healthcare organization after compromising an administrative account and remaining in the environment for several days before encrypting systems. Investigators from **Beazley Security** and **Halcyon** said the attackers also cleared activity and event logs in an apparent effort to erase evidence, and found no signs of data exfiltration despite earlier U.S. intelligence linking Pay2Key primarily to information theft. Researchers said the intrusion reflects a more destructive and covert use of Pay2Key amid heightened U.S.-Iran military tensions, with the group increasingly assessed as pursuing strategic disruption rather than purely financial gain. Halcyon warned that additional U.S. organizations may already have been affected by Iranian cyber activity, including ransomware, wiper-style attacks, and efforts to exploit unpatched vulnerabilities, while Pay2Key has also expanded as a ransomware-as-a-service operation with recruitment on Russian cybercrime forums, roughly 170 attributed victims, and about **$8 million** in ransom payments since summer 2025.
Jun 29, 2026