Panera Bread's recent week-long outage was caused by a ransomware attack, according to people familiar with the matter and emails seen by BleepingComputer.
BleepingComputer has…
Weekly intelligence
Trend-first
Weekly ransomware & data leak landscape
A seven-day view of claim activity, leak escalation, actor concentration, sector shifts, and supporting news context from eCrime.ch.
Window: 2024-03-30 → 2024-04-05 UTC
Choose a report date
Observed events
64
Public claims in the selected week
Data leak indicators
47
73.4% of observed events
Active actors
22
Distinct groups with observed activity
Torrent-linked events
0
Events intersecting with torrent intelligence
What changed this week?
•
Hunters International generated the highest visible claim volume this week, representing 10.9% of observed events.
•
73.4% of observed events in this window showed a public data-leak indicator, which is a stronger escalation signal than a fresh listing alone.
•
Construction was the most represented sector in this window with 9 observed events.
•
2 actor(s) appeared active this week without matching activity in the prior 30-day lookback, suggesting fresh campaigns, rebrands, or resurfacing infrastructure.
Coverage snapshot
As of 2024-04-05 UTC.
Leak sites observed this week
22
Leak sites online near report date
0
Threat actor profiles updated this week
3
Countries represented this week
20
Sectors represented this week
39
Top active actors
By observed claim volumeHunters International
7 events · 7 leak indicators
INC Ransom
7 events · 7 leak indicators
8BASE
5 events · 4 leak indicators
LockBit 3.0
5 events · 5 leak indicators
Medusa
5 events · 5 leak indicators
RA Group
5 events · 0 leak indicators
Blacksuit
4 events · 2 leak indicators
Cactus
4 events · 4 leak indicators
Emerging or resurfacing actors
No matching activity in prior 30 days- MalekTeam 2 events
- CiphBit 1 event
Country mix
Share of weekly events across the last 12 reporting windows. Click to expand top actors for this week.
United States35
- Hunters International5 events · 5 leak indicators
- INC Ransom5 events · 5 leak indicators
- Blacksuit4 events · 2 leak indicators
- Cactus4 events · 4 leak indicators
- Medusa4 events · 4 leak indicators
- PLAY4 events · 4 leak indicators
- LockBit 3.02 events · 2 leak indicators
- Qilin2 events · 0 leak indicators
Germany4
- RA Group2 events · 0 leak indicators
- 8BASE1 event · 1 leak indicator
- LockBit 3.01 event · 1 leak indicator
India3
- Kill Security1 event · 0 leak indicators
- LockBit 3.01 event · 1 leak indicator
- Stormous1 event · 1 leak indicator
United Kingdom3
- BlackBasta1 event · 1 leak indicator
- INC Ransom1 event · 1 leak indicator
- Medusa1 event · 1 leak indicator
Brazil2
- RA Group1 event · 0 leak indicators
- RansomHub1 event · 1 leak indicator
Canada2
- Akira1 event · 0 leak indicators
- Qilin1 event · 1 leak indicator
Israel2
- MalekTeam2 events · 0 leak indicators
Australia1
- DragonForce1 event · 1 leak indicator
Sector mix
Share of weekly events across the last 12 reporting windows. Click to expand top actors for this week.
Construction9
- PLAY2 events · 2 leak indicators
- Akira1 event · 0 leak indicators
- BianLian1 event · 1 leak indicator
- Cactus1 event · 1 leak indicator
- INC Ransom1 event · 1 leak indicator
- LockBit 3.01 event · 1 leak indicator
- Medusa1 event · 1 leak indicator
- RA Group1 event · 0 leak indicators
Hospitals and Health Care5
- INC Ransom3 events · 3 leak indicators
- MalekTeam1 event · 0 leak indicators
- Medusa1 event · 1 leak indicator
Retail5
- Hunters International2 events · 2 leak indicators
- LockBit 3.01 event · 1 leak indicator
- PLAY1 event · 1 leak indicator
- RA Group1 event · 0 leak indicators
IT Services and IT Consulting3
- Hunters International1 event · 1 leak indicator
- INC Ransom1 event · 1 leak indicator
- Rhysida1 event · 1 leak indicator
Chemical Manufacturing2
- 8BASE2 events · 2 leak indicators
Financial Services2
- INC Ransom1 event · 1 leak indicator
- RansomHub1 event · 1 leak indicator
Government Administration2
- INC Ransom1 event · 1 leak indicator
- Medusa1 event · 1 leak indicator
Insurance2
- Hunters International1 event · 1 leak indicator
- Qilin1 event · 0 leak indicators
Organization size bands
Share of weekly events by employee-size group across the last 12 reporting windows.
