Loading story…
Insight Partners, a major venture capital and private equity firm, confirmed a ransomware attack that compromised sensitive data of more than 12,000 people. Attackers gained access via a sophisticated social engineering attack in October 2024, exfiltrated data, and encrypted servers in January 2025. The breach affected employees, former staff, limited partners, and included banking, tax, and fund information.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Initial story creation
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Several significant data leaks and ransomware incidents have surfaced, affecting a range of organizations including Banco Vimenca, WIRED subscribers, Mexico’s Tax Administration Service (SAT), and New Zealand’s Neighbourly platform. Threat actors have claimed responsibility for exposing sensitive data such as government financial records, large-scale subscriber information, and user communications, with some incidents linked to ransomware groups. While the authenticity of these dark web postings remains unverified, the breadth of affected entities highlights ongoing risks to both financial institutions and government agencies from cybercriminal activity. In the United States, two banks—Artisans' Bank and VeraBank—have notified thousands of customers that their personal information was compromised in a ransomware attack on Marquis Software, a vendor providing data analytics and communication services to financial institutions. The attack, traced to a vulnerability in a SonicWall firewall, resulted in the exposure of names and Social Security numbers, though the banks’ own systems were not directly breached. These incidents underscore the persistent threat posed by supply chain vulnerabilities and the importance of robust third-party risk management for organizations handling sensitive data.
Jun 29, 2026
Cognizant Technology Solutions disclosed that a ransomware attack disrupted parts of its environment and led to the likely exfiltration of a limited amount of data from company systems. The company said it discovered the intrusion on April 20, 2020, with malicious activity occurring between April 9 and April 11, and notified affected individuals that exposed information included names and one or more sensitive identifiers such as Social Security numbers, tax identification numbers, financial account details, driver’s license information, or passport information. Reporting tied the incident to the **Maze** ransomware operation based on indicators of compromise associated with files previously linked to the group, although Maze operators reportedly denied responsibility in an interview cited by coverage. Cognizant said it was working with the **FBI**, cyber-defense firms, and customers to contain the attack, share technical details and IoCs, strengthen security, and provide affected individuals with 12 months of complimentary credit monitoring and dark web monitoring services through ID Experts.
Aug 15, 2026
Ingram Micro disclosed that a **July 2025 ransomware attack** resulted in the theft of files from internal repositories and a subsequent data breach affecting **~42,000 people** (reported as **42,521** in filings). The company said an unauthorized party accessed and exfiltrated certain files between **July 2–3, 2025**, and that it detected the incident on **July 3**, after which it took systems offline and began containment and remediation with external cybersecurity experts and law enforcement notification. The compromised data primarily involved **employee and job applicant records**, including names, contact details, dates of birth, and government-issued identification numbers such as **Social Security**, driver’s license, and passport numbers, as well as some **employment-related information** (e.g., work-related evaluations). The incident also caused significant operational disruption, including outages impacting internal systems and customer-facing operations; reporting noted that **SafePay** claimed responsibility and alleged theft of **~3.5 TB** of data, though Ingram Micro has not publicly attributed the intrusion to a specific threat group while confirming ransomware was deployed.
Jun 29, 2026