Loading story…
UFP Technologies, a Massachusetts-based medical device manufacturer, disclosed in an SEC filing that it detected suspicious activity on its IT systems on February 14 and responded by isolating affected systems, engaging external cybersecurity experts, and launching an investigation. The company reported that the incident impacted many but not all IT systems and disrupted business functions including billing and label making for customer deliveries; it also stated that certain company or company-related data appears to have been stolen or destroyed.
UFP said it believes the intruder has been removed from its environment and that access to impacted information has been restored “in all material respects,” with recovery supported by contingency plans and backup systems. Reporting noted that the combination of apparent data theft and destruction could indicate ransomware or wiper-like activity, though no malware family or threat actor has been publicly identified and no ransomware group had claimed responsibility at the time of publication; UFP also indicated it is still assessing whether sensitive or personal information was exfiltrated and expects cyber insurance to cover most incident-related costs.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
UFP publicly reported the incident in an SEC filing, stating that many but not all IT systems were affected, personal-data impact was still under assessment, and the company did not expect a material operational or financial impact.
UFP said the threat actor had been removed from its environment and that access to affected information had been restored in all material respects, including through use of backup data systems.
During its investigation, the company concluded that some company or company-related data appears to have been exfiltrated or destroyed, while functions such as billing and label-making for customer deliveries were affected.
After detecting the intrusion, UFP isolated impacted systems, launched remediation efforts, and engaged external cybersecurity advisors to investigate and contain the attack.
UFP Technologies discovered suspicious activity affecting portions of its IT environment on 2026-02-14, marking the start of the disclosed cybersecurity incident.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
teiss.co.uk
Open sourcetherecord.media
Open sourcebleepingcomputer.com
Open sourcebankinfosecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
West Pharmaceutical Services disclosed a material cybersecurity incident after detecting suspicious activity on May 4 and determining by May 7 that an unauthorized actor had exfiltrated data and encrypted multiple internal systems. In an SEC filing, the pharmaceutical packaging and drug-delivery manufacturer said the attack disrupted parts of its global operations, including manufacturing, shipping, and enterprise functions. The company isolated affected systems, restricted enterprise network access, notified law enforcement, and brought in external incident-response support from **Palo Alto Networks Unit 42** while recovery efforts continued. West said some production and distribution systems have been restored and manufacturing has partially resumed, but the investigation is ongoing and the full scope of stolen data and financial impact remains unknown. No ransomware group has publicly claimed responsibility, though the combination of data theft and encryption matches **double-extortion ransomware** tactics that have repeatedly hit pharmaceutical manufacturers and broader healthcare supply chains, including earlier warnings from Indian drugmaker Sun Pharma that a ransomware attack could lead to revenue loss and litigation.
Jun 29, 2026
The **University of Hawaii (UH) Cancer Center** disclosed that a ransomware intrusion affecting a single cancer research project led to the encryption of systems and the theft of a limited set of research files, including some legacy documents from the 1990s containing **Social Security numbers** used to identify study participants. UH reported the incident occurred in late August 2025 and said clinical operations and patient care were not impacted, but recovery and investigation were delayed due to the extent of encryption damage; UH also stated it engaged external experts, isolated affected systems, and negotiated with the attackers, including paying to obtain a decryptor and seeking assurances of deletion of stolen data. The disclosure drew scrutiny because UH reportedly notified the state legislature well after Hawaii’s **20-day breach reporting deadline**, and the university has not provided key details such as the specific research project, the number of affected individuals, or concrete measures proving the stolen data was not exposed after negotiations. Separate reporting on unrelated ransomware activity included **Everest** claiming a breach of **Nissan** with an alleged 900GB data theft and **Trellix** research describing **CrazyHunter** ransomware targeting Taiwan healthcare organizations; those items do not appear connected to the UH Cancer Center incident beyond being ransomware-related.
Jun 29, 2026
A ransomware attack on UnitedHealth subsidiary **Change Healthcare** crippled prescription processing, billing, and claims services across the U.S., leaving pharmacies, hospitals, doctors, and therapists unable to process insurance transactions and creating severe cash-flow problems for providers. UnitedHealth disclosed the intrusion after isolating affected systems, and the **ALPHV/BlackCat** gang later claimed responsibility, saying it stole terabytes of data from the company’s environment. The outage highlighted Change Healthcare’s central role in the health sector, where it processes a huge share of medical and pharmacy transactions. UnitedHealth later acknowledged paying a ransom reportedly worth about **$22 million** in bitcoin, but the extortion did not end there: a second group, **RansomHub**, claimed it had obtained the stolen files and began leaking patient data online. Subsequent reporting said the breach likely included highly sensitive personal and health information, potentially affecting U.S. service members and eventually tens of millions of Americans, with later estimates rising to **100 million** and then **193 million** victims. Investigators and executives also said the attackers entered through a **Citrix portal without MFA**, turning the incident into one of the largest and most consequential healthcare data breaches on record.
Jun 29, 2026