- 51-200 employees 13
- 201-500 employees 12
- 2-10 employees 10
- 501-1,000 employees 9
- 11-50 employees 6
- 1,001-5,000 employees 3
Notable actor profile updates
Active actor records only.
New ransom note observed
No ransom-note change logged in this reporting window.
New actor infrastructure / contact channel
No infrastructure/contact-channel change logged in this reporting window.
New vuln / TTP intelligence
No vuln/TTP change logged in this reporting window.
Recent signal samples
Selected weekly signals.
| Actor | Sector | Country | Leak proof | Seen |
|---|---|---|---|---|
| LockBit 3.0 | Construction | United States | Data leak | 2024-04-05 |
| Stormous | Computers and Electronics Manufacturing | India | Data leak | 2024-04-05 |
| DragonForce | Education | Australia | Data leak | 2024-04-05 |
| PLAY | Retail | United States | Data leak | 2024-04-04 |
| PLAY | Manufacturing | United States | Data leak | 2024-04-04 |
| PLAY | Construction | United States | Data leak | 2024-04-04 |
| Akira | Construction | United States | Claim only | 2024-04-04 |
| Akira | Transportation, Logistics, Supply Chain and Storage | Canada | Claim only | 2024-04-04 |
| RansomHub | Financial Services | El Salvador | Data leak | 2024-04-04 |
| INC Ransom | Financial Services | Seychelles | Data leak | 2024-04-04 |
| Cactus | Construction | United States | Data leak | 2024-04-04 |
| Qilin | Law Practice | United States | Claim only | 2024-04-03 |
News and research context
Recent articles from the same time window.
On Thursday, the FBI Director made his way to Lawrence to discuss cyber security. This talk is on the heels of multiple ransomware attacks across the Metro and nationally.
Related actor: Daixin
Omni Hotels & Resorts' computer systems have been offline since Friday due to what the American luxury hospitality chain called a "disruption."
Related actor: LockBit 3.0
The sentiments of the cybercrime community to LockBit's disruption ranged from satisfaction to speculation about the group’s future, hinting at the significant impact of the incid…
To deploy a ransomware attack, adversaries must first gain access to a victim’s corporate environment, devices, and data. Threat actors typically use two main approaches to gain e…
Related actor: BlackByte
Lamoille Health Partners, a Vermont health system serving patients in Lamoille County, has agreed to settle a lawsuit that was filed in response to a June 2022 ransomware attack i…
Educational institutions may face a range of cyberthreats in 2024, but our 2024 State of Malware in Education report identifies the six most critical ones.
Ransomware, for exam…
VIETNAM, April 3 - HÀ NỘI — PetroVietnam Oil Corporation (PVOIL) is working with the Ministry of Public Security to handle a ransomware attack which caused disruption to its IT sy…
Vacaville hospital turns away patients due to cyber incident, systems down - CBS Sacramento
2024-04-03
VACAVILLE — Some patients are being turned away from NorthBay VacaValley Hospital because the facility is dealing with systemwide problems due to what they're calling a cyber inci…
An economic success story in Asia, Vietnam is seeing more manufacturing and more business investment. But with that comes a significant uptick in cybercrime as well.
For one week…
Notes
- Observed events reflect monitored leak-site and extortion activity, not independent confirmation of every intrusion.
- Data-leak indicators reflect visible public leak evidence or escalation, which is stronger than a fresh listing alone.
- Country, sector, and company-size metadata can be incomplete. Unknown values are excluded from the public mix views.
- The goal is to explain concentration, escalation, churn, and patterns — not to build a wall of named victims.
Method
- The page uses a fixed seven-day window based on the selected date.
- Only public-facing actor and event records are included.
- Counts and breakdowns are designed for trend review, not incident confirmation.