Loading story…
The World Leaks extortion group claimed it breached Hungarian media company Mediaworks and published nearly 8.5 TB of allegedly stolen data on its leak site. Mediaworks confirmed an incident involving unauthorized access to a significant volume of illegally obtained data and opened an investigation, while warning that use or publication of the leaked material could be criminal. Local reporting said the exposed files included payroll records, contracts, financial statements, internal communications and notes from a January 2025 editorial meeting that allegedly referenced possible contact with Moscow over articles targeting Ukrainian President Volodymyr Zelensky; the authenticity of that memo has not been independently verified.
Separately, the Everest ransomware group began leaking what it said was a 108 GB dataset tied to insurer Liberty Mutual after alleging the company did not respond to its demands. Liberty Mutual acknowledged the claims and said its investigation so far indicates the incident appears linked to a third-party vendor rather than a compromise of its own systems or networks. The allegedly stolen files reportedly contain policyholder data, including names, addresses, policy numbers, and financial and insurance details, underscoring how extortion groups are continuing to pressure victims by publishing sensitive data even when direct network encryption is not evident.
TTPs, infrastructure, and targeting history in one profile.
8 events from the most recent confirmed update back to the earliest known activity.
Mediaworks confirmed that unauthorized parties may have obtained a significant amount of illegally acquired data and said it had launched an investigation. The company also warned journalists that using or publishing the leaked material could be criminal and reportedly sought removal of coverage about the leaked memo.
World Leaks claimed responsibility for a ransomware-related breach of Hungarian media company Mediaworks and said it published nearly 8.5 terabytes of allegedly stolen data on its leak site. The incident was described as the group's first known operation in Hungary.
Liberty Mutual said it was aware of the online claims and immediately launched an investigation. The company stated its review indicated the incident appeared to involve a third-party vendor rather than a compromise of Liberty Mutual's own systems.
The Everest ransomware group began publishing what it claimed was Liberty Mutual data after alleging the insurer did not respond to its demands. The leak was described as being replicated across hacker forums and leak database sites.
Telex published reporting on a leaked Mediaworks document that allegedly described phone assistance from Moscow for discrediting Zelensky. This public reporting revealed part of the contents of the broader Mediaworks leak.
Everest said the dataset tied to Liberty Mutual was stolen on April 30, 2026, and described it as more than 108 gigabytes. The allegedly stolen files reportedly included policyholder names, addresses, policy numbers, and financial and insurance details.
A leaked internal Mediaworks note from a January 2025 editorial meeting reportedly referenced possible phone contact with Moscow regarding articles targeting Ukrainian President Volodymyr Zelensky. The memo later became part of reporting on the broader Mediaworks data leak.
The World Leaks cyber-extortion group emerged in early 2025 as a rebrand of the Hunters International operation. The group primarily shifted to data theft and extortion rather than file-encrypting ransomware attacks.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
4 references tracked. Mallory keeps watching after this page renders.
therecord.media
Open sourcebankinfosecurity.com
Open sourcegovinfosecurity.com
Open sourcetelex.hu
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**Ransomware and data-extortion activity** was reported across multiple sectors, with threat actors using leak sites to pressure victims and amplify impact. The **RansomHub** ransomware-as-a-service operation claimed it breached Chinese manufacturer **Luxshare** and stole sensitive manufacturing and R&D archives allegedly tied to major technology firms (including Apple, Nvidia, Tesla, and LG). The posted sample was described as containing engineering artifacts such as **3D CAD/Parasolid files, PCB manufacturing data, and engineering documentation**, plus some project-related PII; the breach had not been independently confirmed at the time of reporting. Separately, the **Everest** ransomware group claimed it breached **McDonald’s India**, alleging exfiltration of **861 GB** of internal documents and customer personal data and threatening publication if demands were not met; McDonald’s India had not confirmed the claim. In US healthcare, **Valley Eye Associates** confirmed a ransomware incident with **data exfiltration** during a short intrusion window, while **Qilin** publicly claimed responsibility and alleged **139 GB** stolen and posted—suggesting a non-payment outcome. A related but distinct development involved healthcare IT vendor **Veradigm**, which agreed to a **$10.5M** settlement tied to a prior (2024) breach affecting **2+ million** patients, underscoring ongoing legal and financial exposure following large-scale patient-data compromises.
Jun 29, 2026
Several significant data leaks and ransomware incidents have surfaced, affecting a range of organizations including Banco Vimenca, WIRED subscribers, Mexico’s Tax Administration Service (SAT), and New Zealand’s Neighbourly platform. Threat actors have claimed responsibility for exposing sensitive data such as government financial records, large-scale subscriber information, and user communications, with some incidents linked to ransomware groups. While the authenticity of these dark web postings remains unverified, the breadth of affected entities highlights ongoing risks to both financial institutions and government agencies from cybercriminal activity. In the United States, two banks—Artisans' Bank and VeraBank—have notified thousands of customers that their personal information was compromised in a ransomware attack on Marquis Software, a vendor providing data analytics and communication services to financial institutions. The attack, traced to a vulnerability in a SonicWall firewall, resulted in the exposure of names and Social Security numbers, though the banks’ own systems were not directly breached. These incidents underscore the persistent threat posed by supply chain vulnerabilities and the importance of robust third-party risk management for organizations handling sensitive data.
Jun 29, 2026
Reporting and research indicate **ransomware/data-extortion activity remained elevated through 2025 into early 2026**, with threat actors increasingly emphasizing **data theft, public pressure, and supply-chain leverage** rather than encryption alone. Cyble’s threat landscape findings cited by TechRepublic put 2025 at **6,604 recorded ransomware attacks** (up **52% YoY**), with **731 attacks in December** and **2,000+ claims in the last three months of 2025**; the same reporting also notes **supply-chain attacks nearly doubled**, increasing the potential blast radius when service providers are hit. A major example is *Conduent*, where the **January 2025 ransomware attack** is now assessed to have impacted **~25 million Americans** (up from an initial **10 million**), with reporting describing **~8TB of data** stolen including **Social Security numbers and medical data**, alongside days of operational disruption. Separately, Accenture-linked research reported that the **World Leaks** extortion operation added a custom Rust-based tool, **`RustyRocket`**, described as a stealthy **data-exfiltration and proxy** capability using obfuscated, multi-layer encrypted tunnels and a runtime “guardrail” requiring a pre-encrypted configuration—features intended to make detection and monitoring difficult. Broader ecosystem reporting also highlights how **data leak sites (DLSs)** and “naming-and-shaming” tactics have become central to double-extortion pressure, while a weekly incident roundup underscores continued real-world disruption from ransomware (e.g., impacts to public services) and ongoing regulatory consequences for inadequate security controls following breaches.
Jun 29, 2026