Loading story…
Senegal temporarily shut down operations at the Directorate of File Automation (DAF)—the government office responsible for national ID cards, passports, and biometric services—after a cyberattack disrupted systems supporting these functions. Authorities notified the country’s ~19.5 million residents that services were suspended while the incident was contained and systems were restored, and a senior police official publicly asserted that the integrity of citizens’ personal data “remains intact,” though the full impact was still being assessed.
A ransomware actor calling itself Green Blood Group claimed responsibility, alleging theft of 139 GB of data including citizen records, biometric information, and immigration documents, and published samples as proof. Both reports cite a leaked email from Quik Saw Choo (senior GM at Malaysia’s IRIS Corporation Berhad, involved in Senegal’s digital ID card program) stating that two DAF servers were breached on Jan. 19, with card personalization data stolen from one; IRIS reported taking containment steps such as cutting network access to one server, changing passwords on another, and blocking network connections to foreign missions while coordinating with Malaysian cybersecurity experts and planning on-site support in Dakar. The incident occurred amid a reported contractual/payment dispute between Senegal and IRIS related to the digital national ID project.
See the actors and campaigns active against you right now.
5 events from the most recent confirmed update back to the earliest known activity.
Senegalese authorities publicly confirmed a cyber incident affecting the Directorate of File Automation and temporarily shut the office's operations. Officials said services were being restored securely and stated that the integrity of citizens' data had not been affected.
The ransomware group Green Blood Group claimed responsibility for the intrusion into DAF and alleged it stole 139 GB of data, including citizen records, biometric information, and immigration documents. The group published sample data and a leaked IRIS email as purported proof.
By February 5, local reporting indicated DAF had been disrupted for at least five days, affecting services tied to national ID cards, passports, and biometric records. Restoration efforts were underway while questions persisted about a payment dispute between Senegal and IRIS.
Following the reported server breach, IRIS said it disconnected a server, changed a password, and cut network links to foreign missions and offices to contain the incident. The company also sought to send a team to Dakar with Malaysian cybersecurity experts on January 22.
An email attributed to IRIS Corporation Berhad said two servers at Senegal's Directorate of File Automation (DAF) were breached on January 19, resulting in theft of card personalization data. The compromised environment supported Senegal's national ID infrastructure.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
6 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcescworld.com
Open sourcescworld.com
Open sourcesecurityaffairs.com
Open sourceteiss.co.uk
Open sourcetherecord.media
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Rome’s **La Sapienza University** shut down network systems as a precaution after a cyberattack caused widespread disruption and left its website offline; Italian media attributed the incident to a suspected ransomware operation linked to pro-Russian actor **Femwar02**, with reported tradecraft resembling **Bablock/Rorschach**-style fast encryption. Separately, Romania’s national oil pipeline operator **Conpet** reported a cyberattack that disrupted corporate IT and took down `www.conpet.ro` while leaving **OT/SCADA** and pipeline transport operations unaffected; **Qilin** claimed responsibility, alleging theft of nearly **1TB** of data and posting sample documents (including financial data and passport scans) to support extortion claims. In the U.S., government services contractor **Conduent** faced expanding breach impact from its January 2025 ransomware incident, with notifications indicating exposure potentially reaching **dozens of millions**; reported affected data includes **names, Social Security numbers, and medical/health insurance information**, with at least **15.4M** impacted in Texas and **10.5M** in Oregon per state disclosures. Additional healthcare-sector disclosures included a ransomware-linked intrusion at **Insightin Health** (unauthorized access in September 2025; **Medusa** claimed exfiltration of **378GB**) and a separate compromise at **Clinic Service Corporation** (August 2025 access window), while **Central Ozarks Medical Center** reported a criminal cyberattack affecting **11,818** individuals with exposure of PHI/PII (including SSNs and financial/insurance data). Other items in the set were not incident-specific: an **HHS-OIG** audit describing web application security weaknesses at a large hospital, and general guidance/education pieces on the value of medical records to attackers and **CISA** insider-threat guidance.
Jun 29, 2026
Multiple organizations disclosed or were linked to **ransomware/data-extortion** activity with material operational or privacy impact. **Air Côte d’Ivoire** confirmed a cyberattack affecting parts of its information systems after **INC ransomware** claimed theft of **208 GB** and threatened to leak data, while the airline said it engaged the national CERT and external experts to contain impact and maintain flight operations. In the US healthcare sector, **University of Mississippi Medical Center (UMMC)** reported a ransomware incident that forced statewide clinic closures and disrupted access to **Epic** electronic medical records, prompting engagement with the **FBI** and **CISA** and use of downtime procedures to sustain patient care. Separately, **Conduent**’s earlier ransomware-linked breach continued to expand in scope, with breach notifications indicating at least **~25 million** people affected across multiple states and exposure of sensitive PII (including **SSNs** and health/insurance data). **Wynn Resorts** also confirmed an unauthorized party accessed and stole employee data after being listed by the **ShinyHunters** extortion group, with the company stating the actor claimed the data was deleted and that guest operations were not impacted. Other items in the set describe distinct, unrelated security events and broader threat research rather than the same incident: alleged data leaks involving **Burger King France** and **Wendy’s UK**; **Qilin** ransomware claims against a New York City transit union; Russian cyber operations against Ukraine’s power grid focused on intelligence collection; and a New Zealand healthcare application (**MediMap**) taken offline after apparent unauthorized access and **patient record tampering** (e.g., records marked deceased). Additional references cover threat research and trends (airline brand impersonation domains, edge-device exploitation telemetry, MuddyWater’s *Operation Olalampo*, Google Ads cloaking via **1Campaign**, freight/logistics phishing by “Diesel Vortex,” and various governance/AI/5G/quantum commentary), which provide context on the threat environment but do not substantively report on the same specific breach event.
Jun 29, 2026
Ingram Micro disclosed that a **July 2025 ransomware attack** resulted in the theft of files from internal repositories and a subsequent data breach affecting **~42,000 people** (reported as **42,521** in filings). The company said an unauthorized party accessed and exfiltrated certain files between **July 2–3, 2025**, and that it detected the incident on **July 3**, after which it took systems offline and began containment and remediation with external cybersecurity experts and law enforcement notification. The compromised data primarily involved **employee and job applicant records**, including names, contact details, dates of birth, and government-issued identification numbers such as **Social Security**, driver’s license, and passport numbers, as well as some **employment-related information** (e.g., work-related evaluations). The incident also caused significant operational disruption, including outages impacting internal systems and customer-facing operations; reporting noted that **SafePay** claimed responsibility and alleged theft of **~3.5 TB** of data, though Ingram Micro has not publicly attributed the intrusion to a specific threat group while confirming ransomware was deployed.
Jun 29, 2026