Loading story…
Cognizant Technology Solutions disclosed that a ransomware attack disrupted parts of its environment and led to the likely exfiltration of a limited amount of data from company systems. The company said it discovered the intrusion on April 20, 2020, with malicious activity occurring between April 9 and April 11, and notified affected individuals that exposed information included names and one or more sensitive identifiers such as Social Security numbers, tax identification numbers, financial account details, driver’s license information, or passport information.
Reporting tied the incident to the Maze ransomware operation based on indicators of compromise associated with files previously linked to the group, although Maze operators reportedly denied responsibility in an interview cited by coverage. Cognizant said it was working with the FBI, cyber-defense firms, and customers to contain the attack, share technical details and IoCs, strengthen security, and provide affected individuals with 12 months of complimentary credit monitoring and dark web monitoring services through ID Experts.
TTPs, infrastructure, and targeting history in one profile.
10 events from the most recent confirmed update back to the earliest known activity.
In a breach notification letter dated June 17, 2020, Cognizant told affected individuals that personal information including names and sensitive identifiers was impacted, said it was cooperating with the FBI, and offered 12 months of complimentary credit and dark web monitoring services.
Maze operators reportedly denied association with the Cognizant incident in an interview with Bleeping Computer, despite reporting that tied the attack to Maze.
Reporting said Cognizant shared IoCs including IP addresses tied to files previously associated with Maze, and SentinelLabs' Vitali Kremez released Yara rules related to Maze tactics, techniques, and procedures for the attack.
Cognizant confirmed it was hit by a ransomware attack that disrupted its systems and said it was providing customers with indicators of compromise and other technical details while working with external cyber-defense firms and law enforcement to contain the incident.
Cognizant said it learned on April 20, 2020 that attackers had staged and likely exfiltrated a limited amount of data from its systems.
Cognizant said the ransomware attack that disrupted its systems began on a Friday evening in April 2020.
Cognizant said the malicious activity tied to its ransomware incident occurred between April 9 and April 11, 2020, during which attackers staged and likely exfiltrated a limited amount of data.
Reporting noted that Maze operators had previously been linked to a high-profile attack against the city of Pensacola, Florida, in December 2019.
The Maze ransomware family was first discovered in 2019, establishing the malware later linked in reporting to the Cognizant incident.
The article cited a November Maze ransomware attack against Allied Universal, where attackers later demanded 300 Bitcoin and threatened misuse of stolen information after the company refused to pay.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cognizant Technology Solutions, through its subsidiary TriZetto Provider Solutions, experienced a significant data breach that went undetected for nearly a year, exposing sensitive personal information such as Social Security numbers, financial account details, and home addresses. The breach, which affected at least 100 individuals across several states, led to multiple class-action lawsuits alleging delayed disclosure, insufficient notification to victims, and a lack of transparency regarding the incident's root cause and remediation. Plaintiffs argue that the delay in notification left affected individuals vulnerable to identity theft and financial fraud, while Cognizant and TriZetto have offered limited public comment due to ongoing litigation. Separately, Covenant Health, a major healthcare provider operating in several northeastern US states, suffered a ransomware attack by the Qilin group in May 2025. The attack compromised the data of over 478,000 individuals, leading to system shutdowns across hospitals and clinics and prompting the organization to hire cybersecurity experts for containment and investigation. Covenant Health initially reported a smaller number of affected individuals but later updated the total to nearly half a million, subsequently notifying patients and offering credit monitoring and identity protection services. Both incidents underscore the persistent cybersecurity risks facing the healthcare sector and the significant impact of breaches on patient privacy and organizational trust.
Jun 29, 2026
Security researchers reported that **Maze ransomware** was delivered through the **Spelevo exploit kit**, which abused `CVE-2018-15982`, a critical Adobe Flash Player flaw, to execute code and install the payload. Once launched, Maze encrypted files with **RSA** and **ChaCha20**, dropped the `DECRYPT-FILES.txt` ransom note, and directed victims to both Tor and clear-web payment portals that offered live chat and limited test decryption. Researchers also linked Maze to earlier delivery through the **Fallout exploit kit**, showing that the operators used multiple infection channels to spread the malware. Separate incident-response findings showed Maze operators evolving beyond simple encryption into **targeted intrusions** that paired ransomware with **data theft and extortion**. Cisco Talos observed attackers using **Cobalt Strike** after initial access, moving laterally for at least a week, logging in interactively over **RDP**, executing remote PowerShell through **WMIC**, compressing stolen data with **7-Zip**, and exfiltrating it via PowerShell to a remote FTP server before deploying the ransomware. The activity reflected a broader shift in ransomware operations toward stealing sensitive files first and then threatening public release to increase pressure on victims.
Aug 15, 2026
Rome’s **La Sapienza University** shut down network systems as a precaution after a cyberattack caused widespread disruption and left its website offline; Italian media attributed the incident to a suspected ransomware operation linked to pro-Russian actor **Femwar02**, with reported tradecraft resembling **Bablock/Rorschach**-style fast encryption. Separately, Romania’s national oil pipeline operator **Conpet** reported a cyberattack that disrupted corporate IT and took down `www.conpet.ro` while leaving **OT/SCADA** and pipeline transport operations unaffected; **Qilin** claimed responsibility, alleging theft of nearly **1TB** of data and posting sample documents (including financial data and passport scans) to support extortion claims. In the U.S., government services contractor **Conduent** faced expanding breach impact from its January 2025 ransomware incident, with notifications indicating exposure potentially reaching **dozens of millions**; reported affected data includes **names, Social Security numbers, and medical/health insurance information**, with at least **15.4M** impacted in Texas and **10.5M** in Oregon per state disclosures. Additional healthcare-sector disclosures included a ransomware-linked intrusion at **Insightin Health** (unauthorized access in September 2025; **Medusa** claimed exfiltration of **378GB**) and a separate compromise at **Clinic Service Corporation** (August 2025 access window), while **Central Ozarks Medical Center** reported a criminal cyberattack affecting **11,818** individuals with exposure of PHI/PII (including SSNs and financial/insurance data). Other items in the set were not incident-specific: an **HHS-OIG** audit describing web application security weaknesses at a large hospital, and general guidance/education pieces on the value of medical records to attackers and **CISA** insider-threat guidance.
Jun 29, 2026